DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Remarks/Arguments
This Office Action is in response to the communications for the present US application S/N 18/510,982 last filed on December 11, 2025.
Claims 1-20 were amended and remain pending and have been examined.
Applicant’s arguments filed 12/11/25 have been fully considered but they are not persuasive.
With respect to the 35 U.S.C. 101 rejections of the claims as directed to non-statutory subject matter, Applicant requests that the rejections be withdrawn because independent claims 1, 8, and 15 have been amended.
The examiner respectfully disagrees.
Applicant’s amendments merely recite a mental process on a generic computer comprising a memory and a computing device coupled to the memory. Automating a mental process using standard computer functions does not integrate the idea into a practical application (MPEP 2106.04(d)(II). The added limitations of further describing how the mental steps are performed do not impose meaningful limit on the claims or provide a practical application. The newly added limitations are routine, well understood, and conventional in the relevant art. Further, the added limitations do not improve the functioning of the computer itself, but rather rely on the computer as a tool to process the mental steps.
With respect to the 35 U.S.C. 103 rejections of the claims, Applicant argues that Crabtree is directed to performing network cybersecurity analysis that uses user and entity behavioral analysis combined with network topology information to provide improved cybersecurity Crabtree does NOT mention network traffic messages initiated by an entity corresponding to a particular account and sent to a plurality of recipients.
The Examiner disagrees.
While Crabtree does not explicitly mention network traffic messages, it is common knowledge in the relevant art that cybersecurity issues frequently cause network traffic anomalies, and message errors. Causes of message anomalies and failures include malformed packets (intruders send corrupted or incorrectly formatted protocol messages that crash application parsers), connection failures (high rates of blocked access attempts and port scanning inflate the volume of failed connection states across the network), and resource starvation (ransomware or crypto-mining malware hog device and network processing power, leading to application timeouts and communication failures).
Applicant further argues that since Crabtree does not teach or suggest handling network traffic messages initiated by an entity corresponding to a particular account and sent to a plurality of recipients, Crabtree does not teach or suggest most of the other claim limitations. Applicant additionally argues that Crabtree does not teach or suggest “generate an anomaly impact score based on the failure score, the fluctuation score, and the sparsity score,” as recited in claim 1.
An applicant cannot successfully argue that a reference fails to teach particular limitations by making a conclusory statement without providing supporting details. The USPTO rules require substantive, detailed explanations to overcome an examiner’s rejection. Under MPEP 2142, one the examiner establishes a prima facie case of rejection, the burden shifts to the applicant to show that the rejection is in error. A bare assertion that a limitation is missing does not meet this burden. The applicant must specifically point out where the limitation is missing in the cited reference or explain why the combination of references fails to disclose or render obvious the claimed feature to effectively traverse an obviousness or anticipation rejection, the response must address the specific teachings or combined teachings of the proper art.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e. a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Claims 1, 8 and 15 are directed to a methods and systems for analyzing network traffic data and assigning a risk level to a plurality of anomalies based on a scoring scale using historical traffic data individually associated with one or more of a plurality of accounts. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the claims merely recite the following steps/functions: “identifying an anomaly ...”, determining a failure score ...”, “determining … a fluctuation score ...”, “determining a sparsity score ...”, “generating an anomaly impact score ...” and “assigning an anomaly to a severity bin ...”. When considered in combination with the claim in its entirety, the claimed steps and features reduce the claims to an abstract idea without significantly more because the claimed invention is merely performing steps of gathering data, monitoring the data, and performing calculations on the data to obtain a result. Analyzing the claims as a whole for an inventive concept, the claim limitations, while recited individually or collectively in their generic form, are simply concepts relating to collecting and analyzing information. That is, the steps recited in claims 1, 8 and 15 merely suggest methods for collecting information (e.g. collecting historic traffic data), analyzing/manipulating the information (i.e. identifying an anomaly, determining a failure/fluctuation/sparsity score), and storing the information (e.g. assigning the anomaly to a severity bin), which all can be performed mentally by the human mind. These concepts are further similar to concepts that have been identified by the courts as abstract ideas, namely as in In re Killian, 45 F.4th 1373, 1379 (Fed. Cir. 2022). Additionally, this judicial exception is not integrated into a practical application because the claim fails to suggest, disclose or teach sufficient descriptions of not only a technical problem being solved, but specifically how the claimed functions solve the technical problem. Next, the claims as a whole is analyzed to determine if any element, or combination of elements, is sufficient to ensure that the claim(s) amounts to significantly more than the judicial exception. Here, the claims recite a “data store”, “at least one computing device” and “a plurality of severity bins”, which are recited broadly in the claims and do not provide a specific structure, or method for performing the claimed steps, and therefore, given its broadest reasonable interpretation, these steps could simply be interpreted as any characteristic associated with performing a series of analysis steps and anomaly scoring that can be done in the mind, pen and paper. It is therefore evident that the pending claims relate to methods of manipulating and storing data for performing random scoring on network traffic data, and arranging the data based on the scoring. Accordingly, the elements recited in the claims do not constitute an improvement of the technology because the claims as presented fail to provide a practical application of the claimed invention to solve a technical problem faced by the Applicant. Therefore, the claims are found patent ineligible.
Regarding claims 2-7, 9-14 and 16-20, they are dependent claims of their respective parent claims 1, 8 and 15 and are directed to an abstract idea as determined above. Additionally, when viewed individually or as an ordered combination, neither one of the dependent claims 2-7, 9-14 and 16-20 provide additional elements that amount to significantly more than the judicial exception. Therefore, claims 2-7, 9-14 and 16-20 are not patent eligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 4-9, 11-15 and 17-20 are rejected under 35 U.S.C. 103 as being unpatentable over Crabtree et al. (US 20200358804) hereinafter Crabtree in view of Trinh et al. (US 20200379454) hereinafter Trinh.
Regarding claim 1, Crabtree teaches a system comprising:
a memory (see [0089]: For example, monitoring service 822 may use the data pipelines of ACDP system 100 or multidimensional time series data store 120 (memory). The baseline data for each user/device interaction may be stored in, or associated with, the graph node for that device 2402-2404); and
at least one computing device coupled with the memory, the at least one computing device being configured to:
identify an anomaly based on metadata associated with a plurality of network traffic messages that were initiated by an entity corresponding to a particular account and sent to a plurality of recipients (see [0005]: The system and method involve gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns; see also [0089]: Monitoring service 822 may actively monitor groups for anomalous behavior, as based the established baseline. For example, monitoring service 822 may use the data pipelines of ACDP system 100 or multidimensional time series data store 120 to conduct real-time monitoring of various network resource sensors. Aspects that may be monitored may include, but is not limited to, anomalous web browsing, for example, the number of distinct domains visited exceeding a predefined threshold; anomalous data exfiltration, for example, the amount of outgoing data exceeding a predefined threshold, etc.);
determine a failure score for the plurality of network traffic messages initiated by the entity corresponding to the particular account and sent to the plurality of recipients, the failure score representing a rate of failure of the plurality of network traffic messages (see [0093]: For example, for device 2402, the measured number of logins (19) and failed logins (12) has increased dramatically over the baseline data (i.e. rate of failure) for those interactions, suggesting either that the user is engaging in anomalous behavior or that the user's account has been compromised and is being used to attempt to gain network access);
determine, based on a change in volume of the plurality of network traffic messages, a fluctuation score for the plurality of network traffic messages initiated by the entity corresponding to the particular account and sent to the plurality of recipients (see [0089]: Aspects that may be monitored may include, but is not limited to anomalous data exfiltration, for example, the amount of outgoing data exceeding a predefined threshold; see also [0093]: In the example for device 2403, the measured number of USB device mounts has increased dramatically over the baseline data for that interaction, suggesting that the user is attempting transfer more data to portable devices than usual (i.e. change in volume of network traffic messages), which could indicate a data exfiltration attempt);
determine a sparsity score by analyzing a quantity of messages delivered to the plurality of recipients over a particular period of time (see [0089]: Aspects that may be monitored may include, but is not limited to unusual domain access, for example, a subgroup consisting a few members within an established group demonstrating unusual browsing behavior by accessing an unusual domain a predetermined number of times within a certain timeframe);
generate an anomaly impact score based on the failure score, the fluctuation score, and the sparsity score (see [0094]: In addition to the baseline and measurements, additional data, weights, and/or variables may be assigned, such as a user/device criticality rating. For example, if the user 2401 is a low-level employee with access only to non-confidential and/or publicly-disclosed information through the devices 2402-2404, anomalous user/device interaction behavior has a low risk of having a negative cybersecurity impact, and the user/device criticality may be very low, reducing the level of effort expended on investigating such anomalous behavior. Conversely, if the user 2401 is an executive-level employee with access to highly-sensitive information through the devices 2402-2404, anomalous user/device interaction behavior has a high risk of having a negative cybersecurity impact, and the user/device criticality may be very high, meaning that investigating even minor anomalous behavior is a high priority; see also Fig. 10 and [0100]: According to the aspect, impact assessment of an attack may be measured using a DCG 155 to analyze a user account and identify its access capabilities 1001 (for example, what files, directories, devices or domains an account may have access to). This may then be used to generate 1002 an impact assessment score for the account, representing the potential risk should that account be compromised).
Crabtree, by disclosing cyber security events in paragraphs [0089] and [0092], covers “network traffic messages initiated by an entity corresponding to a particular account and sent to a plurality of recipients. As mentioned above, it is common knowledge in the relevant art that cybersecurity issues frequently cause network traffic anomalies, and message errors. Causes of message anomalies and failures include malformed packets (intruders send corrupted or incorrectly formatted protocol messages that crash application parsers), connection failures (high rates of blocked access attempts and port scanning inflate the volume of failed connection states across the network), and resource starvation (ransomware or crypto-mining malware hog device and network processing power, leading to application timeouts and communication failures).
However, the Crabtree reference does not explicitly teach a system comprising at least one computing device configured to:
assign the anomaly to a particular severity bin of a plurality of severity bins based on the anomaly impact score.
In the same field of endeavor as the Crabtree reference, Trinh teaches a system comprising generating an anomaly impact score (see [0066]: The predictive maintenance server 110 receives raw data from various sensors and stores the raw data in a raw data store 420. The predictive maintenance server 110 determines various anomaly scores 460 at a high frequency that is close to the frequency at which raw data is received. The anomaly scores 460 may indicate the likelihood of anomalies according to various embodiments disclosed herein). Furthermore, Trinh suggests a system in accordance with the present invention, the system comprising at least one computing device configured to:
assign the anomaly to a particular severity bin of a plurality of severity bins based on the anomaly impact score (see [0066]: The predictive maintenance server 110 sends periodic alerts 462 based on the anomaly scores 460 ... In an embodiment, the predictive maintenance server 110 associates each alert with a severity level ... For example, if more than a threshold T1 (say 4) instances of consecutive anomaly scores that exceed a threshold T are identified, the predictive maintenance server 110 generates an alert with severity level L1. However, of the sequence of consecutive instances of anomaly scores exceeding threshold T1 becomes longer than a second threshold T2 (say 8), the predictive maintenance server 110 modifies the severity level of the alert to a level L2 indicating higher severity compared to level L1 (i.e. a plurality of severity bins)).
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the present invention to incorporate the teachings of Trinh suggesting assigining the anomalies to a plurality of severity bins into the vulnerability analysis system taught by Crabtree in order to evaluate cybersecurity risks to the network and take any necessary actions appropriately. The motivation for such combination would have been to improve current data analysis technology by computing severity of a plurality of anomalies simultaneously, which allows for investigation of detected anomalies to occur holistically using the classifications of detected anomalies.
Regarding claim 2, Crabtree in view of Trinh is applied as disclosed in claim 1 examined above. The combination of Crabtree and Trinh teaches a system comprising generating an anomaly impact score based on the failure score, the fluctuation score, and the sparsity score. Furthermore, Trinh teaches a system wherein the at least one computing device is further configured to generate the anomaly impact score as a weighted average of the failure score, the fluctuation score, and the sparsity score (see [0065]: The predictive maintenance server 110 performs various steps, which may include (1) aggregating atomic scores into per-equipment health score (risk score) (2) raising alerts from atomic (e.g., minutely) anomaly scores, subject to moving average smoothing (e.g., simple weighted moving average or exponentially weighted moving average).
Regarding claim 4, Crabtree in view of Trinh is applied as disclosed in claim 1 examined above. The combination of Crabtree and Trinh teaches a system comprising generating an anomaly impact score based on the failure score, the fluctuation score, and the sparsity score. Furthermore, Crabtree teaches a system wherein the at least one computing device is further configured to identify the anomaly by determining that a count of traffic failures in the metadata associated with the plurality of network traffic messages exceeds an anomaly threshold associated with the particular account (see [0093]: For example, for device 2402, the measured number of logins (19) and failed logins (12) has increased dramatically over the baseline data for those interactions, suggesting either that the user is engaging in anomalous behavior or that the user's account has been compromised and is being used to attempt to gain network access).
Regarding claim 5, Crabtree in view of Trinh is applied as disclosed in claim 1 examined above. The combination of Crabtree and Trinh further teaches a system wherein the at least one computing device is further configured to:
receive historical anomaly data comprising a plurality of known anomalies and a plurality of known regularities (Crabtree - see [0067]: provide predictive attack modeling based upon historic, current, and contextual attack progression analysis such that human decision makers can rapidly formulate the most effective courses of action at their levels of responsibility in command of the most actionable information with as little distractive data as possible; see also [0103]: According to the aspect, a baseline score can be used to measure an overall level of risk for a network infrastructure, and may be compiled by first collecting 1301 information on publicly-disclosed vulnerabilities, such as (for example) using the Internet or common vulnerabilities and exploits (CVE) process);
train a machine learning algorithm predictive of anomalies using the historical anomaly data (Crabtree - see [0088]: The aggregated data may then be used to generate a behavioral baseline for each group established by grouping engine 813. Behavioral analysis engine 819 may use graph stack service 145 and DCG module 155 to convert and analyze the data in graph format using various machine learning models; see also [0092]: The baseline behavior of the user's 2401 interaction with each device is established. In this simplified example, in a given week for each device 2402-2404, the user 2401 normally has seven logins, zero failed login attempts, mounts three USB devices, has one instance of risky web activity (e.g., visiting a website with a known risk of malware), and has zero instances of data exfiltration (e.g., moving or copying of data to an unauthorized location). The baseline data for each user/device interaction may be stored in, or associated with, the graph node for that device 2402-2404); and
identify the anomaly based on applying the machine learning algorithm to the metadata associated with the plurality of network traffic messages corresponding to the particular account (Crabtree - see [0089]: Aspects that may be monitored may include, but is not limited to, anomalous web browsing, for example, the number of distinct domains visited exceeding a predefined threshold; anomalous data exfiltration, for example, the amount of outgoing data exceeding a predefined threshold; unusual domain access, for example, a subgroup consisting a few members within an established group demonstrating unusual browsing behavior by accessing an unusual domain a predetermined number of times within a certain timeframe ...; see also [0093]: For example, for device 2402, the measured number of logins (19) and failed logins (12) has increased dramatically over the baseline data for those interactions, suggesting either that the user is engaging in anomalous behavior or that the user's account has been compromised and is being used to attempt to gain network access).
Regarding claim 6, Crabtree in view of Trinh is applied as disclosed in claim 1 examined above. The combination of Crabtree and Trinh teaches a system configured to determine a fluctuation score for the plurality of network traffic messages based on a change in volume of the plurality of network traffic messages over time. Furthermore, Crabtree teaches a system wherein determining the fluctuation score for the plurality of network traffic messages comprises comparing a quantity of the plurality of network traffic messages in a current period of time against at least one quantity of at least one previous period of time (see [0089]: Aspects that may be monitored may include, but is not limited to anomalous data exfiltration, for example, the amount of outgoing data exceeding a predefined threshold; see also [0093]: In the example for device 2403, the measured number of USB device mounts has increased dramatically over the baseline data for that interaction, suggesting that the user is attempting transfer more data to portable devices than usual (i.e. change in volume of network traffic messages), which could indicate a data exfiltration attempt).
Regarding claim 7, Crabtree in view of Trinh is applied as disclosed in claim 1 examined above. The combination of Crabtree and Trinh teaches a system configured to determine a fluctuation score for the plurality of network traffic messages based on a change in volume of the plurality of network traffic messages over time. Furthermore, Crabtree teaches a system wherein the plurality of network traffic messages comprise at least one network traffic message from at least one additional account associated with the particular account (see [0089]: for example, a user logging in using an account from two distinct locations that may be physically impossible within a certain timeframe).
Regarding claims 8 and 15, they teach similar limitations as claim 1. Therefore, the same rationale applies.
Regarding claim 9, it teaches the same limitations as claim 2 examined above. Therefore, the same rationale applies.
Regarding claims 11 and 17, they teach the same limitations as claim 4 examined above. Therefore, the same rationale applies.
Regarding claims 12 and 18, they teach the same limitations as claim 5 examined above. Therefore, the same rationale applies.
Regarding claims 13 and 19, they teach the same limitations as claim 6 examined above. Therefore, the same rationale applies.
Regarding claims 14 and 20, they teach the same limitations as claim 7 examined above. Therefore, the same rationale applies.
Claims 3, 10 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Crabtree et al. (US 20200358804) hereinafter Crabtree in view of Trinh et al. (US 20200379454) hereinafter Trinh, in further view of Zang et al. (WO 2023191787) hereinafter Zang.
Regarding claim 3, Crabtree in view of Trinh is applied as disclosed in claim 1 examined above. The combination of Crabtree and Trinh teaches a system comprising at least one computing device in communication with the data store, the at least one computing device being configured to identify an anomaly based on metadata associated with a plurality of network traffic messages corresponding to a particular account. However, the Crabtree-Trinh combination does not explicitly teach a system wherein the at least one computing device is further configured to:
identify a configuration property associated with the anomaly based on the metadata associated with the plurality of network traffic messages; and
perform a remedial action comprising modifying the configuration property.
In the same field of endeavor, Zhang teaches a system in accordance with the present invention, the system wherein the at least one computing device is further configured to:
identify a configuration property associated with the anomaly based on the metadata associated with the plurality of network traffic messages (see Page 3 lines 14-15: In some aspects, the system may further identify a set of root causes for the failures and may use the root causes as additional information to help diagnose the failures, and take actions to remediate or avoid the failures); and
perform a remedial action comprising modifying the configuration property (see Page 3 line 15: use the root causes as additional information to help diagnose the failures, and take actions to remediate or avoid the failures).
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the present invention to incorporate the teachings of Zhang suggesting identifying a configuration property associated with the anomaly based on the metadata associated with the plurality of network traffic messages and performing a remedial action comprising modifying the configuration property into the system taught by Crabtree-Trinh. The motivation for such combination would have been to provide failure predictions and prevention solutions in communication networks to reduce damage to assets and improve the health of the overall system by reducing unplanned downtime and operating delays while increasing productivity and operational effectiveness.
Regarding claims 10 and 16, they teach the same limitations as claim 3 examined above. Therefore, the same rationale applies.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Emmanuel Moise whose telephone number is (571)272-3865. The examiner can normally be reached M-F 8:30 AM - 5:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Colleen Fauz can be reached at (571)272-1667. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/EMMANUEL L MOISE/Supervisory Patent Examiner, Art Unit 2455
Prosecution Insights