DETAILED ACTION
This office action is in response to the Amendments filed on 02/04/2026.
Claims 2, 7, and 12 are cancelled.
Claims 1, 6, 11, 13-15 are amended.
Claims 1, 3-6, 8-11, and 13-15 are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments, see Remarks pg 8, filed 02/04/2026, with respect to Claim objections to claims 13-15 have been fully considered and are persuasive. The Claim objections to claims 13-15 has been withdrawn.
Applicant's arguments filed in Remarks pg. 8-13 regarding 35 USC 103 rejections to the claims on 02/04/2026 have been fully considered but they are not persuasive.
Applicant argues in essence:
[a] “The Office Action admits that Tarighat fails to disclose that "the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website" (originally recited in claim 2), but it alleges that Su teaches these features. See Office Action at p. 7-8. Applicant respectfully disagrees.
[[Su pg. 55 and pg 57]]
As seen above, Su describes that pl and p2 are the probabilities of the corresponding categories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively. The softmax classifier is a multi-class classifier. Accordingly, Su describes performing classification on the features of the hierarchical attention layer and the CNN layer separately using a multi-class classifier.
Su further describes on page 57 below Figure 4 that "In this paper, we truncate the entire web text into segments of fixed length, which are coded by XLNet and used as input for the Hierarchical Attention layer, and the output are global features of web text." Accordingly, the output of the Hierarchical Attention layer in Su is the global features of web text, not a binary classification result. This also indicates that the Hierarchical Attention layer in Su does not comprise multiple binary classifiers, and therefore cannot be equated with the preset classification model of the present disclosure, which comprises multiple binary classifiers. Thus, Su does not disclose "the preset classification model" required by amended claim 1.”
In response to [a], Examiner respectfully disagrees. In response to applicant's arguments against the references individually, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986).
Firstly, it should be noted that a target website in view of the rejection as shown in primary reference Tarighat is that of a malicious website.
Tarighat: analyzing a correlation of the features using a target website identification model to obtain a probability result of a target website being accessed (Tarighat: para.0031 "The network layer security system 110 uses both known databases of connections as well as machine learning to determine if a connection is likely to be malicious. When a phishing connection is detected, the user is blocked from opening the link, displaying the website, or transmitting data; even if the connection is not made directly by the user and instead by an application. Para.0033 "The network layer security system 110 also detects connections to malicious websites by analyzing known databases of such sites and machine learning to detect similar potential threats The user and monitoring staff are also notified when the connection to the malicious website was not made by the user but rather by some other application or malware. " It is determined how likely the traffic is to a malicious website, i.e. a target website.)
Secondly, regarding the arguments of Su showing a multiclass classification rather than a binary, it should be noted that Su is not relied upon to show the plurality of binary classifiers. With that said, Su discloses in equations 12 and 13 a probability output of classification from 2 different models, the CNN layer and Hierarchical Attention Layer. Each of the probabilities represent the probability of classification of the website into a particular category.
Su: Pg. 55 “The web page classification method proposed in this paper mainly consists of two parts. The first is data acquisition and pre-processing. Using URLs to obtain its corresponding HTML and extract the body, title and keywords of web pages text, transforming the semi structured data into structured data. The second is to use the pre trained model XLNet to generate word vectors, then input word vectors into deep learning model for training, finally make predictions to obtain the final classification results”
Pg. 57 “where 𝑜𝑢𝑡𝑝𝑢𝑡1 is the feature vector of the CNN layer output, 𝑜𝑢𝑡𝑝𝑢𝑡2 is the feature vector of the Hierarchical Attention layer output, 𝑝1 and 𝑝2are the probabilities of the corresponding cate gories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively, and the final category probability 𝑝 is obtained by taking the arithmetic average of 𝑝1 and 𝑝2.”
However, while Su discloses a range of probabilities of a particular classification and therefore is not relied upon to show binary classifiers (i.e. black and white classification rather than a percentage range), it is not to say this is a multiclass classifier as argued. Applicant argues that because Su determines 2 probabilities and averages them together, it is a multi-class classification and therefore not binary, however this is not the case. Su discloses determining at least one probability as in pg. 57, of a single classification, this is performed by averaging the 2 probabilities determined from different models. As noted above, this probability if a final classification result for a the final category, not an average of multiple probabilities for different classifications.
Therefore, while examiner does not rely upon Su for binary classifiers, Su still teaches single class classification for target website, and Sen is relied upon to show multiple binary classifiers explained in more detail below.
[b] “When considered in combination with the features of "obtaining a target website identification result based on the probability result and a preset classification model; wherein the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website" further required by amended claim 1, it is understood that, each website to be identified corresponds to a binary classifier to identify whether that website is a target website. Clearly, the identification method using multiple binary classifiers in amended claim 1 differs from the method using a softmax classifier in Su.”
In response to [b], examiner respectfully disagrees. The limitation “wherein the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website.” Does not require a correspondence for each binary classifier and a website to be classified. Under broadest reasonable interpretation, the claim requires the preset classification model broadly being used in target website identification result, and that is comprises at least 2 binary classifiers that are configured to classify a website as a target website.
Additionally, as explained above, Su has similar classification method using a single probability of likelihood of classification as a target website, however does not explicitly disclose this classifier being multiple binary classifiers and Sen is relied upon for this concept.
[c] “Furthermore, Su describes using a Hierarchical Attention layer to perform single classification on web pages, where the "global features of web text" output via softmax correspond to a single category. In this field, the output of softmax is "mutually exclusive" (the sum of probabilities for all categories equals 1), thereby making it suitable for single-label classification.
However, as stated in amended claim 1, the present disclosure relates to "a scenario where a plurality of pages are accessed simultaneously." In such a scenario, a target website may coexist with non-target websites, or multiple target websites may exist concurrently. Therefore, the use of multiple binary classifiers in amended claim 1 enables the model to independently determine whether each website is a target website.
If the present disclosure were to apply the softmax classifier described in Su, which outputs probabilities for multiple concurrent websites as target websites in a single pass, the features of multiple concurrent websites would become intermixed. The softmax classifier would force the selection of a single "winner" among the concurrent websites, thereby leading to recognition errors or omissions. Thus, the softmax classifier described in Su cannot be applied to the scenario in the present disclosure where a plurality of pages are accessed simultaneously.
Therefore, Su does teach or suggest that "the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website," as required by amended claim 1.”
In response to [c], examiner respectfully disagrees. Firstly, as explained above, examiner acknowledges Su does not disclose multiple binary classifiers for the target website classification and is referenced to perform a single classification, and the multiple binary classifiers is taught by Sen.
Secondly, under broadest reasonable interpretation the claim only requires a single identification of probability of a target website being accessed from the set of traffic patterns and the result is based on this probability further “based” on a preset classification model that has a plurality of binary classifiers that identify if a website is included in a target website. This process by the preset classification model does not require the active steps of, for example, identifying 2 websites from the browsed traffic packets, determining each website being a target website using a binary classifier for each website, and the target website identification result is based on the probability as well as 2 results for 2 different websites by 2 different binary classifiers, as is argued above.
The added limitation from claim 2 merely states that “wherein the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website.”, and the result is broadly based on this model that individually identifies of a website is included in the target website. The claim does not recite any language that states the preset classification model is applied to each website, only that it is configured to be applicable to identify if a website if in a target website, i.e. applied multiple times. The claim also does not define the configuration of the individual binary classifiers as argued, the limitation states that the plurality of binary classifiers configured to identify whether each website is included in the target website, that is, the binary classifiers may be usable together to for a single identification for each website.
This may be an avenue to move prosecution forward by further defining to what extent the preset classification model is applied to the target website identification result, as well as the individual processes of each binary classifier and how it changes the target website identification result, rather than simple being “based” on the model.
[d] “Tarighat, Frantz, and Sen likewise do not disclose "the preset classification model" comprising the multiple binary classifiers required by amended claim 1. For example, while Sen discloses a plurality of binary classifiers 104, they are configured to output scores related to whether a packet flow belongs to the traffic class associated with the respective binary classifier, which is different from the function of the binary classifiers of amended claim 1 that are configured to identify whether each website is included in the target website. Therefore, the combination of Tarighat, Su, Frantz, and Sen does not teach or suggest that "the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website," as required by amended claim 1.”
In response to [d], examiner respectfully disagrees. In response to applicant's arguments against the references individually, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986).
As explained above, in [a], Tarighat-Sen-Frantz is shown to teach classification of the web traffic to target website, i.e. a malicious website in Tarighat, using a set of probabilities from different models to determine a final probability result for classification, as in Su.
Tarighat: analyzing a correlation of the features using a target website identification model to obtain a probability result of a target website being accessed (Tarighat: para.0031 "The network layer security system 110 uses both known databases of connections as well as machine learning to determine if a connection is likely to be malicious. When a phishing connection is detected, the user is blocked from opening the link, displaying the website, or transmitting data; even if the connection is not made directly by the user and instead by an application. Para.0033 "The network layer security system 110 also detects connections to malicious websites by analyzing known databases of such sites and machine learning to detect similar potential threats The user and monitoring staff are also notified when the connection to the malicious website was not made by the user but rather by some other application or malware. " It is determined how likely the traffic is to a malicious website, i.e. a target website.)
Su: Pg. 55 “The web page classification method proposed in this paper mainly consists of two parts. The first is data acquisition and pre-processing. Using URLs to obtain its corresponding HTML and extract the body, title and keywords of web pages text, transforming the semi structured data into structured data. The second is to use the pre trained model XLNet to generate word vectors, then input word vectors into deep learning model for training, finally make predictions to obtain the final classification results”
Pg. 57 “where 𝑜𝑢𝑡𝑝𝑢𝑡1 is the feature vector of the CNN layer output, 𝑜𝑢𝑡𝑝𝑢𝑡2 is the feature vector of the Hierarchical Attention layer output, 𝑝1 and 𝑝2are the probabilities of the corresponding cate gories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively, and the final category probability 𝑝 is obtained by taking the arithmetic average of 𝑝1 and 𝑝2.”
However, while Su discloses the classification from a preset classification model, it does not disclose this result from a set of binary classifiers to identify if the website in included in a target website.
Sen shows a process of using a set of binary classifiers to classify web traffic as shown below.
Sen: para.0076 “In step 234, the binary classifiers 104 generate a set of output scores using the feature set as input for the plurality of binary classifiers 104. The plurality of binary classifiers 104 are configured to operate in parallel, each binary classifier 104 associated with one of k traffic classes.”
Para.0077 “Each estimated class probability value indicates an estimated probability that the packet flow on which the output score is based belongs to the traffic class associated the respective binary classifier 104 and associated calibrator 106.”
The combination incorporates the binary classifiers used to classify web traffic in Sen to the website identification being performed in Tarighat-Su-Frantz. As explained above in view of Tarighat, a target website is a malicious website. Su performs its classification using traffic features in vector form as described in pg. 55 (cited above), and similarly Sen uses binary classifiers to sort web traffic into classifications. As explained in the rejection, binary classifiers are incorporated to Tarighat-Su-Frantz for classifying web traffic used in the result generated by Su. Therefore in combination, Su and Sen teach the preset classification model.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 6, is/are rejected under 35 U.S.C. 103 as being unpatentable over Tarighat (US 2023/0224277 A1) in view of Su et al. (hereinafter Su, “Design and Implementation of Web Page Classification Method Based on XLNet Fusing Hierarchical Attention and CNN” NPL September 2022) in view of Frantz et al. (hereinafter Frantz, US 2011/0302653 A1) further in view of Sen et al. (hereinafter Sen, US 2011/0040706 A1).
Regarding Claim 1, Tarighat discloses A method for identifying a dark web website (Tarighat: para.0035 “dark web”), comprising:
obtaining browsed network traffic packets of websites to be identified (Tarighat: para.0051 “ The network layer security system 110 monitors metadata of the TCP/IP traffic transmitted to and received from the user's individually-owned electronic device (step 302) and determines whether there is an anomaly in the metadata (step 304)” browsing traffic is monitored), and
extracting direction sequence features from the browsed network traffic packets (Tarighat: para.0051 “For example, the metadata may indicate that the user's individually-owned electronic device 101 is transmitting data to and/or receiving data from a server 122 that is known to be compromised or known to contain malicious code.” To and from, i.e. directional, metadata is extracted from the packets.);
analyzing a correlation of the features using a target website identification model to obtain a probability result of a target website being accessed (Tarighat: para.0031 “The network layer security system 110 uses both known databases of connections as well as machine learning to determine if a connection is likely to be malicious. When a phishing connection is detected, the user is blocked from opening the link, displaying the website, or transmitting data; even if the connection is not made directly by the user and instead by an application.” Para.0033 “The network layer security system 110 also detects connections to malicious websites by analyzing known databases of such sites and machine learning to detect similar potential threats…. The user and monitoring staff are also notified when the connection to the malicious website was not made by the user but rather by some other application or malware. ” It is determined how likely the traffic is to a malicious website, i.e. a target website.); and
However Tarighat does not explicitly disclose A method for identifying a dark web website in a scenario where a plurality of pages are accessed simultaneously; dividing the direction sequence features into a plurality of subsequence features based on a plurality of sliding windows, and inputting the plurality of subsequence features into a neural network model to extract preset pattern features; analyzing a correlation of the preset pattern features using a target website identification model to obtain a probability result of a target website being accessed; obtaining a target website identification result based on the probability result and a preset classification model; wherein the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website.
Su discloses dividing the direction sequence features into a plurality of subsequence features based on a plurality of sliding windows (Su: pg. 57 3.2.3 CNN layer “CNN Layer. The core idea of CNN is to capture local features, which for text are sliding windows consisting of several words, similar to n-gram.” A sliding window operation is used to divide the input data several words at a time. The resulting groups of every sliding window are the plurality of subsequence features.), and
inputting the plurality of subsequence features into a neural network model to extract preset pattern features (Su: pg. 57 3.2.3 CNN layer “A convolution operation is performed on a window 𝑥𝑖:𝑖+ℎ−1 using a convolution kernel to produce a feature map 𝑐𝑖 … The final feature map is represented as 𝑐 = [𝑐1, 𝑐2, ..., 𝑐𝑛−ℎ+1 ], and then use the maximum pooling operation for each feature map to filter features and perform feature fusion to obtain local features:” the preset pattern feature is the local features);
analyzing a correlation of the preset pattern features using a target website identification model (Su: abstract “we propose a web page classification model XLNet-HAC based on the pre-trained model XLNet fusing Hierarchical Attention and CNN. F”) to obtain a probability result of a target website being accessed (Examiner notes that in claim 5 the target website identification model is an attention layer, and in para.0083 of applicant specification, the attention layer incorporates a softmax operation. Su: pg. 57 3.2.4 Fusion output layer “The XLNet-HAC model extracts the higher-order global features and local features of the web text using the Hierarchical Attention layer and CNN layer respectively, and uses the two features as the input of the fully connected layer, which uses ReLU as the activation function and adds the dropout mechanism to prevent overfitting, then the output of the fully connected layer is applied to the softmax classifier. Finally, the results of the softmax classifier are fused to obtain the final classification results. The specific result fusion strategy is as follows:… where 𝑜𝑢𝑡𝑝𝑢𝑡1 is the feature vector of the CNN layer output, 𝑜𝑢𝑡𝑝𝑢𝑡2 is the feature vector of the Hierarchical Attention layer output, 𝑝1 and 𝑝2are the probabilities of the corresponding categories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively, and the final category probability 𝑝 is obtained by taking the arithmetic average of 𝑝1 and 𝑝2” the correlation of the preset pattern features, i.e. the local features, is done using a softmax operation, the target website identification model, which results in a probability output using p1 result in equation 12. );
obtaining a target website identification result (Su: abstract “we propose a web page classification model XLNet-HAC based on the pre-trained model XLNet fusing Hierarchical Attention and CNN. F”) based on the probability result and a preset classification model (Su: pg. 57 “where 𝑜𝑢𝑡𝑝𝑢𝑡1 is the feature vector of the CNN layer output, 𝑜𝑢𝑡𝑝𝑢𝑡2 is the feature vector of the Hierarchical Attention layer output, 𝑝1 and 𝑝2are the probabilities of the corresponding categories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively, and the final category probability 𝑝 is obtained by taking the arithmetic average of 𝑝1 and 𝑝2” pg. 55 Method “The second is to use the pretrained model XLNet to generate word vectors, then input word vectors into deep learning model for training, finally make predictions to obtain the final classification results.” equation 12 combines the probability result in equation 12 of the CNN result, and combines it with the result of another model, the hierarchical attention layer, the preset classification model. This results in a probability result of classification for the web service);
wherein the preset classification model configured to identify whether each website is included in the target website (Su: pg. 55 “The web page classification method proposed in this paper mainly consists of two parts. The first is data acquisition and pre-processing. Using URLs to obtain its corresponding HTML and extract the body, title and keywords of web pages text, transforming the semistructured data into structured data. The second is to use the pretrained model XLNet to generate word vectors, then input word vectors into deep learning model for training, finally make predictions to obtain the final classification results.” Pg. 56 Fig. 2 left side, pg. 57 “𝑜𝑢𝑡𝑝𝑢𝑡2 is the feature vector of the Hierarchical Attention layer output, 𝑝1 and 𝑝2are the probabilities of the corresponding categories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively,” heierarchical attention layer the left hand side of Fig. 2 is the preset classification model that identifies classification of webpages)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat with Su in order to incorporate dividing the direction sequence features into a plurality of subsequence features based on a plurality of sliding windows, and inputting the plurality of subsequence features into a neural network model to extract preset pattern features; analyzing a correlation of the preset pattern features using a target website identification model to obtain a probability result of a target website being accessed; obtaining a target website identification result based on the probability result and a preset classification model, wherein the preset classification model configured to identify whether each website is included in the target website, and apply this concept to the website classification of Tarighat.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy in classification of web pages (Su: abstract)
However Tarighat-Su does not explicitly disclose A method for identifying a dark web website in a scenario where a plurality of pages are accessed simultaneously; wherein the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website.
Frantz discloses A method for identifying a malicious website in a scenario where a plurality of pages are accessed simultaneously (Frantz: para.0132 “if a client opens a plurality of pages concurrently, those requests may travel along different routes and be received by the website out of order, and they may be processed by servers of differing speeds and responded to out of order, and the responses may likewise travel along different paths and reach the client out of order.” Para.0086 “Security classifier 4070 examines each web service 4030, and outputs security level 4080 classifying the service according to whether its contents are ever transmitted as plaintext, or always transmitted in encrypted form via a secure protocol such as TLS or SSL, as recognizable by the "https://" secure protocol name in the services' URLs, as opposed to "http://", or by the HTTP Upgrade header.” Para.0093 “Conflict analyzer 4160 uses website map 3110 to analyze the structural integrity of the website, and outputs conflict warnings 4170 for any structural security flaws in the website, ranked by priority, in order to thwart certain types of threats of which the website security personnel are presumably not yet aware and which fraudsters may already be exploiting.” Para.0163 “The timestamps, in addition to being used to sort the transactions in chronological order, are also used to help segregate sessions on the basis of overlapping transactions. Note, however, that a single client may legitimately have overlapping transactions, for example by concurrently opening or operating multiple browser windows opened to the same website.” Websites and their webservices are classified even in situations when multiple pages are access concurrently.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Tarighat-Su with Frantz in order to incorporate A method for identifying a malicious website in a scenario where a plurality of pages are accessed simultaneously, and apply this concept to Tarighat-Su that identifies dark web websites.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of being able to analyze web traffic even when multiple pages are access concurrently which is a common situation when vulnerabilities can occur (Frantz: para.0263, para.0163, para.0132).
However Tarighat-Su-Frantz does not explicitly disclose wherein the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website.
Sen discloses wherein the preset classification model comprises a plurality of binary classifiers configured to classify web traffic (Sen: para.0076 “In step 234, the binary classifiers 104 generate a set of output scores using the feature set as input for the plurality of binary classifiers 104. The plurality of binary classifiers 104 are configured to operate in parallel, each binary classifier 104 associated with one of k traffic classes.” Para.0077 “Each estimated class probability value indicates an estimated probability that the packet flow on which the output score is based belongs to the traffic class associated the respective binary classifier 104 and associated calibrator 106.” A plurality of binary classifiers are used to classify the incoming traffic.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat-Su-Frantz with that of Sen in order to incorporate wherein the preset classification model comprises a plurality of binary classifiers configured to classify web traffic, and apply the concept of a plurality of binary classifiers to the website identification of Tarighat-Su-Frantz.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy in classification of traffic (Sen: para.0004).
Regarding Claim 6, it recites all of the same steps as claim 1 but in A device for identifying a dark web website in a scenario where a plurality of pages are accessed simultaneously, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to: (Tarighat: para.0018, para.0035, para.0051, Fig. 1 the memory and processor of the networks operation center 105). Therefore the supporting rejection to claim 1 applies equally as well to that of claim 6.
Claim(s) 3, 8, is/are rejected under 35 U.S.C. 103 as being unpatentable over Tarighat (US 2023/0224277 A1) in view of Su et al. (hereinafter Su, “Design and Implementation of Web Page Classification Method Based on XLNet Fusing Hierarchical Attention and CNN” NPL September 2022) in view of Frantz et al. (hereinafter Frantz, US 2011/0302653 A1) further in view of Sen et al. (hereinafter Sen, US 2011/0040706 A1) in view of Song et al. (hereinafter Song, US 2017/0085531 A1).
Regarding Claim 3, Tarighat-Su-Frantz-Sen discloses claim 1 as set forth above.
However Tarighat does not explicitly disclose wherein dividing the direction sequence features into the plurality of subsequence features based on the plurality of sliding windows comprises:splicing the direction sequence features to obtain a traffic loop feature; and segmenting the traffic loop feature from different positions by using the plurality of sliding windows to obtain the plurality of subsequence features.
Su discloses wherein dividing the direction sequence features into the plurality of subsequence features based on the plurality of sliding windows comprises: splicing the direction sequence features to obtain a traffic feature (Su: pg. 56 Fig. 2 the XLNET embedding step creates a plurality of segments of features SegN+1 features); and
segmenting the traffic feature from different positions by using the plurality of sliding windows to obtain the plurality of subsequence features (Su: pg. 56 Fig. 2 the segN+1 features are input into the CNN to generate subsequence features, the features prior to feature fusion. pg. 57 3.2.3 CNN layer “A convolution operation is performed on a window 𝑥𝑖:𝑖+ℎ−1 using a convolution kernel to produce a feature map 𝑐𝑖 : 𝑐𝑖 = 𝑓 (𝑤 ∗ 𝑥𝑖:𝑖+ℎ−1 + 𝑏) (11) where 𝑓 is a nonlinear function, ∗ denotes the dot product operation in the elemental way, 𝑥𝑖:𝑖+ℎ−1 represents a window of size ℎ × 768 consisting of rows 𝑖 to 𝑖 + ℎ − 1 of the input matrix, stitched by 𝑥𝑖 , 𝑥𝑖+1, ..., 𝑥𝑖:𝑖+ℎ−1 , 𝑤 is the size of ℎ × 768 weight matrix, ℎ denotes the number of words in the window, and 𝑏 is the bias parameter. The final feature map is represented as 𝑐 = [𝑐1, 𝑐2, ..., 𝑐𝑛−ℎ+1 ], and then use the maximum pooling operation for each feature map to filter features and perform feature fusion to obtain local features.” A sliding window operation is used to divide the input data several words at a time. The resulting groups of every sliding window are the plurality of subsequence features. Each window results in a different position of the feature.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat with Su in order to incorporate wherein dividing the direction sequence features into the plurality of subsequence features based on the plurality of sliding windows comprises: splicing the direction sequence features to obtain a traffic feature; and segmenting the traffic feature from different positions by using the plurality of sliding windows to obtain the plurality of subsequence features.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy in classification of web pages (Su: abstract).
However Tarighat-Su-Frantz-Sen does not explicitly disclose wherein dividing the direction sequence features into the plurality of subsequence features based on the plurality of sliding windows comprises: splicing the direction sequence features to obtain a traffic loop feature; and segmenting the traffic loop feature from different positions by using the plurality of sliding windows to obtain the plurality of subsequence features.
Song discloses splicing the direction sequence features to obtain a traffic loop feature (Song: Fig. 3, para.0028 “FIG. 3 is a schematic flow diagram of another embodiment of a process for identifying network loops.” Para.0029 “In 310, the traffic cleaning equipment determines a first data packet having a TTL that is less than or equal to a first preset threshold value or at least meets a first condition from among diverted network traffic, and determines a destination IP address of the first data packet.” Para.0030 “In 320, the traffic cleaning equipment records the destination IP address of the first data packet in an IP address list used to monitor network loops. In this example, the traffic cleaning equipment maintains the IP address list which tracks the destination IP addresses of packets, and examines the IP addresses of packets that are diverted to the traffic cleaning equipment. If a packet has a destination IP address that is not in the list, this packet is deemed to be a first data packet, and its destination IP address is recorded in the list.” Para.0033 “In 350, in the event that the set number of TTLs that are reduced to the second preset threshold value exists among the multiple TTLs corresponding to the multiple second data packets, the traffic cleaning equipment determines that a network loop exists for the destination IP address.” Based on the analyzing packet features, i.e. destination ip, the packets are spliced, i.e. packets are separated into a list, to identify a network loop to identify an attack in para.0059).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat-Su-Frantz-Sen with Son in order to incorporate splicing the direction sequence features to obtain a traffic loop feature, such that the traffic loop feature is spliced and segmented by the process of Su
One of oridanry skill in the art would have been motivated to combine because of the expected benefit of improved network security by identifying malicious traffic (Son: para.0003).
Regarding Claim 8, it does not recite nor further define over the limitations of claim 3. Therefore the supporting rationale for the rejection to claim 3 applies equally as well to that of claims 8.
Claim(s) 4, 9, is/are rejected under 35 U.S.C. 103 as being unpatentable over Tarighat (US 2023/0224277 A1) in view of Su et al. (hereinafter Su, “Design and Implementation of Web Page Classification Method Based on XLNet Fusing Hierarchical Attention and CNN” NPL September 2022) in view of Frantz et al. (hereinafter Frantz, US 2011/0302653 A1) further in view of Sen et al. (hereinafter Sen, US 2011/0040706 A1) in view of Li et al. (hereinafter Li, “An Attention-Based CNN with Batch Normalization Model for Network Intrusion Detection” NPL 2021).
Regarding Claim 4, Tarighat-Su-Frantz-Sen discloses claim 1 as set forth above.
However Tarighat-Su-Frantz-Sen does not explicitly disclose wherein the neural network model comprises a first analysis component and a second analysis component; and inputting the plurality of subsequence features into the neural network model to extract the preset pattern features comprises: inputting the plurality of subsequence features into a convolutional layer and a Batch Norm layer of the first analysis component to output a first local feature vector, connecting the first local feature vector with the plurality of subsequence features, and inputting it into a max pooling layer of the first analysis component to output a first local pattern feature; and inputting the first local pattern feature into a convolutional layer and a Batch Norm layer of the second analysis component to output a second local feature vector, connecting the second local feature vector with the first local feature vector, and inputting it into a max pooling layer of the second analysis component to output a second local pattern feature.
Li discloses wherein the neural network model comprises a first analysis component and a second analysis component (Li: pg. 3532 attentioned-based cnn with bath normalization Fig. 2 pg 3533 Fig. 2 is a convolutional neural network model type called ACNNBN, and including convolution layer to max pooling layer 3x3x32 to 2x2x32 steps is the first analysis component, the convolution layer to the max pooling layer in the 3x3x64 to 2x2x64 is the second component); and
inputting the plurality of subsequence features into the neural network model to extract the preset pattern features comprises: inputting the plurality of subsequence features into a convolutional layer (Li: Convolution layer 3x3x32) and a Batch Norm layer (Li: Fig. 2 the first Batch Norm layer after the convolution layer) of the first analysis component to output a first local feature vector (Li: pg. 3533 “In ACNNBN, the input layer obtains the pixel matrix of input image as the input data. Let WM×M×D×N represent the convolutional filter, with size of M × M × D. Where, D is the number of input channels, N denotes the number of output channels. YH1×W1×N expresses the output matrix, H1 and W1 of the height and width of Y respectively….A batch normalization is appended after each convolution module to prevent vanishing gradient, and accelerate model convergence. Assume that the input of the batch normalization is X = [x1,1,…,x1,n;…;xm,1,…,xm,n], where xi,j represents a sample, and m × n is the batch size. The output of batch normalization is shown in Eq.3.” the features are input into the convolution layer, and the output of the convolution is input into the batch norm layer.),
connecting the first local feature vector with the plurality of subsequence features (Li: pg. 3533 “A batch normalization is added after the convolution layer to solve the problems caused by the offset and increase of input data. Furthermore, we integrate CBAM into CNN architecture . The output which comes from the attention module will superimpose on the output of batch normalization by element-wise summation.” Fig. 2, the input is connected to the output of the batch norm layer), and
inputting it into a max pooling layer of the first analysis component to output a first local pattern feature (Li: pg. 3533 Fig. 2 “We select the max pooling layer to condense data and parameters, and diminish the dimension of the input attribute.” The combined input and output of the convolution and batch norm layers are input into the max pooling layer 2x2x32 in Fig. 2); and
inputting the first local pattern feature into a convolutional layer (Li: pg. 3533 Fig. 2 convolution layer 3x3x64) and a Batch Norm layer (Li: pg. 3533 Fig. 2 bath norm after the convolution layer) of the second analysis component to output a second local feature vector (Li: pg. 3533 “In ACNNBN, the input layer obtains the pixel matrix of input image as the input data. Let WM×M×D×N represent the convolutional filter, with size of M × M × D. Where, D is the number of input channels, N denotes the number of output channels. YH1×W1×N expresses the output matrix, H1 and W1 of the height and width of Y respectively….A batch normalization is appended after each convolution module to prevent vanishing gradient, and accelerate model convergence. Assume that the input of the batch normalization is X = [x1,1,…,x1,n;…;xm,1,…,xm,n], where xi,j represents a sample, and m × n is the batch size. The output of batch normalization is shown in Eq.3.” the output from the first half of Fig. 2 are input into the convolution layer 3x3x64, and the output of the convolution is input into the batch norm layer to obtain the resulting features after the second batch norm.),
connecting the second local feature vector with the first local feature vector (Li: pg. 3533 “A batch normalization is added after the convolution layer to solve the problems caused by the offset and increase of input data. Furthermore, we integrate CBAM into CNN architecture . The output which comes from the attention module will superimpose on the output of batch normalization by element-wise summation.” Fig. 2, the input, i.e. the output from the first convolution, batch norm and max pool, is connected to the output of the second batch norm layer), and
inputting it into a max pooling layer of the second analysis component to output a second local pattern feature (Li: pg. 3533 Fig. 2 “We select the max pooling layer to condense data and parameters, and diminish the dimension of the input attribute.” The combined input and output of the second convolution and batch norm layers are input into the max pooling layer 2x2x64 in Fig. 2).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat-Su-Frantz-Sen with Li in order to incorporate wherein the neural network model comprises a first analysis component and a second analysis component; and inputting the plurality of subsequence features into the neural network model to extract the preset pattern features comprises: inputting the plurality of subsequence features into a convolutional layer and a Batch Norm layer of the first analysis component to output a first local feature vector, connecting the first local feature vector with the plurality of subsequence features, and inputting it into a max pooling layer of the first analysis component to output a first local pattern feature; and inputting the first local pattern feature into a convolutional layer and a Batch Norm layer of the second analysis component to output a second local feature vector, connecting the second local feature vector with the first local feature vector, and inputting it into a max pooling layer of the second analysis component to output a second local pattern feature.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improving efficiency and accuracy of network traffic feature analysis (Li: abstract).
Regarding Claim 9, it does not recite nor further define over the limitations of claim 4. Therefore the supporting rationale for the rejection to claim 4 applies equally as well to that of claims 9.
Claim(s) 5, 10, is/are rejected under 35 U.S.C. 103 as being unpatentable over Tarighat (US 2023/0224277 A1) in view of Su et al. (hereinafter Su, “Design and Implementation of Web Page Classification Method Based on XLNet Fusing Hierarchical Attention and CNN” NPL September 2022) in view of Frantz et al. (hereinafter Frantz, US 2011/0302653 A1) further in view of Sen et al. (hereinafter Sen, US 2011/0040706 A1) in view of Li et al. (hereinafter Li, “An Attention-Based CNN with Batch Normalization Model for Network Intrusion Detection” NPL 2021) in view of Li el al. (hereinafter Li2, “Residual attention graph convolutional network for web services classification” NPL 2021).
Regarding Claim 5, Tarighat-Su-Frantz-Sen -Li discloses claim 4 as set forth above.
However Tarighat-Su-Frantz-Sen -Li does not explicitly disclose wherein the target website identification model comprises a multi head top-m attention layer; analyzing the correlation of the preset pattern features by using the target website identification model to obtain the probability result of the target website being accessed comprises: obtaining a projection matrix of a head of a preset number based on the second local pattern feature and the multi head top-m attention layer, and obtaining an output result of the head of the preset number based on the projection matrix and a first preset formula; obtaining an output result of the multi head top-m attention layer based on the output result of the head of the preset number and a linear projection function and using a second preset formula; and obtaining the probability result of the target website being accessed by using a third preset formula and according to the output result of the multi head top-m attention layer and a preset network rule.
Li2 discloses wherein the target website identification model comprises a multi head top-m attention layer (Li2 pg. 47 “At the same time, this article introduces the multi-head attention model, which discusses the influence of different heads on the experimental results.” pg. 48 “Therefore, we introduced an attention mechanism to learn the importance of each node in the sampling node and aggregate the representation of these meaningful nodes to form node embedding.” A multi head top m attention layer is incorporated, see equation 3 in pg 48 showing top m, i..e k number of heads);
analyzing the correlation of the preset pattern features by using the target website identification model to obtain the probability result of the target website being accessed comprises: obtaining a projection matrix of a head of a preset number based on the second local pattern feature and the multi head top-m attention layer (Li2: pg. 48 equation 1 “A shared parameter W linear mapping augments the features of the vertices, of course, this is a common feature augmentation method. The feature augmentation process is as follows:[[equation (1)]] are the original feature of node i and the feature after augments” equation 1 is used by the multi head top m attention layer to calculate a projection matrix of the features, the projection matrix being hi’, the second local pattern feature being hi.), and
obtaining an output result of the head of the preset number based on the projection matrix and a first preset formula (Li2: pg. 48 “After that, we use the multi-head attention mechanism to learn the weights between sampling nodes. This mechanism can perform K linear transformations on the same node. Each linear transformation is considered to be a header calculation, and parameter W between the header calculations is different. Each calculation process is as follows: [[equation (2)]]” equation 2 is the first preset formula that obtains an output result headijk using an attention function with the hi’ as input);
obtaining an output result of the multi head top-m attention layer based on the output result of the head of the preset number and a linear projection function and using a second preset formula (Li2: pg 48-49 “The results of kth calculations are spliced, and a linear transformation is performed to obtain the value of multi-head attention. The calculation process is as follows: [[equation (3)]] where k is a splicing operation. At the same time, the formula also shows that the attention of the importance of the node pair (i; j) depends on their own characteristics.” Equation 3 is the second preset formula used that performs a linear projection function for the output of the multi head top-m attention layer for k number of heads); and
obtaining the probability result of the target website being accessed by using a third preset formula and according to the output result of the multi head top-m attention layer and a preset network rule (Li2: pg. 476 left column “a new web service classification model named RAGCN is proposed in this paper.” pg. 47 “In RAGCN, convolution is divided into two parts, one part is sampling, i.e., neighborhood nodes are obtained by constructing neighborhoods; the other part is aggregation information, i.e., using aggregation functions to aggregate information about neighborhood nodes to obtain the embedding of target nodes.” Pg. 49 “After obtaining the importance between the node pairs, we normalize them through softmax function to obtain the weight coefficient aig” pg. 50 algorithm 1. The end of the sampling portion, equations 1-4 the output a, is then used to aggregate the information in order to obtain the embedding result Z. Equation 4 being the third preset equation, the output of the multihead top m attention layer being a the regularized attention values in algorithm 1, the Z function being the preset network rule that aggregates the multiple attention values. The embedding result Z represents the classification of the webservice as an outcome of RAGCN.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Tarighat-Su-Frantz-Sen -Li with that of Li2 in order to incorporate wherein the target website identification model comprises a multi head top-m attention layer; analyzing the correlation of the preset pattern features by using the target website identification model to obtain the probability result of the target website being accessed comprises: obtaining a projection matrix of a head of a preset number based on the second local pattern feature and the multi head top-m attention layer, and obtaining an output result of the head of the preset number based on the projection matrix and a first preset formula; obtaining an output result of the multi head top-m attention layer based on the output result of the head of the preset number and a linear projection function and using a second preset formula; and obtaining the probability result of the target website being accessed by using a third preset formula and according to the output result of the multi head top-m attention layer and a preset network rule, and apply this concept to the probability result of a target website being accessed as described in Tarighat-Su-Frantz-Li.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved classification accuracy (Li2: conclusion pg. 55).
Regarding Claims 10 it does not recite nor further define over the limitations of claim 5, therefore the supporting rationale for the rejection to claim 5 applies equally as well to that of claims 10.
Claim(s) 11 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tarighat (US 2023/0224277 A1) in view of Su et al. (hereinafter Su, “Design and Implementation of Web Page Classification Method Based on XLNet Fusing Hierarchical Attention and CNN” NPL September 2022) further in view of Sen et al. (hereinafter Sen, US 2011/0040706 A1).
Regarding Claim 11, Tarighat discloses A non-transitory computer-readable storage medium having stored therein instructions that, when executed by a processor (Tarighat: para.0018, para.0035, para.0051, Fig. 1 the memory and processor of the networks operation center 105), causes the processor to:
obtain browsed network traffic packets of a website to be identified (Tarighat: para.0051 “ The network layer security system 110 monitors metadata of the TCP/IP traffic transmitted to and received from the user's individually-owned electronic device (step 302) and determines whether there is an anomaly in the metadata (step 304)” browsing traffic is monitored), and
extract direction sequence features from the browsed network traffic packets (Tarighat: para.0051 “For example, the metadata may indicate that the user's individually-owned electronic device 101 is transmitting data to and/or receiving data from a server 122 that is known to be compromised or known to contain malicious code.” To and from, i.e. directional, metadata is extracted from the packets.);
analyze a correlation of the features using a target website identification model to obtain a probability result of a target website being accessed (Tarighat: para.0031 “The network layer security system 110 uses both known databases of connections as well as machine learning to determine if a connection is likely to be malicious. When a phishing connection is detected, the user is blocked from opening the link, displaying the website, or transmitting data; even if the connection is not made directly by the user and instead by an application.” Para.0033 “The network layer security system 110 also detects connections to malicious websites by analyzing known databases of such sites and machine learning to detect similar potential threats…. The user and monitoring staff are also notified when the connection to the malicious website was not made by the user but rather by some other application or malware. ” It is determined how likely the traffic is to a malicious website, i.e. a target website.); and
obtain a target website identification result in the website to be identified based on the probability result and a preset classification model.
However Tarighat does not explicitly disclose divide the direction sequence features into a plurality of subsequence features based on a plurality of sliding windows, and input the plurality of subsequence features into a neural network model to extract preset pattern features; analyze a correlation of the preset pattern features using a target website identification model to obtain a probability result of a target website being accessed; and obtain a target website identification result in the website to be identified based on the probability result and a preset classification model; wherein the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included in the target website.
Su discloses divide the direction sequence features into a plurality of subsequence features based on a plurality of sliding windows (Su: pg. 57 3.2.3 CNN layer “CNN Layer. The core idea of CNN is to capture local features, which for text are sliding windows consisting of several words, similar to n-gram.” A sliding window operation is used to divide the input data several words at a time. The resulting groups of every sliding window are the plurality of subsequence features.), and
input the plurality of subsequence features into a neural network model to extract preset pattern features (Su: pg. 57 3.2.3 CNN layer “A convolution operation is performed on a window 𝑥𝑖:𝑖+ℎ−1 using a convolution kernel to produce a feature map 𝑐𝑖 … The final feature map is represented as 𝑐 = [𝑐1, 𝑐2, ..., 𝑐𝑛−ℎ+1 ], and then use the maximum pooling operation for each feature map to filter features and perform feature fusion to obtain local features:” the preset pattern feature is the local features);
analyze a correlation of the preset pattern features using a target website identification model (Su: abstract “we propose a web page classification model XLNet-HAC based on the pre-trained model XLNet fusing Hierarchical Attention and CNN. F”) to obtain a probability result of a target website being accessed (Examiner notes that in claim 5 the target website identification model is an attention layer, and in para.0083 of applicant specification, the attention layer incorporates a softmax operation. Su: pg. 57 3.2.4 Fusion output layer “The XLNet-HAC model extracts the higher-order global features and local features of the web text using the Hierarchical Attention layer and CNN layer respectively, and uses the two features as the input of the fully connected layer, which uses ReLU as the activation function and adds the dropout mechanism to prevent overfitting, then the output of the fully connected layer is applied to the softmax classifier. Finally, the results of the softmax classifier are fused to obtain the final classification results. The specific result fusion strategy is as follows:… where 𝑜𝑢𝑡𝑝𝑢𝑡1 is the feature vector of the CNN layer output, 𝑜𝑢𝑡𝑝𝑢𝑡2 is the feature vector of the Hierarchical Attention layer output, 𝑝1 and 𝑝2are the probabilities of the corresponding categories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively, and the final category probability 𝑝 is obtained by taking the arithmetic average of 𝑝1 and 𝑝2” the correlation of the preset pattern features, i.e. the local features, is done using a softmax operation, the target website identification model, which results in a probability output using p1 result in equation 12. ); and
obtain a target website identification result in the website to be identified based on the probability result and a preset classification model (Su: abstract “we propose a web page classification model XLNet-HAC based on the pre-trained model XLNet fusing Hierarchical Attention and CNN. F”) based on the probability result and a preset classification model (Su: pg. 57 “where 𝑜𝑢𝑡𝑝𝑢𝑡1 is the feature vector of the CNN layer output, 𝑜𝑢𝑡𝑝𝑢𝑡2 is the feature vector of the Hierarchical Attention layer output, 𝑝1 and 𝑝2are the probabilities of the corresponding categories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively, and the final category probability 𝑝 is obtained by taking the arithmetic average of 𝑝1 and 𝑝2” pg. 55 Method “The second is to use the pretrained model XLNet to generate word vectors, then input word vectors into deep learning model for training, finally make predictions to obtain the final classification results.” equation 12 combines the probability result in equation 12 of the CNN result, and combines it with the result of another model, the hierarchical attention layer, the preset classification model. This results in a probability result of classification for the web service);
wherein the preset classification model configured to identify whether each website is included the target website (Sen: pg. 55 “The web page classification method proposed in this paper mainly consists of two parts. The first is data acquisition and pre-processing. Using URLs to obtain its corresponding HTML and extract the body, title and keywords of web pages text, transforming the semistructured data into structured data. The second is to use the pretrained model XLNet to generate word vectors, then input word vectors into deep learning model for training, finally make predictions to obtain the final classification results.” Pg. 56 Fig. 2 left side, pg. 57 “𝑜𝑢𝑡𝑝𝑢𝑡2 is the feature vector of the Hierarchical Attention layer output, 𝑝1 and 𝑝2are the probabilities of the corresponding categories obtained by using the softmax classifier for the hierarchical attention layer and the CNN layer, respectively,” hierarchical attention layer the left hand side of Fig. 2 is the preset classification model that identifies classification of webpages).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat with Su in order to incorporate divide the direction sequence features into a plurality of subsequence features based on a plurality of sliding windows, and input the plurality of subsequence features into a neural network model to extract preset pattern features; analyze a correlation of the preset pattern features using a target website identification model to obtain a probability result of a target website being accessed; and obtain a target website identification result in the website to be identified based on the probability result and a preset classification model, wherein the preset classification model configured to identify whether each website is included the target website, and apply this concept to the website classification of Tarighat.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy in classification of web pages (Su: abstract)
However Tarighat-Su does not explicitly disclose wherein the preset classification model comprises a plurality of binary classifiers configured to identify whether each website is included the target website.
Sen discloses wherein the preset classification model comprises a plurality of binary classifiers configured to classify web traffic (Sen: para.0076 “In step 234, the binary classifiers 104 generate a set of output scores using the feature set as input for the plurality of binary classifiers 104. The plurality of binary classifiers 104 are configured to operate in parallel, each binary classifier 104 associated with one of k traffic classes.” Para.0077 “Each estimated class probability value indicates an estimated probability that the packet flow on which the output score is based belongs to the traffic class associated the respective binary classifier 104 and associated calibrator 106.” A plurality of binary classifiers are used to classify the incoming traffic.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat-Su with that of Sen in order to incorporate wherein the preset classification model comprises a plurality of binary classifiers configured to classify web traffic, and apply the concept of a plurality of binary classifiers to the website identification of Tarighat-Su.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy in classification of traffic (Sen: para.0004).
Claim(s) 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tarighat (US 2023/0224277 A1) in view of Su et al. (hereinafter Su, “Design and Implementation of Web Page Classification Method Based on XLNet Fusing Hierarchical Attention and CNN” NPL September 2022) further in view of Sen et al. (hereinafter Sen, US 2011/0040706 A1) in view of Song et al. (hereinafter Song, US 2017/0085531 A1).
Regarding Claim 13, Tarighat-Su-Sen discloses claim 11 as set forth above.
However Tarighat does not explicitly disclose wherein the processor is configured to: splice the direction sequence features to obtain a traffic loop feature; and segment the traffic loop feature from different positions by using the plurality of sliding windows to obtain the plurality of subsequence features.
Su discloses wherein the processor is configured to: splice the direction sequence features to obtain a traffic feature (Su: pg. 56 Fig. 2 the XLNET embedding step creates a plurality of segments of features SegN+1 features); and
segment the traffic feature from different positions by using the plurality of sliding windows to obtain the plurality of subsequence features (Su: pg. 56 Fig. 2 the segN+1 features are input into the CNN to generate subsequence features, the features prior to feature fusion. pg. 57 3.2.3 CNN layer “A convolution operation is performed on a window 𝑥𝑖:𝑖+ℎ−1 using a convolution kernel to produce a feature map 𝑐𝑖 : 𝑐𝑖 = 𝑓 (𝑤 ∗ 𝑥𝑖:𝑖+ℎ−1 + 𝑏) (11) where 𝑓 is a nonlinear function, ∗ denotes the dot product operation in the elemental way, 𝑥𝑖:𝑖+ℎ−1 represents a window of size ℎ × 768 consisting of rows 𝑖 to 𝑖 + ℎ − 1 of the input matrix, stitched by 𝑥𝑖 , 𝑥𝑖+1, ..., 𝑥𝑖:𝑖+ℎ−1 , 𝑤 is the size of ℎ × 768 weight matrix, ℎ denotes the number of words in the window, and 𝑏 is the bias parameter. The final feature map is represented as 𝑐 = [𝑐1, 𝑐2, ..., 𝑐𝑛−ℎ+1 ], and then use the maximum pooling operation for each feature map to filter features and perform feature fusion to obtain local features.” A sliding window operation is used to divide the input data several words at a time. The resulting groups of every sliding window are the plurality of subsequence features. Each window results in a different position of the feature.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat with Su in order to incorporate wherein the processor is configured to: splice the direction sequence features to obtain a traffic feature; and segment the traffic feature from different positions by using the plurality of sliding windows to obtain the plurality of subsequence features.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy in classification of web pages (Su: abstract).
However Tarighat-Su-Sen does not explicitly disclose wherein the processor is configured to: splice the direction sequence features to obtain a traffic loop feature; and segment the traffic loop feature from different positions by using the plurality of sliding windows to obtain the plurality of subsequence features.
Song discloses wherein the processor is configured to: splice the direction sequence features to obtain a traffic loop feature (Song: Fig. 3, para.0028 “FIG. 3 is a schematic flow diagram of another embodiment of a process for identifying network loops.” Para.0029 “In 310, the traffic cleaning equipment determines a first data packet having a TTL that is less than or equal to a first preset threshold value or at least meets a first condition from among diverted network traffic, and determines a destination IP address of the first data packet.” Para.0030 “In 320, the traffic cleaning equipment records the destination IP address of the first data packet in an IP address list used to monitor network loops. In this example, the traffic cleaning equipment maintains the IP address list which tracks the destination IP addresses of packets, and examines the IP addresses of packets that are diverted to the traffic cleaning equipment. If a packet has a destination IP address that is not in the list, this packet is deemed to be a first data packet, and its destination IP address is recorded in the list.” Para.0033 “In 350, in the event that the set number of TTLs that are reduced to the second preset threshold value exists among the multiple TTLs corresponding to the multiple second data packets, the traffic cleaning equipment determines that a network loop exists for the destination IP address.” Based on the analyzing packet features, i.e. destination ip, the packets are spliced, i.e. packets are separated into a list, to identify a network loop to identify an attack in para.0059).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat-Su-Sen with Son in order to incorporate splice the direction sequence features to obtain a traffic loop feature, such that the traffic loop feature is spliced and segmented by the process of Su.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved network security by identifying malicious traffic (Son: para.0003).
Claim(s) 14 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tarighat (US 2023/0224277 A1) in view of Su et al. (hereinafter Su, “Design and Implementation of Web Page Classification Method Based on XLNet Fusing Hierarchical Attention and CNN” NPL September 2022) further in view of Sen et al. (hereinafter Sen, US 2011/0040706 A1) in view of Li et al. (hereinafter Li, “An Attention-Based CNN with Batch Normalization Model for Network Intrusion Detection” NPL 2021).
Regarding Claim 14, Tarighat-Su-Sen discloses claim 11 as set forth above.
However Tarighat-Su-Sen does not explicitly disclose wherein the processor is configured to: input the plurality of subsequence features into a convolutional layer and a Batch Norm layer of a first analysis component to output a first local feature vector, connect the first local feature vector with the plurality of subsequence features, and input it into a max pooling layer of the first analysis component to output a first local pattern feature; and input the first local pattern feature into a convolutional layer and a Batch Norm layer of a second analysis component to output a second local feature vector, connect the second local feature vector with the first local feature vector, and input it into a max pooling layer of the second analysis component to output a second local pattern feature.
Li discloses wherein the processor is configured to: input the plurality of subsequence features into a convolutional layer (Li: Convolution layer 3x3x32) and a Batch Norm layer (Li: Fig. 2 the first Batch Norm layer after the convolution layer) of a first analysis component to output a first local feature vector (Li: pg. 3533 “In ACNNBN, the input layer obtains the pixel matrix of input image as the input data. Let WM×M×D×N represent the convolutional filter, with size of M × M × D. Where, D is the number of input channels, N denotes the number of output channels. YH1×W1×N expresses the output matrix, H1 and W1 of the height and width of Y respectively….A batch normalization is appended after each convolution module to prevent vanishing gradient, and accelerate model convergence. Assume that the input of the batch normalization is X = [x1,1,…,x1,n;…;xm,1,…,xm,n], where xi,j represents a sample, and m × n is the batch size. The output of batch normalization is shown in Eq.3.” the features are input into the convolution layer, and the output of the convolution is input into the batch norm layer.),
connect the first local feature vector with the plurality of subsequence features (Li: pg. 3533 “A batch normalization is added after the convolution layer to solve the problems caused by the offset and increase of input data. Furthermore, we integrate CBAM into CNN architecture . The output which comes from the attention module will superimpose on the output of batch normalization by element-wise summation.” Fig. 2, the input is connected to the output of the batch norm layer),
and input it into a max pooling layer of the first analysis component to output a first local pattern feature (Li: pg. 3533 Fig. 2 “We select the max pooling layer to condense data and parameters, and diminish the dimension of the input attribute.” The combined input and output of the convolution and batch norm layers are input into the max pooling layer 2x2x32 in Fig. 2); and
input the first local pattern feature into a convolutional layer (Li: pg. 3533 Fig. 2 convolution layer 3x3x64) and a Batch Norm layer (Li: pg. 3533 Fig. 2 bath norm after the convolution layer) of a second analysis component to output a second local feature vector (Li: pg. 3533 “In ACNNBN, the input layer obtains the pixel matrix of input image as the input data. Let WM×M×D×N represent the convolutional filter, with size of M × M × D. Where, D is the number of input channels, N denotes the number of output channels. YH1×W1×N expresses the output matrix, H1 and W1 of the height and width of Y respectively….A batch normalization is appended after each convolution module to prevent vanishing gradient, and accelerate model convergence. Assume that the input of the batch normalization is X = [x1,1,…,x1,n;…;xm,1,…,xm,n], where xi,j represents a sample, and m × n is the batch size. The output of batch normalization is shown in Eq.3.” the output from the first half of Fig. 2 are input into the convolution layer 3x3x64, and the output of the convolution is input into the batch norm layer to obtain the resulting features after the second batch norm.),
connect the second local feature vector with the first local feature vector (Li: pg. 3533 “A batch normalization is added after the convolution layer to solve the problems caused by the offset and increase of input data. Furthermore, we integrate CBAM into CNN architecture . The output which comes from the attention module will superimpose on the output of batch normalization by element-wise summation.” Fig. 2, the input, i.e. the output from the first convolution, batch norm and max pool, is connected to the output of the second batch norm layer), and
input it into a max pooling layer of the second analysis component to output a second local pattern feature (Li: pg. 3533 Fig. 2 “We select the max pooling layer to condense data and parameters, and diminish the dimension of the input attribute.” The combined input and output of the second convolution and batch norm layers are input into the max pooling layer 2x2x64 in Fig. 2).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Tarighat-Su-Sen with Li in order to incorporate wherein the processor is configured to: input the plurality of subsequence features into a convolutional layer and a Batch Norm layer of a first analysis component to output a first local feature vector, connect the first local feature vector with the plurality of subsequence features, and input it into a max pooling layer of the first analysis component to output a first local pattern feature; and input the first local pattern feature into a convolutional layer and a Batch Norm layer of a second analysis component to output a second local feature vector, connect the second local feature vector with the first local feature vector, and input it into a max pooling layer of the second analysis component to output a second local pattern feature.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improving efficiency and accuracy of network traffic feature analysis (Li: abstract).
Claim(s) 15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Tarighat (US 2023/0224277 A1) in view of Su et al. (hereinafter Su, “Design and Implementation of Web Page Classification Method Based on XLNet Fusing Hierarchical Attention and CNN” NPL September 2022) further in view of Sen et al. (hereinafter Sen, US 2011/0040706 A1) in view of Li et al. (hereinafter Li, “An Attention-Based CNN with Batch Normalization Model for Network Intrusion Detection” NPL 2021) in view of Li el al. (hereinafter Li2, “Residual attention graph convolutional network for web services classification” NPL 2021).
Regarding Claim 15, Tarighat-Su-Sen-Li discloses claim 14 as set forth above.
However Tarighat-Su-Frantz-Li does not explicitly disclose wherein the processor is configured to: obtain a projection matrix of a head of a preset number based on the second local pattern feature and a multi head top-m attention layer, and obtain an output result of the head of the preset number based on the projection matrix and a first preset formula;obtain an output result of the multi head top-m attention layer based on the output result of the head of the preset number and a linear projection function and using a second preset formula; and obtain the probability result of the target website being accessed by using a third preset formula and according to the output result of the multi head top-m attention layer and a preset network rule.
Li2 discloses wherein the processor is configured to: obtain a projection matrix of a head of a preset number based on the second local pattern feature and a multi head top-m attention layer (Li2: pg. 48 equation 1 “A shared parameter W linear mapping augments the features of the vertices, of course, this is a common feature augmentation method. The feature augmentation process is as follows:[[equation (1)]] are the original feature of node i and the feature after augments” equation 1 is used by the multi head top m attention layer to calculate a projection matrix of the features, the projection matrix being hi’, the second local pattern feature being hi.),
and obtain an output result of the head of the preset number based on the projection matrix and a first preset formula (Li2: pg. 48 “After that, we use the multi-head attention mechanism to learn the weights between sampling nodes. This mechanism can perform K linear transformations on the same node. Each linear transformation is considered to be a header calculation, and parameter W between the header calculations is different. Each calculation process is as follows: [[equation (2)]]” equation 2 is the first preset formula that obtains an output result headijk using an attention function with the hi’ as input);
obtain an output result of the multi head top-m attention layer based on the output result of the head of the preset number and a linear projection function and using a second preset formula (Li2: pg 48-49 “The results of kth calculations are spliced, and a linear transformation is performed to obtain the value of multi-head attention. The calculation process is as follows: [[equation (3)]] where k is a splicing operation. At the same time, the formula also shows that the attention of the importance of the node pair (i; j) depends on their own characteristics.” Equation 3 is the second preset formula used that performs a linear projection function for the output of the multi head top-m attention layer for k number of heads); and
obtain the probability result of the target website being accessed by using a third preset formula and according to the output result of the multi head top-m attention layer and a preset network rule (Li2: pg. 476 left column “a new web service classification model named RAGCN is proposed in this paper.” pg. 47 “In RAGCN, convolution is divided into two parts, one part is sampling, i.e., neighborhood nodes are obtained by constructing neighborhoods; the other part is aggregation information, i.e., using aggregation functions to aggregate information about neighborhood nodes to obtain the embedding of target nodes.” Pg. 49 “After obtaining the importance between the node pairs, we normalize them through softmax function to obtain the weight coefficient aig” pg. 50 algorithm 1. The end of the sampling portion, equations 1-4 the output a, is then used to aggregate the information in order to obtain the embedding result Z. Equation 4 being the third preset equation, the output of the multihead top m attention layer being a the regularized attention values in algorithm 1, the Z function being the preset network rule that aggregates the multiple attention values. The embedding result Z represents the classification of the webservice as an outcome of RAGCN.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Tarighat-Su-Sen-Li with that of Li2 in order to incorporate wherein the processor is configured to: obtain a projection matrix of a head of a preset number based on the second local pattern feature and a multi head top-m attention layer, and obtain an output result of the head of the preset number based on the projection matrix and a first preset formula;obtain an output result of the multi head top-m attention layer based on the output result of the head of the preset number and a linear projection function and using a second preset formula; and obtain the probability result of the target website being accessed by using a third preset formula and according to the output result of the multi head top-m attention layer and a preset network rule, and apply this concept to the probability result of a target website being accessed as described in Tarighat-Su-Li.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved classification accuracy (Li2: conclusion pg. 55).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Akhtar US 2023/0344842 A1 para.0030 anomaly detection using a sliding window of feature vectors.
Tsykynovskyy US 2020/0050707 A1 para.0009, para.0031 website classification.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to EUI H KIM whose telephone number is (571)272-8133. The examiner can normally be reached 7:30-5 M-R, M-F alternating.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamal B Divecha can be reached at 5712725863. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/EUI H KIM/ Examiner, Art Unit 2453
/KAMAL B DIVECHA/ Supervisory Patent Examiner, Art Unit 2453
Prosecution Insights