DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Remarks
This action is in response to the amendments received on 8/19/26. Claims 1-20 are pending in the application. Applicants arguments are carefully and respectfully considered.
Claims 1-20 are provisionally rejected on the ground of non-statutory double patenting.
Claims 5 and 14 are rejected under 35 U.S.C. 112.
Claims 1-20 are rejected under 35 U.S.C. 101.
Claims 1-3, 6-12, and 15-20 are rejected under 35 U.S.C. 103 as being unpatentable over Margel et al. (US 2020/0259861), and further in view of Yen et al. (US 9,516,039).
Claims 4, 5, 13, and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Margel in view of Yen, and further in view of Li et al. (US 11,157,574).
Double Patenting
The non-statutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A non-statutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on non-statutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a non-statutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based e-Terminal Disclaimer may be filled out completely online using web-screens. An e-Terminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about e-Terminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 are provisionally rejected on the ground of non-statutory double patenting as being unpatentable over Claims 1-20 of co-pending Application No. 18/498,675 in view of Yen et al. (US 9,516,039).
co-pending Application 18/498,675
Present Application No. 18/499,178
1. A computer implemented method for aggregating and mapping incident characteristics into a daily profile, the method comprising:
10. A system for aggregating and mapping incident characteristics into a daily profile, the system comprising: a memory having processor-readable instructions stored therein; and at least one processor configured to access the memory and execute the processor-readable instructions to perform operations including:
19. A non-transitory computer readable medium storing processor-readable instructions which, when executed by at least one processor, cause the at least one processor to perform operations including:
receiving a set of historical data objects indicating an occurrences of a set of incidents each associated with a set of configurable items;
determining a single incident profile for each of the historical data objects;
determining a consolidated single incident profile for each of the historical data objects;
aggregating the consolidated single incident profiles at a day level; and
clustering the aggregated consolidated single incident profiles of a plurality of days to determine one or more historic day profile clusters, each historic day profile cluster comprising a plurality of days grouped together based on similarity of their aggregated consolidated single incident profiles;
selecting, from the one or more historic day profile clusters, a benchmark historic day profile cluster having a greatest number of days, the benchmark historic day profile cluster representing a normal operation day; and
matching an aggregated consolidated single incident profile for a particular day to the benchmark historic day profile cluster.
1. A computer implemented method for aggregating and mapping incident characteristics into a daily profile, the method comprising:
10. A system for aggregating and mapping incident characteristics into a daily profile, the system comprising: a memory having processor-readable instructions stored therein; and at least one processor configured to access the memory and execute the processor-readable instructions to perform operations including:
19. A non-transitory computer readable medium storing processor-readable instructions which, when executed by at least one processor, cause the at least one processor to perform operations including:
receiving a set of historical data objects indicating an occurrences of a set of incidents each associated with a set of configurable items;
determining a single incident profile for each of the historical data objects;
determining a consolidated single incident profile for each of the historical data objects;
applying a clustering algorithm to the determined consolidated single incident profiles to assign one of a plurality of consolidated single incident profile clusters to each historical data object;
aggregating the consolidated single incident profiles at a day level, including grouping the historical data objects by day using the time stamp from each historical data object and determining, for each day, a number of the historical data objects assigned to each of the plurality of consolidated single incident profile clusters;
outputting the consolidated single incident profiles at the day level.
2. The method of claim 1,
11. The system of claim 10,
20. The non-transitory computer readable medium of claim 19,
wherein the set of historical data objects represents the occurrences of the set of incidents over at least a month.
2. The method of claim 1,
11. The system of claim 10,
20. The non-transitory computer readable medium of claim 19,
wherein the set of historical data objects represents the occurrences of a set of incidents over at least a month.
3. The method of claim 1,
12. The system of claim 10,
wherein determining the single incident profile for said each of the historical data objects includes: determining features from text descriptions of the historical data objects; performing a clustering algorithm on the features; and determining clusters for each of the historical data objects.
3. The method of claim 1,
12. The system of claim 10,
where determining a single incident profile for each of the historical data objects includes: determining features from text descriptions of the historical data objects; performing a clustering algorithm on the features; and determining clusters for each of the historical data objects.
4. The method of claim 3, further including:
13. The system of claim 12, further including:
determining a first set of features utilizing term frequency-inverse document frequency vectorization; determining a second set of features utilizing noun phrase extraction; and determining a third set of features utilizing verb phrase extraction.
4. The method of claim 3, further including:
13. The system of claim 12, further including:
determining a first set of features utilizing term frequency-inverse document frequency vectorization; determining a second set of features utilizing noun phrase extraction; and determining a third set of features utilizing verb phrase
extraction.
5. The method of claim 4,
14. The system of claim 13,
wherein the clustering algorithms are applied separately on the first set of features, the second set of feature, and the third set of features.
5. The method of claim 4,
14. The system of claim 13,
wherein performing the clustering algorithm on the features includes applying the clustering algorithm separately the first set of features, the second set of features, and the third set of features.
6. The method of claim 1,
15. The system of claim 10,
wherein determining the consolidated single incident profile for said each of the historical data objects further includes: applying a clustering algorithm on the consolidated single incident profile; and saving a single incident cluster for said each historical data object.
6. The method of claim 1,
15. The system of claim 10,
wherein determining a consolidated single incident profile for each of the historical data objects further includes saving a single incident cluster for each historical data object.
7. The method of claim 6,
16. The system of claim 15,
wherein aggregating the consolidated single incident profiles at the day level further includes: performing a clustering algorithm on the consolidated single incident profiles, wherein the consolidated single incident profiles at the day level has an aggregation of all single incident clusters for said each historical data object for a day.
7. The method of claim 6,
16. The system of claim 15,
wherein aggregating the consolidated single incident profiles at a day level further includes: determining that the consolidated single incident profiles, at a day level have an aggregation of all single incident clusters for each historical data object for a day.
8. The method of claim 1, further including:
17. The system of claim 10, further including:
outputting the historic day profile clusters for a set period of time.
8. The method of claim 1,
17. The system of claim 10,
wherein outputting the consolidated single incident profile at the day level includes outputting an amount of incidents received over a period of time, and an amount of determined single incident profiles.
9. The method of claim 8, further including;
18. The system of claim 17, further including;
determining an amount of days within each of the determined historic day profile clusters.
9. The method of claim 1,
18. The system of claim 10,
wherein outputting the consolidated single incident profile at the day level includes compiling and outputting a total amount of incidents received for a particular day and outputting a corresponding single incident profile for each incident.
As shown in the comparison table above, Claims 1-20 of co-pending Application No. 18/498,675 contain every limitation of Claims 1-20 of the instant application except for the limitations of (1) "applying a clustering algorithm to the determined consolidated single incident profiles to assign one of a plurality of consolidated single incident profile clusters to each historical data object;… outputting the consolidated single incident profiles at the day level" (Claims 1-20); (2) " outputting an amount of incidents received over a period of time, and an amount of determined single incident profiles " (Claims 8 and 17); and (3) " compiling and outputting a total amount of incidents received for a particular day and outputting a corresponding single incident profile for each incident." (Claims 9 and 18). However, Yen teaches the limitation (1) applying a clustering algorithm to the determined consolidated single incident profiles to assign one of a plurality of consolidated single incident profile clusters to each historical data object (Yen, Col. 10 Li. 32-43, applying a clustering algorithm to the projected vectors… 1. Randomly select a vector as the first cluster hub, and assign all vectors to this cluster. 2. Select the vector farthest away from its hub as a new hub, and reassign every vector to the cluster with the closest hub. 3. Repeat step 2 until no vector is farther away from its hub than half of the average hub-to-hub distance. Examiner note: vectors represent consolidated single incident profiles);… outputting the consolidated single incident profiles at the day level (Yen, Col. 10 Li. 63-65, a graphical representation of the incidents generated over a given period of time (for example, in a particular day) can be displayed to an analyst); the limitation (2) outputting an amount of incidents received over a period of time, and an amount of determined single incident profiles (Yen, Col. 10 Li. 63-65, a graphical representation of the incidents generated over a given period of time (for example, in a particular day) can be displayed to an analyst); and the limitation (3) compiling and outputting a total amount of incidents received for a particular day and outputting a corresponding single incident profile for each incident (Yen, Col. 10 Li. 63-65, a graphical representation of the incidents generated over a given period of time (for example, in a particular day) can be displayed to an analyst). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention) to include the teaching of Yen because it provides a way to automatically extract and leverage knowledge from log data produced by a wide variety of security products in a large enterprise (Yen, Col. 1 Li. 52-54).
This is a provisional non-statutory double patenting rejection.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 5 and 14 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
The amendments to claims 1 and 10 introduce a clustering algorithm. Claims 3 and 12 depend from these claims and also disclose a clustering algorithm. Claims 5 and 14 refer back to “the clustering algorithm”, however, it is unclear which recitation this refers to.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 2A, Prong One asks: Is the claim directed to a law of nature, a natural phenomenon (product of nature) or an abstract idea? See MPEP 2106.04 Part I. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. See MPEP 2106.04(a).
With respect to claims 1, 10, and 19, the limitation of “determining a single incident profile for each of the historical data objects,” “determining a consolidated single incident profile for each of the historical data objects,” and “determining, for each day, a number of the historical data objects”, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, nothing in the claim element precludes the step from practically being performed in the mind. For example, “determining” in the context of this claim encompasses the user mentally determining information about data objects. Similarly, the limitation of “applying a clustering algorithm” and “aggregating the consolidated single incident profiles at a day level”, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. For example, “applying a clustering algorithm” and “aggregating” in the context of this claim encompasses the user mentally determining groups of similar data. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea.
At step 2a, prong two, this judicial exception is not integrated into a practical application. Claims 10 and 19 recite a processor to execute the operations, however, this is recited as a high-level of generality (i.e., as a generic processor performing a generic computer function) such that it amounts to no more than mere instructions to apply the exception using a generic computer component. Additionally, the claim recites “receiving a set of historical data objects” and “outputting the consolidated single incident profiles.” These elements do not integrate the abstract idea into a practical application because they do not impose a meaningful limit on the judicial exception and provide only insignificant extra solution activity that is mere data gathering in conjunction with the abstract idea.
The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements amount to no more than mere instructions to apply an exception using generic computer components. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
With respect to “receiving a set of historical data objects”, the courts have found limitations directed towards data gathering to be well-understood, routine, and conventional. See MPEP 2106.05(d)(II). Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information).
With respect to “outputting the consolidated single incident profiles”, the courts have found limitations directed towards outputting to be well-understood, routine, and conventional. See MPEP 2106.05(d)(II). Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Considering the additional elements individually and in combination and the claim as a whole, the additional elements do not provide significantly more than the abstract idea. The claim is not patent eligible.
With respect to claims 2, 5, 11, 14, and 20, the limitations define elements that are discussed in other claims and do not include additional elements that are sufficient to amount to significantly more than the judicial exception.
With respect to claims 3, 4, 12, and 13, the limitations, as drafted, describes a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, nothing in the claim element precludes the step from practically being performed in the mind. For example, this claim encompasses the user mentally determining profiles for data objects.
With respect to claims 6 and 15, the limitation “saving a single incident cluster,” these elements do not integrate the abstract idea into a practical application because they do not impose a meaningful limit on the judicial exception and provide only insignificant extra solution activity. The courts have found limitations directed towards storing to be well-understood, routine, and conventional. See MPEP 2106.05(d)(II). Electronic recordkeeping, Alice Corp. Pty. Ltd. v. CLS Bank Int'l, 573 U.S. 208, 225, 110 USPQ2d 1984 (2014) (creating and maintaining "shadow accounts") and “storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015).
With respect to claims 7 and 16, the limitation “determining that the consolidated single incident profiles at a day level have an aggregation” is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, nothing in the claim element precludes the step from practically being performed in the mind. For example, this claim encompasses the user mentally determining information.
With respect to claims 8 and 17, the limitations are directed towards outputting data. These elements do not integrate the abstract idea into a practical application because they do not impose a meaningful limit on the judicial exception and provide only insignificant extra solution activity that is mere data gathering in conjunction with the abstract idea. The courts have found limitations directed towards storing to be well-understood, routine, and conventional. See MPEP 2106.05(d)(II). Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
With respect to claims 9 and 18, the limitations are directed towards compiling and outputting data. Compiling data is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, nothing in the claim element precludes the step from practically being performed in the mind. For example, this claim encompasses the user mentally determining clusters.
With respect to “outputting data,” these elements do not integrate the abstract idea into a practical application because they do not impose a meaningful limit on the judicial exception and provide only insignificant extra solution activity that is mere data gathering in conjunction with the abstract idea. The courts have found limitations directed towards storing to be well-understood, routine, and conventional. See MPEP 2106.05(d)(II). Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 6-12, and 15-20 are rejected under 35 U.S.C. 103 as being unpatentable over Margel et al. (US 2020/0259861), and further in view of Yen et al. (US 9,516,039).
With respect to claim 1, Margel teaches a computer implemented method for aggregating and mapping incident characteristics into a daily profile, the method comprising:
receiving a set of historical data objects indicating an occurrences of a set of incidents, each occurrence being associated with a set of configurable items (Margel, pa 0033, The security alert correlator 160 may receive security alerts generated by an attack detector 140);
determining a single incident profile for each of the historical data objects (Margel, pa 0033, The security alert correlator 160 may receive security alerts generated by an attack detector 140 and correlate/distill those security alerts into incidents, where each incident represents a group of security alerts that have been determined to be associated with the same security event (e.g., an attack or potential attack) based on having similar features. Examiner note: The incident provides a single incident profile);
determining a consolidated single incident profile for each of the historical data objects (Margel, pa 0036, The incident grouper 170 may group similar incidents (e.g., incidents having similar features) occurring across multiple enterprise networks 120 into one or more groups of incidents. Incidents may be grouped based on one or more features. Examiner note: grouped incidents provide a consolidated profile);
applying a clustering algorithm to the determined consolidated single incident profiles to assign one of a plurality of consolidated single incident profile clusters to each historical data object (Margel, pa 0036, the incident grouper 170 uses a clustering-based grouping algorithm to group incidents into groups);
aggregating the consolidated single incident profiles at a day level (Margel, pa 0053, At block 510, the incident grouper obtains features of a plurality of incidents ( e.g., occurring across multiple enterprises). In one embodiment, the incident grouper obtains features of a batch of incidents occurring during a specified period of time (e.g., the last N days).).
Margel doesn't expressly discuss each historical data object comprising a time stamp, aggregating the consolidated single incident profiles at a day level including grouping the historical data objects by day using the time stamp from each historical data object, and outputting the consolidated single incident profiles at the day level.
Yen teaches receiving a set of historical data objects indicating an occurrences of a set of incidents, each occurrence being associated with a set of configurable items, each historical data object comprising a time stamp (Yen, Col. 11 Li. 20-21, normalizing a timestamp associated with each item of said log data into a common time zone);
applying a clustering algorithm to the determined consolidated single incident profiles to assign one of a plurality of consolidated single incident profile clusters to each historical data object (Yen, Col. 10 Li. 32-43, applying a clustering algorithm to the projected vectors… 1. Randomly select a vector as the first cluster hub, and assign all vectors to this cluster. 2. Select the vector farthest away from its hub as a new hub, and reassign every vector to the cluster with the closest hub. 3. Repeat step 2 until no vector is farther away from its hub than half of the average hub-to-hub distance. Examiner note: vectors represent consolidated single incident profiles);
aggregating the consolidated single incident profiles at a day level including grouping the historical data objects by day using the time stamp from each historical data object (Yen, Col. 10 Li. 46-48, The clustering algorithm can be applied at a given interval (for example, daily) on the feature vectors for all active, dedicated hosts in the enterprise.) and
determining, for each day, a number of the historical data objects assigned to each of the plurality of consolidated single incident profile clusters; and outputting the consolidated single incident profiles at the day level (Yen, Col. 10 Li. 63-65, a graphical representation of the incidents generated over a given period of time (for example, in a particular day) can be displayed to an analyst).
It would have been obvious at the effective filing date of the invention to a person having ordinary skill in the art to which said subject matter pertains to have modified Margel with the teachings of Yen because it provides a way to automatically extract and leverage knowledge from log data produced by a wide variety of security products in a large enterprise (Yen, Col. 1 Li. 52-54).
With respect to claim 2, Margel in view of Yen teaches the method of claim 1, wherein the set of historical data objects represents the occurrences of a set of incidents over at least a month (Margel, pa 0028, Web application layer attack detector 140A may generate security alerts based on applying a set of security rules to traffic (e.g., web application layer messages) being sent between clients 130A and server 150A.).
With respect to claim 3, Margel in view of Yen teaches the method of claim 1, where determining a single incident profile for each of the historical data objects includes: determining features from text descriptions of the historical data objects (Margel, pa 0033, each incident represents a group of security alerts that have been determined to be associated with the same security event ( e.g., an attack or potential attack) based on having similar features. Each incident may be described using various features. & Yen, Col. 11 Li. 26-27, Step 304 includes extracting one or more features from said log data on a per host device basis.)
performing a clustering algorithm on the features; and determining clusters for each of the historical data objects (Yen, Col. 11 Li. 53-54, Step 310 includes clustering the multiple host devices into one or more groups based on said one or more features.).
With respect to claim 6, Margel in view of Yen teaches the method of claim 1, wherein determining a consolidated single incident profile for each of the historical data objects further includes saving a single incident cluster for each historical data object (Margel, pa 0049, At block 360, the incident grouper combines the selected cluster with one or more other existing clusters in response to a determination that the distance between the features of the selected cluster and the features of each of the one or more other clusters is below a threshold level.)
.
With respect to claim 7, Margel in view of Yen teaches the method of claim 6, wherein aggregating the consolidated single incident profiles at a day level further includes: determining that the consolidated single incident profiles, at a day level have an aggregation of all single incident clusters for each historical data object for a day (Margel, pa 0053, At block 510, the incident grouper obtains features of a plurality of incidents ( e.g., occurring across multiple enterprises). In one embodiment, the incident grouper obtains features of a batch of incidents occurring during a specified period of time (e.g., the last N days).).
With respect to claim 8, Margel in view of Yen teaches the method of claim 1, wherein outputting the consolidated single incident profile at the day level includes outputting an amount of incidents received over a period of time, and an amount of determined single incident profiles (Yen, Col. 10 Li. 63-65, a graphical representation of the incidents generated over a given period of time (for example, in a particular day) can be displayed to an analyst & Margel, pa 0039, the attack analytics module 100 generates and causes a report to be displayed by a management console 190 that indicates the results of the classification to a customer (e.g., customer A and/or customer Z) or other security personnel. In one embodiment, the report indicates whether an incident occurring in an enterprise network 120 is part of a group of incidents classified as being a community attack (and may further indicate whether this attack is classified as being an industry-based attack or spray-and-pray attack). The report may also indicate the features that are common among incidents within a group of incidents occurring across multiple enterprise networks. For example, the report may indicate that all incidents within a group of incidents have a particular source IP address.).
With respect to claim 9, Margel in view of Yen teaches the method of claim 1, wherein outputting the consolidated single incident profile at the day level includes compiling and outputting a total amount of incidents received for a particular day and outputting a corresponding single incident profile for each incident (Yen, Col. 10 Li. 63-65, a graphical representation of the incidents generated over a given period of time (for example, in a particular day) can be displayed to an analyst).
With respect to claims 10-12 and 15-18, the limitations are essentially the same as claims 1-3 and 6-9, and are rejected for the same reasons.
With respect to claims 19 and 20, the limitations are essentially the same as claims 1 and 2, and are rejected for the same reasons.
Claims 4, 5, 13, and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Margel in view of Yen, and further in view of Li et al. (US 11,157,574).
With respect to claim 3, Margel in view of Yen teaches the method of claim 3, as discussed above. Margel in view of Yen doesn't expressly discuss further including: determining a first set of features utilizing term frequency-inverse document frequency vectorization; determining a second set of features utilizing noun phrase extraction; and determining a third set of features utilizing verb phrase extraction.
Li teaches further including: determining a first set of features utilizing term frequency-inverse document frequency vectorization; determining a second set of features utilizing noun phrase extraction (Li, Col. 12 Li. 35-48, At step 1304, the social media posting is processed to extract terms of the posting corresponding one or more different semantic classes of terms, and assign those terms to the corresponding classes. In general, a social media posting typically contains terms corresponding to aspects that define an event, such as “who,” “what,” “where” and “when.” These terms can be classified into different semantic classes, which will have corresponding different levels of importance for describing an event… the semantic classes used include one or more of (i) proper noun, (ii) mention, (iii) location, (iv) hashtag, (v) verb, and (vi) common noun. & Col. 12 Li. 50-62, Pronouns may describe the “who” of an event, such as people or organization names. Occasionally, pronouns may also describe the “what” of an event.); and determining a third set of features utilizing verb phrase extraction (Li, Col. 12 Li. 59-60, Verbs usually describe the “what” aspect of an event, such as killed, sued, and died.)
It would have been obvious at the effective filing date of the invention to a person having ordinary skill in the art to which said subject matter pertains to have modified Margel in view of Yen with the teachings of Li because it indicates text that is semantically similar (Li, Col. 13 Li. 27-35).
With respect to claim 5, Margel in view of Yen teaches the method of claim 4, wherein the clustering algorithms are applied separately on the first set of features, the second set of feature, and the third set of features (Li, Col. 10 Li. 52-57, Embodiments of the method 1100 may be used to perform the cluster correspondence identification, and grouping with existing or new clusters, of steps 210, 212 and 214 of the method 200. The method 1100 may be performed by or involving components of the event clustering module 64 of FIG. 10.).
With respect to claims 13 and 14, the limitations are essentially the same as claims 4 and 5, and are rejected for the same reasons.
Response to Arguments
Double Patenting
Applicant seems to argue a newly amended limitation. Applicant’s amendment has rendered the previous rejection moot. Upon further consideration of the amendment, a new grounds of rejection is made in view of Yen et al. (US 9,516,039).
35 U.S.C. 112 rejection
The amendments to the claims have introduced new 35 U.S.C. 112 issues, as discussed above.
35 U.S.C. 101
Applicant argues that the amended claim recites machine-executed clustering of consolidated profiles and per-day tabulation of counts against cluster assignments and cannot be performed in the human mind. The Examiner respectfully disagrees. Any claimed disclosure of machine execution is recited as a high-level of generality such that it amounts to no more than mere instructions to apply the exception using a generic computer component. As discussed above, clustering and tabulation can be performed mentally.
Applicant argues that the clustering and day-level counting steps provide additional elements that deliver the technical solution described in the specification. The Examiner respectfully disagrees. As discussed above, these elements are part of the recited abstract idea and do not provide additional elements. Elements determined to be additional to the abstract idea cited above are “receiving a set of historical data objects” and “outputting the consolidated single incident profiles.” However, these elements do not integrate the abstract idea into a practical application because they do not impose a meaningful limit on the judicial exception.
Applicant argues that the characterization of “outputting the consolidated single incident profiles” as well-understood, routine, and conventional is inapplicable to the amended claim and points to Step 2A Prong Two. At Step 2A Prong Two, a claim that integrates a judicial exception into a practical application will apply, rely on, or use the judicial exception in a manner that imposes a meaningful limit on the judicial exception.
The courts have also identified limitations that did not integrate a judicial exception into a practical application including adding insignificant extra-solution activity to the judicial exception. See MPEP 2106.04(d) part I. This consideration is similar to factors used in past Office guidance (for example, the now superseded Bilski and Mayo analyses) that were described as mere data gathering in conjunction with a law of nature or abstract idea. When determining whether an additional element is insignificant extra-solution activity consider whether the limitation amounts to necessary data gathering and outputting, (i.e., all uses of the recited judicial exception require such data gathering or data output). See Mayo, 566 U.S. at 79, 101 USPQ2d at 1968; OIP Techs., Inc. v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1092-93 (Fed. Cir. 2015) (presenting offers and gathering statistics amounted to mere data gathering). This is considered in Step 2A Prong Two and Step 2B. Below are examples of activities that the courts have found to be insignificant extra-solution activity: … iii. Presenting offers to potential customers and gathering statistics generated based on the testing about how potential customers responded to the offers; the statistics are then used to calculate an optimized price, OIP Technologies, 788 F.3d at 1363, 115 USPQ2d at 1092-93. See MPEP 2106.05(g).
Applicant argues the “receiving” step is not mere data gathering because the recited time stamps are used by the “aggregating” step to group historical data objects by day and is integral to the claimed method and imposes a meaningful limit on the claim. The Examiner respectfully disagrees. Receiving data containing timestamps is gathering data to be used in the “aggregating” step. This is similar to the examples of “mere data gathering” in MPEP 2106.05(g) such as “ii. Testing a system for a response, the response being used to determine system malfunction, In re Meyers, 688 F.2d 789, 794; 215 USPQ 193, 196-97 (CCPA 1982); iii. Presenting offers to potential customers and gathering statistics generated based on the testing about how potential customers responded to the offers; the statistics are then used to calculate an optimized price, OIP Technologies, 788 F.3d at 1363, 115 USPQ2d at 1092-93;… v. Consulting and updating an activity log, Ultramercial, 772 F.3d at 715, 112 USPQ2d at 1754.” All uses of the recited judicial exception require such data gathering and therefore, these elements do not integrate the abstract idea into a practical application.
35 U.S.C. 103 rejection
Applicant seems to argue a newly amended limitation. Applicant’s amendment has rendered the previous rejection moot. Upon further consideration of the amendment, a new grounds of rejection is made in view of Yen et al. (US 9,516,039).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRITTANY N ALLEN whose telephone number is (571)270-3566. The examiner can normally be reached M-F 9 am - 5:00 pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sherief Badawi can be reached at 571-272-9782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRITTANY N ALLEN/ Primary Examiner, Art Unit 2169
