DETAILED ACTION
Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
2. A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on May 08, 2026 has been entered.
Response to Amendment
3. Claims 1, 15, 19 and 20 have been amended. Claims 1-7 and 9-20 are presented for examination. Applicant’s amendments to claims 1, 15 and 19 have overcome the claim objections previously set forth in the Final Office Action mailed December 23, 2025. The objection of claims 1, 15 and 19 has been withdrawn.
Response to Arguments
4. Applicant’s arguments, filed May 08, 2026, with respect to the rejection of claim 1 under 35 U.S.C. § U.S.C. § 103 have been considered but are moot in view of the new grounds of rejection. The claim (as amended) does not overcome the new ground of rejection made in view of newly found prior art references.
5. Applicant’s arguments, see page 9, filed May 08, 2026, with respect to the rejection of claims 2-7 and 9-18 under 35 U.S.C. § 103 have been considered but are moot in view of the new grounds of rejection. The claims do not overcome the new ground of rejection made in view of newly found prior art references.
6. Applicant’s arguments, filed May 08, 2026, with respect to the rejection of claim 19 under 35 U.S.C. § 103 have been considered but are moot in view of the new grounds of rejection. The claim (as amended) does not overcome the new ground of rejection made in view of newly found prior art references.
7. Applicant’s arguments, filed May 08, 2026, with respect to the rejection of claim 20 under 35 U.S.C. § 103 have been considered but are moot in view of the new grounds of rejection. The claim (as amended) does not overcome the new ground of rejection made in view of newly found prior art references.
Claim Rejections - 35 USC § 103
8. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
9. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
10. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
11. Claims 1, 2, 5, 9-14 and 19 are rejected under 35 U.S.C. § 103 as being unpatentable over Cohen et al., (US 2020/0322368 A1), hereafter Cohen, in view of Gronát et al. (US 2020/0106805 A1), hereafter Gronát.
Noted that indicates what the cited art does not teach.
Regarding claim 1, Cohen teaches a method for computer scanning activity detection, comprising: {Cohen [Para. 0060] “A novel darknet analysis method for detecting new emerging (potential) threats via darknet traffic analysis, by considering the sequence of ports being targeted.”} Cohen discloses a method for analyzing and clustering darknet traffic streams to detect network scanning and attack patterns.
receiving Darknet data associated with scanning activities of a plurality of scanners; {Cohen [Para. 0003] “Packets sent to IP addresses that are part of a darknet are usually the result of network probing/scanning, worm propagation, a DDOS attack…“ [Para. 0046] “a) a data processing module which collects packets that are sent to non-existing IP addresses that belong to darknet's taps (blackholes) that are deployed over the internet;” [Para. 0066] “The present invention models the ongoing activities in the darknet by examining the D-Ports of packets arriving to the darknet.” [Para. 0010] “darknet data is used to detect botnet hosts, typically by clustering and classifying the S-IPs with features such as the destination port (D-port) and packet size.” [Para. 0041] “Network Scanning Clusters that consist of S-IPs trying to access a single destination port;”} Also see para. 2, 27, 65 and 113. Cohen discloses a network monitoring system that collects unsolicited inbound traffic arriving at a network telescope. Traffic received at the network telescope constitutes Darknet data. Cohen further discloses that the inbound traffic originates from distinct sources IP addresses, each source IP address representing an individual network scanner engaged in scanning activity directed at the monitored address space.
determining a plurality of sets of features corresponding to the plurality of scanners based on the Darknet data, {Cohen [Para. 0029] “c) For each time window, grouping the destination port (D-port) records of the same source IP (S-IP) into a port sequence, to obtain a plurality of port sequences;” [Para. 0073] “A sequence S is defined as the sequence of ports collected from a specific S-IP to a specific D-IP.” [Para. 0010] “darknet data is used to detect botnet hosts, typically by clustering and classifying the S-IPs with features such as the destination port (D-port) and packet size.”} Also see para. 0068. Cohen groups inbound Darknet packets by source IP address to extract per-scanner feature set. For each source IP (scanner), Cohen extracts a sequence of destination probed by that scanner, producing a per scanner data representation derived directly from the Darknet data.
wherein each set of features characterizes scanning behavior of a respective scanner and comprises at least one of: traffic volume data, scanning scheme data, targeted application data, or scanner type data; {Cohen [Para. 0029] “c) For each time window, grouping the destination port (D-port) records of the same source IP (S-IP) into a port sequence, to obtain a plurality of port sequences;” [Para. 0008] “Since the destination TCP or UDP port number provides a good indication of the sender's intentions e.g., accessing port 23 may indicate an attempt to search for an accessible Telnet server).” [Para. 0073] “A sequence S is defined as the sequence of ports collected from a specific S-IP to a specific D-IP. The port targets in a given sequence reveal information regarding the intent of the attacker.”} Cohen discloses extracting, per source IP, the sequence of destination port numbers probed by that scanner during the observation window. Destination port numbers identify the application-layer services targeted by the scanner (e.g., port 22->SSH, port 443-> HTTPS/TLS, port 3389-> RDP). Port 3389 is the default network port used by RDP. Port 22 is the standard TCP port used for SSH communications. Port 44 is the standard TCP port used for HTTPS traffic. This constitutes “target application data” within the plain meaning of the claim, and covers the “target application data” disjunct of the aforementioned limitation.
generating a plurality of embeddings based on a deep autoencoder by projecting the plurality of sets of features onto a representation space having a lower dimensionality than the Darknet data via a nonlinear autoencoder function, the plurality of embeddings corresponding to the plurality of sets of features to reduce dimensionality of the plurality of sets of features; {Cohen [Para. 0030] “(d) transforming the port sequences into a numerical feature vector by applying a word embedding algorithm (such as Word2vec) to the port sequences.” [Para. 0036] “Sequence of ports may be summarized as their average embedding.” [Para. 0060] “The first applies the Word2vec [32] technique on sequences of accessed ports in order to find a numeric representation (embedding) that captures the source IP's unique activity.”} Word2vec projects port sequences (the per scanner feature sets) into a dense, lower-dimensionality vector space. Cohen generates port embeddings via a word embedding algorithm, not a non-linear autoencoder function.
generating a plurality of clusters based on the plurality of embeddings using a clustering technique; {Cohen [Para. 0031] “e) clustering the feature vectors over time by performing temporal clustering;” [Para. 0036] “Sequences of ports may be summarized as their average embedding and analyzing their behavior by performing cluster analysis and inspecting the clusters over time.” [Para. 0088] “A clustering algorithm is applied to the data of each time window to group the observations, while any batch clustering algorithm can be used. For example: K-means, Fuzzy C-means, Gaussian mixture models,… DBSCAN can label outliers.”} Also see para. 64 and 65. The features vectors in para. 31 are the Word2Vec embeddings from step d in para. 0030. Cohen discloses applying a clustering technique (e.g., K-means, DBSCAN) to the per-scanner embedding vectors to generate clusters.
and detecting a temporal change in the plurality of clusters.{Cohen [Para. 0089] “A cluster in Ti+1 can be a current cluster (also found in Ti), an old cluster (found in Tj where j<i), or a new cluster (never seen before).” [Para. 0090] “To annotate the clusters in Ti+1, first there is a need to find the current clusters by comparing Ti and Ti+1. A cluster in Ti+1 is mapped to a cluster in Ti if there is a significant overlap of observations between them.” [Para. 0091] “In cases in which the Ti+1 cluster has no corresponding, cluster from Ti, the cluster is considered new.” [Para. 0092] “there is also a need to be able to identity old clusters that have been seen in the past, as well as detect reoccurring clusters, (i.e., clusters that disappear and reappear intermittently).”} Also see para. 21, 104 and 114. Cohen discloses detecting temporal changes in clusters across successive time windows. Specifically, Cohen discloses (a) novelty detection and (b) reappearance detection. Novelty detection identifies the emergence of a new cluster in the current time window that was not present in a prior time window, indicating a new scanning behavior. Reappearance detection identifies when a cluster corresponding to a previously observed behavioral pattern re-emerges after an absence, indicating the return of a known scanning campaign. Both novelty and reappearance are structural changes to the cluster distribution across time windows. Both are instances of a temporal change in the set of clusters.
However, Cohen does not teach generating a plurality of embeddings based on a deep autoencoder by projecting the plurality of sets of features onto a representation space having a lower dimensionality than the Darknet data via a nonlinear autoencoder function. Cohen does not disclose a non-linear autoencoder function for generating per-scanner embeddings.
However, Gronát teaches generating a plurality of embeddings based on a deep autoencoder by projecting the plurality of sets of features onto a representation space having a lower dimensionality than the Darknet data via a nonlinear autoencoder function, the plurality of embeddings corresponding to the plurality of sets of features to reduce dimensionality of the plurality of sets of features; {Gronát [Para. 0025] “A sequence of network packets is provided to an autoencoder network configured to compress high-dimensional flow such as the wide variety of instructions and data that can be encoded in network traffic to an IoT device into a lower dimension latent space, in which anomalies or irregularities in network traffic flows can be more easily detected. In a further example, the autoencoder network incorporates a regularization term that enforces approximately a Gaussian or normal distribution of network flow characterizations in the latent space.”} Also see para. 0008 and 0036. Gronát discloses a deep autoencoder architecture for network anomaly detection comprising : (1) encoder and (2) a decoder. Gronát describes the encoder as employing non-linear activation functions and projecting high-dimensional network data to a lower dimensionality representational space.
Gronát is analogous art because each of Cohen and Gronát pertains to implementing machine leaning techniques for detecting malicious activities in network packets. The functional role of the embedding step in both systems is identical. Both generate a low-dimensional numerical representation of each entity’s behavioral feature sets, suitable for input to a downstream clustering algorithm. It would have been obvious to one of ordinary skill in the art at the time of the invention to substitute Gronát’s autoencoder-based embedding step for Cohen’s word2vec embedding step. Doing so would “improve the performance of malware recognition software,… in which anomalies or irregularities in network traffic flows can be more easily detected” (see Gronát, paras. 25 and 30).
Claim 2:
Regarding claim 2, Cohen and Gronát teach the elements of claim 1 as outlined above.
Cohen further teaches wherein a set of features of the plurality of sets of features corresponds to a scanner of the plurality of scanners, {Cohen [Para. 0029] “c) For each time window, grouping the destination port (D-port) records of the same source IP (S-IP) into a port sequence, to obtain a plurality of port sequences;” [Para. 0073] “A sequence S is defined as the sequence of ports collected from a specific S-IP to a specific D-IP.” [Para. 0010] “darknet data is used to detect botnet hosts, typically by clustering and classifying the S-IPs with features such as the destination port (D-port) and packet size.”} Cohen groups inbound Darknet packets by source IP address to extract per-scanner feature set. For each source IP (scanner), Cohen extracts a sequence of destination probed by that scanner, producing a per scanner data representation.
wherein the scanning activities of the plurality of scanners are within a predetermined period of time, {Cohen [Para. 28] “b) splitting the collected data into sliding time windows, each having a predetermined length;” [Para. 37] “Splitting the collected data into sliding time windows may be performed by sorting and aggregating the most recent data into overlapping time windows, such that there will be overlap between neighboring, in order to track clusters.” [Para. 63] “The proposed method periodically analyzes the packets that have arrived from the sensor in the last L minutes.”} The time window length L is a configurable parameters set in advance, and all per-scanner feature extraction (port sequence) is performed on packets arriving within that window.
and wherein the set of features comprises at least one of: a traffic volume, a scanning scheme, a targeted application, or a scanner type of the scanner. {Cohen [Para. 29] “c) For each time window, grouping the destination port (D-port) records of the same source IP (S-IP) into a port sequence, to obtain a plurality of port sequences;” [Para. 8] “Since the destination TCP or UDP port number provides a good indication of the sender's intentions e.g., accessing port 23 may indicate an attempt to search for an accessible Telnet server).” [Para. 73] “A sequence S is defined as the sequence of ports collected from a specific S-IP to a specific D-IP. The port targets in a given sequence reveal information regarding the intent of the attacker.”} Cohen discloses extracting, per source IP, the sequence of destination port numbers probed by that scanner during the observation window. Destination port numbers identify the application-layer services targeted by the scanner (e.g., port 22 ->SSH, port 443 -> HTTPS/TLS, port 3389 -> RDP). This constitutes “target application data” within the plain meaning of the claim.
Claim 5:
Regarding claim 5, Cohen teaches the elements of claim 2 as outlined above.
Cohen further teaches wherein the targeted application within the predetermined period of time comprises at least one of a set of ports scanned, or a set of protocol request types scanned. {Cohen [Para. 0029] “c) For each time window, grouping the destination port (D-port) records of the same source IP (S-IP) into a port sequence, to obtain a plurality of port sequences;” [Para. 8] “Since the destination TCP or UDP port number provides a good indication of the sender's intentions e.g., accessing port 23 may indicate an attempt to search for an accessible Telnet server).” [Para. 73] “A sequence S is defined as the sequence of ports collected from a specific S-IP to a specific D-IP. The port targets in a given sequence reveal information regarding the intent of the attacker.”} Destination port numbers identify the application-layer services targeted by the scanner (e.g., port 22 -> SSH, port 443 -> HTTPS/TLS, port 3389 -> RDP). This constitutes “target application data”.
Claim 9:
Regarding claim 9, Cohen and Gronát teach the elements of claim 1 as stated above.
However, Cohen does not teach the limitations of claim 9.
However, Gronát teaches wherein the deep autoencoder comprises a fully-connected multilayer perceptron neural network.” {Gronát [Para. 0036] “A trained Gaussian autoencoder network observes data from a network data flow 502. The data is provided to input layer 504 of the network, where it is transformed to a low-dimensional latent space at 506.” [Para. 0039] “In a typical neural network each node of a given layer feeds forward to each node of the next layer, with each such connection multiplied by a different coefficient.”}
Gronát is analogous art because each of Cohen and Gronát pertains to implementing machine leaning techniques for detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen to include Gronát’s teaching of the limitations of claim 9, listed above. Doing so would “improve the performance of malware recognition software,… in which anomalies or irregularities in network traffic flows can be more easily detected” (see Gronát, paras. 25 and 30).
Claim 10:
Regarding claim 10, Gronát teaches the elements of claim 9 as outlined above.
However, Cohen does not teach the limitations of claim 10.
However, Gronát teaches wherein the fully-connected multilayer perceptron neural network uses two layers. {Gronát [Para. 0037, Fig. 6] “The data stream being monitored is represented as X, and is provided to the input layer of the network shown in the left-most column at 602. The input data X has a dimension of the number of input nodes in the column shown at 602, and as the input data propagates to the right through additional network layers is reduced to the low-dimension latent space Zc as shown at 604. The input vector is then reconstructed from Zc as data continues to propagate through layers to the right until it reaches the layer shown at 606, which outputs the reconstructed input data.”}
Gronát is analogous art because each of Cohen and Gronát pertains to implementing machine leaning techniques for detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen to include Gronát’s teaching of the limitations of claim 10, listed above. Doing so would “improve the performance of malware recognition software,… in which anomalies or irregularities in network traffic flows can be more easily detected” (see Gronát, paras. 25 and 30).
Claim 11:
Regarding claim 11, Cohen and Gronát teach the elements of claim 1 as stated above.
However, Cohen does not teach the limitations of claim 11.
However, Gronát teaches further comprising: training the deep autoencoder by minimizing a reconstruction loss based on the plurality of sets of features and the plurality of embeddings. {Gronát [Para. 0031] “FIG. 2 shows a flowchart illustrating a first phase of training the Gaussian autoencoder detection module's network….The first training sample from the batch is provided to the neural network at 202, being fed to the first or input layer of the neural network at 204. An internal or hidden layer of the neural network comprises the latent space having reduced dimensionality relative to the input layer, from which a low-dimensional output is taken… Reconstruction loss is similarly calculated at 212 based on the error or loss in expanding the low dimensional latent space back to a high-dimensional space such as that of the input layer receiving the training sample as shown at 214. Both the Gaussian loss 208 and the reconstruction loss 210 are used to calculate the combined loss 212, which is backpropagated through the network starting at the latent space layer 206 to train the network to minimize the combined loss, desirably across a large number of training samples.”}
Gronát is analogous art because each of Cohen and Gronát pertains to implementing machine leaning techniques for detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen to include Gronát’s teaching of the limitations of claim 11, listed above. Doing so would “improve the performance of malware recognition software,… in which anomalies or irregularities in network traffic flows can be more easily detected” (see Gronát, paras. 25 and 30).
Claim 12:
Regarding claim 12, Gronát teach the elements of claim 11 as stated above.
However, Cohen does not teach the limitations of claim 12.
However, Gronát teaches generating a plurality of decoded input datasets by decoding the plurality of embeddings to map the plurality of decoded input datasets to the plurality of sets of features. {Gronát [Para. 0037, Fig. 6] “The data stream being monitored is represented as X, and is provided to the input layer of the network shown in the left-most column at 602. The input data X has a dimension of the number of input nodes in the column shown at 602, and as the input data propagates to the right through additional network layers is reduced to the low-dimension latent space Zc as shown at 604. The input vector is then reconstructed from Zc as data continues to propagate through layers to the right until it reaches the layer shown at 606, which outputs the reconstructed input data…This portion of the network of FIG. 6 is referred to here as the dimension reduction network because it learns to reduce the dimensionality of the input data to a low-dimension latent space from which the high-dimension space input can be accurately reconstructed.”}
Gronát is analogous art because each of Cohen and Gronát pertains to implementing machine leaning techniques for detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen to include Gronát’s teaching of the limitations of claim 12, listed above. Doing so would “improve the performance of malware recognition software,… in which anomalies or irregularities in network traffic flows can be more easily detected” (see Gronát, paras. 25 and 30).
Claim 13:
Regarding claim 13, Gronát teaches the elements of claim 12 as outlined above.
However, Gronát does not teach the limitations of claim 12.
However, Gronát teaches wherein the reconstruction loss is minimized by minimizing distances between the plurality of sets of features and the plurality of decoded input datasets, the plurality of sets of features corresponding to the plurality of decoded input datasets. {Gronát {Gronát [Para. 0031, FIG. 2] “The first training sample from the batch is provided to the neural network at 202, being fed to the first or input layer of the neural network at 204. An internal or hidden layer of the neural network comprises the latent space having reduced dimensionality relative to the input layer, from which a low-dimensional output is taken… Reconstruction loss is similarly calculated at 212 based on the error or loss in expanding the low dimensional latent space back to a high-dimensional space such as that of the input layer receiving the training sample as shown at 214. Both the Gaussian loss 208 and the reconstruction loss 210 are used to calculate the combined loss 212, which is backpropagated through the network starting at the latent space layer 206 to train the network to minimize the combined loss, desirably across a large number of training samples.”} Also see para. 27 in Gronát.
Gronát is analogous art because each of Cohen and Gronát pertains to implementing machine leaning techniques for detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen to include Gronát’s teaching of the limitations of claim 13, listed above. Doing so would “improve the performance of malware recognition software,… in which anomalies or irregularities in network traffic flows can be more easily detected” (see Gronát, paras. 25 and 30).
Claim 14:
Regarding claim 14, Cohen and Gronát teach the elements of claim 1 as outlined above.
Cohen further teaches wherein the clustering technique comprises a k-means clustering technique clustering the plurality of embeddings into the plurality of clusters, and wherein a number of the plurality of clusters is smaller than a number of the plurality of embeddings. {Cohen [Para. 0031] “e) clustering the feature vectors over time by performing temporal clustering;” [Para. 0036] “Sequences of ports may be summarized as their average embedding and analyzing their behavior by performing cluster analysis and inspecting the clusters over time.” [Para. 0088] “A clustering algorithm is applied to the data of each time window to group the observations, while any batch clustering algorithm can be used. For example: K-means, Fuzzy C-means, Gaussian mixture models…”} Also see para. 65-69. Cohen discloses applying a clustering technique (e.g., K-means) to the per-scanner embedding vectors to generate clusters. For k-means clustering, the number of clusters (denoted by k) can be predefined by a user before running the algorithm (see para. 0088). Therefore, when k is smaller than the total number of embeddings, total number of clusters will be smaller than the total number of embeddings.
Claim 19:
Regarding claim 19, the claim is directed to a system for malicious activity detection, and the system implements the method recited by claim 1. Therefore, the rejection applied to claim 1 also applies to claim 19. Claim 1 is rejected under the same rationale as claim 19.
Claim 19 further recites a system for malicious activity detection, comprising: at least one processor; a communication device connected to the processor and configured to receive data reflective of network activity; a memory having stored thereon a set of instructions which, when executed by the processor, cause the processor to: perform operations of claim 1. {Gronát [Para. 0041] “The computerized systems such as Gaussian autoencoder neural network development system 102 of FIG. 1 used to train the networks, and the devices such as IoT device 124 that execute the trained network to protect against malicious data can take many forms.” [0043, Fig. 7] “Computing device 700 includes one or more processors 702, memory 704, one or more input devices 706, one or more output devices 708, one or more communication modules 710, and one or more storage devices 712… One or more applications, such as Gaussian autoencoder module 722 are also stored on storage device 712, and are executable by computing device 700.” [Para. 0045] “For example, processors 702 may be capable of processing instructions stored in storage device 712 or memory 704.”} Also see para. 40 and 51.
Gronát is analogous art because each of Cohen and Gronát pertains to implementing machine leaning techniques for detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen to include Gronát’s teaching of the limitations of claim 19, listed above. Doing so would “improve the performance of malware recognition software,… in which anomalies or irregularities in network traffic flows can be more easily detected” (see Gronát, paras. 25 and 30).
12. Claims 3, 4 and 7 are rejected under 35 U.S.C. § 103 as being unpatentable over Cohen and Gronát as applied to claims 1 and 2, and further in view of Amit et al., (WO 2020/157561 A1), hereafter Amit.
Regarding claim 3, Cohen teaches the elements of claim 2 as stated above.
However, Cohen and Gronát do not explicitly teach the limitations of claim 3.
However, Amit teaches wherein the traffic volume of the scanner within the predetermined period of time comprises at least one of a total number of packets transmitted, a total amount of bytes transmitted, or an average inter-arrival time between packets transmitted. {Amit [Pg. 15, line 23-28] “Each communication session 68 optionally comprises… a volume 88 (source to destination), a reverse-volume 78 (also referred to as rvolume, destination to source).” [Pg. 16, line 3-4] “volume 88 indicates an amount of data transmitted from the first given workstation to the second given workstation during the given communication session,” [Pg. 17, line 22-23] “a first amount of data (e.g., 600 bytes) that the first given workstation transmitted to the second given workstation in the sequence of data packets to volume 88.”} Also see Pg. 31, line 21-24. Amit discloses byte volume (volume 88/re-volume78) as a per-session traffic measurement used in a port scan detection method.
Amit is analogous art because each of Cohen, Gronát and Amit pertains to detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen and Gronát to include Amit’s teaching of the limitations of claim 3, listed above. Doing so could “detect potentially malicious port scans” (Amit, pg. 22, line 16-17) and “can generate and use source profiles to detect these source nodes in order to whitelist their legitimate port scanning activity” (Amit, pg. 22, line 27-28).
Claim 4:
Regarding claim 4, Cohen teaches the elements of claim 2 as outlined above.
However, Cohen and Gronát do not explicitly teach the limitations of claim 3.
However, Amit discloses wherein the scanning scheme within the predetermined period of time comprises at least one of: a number of distinct destination ports, a number of distinct destination addresses, a prefix destiny, or a destination scheme. {Amit [Pg. 6, line 29-32] “A respective test score that is indicative of a difference between a second number of the communication ports that the given source node in the pair accessed on the given destination node during a second time period and the baseline level.” [Pg. 21, line 1-4] “A given source node 64 can be classified as a noisy scanner if the given source node accesses (i.e., “scans”) at least a first number (e.g., at least 20, at least 25, at least 30, at least 35, or at least 40) of destination ports 72 on at least a second number (e.g., 80, 90, 100, or 110) of destination nodes 66.”} Amit discloses distinct destination ports counts and distinct destination address counts as per scanner features within a time period. These features include the number of communication ports accessed per source node per destination node within a time period, distinct destination ports count, number of distinct destination addresses scanned per source node (see pg. 4, line 9-11) and the daily number of destination nodes scanned by a given source node (see pg. 23, line 31-32).
Amit is analogous art because each of Cohen, Gronát and Amit pertains to detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen and Gronát to include Amit’s teaching of the limitations of claim 4, listed above. Doing so could “detect potentially malicious port scans” (Amit, pg. 22, line 16-17).
Claim 7:
Regarding claim 7, Cohen and Gronát teach the elements of claim 1 as stated above.
However, Cohen and Gronát do not explicitly teach the limitations of claim 7.
However, Amit teaches wherein the plurality of sets of features comprises heterogeneous data containing at least one categorical dataset for a feature and at least one numerical dataset for the feature. {Amit [Pg. 15, line 23-28] “Each communication session 68 optionally comprises a source node identifier 64, a destination port identifier 66, a time 84, a source port identifier 70, a destination port identifier 72, a protocol 74, a status 76, a volume 88 (source to destination), a reverse-volume 78 (also referred to as rvolume, destination to source), and a time 84. Each aggregated communication session 58 optionally comprises a port scan time period 62, a subset 86 of the communication sessions, and a signature 82.”} Each communication session record stores source node identifier (categorical), destination port identifier (categorical/numerical), a time (numerical), protocol (categorical), status (categorical-successful/failed), volume(numerical-bytes), and reverse-volume (numerical-bytes). The per-scanner feature set aggregated from these sessions is heterogeneous. It combines categorical fields (e.g., protocol, status) with numerical fields (byte volume, port counts, destination node counts) within the same feature representation for each scanner.
Amit is analogous art because each of Cohen, Gronát and Amit pertains to detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen and Gronát to include Amit’s teaching of the limitations of claim 7, listed above. Doing so could “detect potentially malicious port scans” (Amit, pg. 22, line 16-17).
13. Claim 6 is rejected under 35 U.S.C. § 103 as being unpatentable over Cohen and Gronát as applied to claims 1 and 2, and further in view of Roesch et al., (US 7,317,693 B1), hereafter Roesch.
Regarding claim 6, Gronát teaches the elements of claim 2 as outlined above.
However, Cohen and Gronát do not teach the limitations of claim 6.
However, Roesch teaches wherein the scanner type of the scanner within the predetermined period of time comprises at least one of: a set of time-to-live (TTL) values of the scanner, or a device operating system (OS) type. {Roesch [Col. 17, line 31-46] “In step 1140, the number of hops traveled by the second packet is determined from the second plurality of protocol fields. The number of hops traveled is determined by identifying the operating system transmitting the packet and calculating the difference between the time-to-live value of the second packet and the time-to-live default value of the operation system. The second plurality of protocol fields is compared to an operating system identifying structure. A matched operating system is selected. The default starting time-to-live value for the matched operating system is read from the operating system identifying structure. The packet time-to-live value is read from the second plurality of protocol fields. The number of hops traveled is found by comparing the default starting time-to-live value to the packet time-to-live value.”}
Roesch is analogous art because each of Roesch, Cohen and Gronát pertains to analyzing data moving across a network. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen and Gronát to include Roesch’s teaching of determining a set of TTL values of a scanner, or a device OS type. Doing so would “improve existing intrusion detection systems or real-time network reporting mechanisms” (Roesch, Col. 33 line 58-62).
14. Claims 15-18 are rejected under 35 U.S.C. § 103 as being unpatentable over Doron, Cohen and Gronát as applied to claims 1 and 14, and further in view of Fan et al., (US 2021/0049452 A1), hereafter Fan.
Regarding claim 15, Cohen teaches the elements of claim 14 as outlined above.
However, Cohen and Gronát do not teach the limitations of claim 15.
However, Fan teaches wherein the plurality of clusters comprises a first clustering assignment matrix and a second clustering assignment matrix, wherein the first clustering assignment matrix and the second clustering assignment matrix are for adjacent time periods. {Fan [Para. 0028] “Anomaly detection service 120 may calculate a pairwise inner product of time series within a segment 304 to produce an n*n*3 “image” matrix 306. Matrix 306 may be further modified into a final input shape 308 for processing by GAN 200. This modification may include appending at least one matrix from at least one adjacent segment 304 to matrix 306 as shown. By appending an adjacent matrix, it may be possible to assemble a time sequence of the output corresponding to the time sequence of the multivariate time series data input. First, it may be assumed that the entire time series related to training is pulled from monitored service 110. Anomaly detection service 120 may generate signature (covariance) matrices (n*n) per each time step in training (every 5 minutes in the illustrated example) and per each predefined window size. Then, for a single time step, anomaly detection service 120 may generate three signature matrices associated with different window sizes. These three signature matrices may be used as three channels of image input… Therefore, anomaly detection service 120 may also append previous immediate h steps to the current time step as input, in order to reflect temporal dependencies. The final input of shape (h+1)*n*n*3 may be stored per time step and fed to GAN 200.”} As disclosed in Fan, anomaly detection service 120 generates a first and a second matrices associated with different adjacent time period window sizes.
Fan is analogous art because each of Cohen, Gronát and Fan pertains to analyzing network traffic to detect network anomalies. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen and Gronát to include Fan’s teaching of the limitations of claim 15, listed above. Doing so would “improve anomaly detection” (Fan, para. 0019).
Claim 16:
Regarding claim 16, Fan teaches the elements of claim 15 as outlined above.
However, Cohen and Gronát do not teach the limitations of claim 16.
However, Fan teaches generating a first probability density function capturing the first clustering assignment matrix: and generating a second probability density function capturing the second clustering assignment matrix. {Fan [Para. 0031] “Once GAN 400 has been trained, it may be applied to score anomalies in data input as final input shape 308. This may be performed by fixing both encoder 204 settings, decoder 206 settings, and discriminator 208 setting to the trained settings and passing input data x through GAN 400, where input data x is the final input shape 308 being analyzed. The output of GAN 400 may include a residual matrix representing a difference between input data x and output data x′ and/or a residual matrix representing a difference between z and z′. An anomaly score may be generated based on these matrices, and a threshold difference may be established, where data having an anomaly score below (or equal or below) the threshold are judged as not likely being anomalous, and data have an anomaly score equal or above the threshold are judged as being anomalous.”} Fan’s assigns an anomaly score to input data and uses two probability density functions for anomaly scoring. The first probability density function captures a first matrix x, and the second probability density function captures a second matrix z.
Fan is analogous art because each of Doron, Bilge, Cohen and Fan pertains to analyzing network traffic to detect network anomalies. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Doron, Bilge and Cohen to include Fan’s teaching of the limitations of claim 16, listed above. Doing so would “improve anomaly detection” (Fan, para. 0019).
Claim 17:
Regarding claim 17, Fan teaches the elements of claim 16 as outlined above.
However, Cohen and Gronát do not teach the limitations of claim 17.
However, Fan teaches wherein the detecting the temporal change comprises transmitting an alert based on a distance between the first probability density function and the second probability density function. {Fan [Para. 0032] “Anomalous data may refer to time steps in final input shape 308 with abnormal values and/or abnormal correlations between time series in final input shape 308. The trained GAN 400 may be used for testing new samples and detecting anomalous time steps. For each input x of the final input shape 308 in a test set, an output z, x′, and z′ may be generated by the generator's network. The L2 distance between x and x′ and the L2 distance between z and z′ may be calculated and used for score assignment. Abnormal patterns in input data may result in large reconstruction error that is reflected in contextual and latent loss.” [Para. 0046] “After anomaly detection service 120 detects an anomaly, troubleshooting service 130 may alert analysts and data engineers for troubleshooting.”} Anomaly detection service 120 includes a GAN (see para. 0022), detects anomalies when the distance between functions are above a threshold, and sends an alert.
Fan is analogous art because each of Cohen, Gronát and Fan pertains to analyzing network traffic to detect network anomalies. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen and Gronát to include Fan’s teaching of the limitations of claim 17, listed above. Doing so would “improve anomaly detection” (Fan, para. 0019).
Claim 18:
Regarding claim 18, Fan teaches the elements of claim 17 as outlined above.
However, Cohen and Gronát do not teach wherein the distance is a 2-Wasserstein distance on the first probability density function and the second probability density function.
However, Fan teaches wherein the distance is a 2-Wasserstein distance on the first probability density function and the second probability density function. {Fan [Para. 0036] “The performance and/or trainability of discriminator 208 may be enhanced by configuring discriminator 208 to use a Wasserstein function. FIGS. 7A-7D describe a Wasserstein function used by a discriminator 208 of a GAN 400. Wasserstein is a loss function defined to calculate the distance between two distributions. On the other hand, the role of discriminator 208 is to maximize the distance between two distributions of real and fake data. Therefore, the whole objective of discriminator 208 (previously adversarial loss) may be performed by the Wasserstein distance function.”} Fan teaches a N-Wasserstein function, which is used to calculate the distance between two probability distributions.
Fan is analogous art because each of Cohen, Gronát and Fan pertains to analyzing network traffic to detect network anomalies. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen and Gronát to include Fan’s teaching of a 2-Wasserstein distance that measures the distance between two probability distributions. Doing so would “improve anomaly detection” (Fan, para. 0019).
15. Claim 20 is rejected under 35 U.S.C. § 103 as being unpatentable over Cohen et al., (US 2020/0322368 A1), hereafter Cohen, in view of Gronát et al. (US 2020/0106805 A1), hereafter Gronát, and further in view of Howard et al. (US 2019/0199736 A1), hereafter Howard.
Noted that indicates what the cited art does not teach.
Regarding claim 20, Doron teaches a system for detecting malicious computer activity, comprising: {Cohen [Para. 0045] “A system for analyzing and clustering darknet traffic streams with word embeddings.”} Cohen discloses a system for analyzing and clustering darknet traffic streams to detect network scanning and attack patterns.
at least one processor; at least one network connection in communication with the at least one processor: and at least one memory having stored thereon a set of instructions which, when executed by the processor cause the processor to: {Cohen [Para. 0100] “The method was developed using the Spark framework on Hadoop architecture. The method has been tested on a Hadoop cluster consisting of 50 cores and 10 executors.”} Cohen’s system was implemented and tested on “a Hadoop cluster consisting of 50 cores and 10 executor”, indicating explicit processor and memory infrastructure.
receive a first set of Darknet data via the at least one network connection, corresponding to a first temporal period; {Cohen [Para. 46] “a) a data processing module which collects packets that are sent to non-existing IP addresses that belong to darknet's taps (blackholes) that are deployed over the internet;” [Para. 0028] “b) splitting the collected data into sliding time windows, each having a predetermined length;”} Time window Ti is a first temporal period, and data collected in that window is a first set of Darknet data.
determining a plurality of sets of features corresponding to the plurality of scanners based on the Darknet data, {Cohen [Para. 0029] “c) For each time window, grouping the destination port (D-port) records of the same source IP (S-IP) into a port sequence, to obtain a plurality of port sequences;” [Para. 0073] “A sequence S is defined as the sequence of ports collected from a specific S-IP to a specific D-IP.” [Para. 0010] “darknet data is used to detect botnet hosts, typically by clustering and classifying the S-IPs with features such as the destination port (D-port) and packet size.”} Also see para. 0068. Cohen groups inbound Darknet packets by source IP address to extract per-scanner feature set. For each source IP (scanner), Cohen extracts a sequence of destination probed by that scanner, producing a per scanner data representation derived directly from the Darknet data.
wherein each set of features characterizes scanning behavior of a respective scanner and comprises at least one of: traffic volume data, scanning scheme data, targeted application data, or scanner type data; {Cohen [Para. 0029] “c) For each time window, grouping the destination port (D-port) records of the same source IP (S-IP) into a port sequence, to obtain a plurality of port sequences;” [Para. 0008] “Since the destination TCP or UDP port number provides a good indication of the sender's intentions e.g., accessing port 23 may indicate an attempt to search for an accessible Telnet server).” [Para. 0073] “A sequence S is defined as the sequence of ports collected from a specific S-IP to a specific D-IP. The port targets in a given sequence reveal information regarding the intent of the attacker.”} Cohen discloses extracting, per source IP, the sequence of destination port numbers probed by that scanner during the observation window. Destination port numbers identify the application-layer services targeted by the scanner (e.g., port 22 ->SSH, port 443 -> HTTPS/TLS, port 3389 -> RDP). This constitutes “target application data” within the plain meaning of the claim, and covers the “target application data” disjunct of the aforementioned limitation.
generating a plurality of embeddings based on a deep autoencoder by projecting the plurality of sets of features onto a representation space; {Cohen [Para. 30] “(d) transforming the port sequences into a numerical feature vector by applying a word embedding algorithm (such as Word2vec) to the port sequences.” [Para. 36] “Sequence of ports may be summarized as their average embedding.” [Para. 60] “The first applies the Word2vec [32] technique on sequences of accessed ports in order to find a numeric representation (embedding) that captures the source IP's unique activity.”} Word2vec projects port sequences (the per scanner feature sets) into a dense, lower-dimensionality vector space. Cohen generates port embeddings via a word embedding algorithm, not a deep autoencoder.
cluster the first set of Darknet data based on the plurality of embeddings to create first cluster data; {Cohen [Para. 0048] “c) a clustering module for performing temporal clustering of the feature vectors over time;” [Para. 0088] “A clustering algorithm is applied to the data of each time window to group the observations.”} The features vectors in para. 48 are the Word2Vec embeddings from step b in para. 47. Cohen discloses applying a clustering technique to embeddings in Ti to produce Ci (first cluster data).
receive a second set of Darknet data via the at least one network connection, corresponding to a second temporal period: {Cohen [Para. 89 ] “Between time window Ti and time window Ti+1, the number of clusters and their types can change.” [Para. 95] “The traffic was collected in two batches; the first was recorded during a period of six weeks (44 days) from Oct. 18, 2025 until Dec. 5, 2018 (denoted by Batch 1), and the second was recorded during a period of eight weeks (55 days) from Feb. 1, 2019 until Mar. 26, 2019 (denoted by Batch 2).”} Ti+1 is the second temporal period with its own Darknet data. The experimental dataset further demonstrates two distinct temporal batches.
cluster the second set of Darknet data to create second cluster data; {Cohen [Para. 0048] “c) a clustering module for performing temporal clustering of the feature vectors over time;” [Para. 0088] “A clustering algorithm is applied to the data of each time window to group the observations.”} Same clustering module applied to embeddings in Ti+1 data produces Ci+1 (second cluster data). The temporal clustering framework applies identically to each successive time window.
generate a plurality of similarity scores using a plurality of Jaccard measures to compare the first cluster data and the second cluster data; {Cohen [Para. 0090] “A cluster in Ti+1 is mapped to a cluster in Ti if there is a significant overlap of observations between them. The overlap is been measured using the Jaccard similarity metric (a percentage of how many objects two sets have in common out of how many objects they have total).” [Para. 0091] “The Jaccard similarity of all of the clusters in Ti+1 with the clusters in Ti is simultaneously calculated. If the Jaccard similarity is above a certain threshold for two clusters, then the cluster from Ti+1 is considered to be the same as the cluster from Ti (i.e., current cluster)”} “All of the clusters” means a Jaccard score is computed for each cluster pairs, producing a plurality of similarity scores. Cohen discloses cluster mapping algorithm 1 in para 0091. The algorithm iterates over cluster pairs between Ti and Ti+1, computing Jaccards (s,k) for each pair.
determine at least one of: (i) an existence of a cluster within the second cluster data that is not within a similarity threshold of any clusters of the first cluster data: {Cohen [Para. 0091] “In cases in which the Ti+1 cluster has no corresponding, cluster from Ti, the cluster is considered new.” [Para. 0072] “A simple way to deal with this attack group is to include an alert rule that issues alert when a cluster that has never seen before is seen, as those attacks will create a new cluster.”} The Jaccard threshold defines “similarity threshold” (see para. 90 and 91). A cluster in Ci+1 falling below that threshold for all clusters in Ci is a cluster not within a similarity threshold of any first period cluster.
or (ii) a change in characteristics of a given cluster from the first cluster data to the second cluster data; {Cohen [Para. 0104] “The majority of the clusters do change over time, either by changing in size or by disappearing and reappearing throughout the experiment.” [Para. 0084] “(4) analyze the trend of ongoing attacks, such as changes in volume, sources, and targets.” [Para. 0072] “Create an alert rule to issue an alert when a cluster dramatically increases in size.” [Para. 0093] “After some time, a concept drift may occur, and the patterns change slightly. To deal with this issue, in cases in which a known cluster appears in the data stream, the corresponding model is updated and retrained.”} Cohen tracks characteristics of clusters across time windows, including size change, membership change, and behavioral drift.
and alerting a user to the determination of (i) or (ii). {Cohen [Para. 0032] “f) upon identifying clusters that have been appeared and classified as malicious in the past or clusters that have never seen before, issuing an alert.” [Para. 0049] “d) an alert logic and visualization module visualizes the data and provides alerts.” [Para. 0072] “Include an alert rule that issues alert when a cluster that has never seen before is seen, as those attacks will create a new cluster. Create an alert rule to issue an alert when a cluster dramatically increases in size.”} Cohen describes issuing both the novelty alert and the change-in-characteristics alert.
However, Cohen does not teach generating a plurality of embeddings based on a deep autoencoder by projecting the plurality of sets of features onto a representation; generate a plurality of similarity scores using a plurality of Jaccard measures to compare the first cluster data and the second cluster data.
However, Gronát teaches generating a plurality of embeddings based on a deep autoencoder by projecting the plurality of sets of features onto a representation space; {Gronát [Para. 0025] “A sequence of network packets is provided to an autoencoder network configured to compress high-dimensional flow such as the wide variety of instructions and data that can be encoded in network traffic to an IoT device into a lower dimension latent space, in which anomalies or irregularities in network traffic flows can be more easily detected. In a further example, the autoencoder network incorporates a regularization term that enforces approximately a Gaussian or normal distribution of network flow characterizations in the latent space.”} Also see para. 0008 and 0036. Gronát discloses a deep autoencoder architecture for network anomaly detection comprising : (1) encoder and (2) a decoder. Gronát describes the encoder as employing non-linear activation functions and projecting high-dimensional network data to a lower dimensionality representational space.
Gronát is analogous art because each of Cohen and Gronát pertains to implementing machine leaning techniques for detecting malicious activities in network packets. It would have been obvious to one of ordinary skill in the art at the time of the invention to substitute Gronát’s autoencoder-based embedding step for Cohen’s word2vec embedding step. The functional role of the embedding step in both systems is identical. Both generate a low-dimensional numerical representation of each entity’s behavioral feature sets, suitable for input to a downstream clustering algorithm. Doing so would “improve the performance of malware recognition software,… in which anomalies or irregularities in network traffic flows can be more easily detected” (see Gronát, paras. 25 and 30).
However, Gronát also does not teach generate a plurality of similarity scores using a plurality of Jaccard measures to compare the first cluster data and the second cluster data.
However, Howard teaches generate a plurality of similarity scores using a plurality of Jaccard measures to compare the first cluster data and the second cluster data. {Howard [Para. 0126] “On the cloud, a received binary is first passed through the Featurizer 610. The features go through the Autoencoder to produce autoencoded features. The autoencoded features go through the Classifier 630. Similarly to on the endpoint, the binary is classified to its nearest neighbor, and a confidence value is calculated. The near-neighbors that are returned by the LSH search are each compared to the target binary by their actual features, and that is the distance metric that is used. The distance measurement used is the Jaccard index between the two sets of features from the two binaries. The Jaccard indexes from the various types of features are weighted and combined to get an overall distance measurement.”} Howard’s system generates a plurality of Jaccard similarity scores to compare two pieces of data.
Howard is analogous art because each of Cohen, Gronát and Howard pertains to generating embeddings representing network traffic data. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Cohen and Gronát to include Howard’s teaching of the limitations of claim 20, listed above. Doing so would “provide for preemptive defense, enabling a defender to predict potential future attacks” (Howard, para. 0067).
Conclusion
16. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Doron et al. (US 2019/0182274 A1) discloses generating attack-sequence signatures and identifying partially matching historic signatures to predict a subsequent attack.
17. Any inquiry concerning this communication or earlier communications from the examiner should be directed to BIN QING ZHENG whose telephone number is (703)756-1535. The examiner can normally be reached on M-F 9:30 am -5:30 pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip J. Chea can be reached on 571-272-3951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BIN QING ZHENG/
Examiner, Art Unit 2499 /PHILIP J CHEA/Supervisory Patent Examiner, Art Unit 2499
Prosecution Insights