DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Action is in response to communications filed 1/22/26.
Claims 1-20 are pending.
Response to Arguments
Applicant's arguments filed 01/22/26 have been fully considered but they are not persuasive.
In the response filed, applicant argues in substance that:
The claimed embodiments are directed to using a trained artificial intelligence (AI) system to select traffic flows through a production communications network that are to be replicated to a digital twin for further analysis. As explained in paragraph [0036] of the as-filed specification, by training model 250 using training data 220, replication logic 200 may be configured so that the "top talker" or "talkers" in the physical network 110 are not simply being mirrored, but the entropy of network communications, including "one off," sporadic, or rarely observed data patterns, have an opportunity to be transmitted to digital twin 120. That is, as also noted in paragraph [0013] of the as-filed specification, "although just a small portion of the overall production traffic flows may be replicated to the digital twin, e.g., perhaps in a ratio of 1:50, that selected portion is configured to best represent, for purposes of digital twin analysis, the production traffic. This approach allows for ongoing and dynamic replication of real production traffic."
In this regard, independent claim 1 of the present application has been amended to recite using an artificial intelligence system that has been trained on traffic flows through the production communications network, identifying selected traffic flows that represent an entropy of the traffic flows through the production communications network; replicating the selected traffic flows to obtain replicated selected traffic flows; and forwarding the replicated selected traffic flows to the digital twin of the production communications network for analysis.
Applicant respectfully submits that to establish a prima facie case of obviousness, three basic criteria must be met. First, there must be some suggestion or motivation, either in the references themselves or in the knowledge generally available to one of ordinary skill in the art, to modify the reference or to combine reference teachings. Second, there must be a reasonable expectation of success. Third, the prior art reference (or references when combined) must teach or suggest all of the claim limitations.
It is respectfully submitted that the rejected claims are patentable over the art of record based on at least the third criterion of obviousness: none of the references alone or in combination teach, suggest, or disclose each claim limitation of the independent claims. That is, none of the cited references teaches, suggests, or discloses "using an artificial intelligence system that has been trained on traffic flows through the production communications network, identifying selected traffic flows that represent an entropy of the traffic flows through the production communications network."
Humphrey discloses using ML model that has been trained on normal, benign behavior of a network to identify abnormal behavior in the network….Such traffic flows need not be “abnormal” in any way (Remarks, pg. 6-8).
In response to argument a, examiner respectfully disagrees.
First, it should be noted that “although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims”. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Applicant cited various citations from the specification, e.g. [0036], [0013], however, these teachings are not recited in the claim.
Claim 1 mere recites “…identifying…traffic flows that represent an entropy of the traffic flows through the production communications network…”
Neither claim 1 nor the specification defines the term “entropy of the traffic flows”.
In fact, the term “entropy” only appears in paragraph [0036] which states “…but the entropy of network communications, including “one off”, “sporadic” or rarely observed data patterns…”.
The term “sporadic” is defined as: “events or things that occur irregularly or scattered intervals or in isolated outbursts” or something that happens occasionally and without a regular schedule.
In this case, applicant has acknowledged that Humphrey discloses using ML model that has been trained on normal, benign behavior of a network to identify abnormal behavior in the network, see remarks above.
The identified “abnormal behavior traffic pattern” is considered “one off” or “sporadic” traffic pattern because the abnormal behavior does not occur regularly or something that happens at regular schedule or intervals. The abnormal traffic can happen at any time without a specific interval.
As such, Humphrey is said to teach “…identifying…traffic flows that represent an entropy of the traffic flows through the production communications network…”, for example at [126-127, 136-137].
Humphrey also teaches after identifying the abnormal behavior or traffic, send the traffic for further analysis to either human analyst or machine learning system [0022-0023], [0138, 0145].
Humphrey does not teach digital twin of the productions network; however, Lee is used to show the digital twin, see corrected mapping below.
Therefore, Humphrey does teach using an artificial intelligence system, identifying selected traffic flows that represent an entropy of the traffic flows through the production communications network.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim 1, 6, 9-11 and 16-17 are rejected under 35 U.S.C. 103 as being unpatentable over Milescu et al. (US 2018/0248714 A1, hereinafter Milescu) in view of Humphrey et al. (US 20230012220 A1, hereinafter Humphrey) further in view of Lee et al. (US 20240177005 A1, hereinafter Lee).
Regarding claim 1, Milescu teaches a method comprising:
operating a production communications network ([18]: The plurality of paths may traverse one or more networks, e.g., network(s) 104 a and/or 104 b. A network traffic flow associated with the connection may then be divided into one or more subflow(s) and each
subflow may be carried by a respective path. Network traffic flow corresponds to the flow of network traffic associated with a connection.);
monitoring traffic flows through the production communications network ([39]: Flow data may be captured at operation 204. For example, flow data may be captured from multipath proxy logic 140 by CTM logic 150. A network traffic flow and/or subflow may be identified at operation 206.);
Milescu however does not teach digital twin of the production network, use an artificial intelligence system that has been trained on traffic flows through the production communication network to identify selected traffic flows that represent an entropy of the traffic flows through the production communications network; replicating the selected traffic flows to obtain replicated selected traffic flows; and forwarding the replicated selected traffic flows to the digital twin of the production communications network for analysis.
Humphrey teaches using an artificial intelligence system that has been trained on traffic flows through the production communication network ([126-0127]: machine learning model is trained on a normal behavior traffic flow of the first network. The input data comes from sources such as raw IP traffic captured from an IP network, machine generated log files, IP flow traffic, etc.), identify selected traffic flows that represent an entropy of the traffic flows through the production communications network ([126-128, 136-137]: Receiving the first abnormal behavior pattern comprises comparing input data monitoring the first network to at least one machine-learning model trained on a normal benign behavior of the first network using a normal behavior benchmark describing parameters corresponding to a normal pattern of activity of the first network to determine that a network behavior of the first network deviates from the normal benign behavior of the first network (Block 602) (i.e. training ML model to determine abnormal behavior pattern on network traffic)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu to incorporate the teachings of Humphrey in order to use an artificial intelligence system that has been trained on traffic flows that represent an entropy of the traffic flows to identify selected traffic flows that represent an entropy of the traffic flows through the production communications network.
One of ordinary skilled in the art would have been motivated to combine the teachings in order for determination of potentially malicious behavior and determine to whether further action need be taken regarding the threat (Humphrey, [147]).
Milescu in view of Humphrey however does not teach replicating the selected traffic flows to obtain replicated selected traffic flows; and forwarding the replicated selected traffic flows to the digital twin of the production communications network for analysis.
Lee teaches operating a digital twin of the production communications network (Fig. 1(30) and [70]: When the presence of the requested AI/ML model is confirmed, the AI/ML model verification unit 110 may create a twin network that replicates the actual network based on the network configuration reference information received from the AI/ML model consumption function 10 S130);
replicating the selected traffic flows to obtain replicated selected traffic flows ([92-93]: The SMF 122 may generate at least one rule to be applied to the UPF 123 according to the policy generated by the PCF 121 and send the generated rule to the UPF 123. The UPF 123 may detect packet data according to the rule sent from the SMF 122, duplicate the detected packet data); and
forwarding the replicated selected traffic flows to the digital twin of the production communications network for analysis ([93]: The UPF 123 may detect packet data according to the rule sent from the SMF 122, duplicate the detected packet data, and forward the duplicated packet data to the digital twin network 30. [82]: The AI/ML model verification unit 110 may collect necessary information from twin instances within the digital twin network 30 through the network operation management unit 20 and/or from the actual network to measure the performance evaluation metric and the operational stability evaluation metric.).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey to incorporate the teachings of Lee and replicating the selected traffic flows to obtain replicated selected traffic flows, and forwarding the replicated selected traffic flows to a digital twin of the production communications network for analysis. One of ordinary skilled in the art would have been motivated to combine the teachings in order to measure the performance and the operational stability (Lee, [82]).
Regarding claim 6, Milescu in view of Humphrey and Lee teaches the method of claim 1. Humphrey teaches further comprising training the artificial intelligence system based on applications supported by the traffic flows through the production communications network ([60]: The cyber threat module uses the collected data to draw an understanding of the email activity and user activity in the network as well as updates a training for the one or more machine-learning models trained on this network and its users. For example, email traffic can be collected by putting hooks into the e-mail application, such as Outlook or Gmail, and/or monitoring the internet gateway from which the e-mails are routed through (i.e. training learning model based on applications and their traffic flows)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey and Lee to incorporate the teachings of Humphrey and training the artificial intelligence system based on applications supported by the traffic flows. One of ordinary skilled in the art would have been motivated to combine the teachings in order for determination of potentially malicious behavior (Humphrey, [147]).
Regarding claim 9, Milescu in view of Humphrey and Lee teaches the method of claim 1. Lee teaches wherein the digital twin is software based ([548]: The embodiments may also be implemented by a program that embodies the functions corresponding to the configurations of the embodiments of the present disclosure or by a recording medium recording the program. The program commands recorded in the computer-readable recording medium may be those designed and configured specifically for the present disclosure or may be those commonly available for those skilled in the field of computer software (i.e. digital twin is software based)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey and Lee to incorporate the teachings of Lee and the digital twin is software based. One of ordinary skilled in the art would have been motivated to combine the teachings in order to implement the digital twin (Lee, [548]).
Regarding claim 10, Milescu in view of Humphrey and Lee teaches the method of claim 1. Lee teaches wherein the selected traffic flows comprise a subset of the traffic flows through the production communications network ([91]: ] The PCF 121 may generate a policy for duplicating the entire or a portion of the network traffic of the actual network environment (a portion of the network traffic may be selected according to a predetermined policy) and forwarding the duplicated traffic to the digital twin network 30 (i.e. traffic accounts for portion of traffic flow selected according to a predetermined policy)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey and Lee to incorporate the teachings of Lee and the selected traffic flows comprise a subset of the traffic flows through the production communications network. One of ordinary skilled in the art would have been motivated to combine the teachings in order for duplicating a portion of the network traffic (Lee, [91]).
Regarding claim 11 and 17, they do not teach or further define over the limitations in claim 1. Therefore, claims 11 and 17 are rejected for the same reasons as set forth in claim 1.
Regarding Claim 16, they do not teach or further define over claim 6. Therefore, claim 16 is rejected for the same reason as set forth above in claim 6.
Claim 2-3, 7-8, 12-13 and 18-19 are rejected under 35 U.S.C. 103 as being unpatentable over Milescu in view of Humphrey and Lee further in view of Dechene et al. (US 20220245441 A1, hereinafter Dechene).
Regarding claim 2, Milescu in view of Humphrey and Lee teaches the method of claim 1.
Milescu in view of Humphrey and Lee however does not teach further comprising training the artificial intelligence system based on a profile of the digital twin.
Dechene teaches further comprising training the artificial intelligence system based on a profile of the digital twin ([32, 166]: Method 2000 further can include an activity 2040 of training the routing agent model on the digital twin network simulation using the reinforcement-learning model on traffic that flows through nodes of the digital twin network simulation (i.e. training AI system on twin network)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey and Lee to incorporate the teachings of Dechene and training the artificial intelligence system based on a profile of the digital twin. One of ordinary skilled in the art would have been motivated to combine the teachings in order to prioritize based on types of traffic (Dechene, [167]).
Regarding claim 3, Milescu in view of Humphrey, Lee and Dechene teaches the method of claim 2. Dechene teaches wherein the profile of the digital twin comprises information representative of at least one of memory capacity, processing power, or bandwidth of the digital twin (Fig. 2 and [73]: Digital twin 622 can be a functional representation of a real, physical computer network. For example, digital twin 622 can be a simulated representation of live network 601 (i.e. digital twin having memory and processing power as of real live network)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey, Lee and Dechene to incorporate the teachings of Dechene and the profile of the digital twin comprises information representative of at least one of memory capacity, processing power, or bandwidth of the digital twin. One of ordinary skilled in the art would have been motivated to combine the teachings in order to create more realistic training scenarios (Dechene, [74]).
Regarding claim 7, Milescu in view of Humphrey and Lee teaches the method of claim 1.
Milescu in view of Humphrey and Lee however does not teach further comprising training the artificial intelligence system based on a size of the production communications network.
Dechene teaches further comprising training the artificial intelligence system based on a size of the production communications network ([107-108]: To AI training based on flows, including source/destination addresses and the traffic type. Intelligent application classification can be performed through fingerprinting techniques on traffic data derived from network control system 315 (FIG. 3), which can go beyond simple flow identification. Identification can take observations from traffic collection, deep packet inspections, behavior analysis such as from traffic size and frequency (i.e. train AI traffic size and frequency from network, here traffic size is proportional to network size)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey and Lee to incorporate the teachings of Dechene and training the artificial intelligence system based on a size of the production communications network. One of ordinary skilled in the art would have been motivated to combine the teachings in order for behavior analysis (Dechene, [108]).
Regarding claim 8, Milescu in view of Humphrey and Lee teaches the method of claim 1.
Milescu in view of Humphrey and Lee however does not teach further comprising training the artificial intelligence system based on policies and configurations of the production communications network.
Dechene teaches further comprising training the artificial intelligence system based on policies and configurations of the production communications network ([82, 89]: The RL training environment can be based on a simulated digital-twin network topology provided by digital twin service 322, and can augmented with synthetic network traffic provided by network traffic service 323. Different configuration items such as network topologies, synthetic network traffic, training scenarios (such as node addition or failure), and AI hyper-parameters can be adjusted to customize (e.g., optimize) the agent model, such as through policy service 324. Training service 325 can be used to train the AI agent in the different scenarios. [106]: Training scenarios can include the ability to optimize scenarios based on policy. In this case, the policy can be the business policy that can apply to network behavior specifications, as defined by rewards configured through user interface system 310 (FIG. 3) (i.e. training AI based on policy and configuration of the network)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey and Lee to incorporate the teachings of Dechene and training the artificial intelligence system based on policies and configurations of the production communications network. One of ordinary skilled in the art would have been motivated to combine the teachings in order to train the AI agent in the different scenarios (Dechene, [56]).
Regarding Claims 12-13 and 18-19, they do not teach or further define over claims 2-3 respectively. Therefore, claims 12-13 and 18-18 are rejected for the same reason as set forth above in claims 2-4 respectively.
Claims 4, 14 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Milescu in view of Humphrey and Lee further in view of Feng et al. (US 20250080556A1, hereinafter Feng).
Regarding claim 4, Milescu in view of Humphrey and Lee teaches the method of claim 1.
Milescu in view of Humphrey and Lee however does not teach further comprising training the artificial intelligence system based on an industry to which the traffic flows through the production communications network pertain.
Feng teaches further comprising training the artificial intelligence system based on an industry to which the traffic flows through the production communications network pertain ([45]: System 100 (e.g., network traffic classifier 170, security platform 140, etc.) trains a classifier (e.g., a model) to detect (e.g., predict) traffic for applications. For example, system 100 trains a classifier to perform traffic classification (e.g., to classify traffic as malicious or benign/non-malicious). As another example, system 100 trains a classifier to determine whether a traffic sample corresponds to C2 traffic. [89]: In connection with training the classifier, prediction engine training module 235 collects a training set of samples. Samples in the training set may collected from one or more of (i) network traffic (e.g., monitored network traffic that was previously classified), (ii) a third-party service that provides a set of previously classified samples (e.g., a whitelist of benign samples, a blacklist of malicious samples, etc.) (i.e. training learning model based on different scenarios required in the industry)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey and Lee to incorporate the teachings of Feng and training the artificial intelligence system based on an industry to which the traffic flows pertain. One of ordinary skilled in the art would have been motivated to combine the teachings in order it to detect/predict traffic for applications (Feng, [45]).
Regarding Claims 14 and 20, they do not teach or further define over claim 4. Therefore, claims 14 and 20 are rejected for the same reason as set forth above in claim 4.
Claim 5 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Milescu in view of Humphrey, Lee and Feng further in view of Palermo et al. (US 11888730 B1, hereinafter Palermo).
Regarding claim 5, Milescu in view of Humphrey, Lee and Feng teaches the method of claim 4.
Milescu in view of Humphrey, Lee and Feng however does not teach wherein the industry is one of energy, healthcare, or banking.
Palermo teaches wherein the industry is one of energy, healthcare, or banking ([Col 20, 5-9]: The node operator 138 can train the model(s) 140 based on the state data 142 (e.g., historical state data), and then dynamically adjust the settings 144 of the node 112 based on the trained model(s) 140 to optimize routing through the decentralized network 104. [Col 41, 42-46]: The card payment network (e.g., the server(s) 1310 associated therewith) can forward the fund transfer request to an issuing bank (e.g., “issuer”). The issuer is a bank or financial institution that offers a financial account (e.g., credit or debit card account) to a user (i.e. the industry is banking industry)).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Milescu in view of Humphrey, Lee and Feng to incorporate the teachings of Palermo and the industry is banking. One of ordinary skilled in the art would have been motivated to combine the teachings in order it to optimize routing (Palermo, [Col 20, 9-10]).
Regarding Claim 15, they do not teach or further define over claim 5. Therefore, claim 15 is rejected for the same reason as set forth above in claim 5.
Additional References
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
a. Garcarz et al., US 12155532 B1: Using Machine Learning For Online Application Detection.
b. Saha et al., US 20230026463 A1: SYSTEMS AND METHODS FOR PREDICTING UNDETECTABLE FLOWS IN DEEP PACKET INSPECTION.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KAMAL B DIVECHA whose telephone number is 571-272-5863. The examiner can normally be reached IFP Normal Hours M-F: 8am-4.30pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Colleen Fauz can be reached at 5712721667. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
KAMAL B. DIVECHA
Primary Patent Examiner
Art Unit 2453
/KAMAL B DIVECHA/Supervisory Patent Examiner, Art Unit 2453
Prosecution Insights