Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
2. This action is in response to the Amendment filed October 23, 2025.
3. Claims 1-9 have been amended and new claims 10-20 have been added.
4. Claims 1-20 have been examined and are pending with this action.
Response to Arguments
5. Applicant’s arguments, see REMARKS (pgs. 11-12), filed October 23, 2025, with respect to the rejection of claims 1, 8, and 9, previously rejected under 35 U.S.C. 102(a)(1) and 102(a)(2) as being anticipated by Baidya et al. (US 2022/0303290 A1), herein referred to as Baidya, have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Wroczynski et al. (US 2019/0272317 A1), herein referred to as Wroczynski.
The applicant(s) seem to be relying on the basis that the claimed invention is novel because the machine learning model (herein a natural language processing model) applied in the invention is pre-trained using normal communication packets as learning data. Normal communication packets are merely data. Data does not patentably distinguish an invention. The input of non-normal communication packets, do not change the functionality nor the operation of the machine learning model (algorithm) or the detection device, but perhaps merely the output of the model.
Even still, Wroczynski has been cited to better teach the claim limitation as amended. The application of such a ML model is subjective and exchanging one model for another in application is not a novel method or nor a novel process.
For at least these reasons above and the rejections set forth below, claims 1-20 have been rejected and remain pending.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
6. Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over
Baidya et al. (US 2022/0303290 A1) in view of Wroczynski et al. (US 2019/0272317 A1).
INDEPENDENT:
As per claim 1, Baidya teaches a detection device comprising:
a feature value database configured to store data including a packet feature value, a label assigned to each packet feature value, and a threshold used for determination in advance;
a memory (see Baidya, [0056]: “As shown, the computing hardware 303 may include one or more processors 307, one or more memories 308, one or more storage components 309, and/or one or more networking components 310.”); and
a processor coupled to the memory (see Baidya, [0056]: “As shown, the computing hardware 303 may include one or more processors 307, one or more memories 308, one or more storage components 309, and/or one or more networking components 310.”) and configured to:
convert a target packet into a feature value using a first natural language processing model that has been trained (see Baidya, [0010]: “The security system may also utilize natural language processing to clean up SDN data and to convert the SDN data into structured data that may be utilized by the machine learning model.”; [0024]: “the security system 115 performs natural language processing (NLP) on the SDN data to clean the SDN data and generate clean SDN data. A format of the clean SDN data may be processable by the machine learning model. For example, the SDN data may include unstructured data. The security system 115 may perform NLP on the unstructured data to generate structured data corresponding to the clean SDN data. In some implementations, the security system 115 performs NLP on the unstructured data to generate a table storing parameters and corresponding values of the parameters associated with an SDN controller 105 and/or an SDN device 110. The security system 115 may generate a respective table for each SDN controller 105 and/or SDN device 110 included in the SDN network.”; and [0038]: “For example, the machine learning system may identify a feature set (e.g., one or more features and/or feature values) by extracting the feature set from structured data, by performing natural language processing to extract the feature set from unstructured data, and/or by receiving input from an operator.”);
assign a label to the feature value converted using the first natural language processing model, based on the feature value converted using the first natural language processing model and the data stored in the feature value database (see Baidya, [0040]: “As shown by reference number 215, the set of observations may be associated with a target variable. The target variable may represent a variable having a numeric value, may represent a variable having a numeric value that falls within a range of values or has some discrete possible values, may represent a variable that is selectable from one of multiple options (e.g., one of multiples classes, classifications, or labels) and/or may represent a variable having a Boolean value. A target variable may be associated with a target variable value, and a target variable value may be specific to an observation. In example 200, the target variable is an attack or an anomaly, which has a value of attack 1 for the first observation.”; and [0049]: “In some implementations, the recommendation and/or the automated action associated with the new observation may be based on a target variable value having a particular label (e.g., classification or categorization), may be based on whether a target variable value satisfies one or more threshold (e.g., whether the target variable value is greater than a threshold, is less than a threshold, is equal to a threshold, falls within a range of threshold values, or the like), and/or may be based on a cluster in which the new observation is classified.”); and
determine whether the target packet has an anomaly based on the assigned label (see Baidya, [0020]: “The machine learning model may utilize one or more machine learning algorithms to generate a predictive model for predicting an attack on the SDN network and/or an anomaly in SDN data associated with the SDN network. In some implementations, the machine learning model may include a regression machine learning model, a BayesNet machine learning model, a decision tree machine learning model, and/or a decision table machine learning model.”; [0026]: “The security system 115 may identify an attack on the SDN network and/or an anomaly in the SDN data based on a category associated with a pattern identified in the SDN data.”; and [0040]: “As shown by reference number 215, the set of observations may be associated with a target variable. The target variable may represent a variable having a numeric value, may represent a variable having a numeric value that falls within a range of values or has some discrete possible values, may represent a variable that is selectable from one of multiple options (e.g., one of multiples classes, classifications, or labels) and/or may represent a variable having a Boolean value. A target variable may be associated with a target variable value, and a target variable value may be specific to an observation. In example 200, the target variable is an attack or an anomaly, which has a value of attack 1 for the first observation.”).
Baidya does not explicitly teach that the model that has been pretrained using normal communication packets as learning data.
Wroczynski teaches a model that has been pretrained using normal communication packets as learning data (see Wroczynski, [0256]: “Unsupervised Learning Algorithms (ULA) 560 is a collective name for additional models used for extending dictionaries and rules without any need for labeling data… Although, in some cases pre-trained models can be used (e.g. a pre-trained vector representation of words) and there is no need for using any additional data… ”).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the system of Baidya in view of Wroczynski so that the model that has been pretrained using normal communication packets as learning data. One would be motivated to do so because Baidya teaches in paragraph [0043], “As shown by reference number 220, the machine learning system may train a machine learning model using the set of observations and using one or more machine learning algorithms, such as a regression algorithm, a decision tree algorithm, a neural network algorithm, a k-nearest neighbor algorithm, a support vector machine algorithm, or the like.”) and further teaches in paragraph [0044], “Additionally, or alternatively, the output may include information that identifies a cluster to which the new observation belongs and/or information that indicates a degree of similarity between the new observation and one or more other observations, such as when unsupervised learning is employed.”.
As per claim 8, Baidya and Wroczynski teach a detection method performed by a computer, the detection method comprising:
converting a target packet into a feature value using a first natural language processing model that has been trained using normal communication packets as learning data;
assigning a label to the feature value converted using the first natural language processing model, based on the feature value converted using the first natural language processing model, a packet feature value obtained in advance, a label assigned to each packet feature value, and a threshold used in the determination; and
determining whether the target packet has an anomaly based on the assigned label (see Claim 1 rejection above).
As per claim 9, Baidya and Wroczynski teach a non-transitory computer readable storage medium having a detection program stored thereon that, when executed by a processor, causes the processor to perform operations (see Baidya, [0056]: “As shown, the computing hardware 303 may include one or more processors 307, one or more memories 308, one or more storage components 309, and/or one or more networking components 310.”; and [0064]: “For example, the storage component 440 may include a hard disk drive, a magnetic disk drive, an optical disk drive, a solid-state disk drive, a compact disc, a digital versatile disc, and/or another type of non-transitory computer-readable medium.”) comprising:
converting a target packet into a feature value using a first natural language processing model that has been pretrained using normal communication packets as learning data;
assigning a label to the feature value converted using the first natural language processing model, based on the feature value converted using the first natural language processing model, a packet feature value obtained in advance, a label assigned to each packet feature value, and a threshold used in the determination; and
determining whether the target packet has an anomaly based on the assigned label (see Claim 1 rejection above).
DEPENDENT:
As per claims 2, 10, and 16, which respectively depend on claims 1, 8, and 9, Baidya further teaches wherein the processor is further configured to: output a notice related to the target packet to which the label is not assigned to the feature value (see Baidya, [0042]: “In this case, the machine learning model may learn patterns from the set of observations without labeling or supervision, and may provide output that indicates such patterns, such as by using clustering and/or association to identify related groups of items within the set of observations.”); and
in a case where a label for the target packet is input, store the feature value of the target packet and the input label in association with each other in the feature value database (see Baidya, [0024]: “In some implementations, the security system 115 performs NLP on the unstructured data to generate a table storing parameters and corresponding values of the parameters associated with an SDN controller 105 and/or an SDN device 110. The security system 115 may generate a respective table for each SDN controller 105 and/or SDN device 110 included in the SDN network.”; and [0053]: “The SDN controller 105 includes one or more devices capable of receiving, generating, storing, processing, providing, and/or routing information, as described elsewhere herein.”).
As per claims 3, 11, and 17, which respectively depend on claims 1, 8, and 9, Baidya further teaches wherein the processor is further configured to: in a case where it is input that the assigned label for the feature value is false, update the threshold stored in the feature value database (see Baidya, [0040]: “The target variable may represent a variable having a numeric value, may represent a variable having a numeric value that falls within a range of values or has some discrete possible values, may represent a variable that is selectable from one of multiple options (e.g., one of multiples classes, classifications, or labels) and/or may represent a variable having a Boolean value. A target variable may be associated with a target variable value, and a target variable value may be specific to an observation. In example 200, the target variable is an attack or an anomaly, which has a value of attack 1 for the first observation.”; and [0070]: “The device may update the trained machine learning model based on the test results”).
As per claims 4, 12, and 18, which respectively depend on claims 1, 8, and 9, Baidya further teaches wherein the processor is further configured to output a feature value to which a normal label is assigned among feature values converted using the first natural language processing model, as learning data of a first detection model for detecting intrusion (see Baidya, [0040]: “The target variable may represent a variable having a numeric value, may represent a variable having a numeric value that falls within a range of values or has some discrete possible values, may represent a variable that is selectable from one of multiple options (e.g., one of multiples classes, classifications, or labels) and/or may represent a variable having a Boolean value. A target variable may be associated with a target variable value, and a target variable value may be specific to an observation. In example 200, the target variable is an attack or an anomaly, which has a value of attack 1 for the first observation.”).
As per claims 5, 13, and 19, which respectively depend on claims 1, 8, and 9, Baidya Wroczynski further teach wherein the feature value database is configured to store all or representative feature values used in pre-training in association with pre-training labels each indicating that it is a feature values used in the pre-training (see Baidya, [0023]: “The security system 115 may periodically request and/or receive the SDN data from the multiple SDN controllers 105 and may store the received SDN data in a data structure (e.g., a database, a table, a list, and/or the like). The SDN data received from an SDN controller 105 may include data associated with events and logs associated with the SDN controller 105. For example, the SDN data may include information associated with each SDN device 110 receiving and/or transmitting a data packet as the data packet is transmitted from a source SDN device 110 to a destination SDN device 110 via one or more SDN devices 110 of the SDN network. In some implementations, the information associated with each node may be similar to the information included in the training data and associated with transmitting a data packet along a path through the simulated SDN network.”), and
wherein the processor is further configured to determine whether a feature value is appropriately converted by the first natural language processing model, based on a similarity between the feature value to which the pre-training label is assigned and the feature value of the target packet, which has been converted using the first natural language processing model (see Baidya, [0023]: “The security system 115 may periodically request and/or receive the SDN data from the multiple SDN controllers 105 and may store the received SDN data in a data structure (e.g., a database, a table, a list, and/or the like)… In some implementations, the information associated with each node may be similar to the information included in the training data and associated with transmitting a data packet along a path through the simulated SDN network.”; and [0044]: “Additionally, or alternatively, the output may include information that identifies a cluster to which the new observation belongs and/or information that indicates a degree of similarity between the new observation and one or more other observations, such as when unsupervised learning is employed.”).
As per claims 6, 14, and 20, which respectively depend on claims 1, 8, and 9, Baidya further teaches wherein the processor is further configured to: in a case where it is determined that that a feature value has been not appropriately converted by the first natural language processing model, establish a new second natural language processing model; train the second natural language processing model on conversion of the target packet into a feature value; and outputting a feature value converted by the second natural language processing model, as learning data of a second detection model for detecting intrusion (see Baidya, [0009]: “For example, the security system may receive training data simulating different types of SDN attacks or anomalies and may train a machine learning model with the training data to generate a trained machine learning model”; [0010]: “By utilizing machine learning models… ”; [0033]: “Accordingly, the security system 115 may conserve computing resources associated with identifying, obtaining, and/or generating historical data for training the machine learning model relative to other systems for identifying, obtaining, and/or generating historical data for training machine learning models”; and [0075]: “The one or more actions may include generating an alarm based on the attack on the SDN network or the one or more anomalies in the SDN data, providing information about the attack or the one or more anomalies for display, retraining the machine learning model based on the attack on the SDN network or the one or more anomalies in the SDN data, removing a software instance of one of the multiple SDN controllers, removing a software instance of one of the multiple SDN devices, replacing a software instance of one of the multiple SDN controllers with a new software instance of an SDN controller, replacing a software instance of one of the multiple SDN devices with a new software instance of an SDN device, determining a correction to a software instance of one of the multiple SDN controllers or a software instance of one of the multiple SDN devices, and/or implementing a correction to a software instance of the one of the multiple SDN controllers or a software instance of the one of the multiple SDN devices”; and [00]: “”).
As per claims 7 and 15, which respectively depend on claims 6 and 14, Baidya further teaches wherein the processor is further configured to: select a natural language processing model in which the converted feature value is most similar to the feature value of the packet that is learning data, among the first and second natural language processing models; and use the detection model corresponding to the selected natural language processing model to detect intrusion (see Baidya, [0010]: “The security system may utilize a machine learning model to predict SDN attacks even if such attacks occur at the same time.”; [0040]: “As shown by reference number 215, the set of observations may be associated with a target variable. The target variable may represent a variable having a numeric value, may represent a variable having a numeric value that falls within a range of values or has some discrete possible values, may represent a variable that is selectable from one of multiple options (e.g., one of multiples classes, classifications, or labels) and/or may represent a variable having a Boolean value. A target variable may be associated with a target variable value, and a target variable value may be specific to an observation. In example 200, the target variable is an attack or an anomaly, which has a value of attack 1 for the first observation.”; and [0047]: “In some implementations, the trained machine learning model 225 may classify (e.g., cluster) the new observation in a cluster, as shown by reference number 240. The observations within a cluster may have a threshold degree of similarity. As an example, if the machine learning system classifies the new observation in a first cluster (e.g., an SDN controller data cluster), then the machine learning system may provide a first recommendation, such as the first recommendation described above.”).
Conclusion
7. For the reasons above, claims 1-20 have been rejected and remain pending.
8. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
9. Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL Y WON whose telephone number is (571)272-3993. The examiner can normally be reached on Wk.1: M-F: 8-5 PST & Wk.2: M-Th: 8-7 PST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Nicholas R Taylor can be reached on 571-272-3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Michael Won/Primary Examiner, Art Unit 2443