DETAILED ACTION
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
2. Claims 1-20 are currently pending. Claims 1 and 11 have been amended. Claims 1-20 have been rejected.
Status of the Application
3. Claims 1-20 are currently pending and have been examined in this application. This communication is the first action on the merits.
Response to Amendments
4. Applicant’s amendment filed on 07/17/2026 necessitated new grounds of rejection in this office action.
Continued Examination under 37 CFR 1.114
5. A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 07/17/2026 has been entered.
Priority
6. The Examiner has noted the Applicants claiming from Continuation (CON) Application # 17/540,756 filed on 07/19/2019 and Continuation in Part (CIP) Application # 18/594,815 filed on 12/02/2021. Therefore, the earliest effective filing date examined for this application is of 07/19/2019.
Response to Arguments
7. Applicant’s arguments, see pages 8-9 of 10 filed on 07/17/2026, with respect to the 35 U.S.C. § 103 Claim Rejections for Claims 1-20 have been fully considered and are found to be not persuasive. Applicant’s arguments with respect to Claims 1-20 have been considered, but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Response to 35 U.S.C. § 101 Arguments
8. Applicant’s 35 U.S.C. § 101 arguments, filed with respect to Claims 1-20 have been fully considered, but they are found not persuasive (see Applicant Remarks, Pages 6-8 of 10 dated 07/17/2026). Examiner respectfully disagrees.
Argument #1:
(A). Applicant argues that Claims 1-20 do not recite an abstract idea, law of nature of natural phenomenon under revised step 2a prong one of the 35 U.S.C § 101 analysis (see Applicant Remarks, Pages 6-7 of 10, dated 07/17/2026). Examiner respectfully disagrees.
Specifically, for Independent Claims 1 and 11, Applicant argues that the claims are directed to “automatically managing a configuration of an application to implement the subset of cybersecurity related projects, wherein the configuration is based on the optimization programming problem algorithm” rather than an abstract idea.
The Examiner respectfully disagrees. Under Step 2A, Prong One, for Independent Claims 1 and 11, the focus is whether the claims recite a judicial exception, not whether they additionally recite technological elements. The claims expressly recite numerous mathematical operations, including: calculating frequency distributions; calculating severity distributions; performing Monte Carlo simulations; generating aggregate loss distributions; computing redundancy coefficients; computing synergy coefficients; performing weighted matrix calculations; solving an optimization programming problem; using an evolutionary algorithm and selecting projects that optimize expected loss reduction.
These limitations expressly recite mathematical concepts as identified in the 2019 Revised Patent Subject Matter Eligibility Guidance. Additionally, the claims recite identifying cybersecurity projects, selecting projects, maximizing expected loss reduction, applying budget constraints, evaluating utility values, and mitigating cybersecurity risk. These limitations constitute commercial or business management activities involving resource allocation and risk management, which fall within the enumerated category of certain methods of organizing human activity. Although the claims additionally recite automatically managing an application configuration, the presence of additional technological limitations does not negate the recitation of judicial exceptions under Step 2A, Prong One.
Applicant argues that the claims are directed to cybersecurity rather than business management. The Examiner respectfully disagrees. The claims do not improve cybersecurity technology itself. Rather, they optimize which cybersecurity projects should be selected. The claimed optimization concerns organizational investment decisions regarding cybersecurity resources. The claims do not improve malware detection, firewall operation, intrusion detection, authentication protocols, packet inspection, cryptography, or other cybersecurity technology. Instead, the claims mathematically evaluate alternative cybersecurity projects to determine which projects should receive organizational resources. Consequently, the focus of the claims remains resource allocation and risk management rather than improvements to cybersecurity technology.
The claim limitations of Independent Claims 1 and 11 recite the steps of (e.g., “calculating frequency and severity distributions for cyber security threats using a loss distribution approach” & “performing Monte Carlo simulations to generate aggregate loss distributions” & “computing redundancy and synergy coefficients using weighted matrix calculations”) can be performed as “Mathematical Concepts” via (1) mathematical calculations or (2) mathematical relationships and additionally or alternatively as “Mental Processes” via (3) concepts performed in the human mind (including observations or evaluations or judgments) or (4) using pen and paper as a physical aid.
With respect to the argument that amended Independent Claims 1 and 11 cannot be performed/executed by the human mind”, Examiner refers Applicant to MPEP § 2106.04 (a) (2) (III) (C): “Claims can recite a mental process even if they are claimed as being performed on a computer. The Supreme Court recognized this in Benson, determining that a mathematical algorithm for converting binary coded decimal to pure binary within a computer’s shift register was an abstract idea. The Court concluded that the algorithm could be performed purely mentally even though the claimed procedures "can be carried out in existing computers long in use, no new machinery being necessary." 409 U.S at 67, 175 USPQ at 675. See also Mortgage Grader, 811 F.3d at 1324, 117 USPQ2d at 1699 (concluding that concept of "anonymous loan shopping" recited in a computer system claim is an abstract idea because it could be "performed by humans without a computer").” “For instance, the Examiner has reviewed Applicant’s Specification and determined that the claimed invention is described as concepts that are performed in the human mind and applicant is merely claiming that concept performed 1) on a generic computer (e.g., see Applicant’s Specification ¶ [0059] & Fig. 5: “Computer 505 can include a processor 510 suitable for the execution of a computer program, and can include, by way of example, both general and special purpose microprocessors, and any one or more processor of any kind of digital computer”.) or 2) in a computer environment (e.g., see Applicant’s Specification ¶ [0057]: “A computer program (also known as a program, software, software application, or code) can be written in any form of programming language, including compiled or interpreted languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.”), or 3) is merely using a computer as a tool to perform these concepts.” Also, Examiner refers Applicant to MPEP § 2106.04 (a) III (B): “The use of a physical aid (e.g., pencil and paper or a slide rule) to help perform a mental step does not negate the mental nature of the limitation, but simply accounts for variations in memory capacity from one person to another. The use of "physical aids" in implementing the abstract mental process, does not preclude the claim from reciting an abstract idea. See MPEP § 2106.04(a) III C. Thus, Examiner maintains that Claims 1-20 still recite a mental process.
Alternatively, with respect to “Mathematical Concepts” category, Examiner refers Applicant to MPEP § 2106.04 (a) (2) (I) (C): “A claim that recites a mathematical calculation, when the claim is given its broadest reasonable interpretation in light of the specification, will be considered as falling within the "mathematical concepts" grouping.” “It is important to note that a mathematical concept need not be expressed in mathematical symbols, because "[w]ords used in a claim operating on data to solve a problem can serve the same purpose as a formula." In re Grams, 888 F.2d 835, 837 and n.1, 12 USPQ2d 1824, 1826 and n.1 (Fed. Cir. 1989). See, e.g., SAP America, Inc. v. InvestPic, LLC, 898 F.3d 1161, 1163, 127 USPQ2d 1597, 1599 (Fed. Cir. 2018) (holding that claims to a ‘‘series of mathematical calculations based on selected information’’ are directed to abstract ideas); Digitech Image Techs., LLC v. Elecs. for Imaging, Inc., 758 F.3d 1344, 1350, 111 USPQ2d 1717, 1721 (Fed. Cir. 2014) (holding that claims to a ‘‘process of organizing information through mathematical correlations’’ are directed to an abstract idea).” Furthermore, see MPEP § 2106.05 (c): “For data, mere "manipulation of basic mathematical constructs [i.e.,] the paradigmatic ‘abstract idea,’" has not been deemed a transformation. CyberSource v. Retail Decisions, 654 F.3d 1366, 1372 n.2, 99 USPQ2d 1690, 1695 n.2 (Fed. Cir. 2011) (quoting In re Warmerdam, 33 F.3d 1354, 1355, 1360, 31 USPQ2d 1754, 1755, 1759 (Fed. Cir. 1994)).”
Therefore, for example; in Independent Claims 1 and 11, the steps of (e.g., “calculating frequency and severity distributions for cyber security threats using a loss distribution approach” & “performing Monte Carlo simulations to generate aggregate loss distributions” & “computing redundancy and synergy coefficients using weighted matrix calculations”) can be performed as “Mathematical Concepts” via mathematical calculations or mathematical relationships.
Accordingly, Examiner maintains that Claims 1-20 are directed to abstract ideas under “Mental Processes” or “Mathematical Concepts” or “Certain Methods of Organizing Human Activities” Groupings under 35 U.S.C. § 101 Step 2A Prong 1.
Argument #2:
(B). Applicant argues that Claims 1-20 recite additional elements that integrate the judicial exception into a practical application under revised step 2a prong two of the 35 U.S.C. § 101 analysis (see Applicant Remarks, Pages 6-7 of 10, dated 07/17/2026). Examiner respectfully disagrees.
Specifically, Applicant argues that the “automatic configuration limitation” provides a practical application with real-world technological effects. The limitation “managing a configuration of an application based on the subset of cyber security related projects” as recited by amended claim 1 goes beyond merely identifying or organizing projects and actually implements technical changes to computer security infrastructure (see Applicant’s Remarks, last ¶ of Page 9 thru 1st ¶ of Page 10, dated 12/02/2025). Examiner respectfully disagrees.
In response to Applicant’s arguments here for step 2a prong 2, Examiner points that despite the assertion of “real-world technological effects” of managing a configuration for a subset of cybersecurity related projects for Independent Claims 1 and 11, the following points below demonstrate the claims remain patent ineligible because they are “directed to” the recited abstract ideas”. First, recitation of a generic results rather than a technical solution, Under the court case of Recentive Analytics v. Fox (Fed. Cir. 2025), a claim does not integrate an abstract idea into a practical application if it merely recites a result (selecting and implementing a configuration) without describing the specific technical mechanism by which the computer or network is improved. Independent Claims 1 and 11 do not describe how the application is reconfigured – such as modifying specific code, ports or protocols, but instead describes the outcome of the earlier mathematical modeling (see MPEP § 2106.05 (h)). Secondly, “managing a configuration” is an “apply it” instruction that uses a generic computer to execute the choices derived from the abstract project selection (see MPEP § 2106.05 (f)). Merely implementing a business-level decision (which projects to fund/use) on a computer system does not transform the underlying organizational or mathematical method into a technical one.
The additional limitation shown in Independent Claims 1 and 11 recites “automatically managing a configuration of an application to implement the subset of cybersecurity related projects”. The claims do not specify: what application is configured; what configuration parameters are modified; how the configuration is changed; what technical settings are altered; how the optimization affects software operation and/or how computer performance is improved.
The claims merely recite the desired functional result of managing an application configuration. No technological mechanism is claimed. The limitation therefore merely applies the optimization results using generic computer functionality. Merely implementing the output of an abstract idea does not integrate the exception into a practical application.
Applicant argues that the claims automatically implement technical changes rather than merely displaying information. The Examiner respectfully disagrees.
Although the amended claims no longer merely display optimization results, the additional implementation step remains recited only at a high level of abstraction. The claims do not recite any specific technological improvement to: computer architecture; operating systems; network communications; application execution; memory management or cybersecurity protocols. Rather, the claims simply state that an application configuration is managed based upon the optimization output. Such generalized implementation constitutes insignificant post-solution activity under the 2019 PEG.
Applicant argues that the ordered combination integrates the exception into a practical application. The Examiner respectfully disagrees. The ordered combination recites: calculating distributions; performing simulations; computing coefficients; solving optimization problems; selecting projects and managing an application configuration. When viewed individually and as an ordered combination, the claims perform mathematical modeling to determine which cybersecurity projects should be implemented. The final implementation step merely applies the mathematical optimization. The mathematical analysis remains the focus of the claims. Accordingly, the ordered combination does not integrate the judicial exception into a practical application.
Applicant relies upon SRI International as analogous to Claims 1-20 of the instant application for 35 U.S.C. 101 step 2a prong 2 purposes. The Examiner respectfully disagrees that SRI is analogous. In SRI International, the claims improved network security technology by detecting previously unknown network intrusions through a specific distributed network monitoring architecture. The Federal Circuit emphasized that the claims improved the operation of network security systems themselves. In contrast, the present claims do not improve network intrusion detection, packet analysis, firewall operation, authentication, malware detection, or network monitoring. Instead, the claims mathematically determine which cybersecurity projects should be selected and then generally recite managing an application configuration. The claims therefore improve organizational decision-making regarding cybersecurity investments rather than improving cybersecurity technology itself. Accordingly, SRI is distinguishable.
Because the claims do not reflect a technological improvement to the computer or network, but rather automate a complex financial and organizational risk-assessment process – the “automatic configuration” step is insufficient to render the claims patent eligible under 35 U.S.C. § 101 step 2a prong 2. Therefore, Examiner maintains that Claims 1-20 remain patent ineligible under 35 U.S.C. § 101 step 2a prong 2 as not reciting additional elements to integrate the judicial exception into a practical application.
Argument #3:
(C). Applicant argues that Claims 1-20 recite additional elements that amount to significantly more than the recited judicial exceptions under revised step 2B of the 35 U.S.C. § 101 analysis (see Applicant Remarks, Pages 7-8 of 10, dated 07/17/2026). Examiner respectfully disagrees.
Specifically, Applicant argues that the amended claim limitations in Independent Claims 1 and 11 for example notes that the technical elements are not well-understood, routine and conventional when considered as the specific ordered combination, and that the Applicant notes that the amended features represents a non-conventional application that integrates multiple technical domains in a specific manner to solve the technical problem of cyber security resource optimization under step 2B of the 35 U.S.C. § 101 analysis (see Applicant’s Remarks, 3rd-4th ¶’s of Page 7, dated 07/17/2026). Examiner respectfully disagrees.
In response, Examiner refers Applicant to Examiner’s 35 U.S.C. 101 analysis section (e.g., Claim Rejections - 35 U.S.C. § 101 section shown below) shown for step 2B particularly for Independent Claims 1 and 11. The claims do not recite additional elements that amount to significantly more than the recited judicial exceptions, because they are merely directed to the particulars of the abstract idea and likewise do not add significantly more to the above-identified judicial exceptions. The limitations are directed to limitations referenced in MPEP § 2106.05I.A. that are not enough to qualify as significantly more when recited in these claims with the abstract idea which include: (1) adding the words “apply it” (or an equivalent) with the judicial exception, (2) or mere instructions to implement an abstract idea on a computer and providing the results to the user on a computer, and (3) generally linking the use of the judicial exception to a particular technological environment or field of use.
For instance, under 35 U.S.C. § 101, the provided claim steps are patent ineligible because they are "directed to" an abstract idea and lack an "inventive concept" to transform them into a patent-eligible application. This analysis focuses on Step 2B of the Alice/Mayo framework, as updated by 2025 USPTO guidance and Federal Circuit precedent. Step 2B determines whether the claim recites an "inventive concept"—additional elements that amount to significantly more than the judicial exception. Independent Claims 1 and 11 does not include additional elements that are sufficient to amount to significantly more than the recited judicial exceptions due to the following reasons shown below. First, generic computer implementation. The use of an “optimization engine comprising an evolutionary algorithm” and a generic computer to perform the calculations. The Supreme Court in Alice Corp and subsequent Federal Circuit cases confirm that merely automating an abstract idea on a general-purpose computer is insufficient to confer eligibility. The claims lack a specific, non-conventional technical solution or an improvement to the computer’s functionality itself. Secondly, field of use limitations. Applying known mathematical and organizational ideas to the new field of “cybersecurity” risk assessment is merely a field-of-use limitation. This does not add significantly more to the abstract ideas.
The argument that the specific combination of LDA, Monte Carlo and evolutionary algorithms solves a “technical problem” through a non-conventional application” fails for the following reasons. One problem-solution mismatch. The “technical problem” of optimally allocating limited computational security resources” is actually a fundamental economic and organizational risk-management problem. Using math to decide how to spend money or deploy assets is an abstract business practice, not a technical solution to a computer-centric problem like increasing network throughput or hardware efficiency. (2) Aggregating Mathematical Concepts. Simply stringing multiple mathematical steps together (LDA -> Monte Carlo -> Matrices -> Optimization) does not result in a technical improvement. The USPTO’s July 2024 AI guidance notes that an ordered combination of abstract ideas that merely results in an “improved mathematical process” remains ineligible. Thirdly, lack of specific technological change. The claims lack a concrete, non-conventional technical implementation. They do not describe a particular way a security control is reconfigured at a machine level-such as a novel encryption handshake or firewall architecture – but rather claim the idea of a desired outcome (an optimized subset). Standard implementation: Integrating “multiple technical domains” (statistics and cybersecurity) is a common cross-disciplinary practice. The Federal Circuit maintains that merely applying computer techniques to solve a problem in a different field is not an inventive concept.
The Applicant argues that combining Loss Distribution Approach (LDA), Monte Carlo simulations, weighted matrices, and automated configuration is non-conventional.
This combination represents the routine automation of known financial/risk modeling techniques applied to a familiar context (cybersecurity). Monte Carlo simulations and LDA are standard actuarial and risk management tools. Applying them to calculate cyber risk, then using weighted matrices to prioritize actions, is the conventional, logical, and expected use of data processing systems to optimize resource allocation. Implementing a known mathematical algorithm or method on a computer is well-understood, routine, and conventional in the relevant field of cybersecurity. The rejection is not based upon whether Monte Carlo simulation, evolutionary algorithms, or statistical analysis were individually known. Rather, under Alice, mathematical concepts remain abstract regardless of novelty. Furthermore, the additional computer implementation consists only of generic processors executing programming instructions and generally managing an application configuration. Applicant has not identified any specific technological mechanism demonstrating that the claimed application configuration changes computer functionality in an unconventional manner. Accordingly, the additional elements, individually and as an ordered combination, merely implement the abstract mathematical analysis using generic computer technology.
Applicant claims the automatic security control configuration is a non-conventional step. Automatic security control configuration is a standard industry practice designed to reduce human error, manage configuration drift, and improve operational efficiency, as described in Automated Security Control Assessment (ASCA) literature. Setting up automated tools to remediate or configure based on risk output is precisely what modern security automated platforms are designed to do. Merely automating a process that was previously performed manually—or setting a computer to perform its routine functions (collecting, analyzing, and applying a formula)—does not add significantly more to the abstract idea. Applicant then argues that the specification combination of elements are non-conventional. The individual elements (LDA, Monte Carlo, matrix calculations) are standard analytical techniques. As the Federal Circuit held, merely combining known, routine tools in a "specific" manner does not inherently provide an inventive concept if the underlying components are conventional. The "combination" here is simply the functional orchestration of standard IT security functions (risk assessment + automated action). Last reason Examiner notes is that the asserted business improvements are results-oriented for optimizing cybersecurity resources. However, Examiner points out that the improvement of "resource optimization" is a generic result or desired outcome, rather than a technical improvement to the computer system itself (e.g., faster, more efficient processing).
Applicant argues that automatic configuration provides significantly more. The Examiner respectfully disagrees. The automatic configuration limitation is recited functionally. The claims do not specify: configuration files; registry changes; firewall rule generation; policy deployment; software installation; access control modification; network configuration; encryption configuration; endpoint configuration and application execution changes. Absent such technological details, the claimed configuration merely represents implementation of the optimization results. Such generalized implementation is insufficient to supply an inventive concept.
The dependent claims recite additional mathematical limitations, including: Poisson distributions; log-normal distributions; Monte Carlo simulations; weighted averages; Knapsack optimization; utility functions and budget constraints. These additional limitations further define the abstract mathematical analysis but do not improve computer technology or integrate the judicial exception into a practical application. Accordingly, Claims 2-10 and 12-20 remain patent ineligible for substantially the same reasons as independent Claims 1 and 11.
Moreover, these claims merely recite the use of computer components as a tool to automate a business decision (risk management). Examiner notes that the ordered combination of these steps in a "cybersecurity" context constitutes a routine application of well-known techniques, which does not provide an inventive concept beyond the abstract idea of computing risk and allocating resources based on it. Therefore, under Step 2B, Claims 1-20 does not include additional elements that are sufficient to amount to significantly more than the recited judicial exceptions
Argument #4:
(D). Applicant argues that the technical elements are not well-understood, routine and conventional when considered as the specific ordered combination amounts to significantly more than the recited judicial exceptions under revised step 2B of the 35 U.S.C. § 101 analysis (see Applicant Remarks, 3rd-4th ¶’s of Page 7, dated 07/17/2026). Examiner respectfully disagrees.
Examiner refers Applicant to BSG Tech LLC v. Buyseasons Inc. decision (Aug. 15, 2018) court case noting that: “But the relevant inquiry is not whether the claimed invention as a whole is unconventional or non-routine. At Step two, we “search for an ‘inventive concept’… that is sufficient to ensure that the patent in practice amounts to significantly more than a patent upon the [ineligible concept] itself.” Alice, 134 S. Ct. at 2355 (internal quotation marks omitted) (quoting Mayo, 566 U.S. at 72-73). But this simply restates what we have already determined is an abstract idea. At Alice step two, it is irrelevant whether considering historical usage information while inputting data may have been non-routine or unconventional as a factual matter. As a matter of law, narrowing or reformulating an abstract idea does not add “significantly more” to it. See SAP Am., Inc. v. InvestPic, LLC. No. 2017-2081, slip op. at 14 (Fed. Cir. 2018).
Additionally, Examiner submits that the question of novelty and non-obviousness evidence (application of prior art) is not relevant to the question of determining whether the claims as constructed contain an inventive concept. Lastly, Examiner cites the case of (Two-Way Media v. Comcast, (Fed. Cir. 2017)) and the District Court from this case concluded that “the proffered materials are irrelevant to the § 101 motion for judgment on the pleadings. None of the proffered materials addresses a § 101 challenge to claims of the asserted patents. The novelty and non-obviousness of the claims under §§ 102 and 103 does not bear on whether the claims are directed to patent-eligible subject matter under § 101. . . . Because the proffered materials are irrelevant to the instant § 101 issue, I have not considered them.” The appeal to Federal Circuit Court affirmed the District Court’s ruling that “eligibility and novelty are separate inquiries”. Therefore, in conclusion, Applicant’s suggestion that specific limitations (or the claimed invention as a whole) must be shown to be well-understood, routine, and conventional to support the conclusion of subject matter ineligibility for 35 U.S.C. § 101 of Independent Claims 1 and 14 is not persuasive.
The claim elements, when viewed as an ordered combination, does not amount to significantly more than the abstract ideas of mathematical concept modeling and risk management. Therefore, under Step 2B, Claims 1-20 does not include additional elements that are sufficient to amount to significantly more than the recited judicial exceptions. Thus, Claims 1-20 are ineligible with respect to the 35 U.S.C. § 101 analysis.
Claim Rejections - 35 USC § 101
9. 35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
10. Claims 1-20 are rejected under 35 U.S.C. § 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1: Claims 1-20 are focused to a statutory category namely, a “method” or a “process” (Claims 1-10) and a “system” or an “apparatus” (Claims 11-20).
Step 2A Prong One: Independent Claims 1 and 11 recites limitations that set forth the abstract idea(s), namely (see in bold except where strikethrough):
“” (see Independent Claim 11);
“” (see Independent Claim 11);
“identifying cyber security related projects used to protect entity assets” (see Independent Claims 1 and 11);
“calculating frequency and severity distributions for cyber security threats using a Loss Distribution Approach” (see Independent Claims 1 and 11);
“performing Monte Carlo simulations to generate aggregate loss distributions based on the frequency and severity distributions” (see Independent Claims 1 and 11);
“computing redundancy and synergy coefficients for pairs of the cyber security related projects using weighted matrix calculations” (see Independent Claims 1 and 11);
“solving, based on the aggregate loss distributions and redundancy and synergy coefficients, an optimization programming problem to identify project synergies to select a subset of cyber security related projects that optimize expected loss reduction from cyber security related threats” (see Independent Claims 1 and 11);
“automatically managing a configuration of an application to implement the subset of cyber security related projects, wherein the configuration is based on the optimization programming problem ” (see Independent Claims 1 and 11).
Here, for Independent Claims 1 and 11, the abstract ideas recite managing business risk by using mathematical models to evaluate potential projects and optimize the selection of a project portfolio. More specifically, the abstract idea is mathematical calculation, data analysis, and mathematical optimization of cyber security project selection based on risk modeling, falling under the judicial exception categories of Mental Processes and Certain Methods of Organizing Human Activities (commercial/risk management concepts). It is fundamentally a risk assessment and resource allocation method implemented using mathematical techniques (such as Monte Carlo simulations and optimization algorithms) in the field of cybersecurity risk management.
The steps of calculating frequency and severity distributions for cyber security threats using a loss distribution approach, performing Monte Carlo simulations to generate aggregate loss distributions, computing redundancy and synergy coefficients using weighted matrix calculations and solving an optimization programming problem using an optimization engine are “Mathematical Concepts” which fall under (1) mathematical calculations or (2) mathematical relationships. These processes heavily rely on mathematical operations and models. Merely using complex math, even for a new purpose like cybersecurity risk, does not make the underlying concepts eligible. Additionally or alternatively, identifying cyber security related projects used to protect entity assets, selecting a subset of cybersecurity related projects that optimize expected loss reduction from cyber security related threats (related to project portfolio management and optimizing business outcomes) and managing a configuration of an application based on the subset of projects (related to implementing business decisions) are “Certain Methods of Organizing Human Activities” which fall (3) fundamental economic and business principles/practices (including mitigating risk) such as risk management, project portfolio selection and optimizing resource allocation or (4) managing personal behavior (including teachings or following rules or instructions).
Additionally or alternatively, the steps of identifying projects, evaluating the effectiveness of projects through calculation (can be a mental step, even if assisted by a machine) and selecting the optimal subset of projects are “Mental Processes” which falls under (5) concepts performed in the human mind (including observations or evaluations or judgments) or (6) using pen and paper as a physical aid, which in order to help perform these mental steps does not negate the mental nature of these limitations. The overall process of identification, evaluation and selection can be performed by a human mind (e.g., a risk manager evaluating options in a spreadsheet) using observation, judgment and basic calculation. The use of "physical aids" in implementing the abstract mental process, does not preclude the claim from reciting an abstract idea. See MPEP § 2106.04(a) III C.
Independent Claims 1 and 11: The claim recites steps of "calculating frequency and severity distributions," "performing Monte Carlo simulations," "computing redundancy and synergy coefficients," and "solving an optimization programming problem algorithm." These limitations recite mathematical concepts, data analysis, and mental processes that can be performed in the human mind or via generic mathematical computation.
That is, other than reciting (e.g., “optimization programming problem algorithm” & “optimization engine” & “evolutionary algorithm”), nothing in the claim elements precludes the steps from being performed as “Mental Processes” which pertains to (1) concepts performed in the human mind (including observations or evaluations or judgments) or (2) using pen and paper as a physical aid and additionally or alternatively as “Certain Methods of Organizing Human Activities” which pertains to (3) managing personal behavior (including teachings or following rules or instructions) or (4) fundamental economic and business principles/practices (including mitigating risk) and additionally or alternatively as “Mathematical Concepts” which pertains to (5) mathematical calculations or (6) mathematical relationships.
Therefore, at step 2a prong 1, Yes, Claims 1-20 recites an abstract idea. We proceed onto analyzing the claims at step 2a prong 2.
Step 2A Prong Two: With respect to Step 2A Prong Two of the eligibility inquiry (as explained in MPEP § 2106.04(d)), the judicial exception is not integrated into a practical application. Independent Claim 11 recites additional elements directed to: (e.g., “a processor” & “a non-transitory, processor-readable storage medium”). These additional elements have been considered individually and in combination, but fail to integrate the abstract idea into a practical application because they amount to using computing elements or instructions (software) to perform the abstract idea, similar to adding the words “apply it” (or an equivalent), which merely serves to link the use of the judicial exception to a particular technological environment. See MPEP § 2106.05(f) and MPEP § 2106.05(h).
Independent Claims 1 and 11: With respect to reliance on additional elements such as (e.g., “optimization programming problem algorithm” & “optimization engine” & “evolutionary algorithm” & “automatically”) shown in Independent Claims 1 and 11 when considered individually and as an ordered combination (as a whole) in view of these claim limitations, these additional elements do not provide limitations that are indicative of integration into a practical application under step 2a prong 2 due to: (1) field of use limitations -> such as applying an abstract idea to a new or particular field of use (cybersecurity risk assessment) is generally insufficient on its own to confer eligibility (see MPEP § 2106.05 (h)). The focus remains on the underlying abstract nature of the process. The claims describe a result (optimizing loss reduction) without specifying how this results in a concrete, non-abstract technical solution beyond the calculations themselves. (2) Lack of a specific technical solution -> such as the claims lack a concrete, machine-specific implementation or a specific non-conventional technol solution to a technical problem. The “managing a configuration of an application” is a functional description of a desired outcome, not a detailed, unconventional technical method that “improves” the technological field of computer security. These additional elements shown in Independent Claims 1 and 11 do not provide limitations that are indicative of integration into a practical application under step 2a prong 2 due to: reciting mere instructions to implement an abstract idea on a computer or using a computer as a tool to “apply” the recited judicial exceptions by providing the results to the user on a computer (see MPEP § 2106.05 (f)).
Here, we look to see if the claim improves a technological process or if the mathematical/mental steps are merely tied to a generic environment. While Independent Claims 1 and 11 ends with the claim limitations of: "automatically managing a configuration of an application... to implement the subset of cyber security related projects," the optimization itself does not improve the functioning of the computer or application technology; rather, it uses the computer as a tool to execute math and change application configuration settings based on an abstract risk score. The abstract mathematical optimization and risk evaluation are not integrated into a practical application that improves technological performance. It is treated as an implementation of a mathematical concept.
In addition, these limitations fail to provide an improvement to the functioning of a computer or to any other technology or technical field, fail to apply the exception with a particular machine, fail to apply the judicial exception to effect a particular treatment or prophylaxis for a disease or medical condition, fail to effect a transformation of a particular article to a different state or thing, and fail to apply/use the abstract idea in a meaningful way beyond generally linking the use of the judicial exception to a particular technological environment.
Accordingly, because the Step 2A Prong One and Prong Two analysis resulted in the conclusion that the claims are directed to an abstract idea, additional analysis under Step 2B of the eligibility inquiry must be conducted in order to determine whether any claim element or combination of elements amount to significantly more than the judicial exception. Therefore, at step 2a prong 2, Claims 1-20 are directed to the abstract idea and do not recite additional elements that integrate into a practical application.
Step 2B: (As explained in MPEP § 2106.05), it has been determined that the claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. Independent Claim 11 recites additional elements directed to: (e.g., “a processor” & “a non-transitory, processor-readable storage medium”). These elements have been considered individually and in combination, but fail to add significantly more to the claims because they amount to using computing elements or instructions (software) to perform the abstract idea, similar to adding the words “apply it” (or an equivalent), which merely serves to link the use of the judicial exception to a particular technological environment (computing environment) and does not amount to significantly more than the abstract idea itself. See MPEP § 2106.05(f) and MPEP § 2106.05(h). Notably, Applicant’s Specification suggests that the claimed invention relies on nothing more than a general-purpose computer executing the instructions to implement the invention (see at least Applicant’s Specification ¶ [0044]: “FIG. 5 illustrates an example computer 505. Computer 505 can include a processor 510 suitable for the execution of a computer program, and can include, by way of example, both general and special purpose microprocessors, and any one or more processor of any kind of digital computer”.
Independent Claims 1 and 11: With respect to reliance on additional elements such as (e.g., “optimization programming problem algorithm” & “optimization engine” & “evolutionary algorithm” & “automatically”) shown in Independent Claims 1 and 11 when considered individually and as an ordered combination (as a whole) in view of these claim limitations, these additional elements do not recite additional elements that amount to significantly more than the recited judicial exceptions under step 2B due to: (1) field of use limitations -> such as applying an abstract idea to a new or particular field of use (cybersecurity risk assessment) is generally insufficient on its own to confer eligibility (see MPEP § 2106.05 (h)). The focus remains on the underlying abstract nature of the process. The claims describe a result (optimizing loss reduction) without specifying how this results in a concrete, non-abstract technical solution beyond the calculations themselves. (2) Lack of a specific technical solution -> such as the claims lack a concrete, machine-specific implementation or a specific non-conventional technol solution to a technical problem. The “managing a configuration of an application” is a functional description of a desired outcome, not a detailed, unconventional technical method that “improves” the technological field of computer security. Thirdly, these additional elements shown in Independent Claims 1 and 11 do not recite additional elements that amount to significantly more than the recited judicial exceptions under step 2B due to: reciting mere instructions to implement an abstract idea on a computer or using a computer as a tool to “apply” the recited judicial exceptions by providing the results to the user on a computer (see MPEP § 2106.05 (f)).
The additional element of “evolutionary algorithm” in general in Independent Claims 1 and 11 do not amount to significantly more than the judicial exception under step 2B due to being expressly recognized as Well-Understood, Routine and Conventional (WURC) in the art.
Examiner refers to NPL Document: “Kremmel, Thomas. Project Portfolio Decision Support Using Evolutionary Algorithms. Diss. 2008”, hereinafter Kremmel, et. al. on Page 48 -> “Evolutionary algorithms (EA) imitate nature’s behaviour, and adapt the basic principles to evolve a set of solutions towards the optimum solution of a problem. EAs are search and optimization algorithms, especially suitable to solve multi-objective optimization problems.” Kremmel, et. al. on Page 51-> “Crossover and mutation of the chromosomes are the common operations, used in evolutionary generation of new offspring.” Kremmel, et. al. on Page 62-> Synergy Effects between projects are considered in the optimization approach presented in the paper Pareto ant colony optimization: A metaheuristic approach to multi-objective selection.”
Kremmel, et. al. on Page 2 -> “Various presented approaches have proven that integer linear programming models, pareto ant colony optimization, and genetic algorithms Medaglia are generally applicable to the project selection problem. The decision to apply an evolutionary algorithm to the project selection problem is inspired by these papers.”
In addition, when taken as an ordered combination, the ordered combination adds nothing that is not already present as when the elements are taken individually. There is no indication that the combination of elements integrates the abstract idea into a practical application. Therefore, when viewed as a whole, these additional claim elements do not provide meaningful limitations to transform the abstract idea into a practical application of the abstract idea or that, as an ordered combination, amount to significantly more than the abstract idea itself.
Dependent Claims 2-10 and 12-20 recite additional elements directed to: (e.g. “Knapsack algorithm” (Dependent Claims 5 and 15)), which in conjunction with the limitations recite the same abstract idea(s) as shown in Independent Claims 1 and 11 along with further steps/details that reflect “Certain Methods of Organizing Human Activities” which pertains to (1) fundamental economic and business principles/practices (including mitigating risk) such as risk management, project portfolio selection and optimizing resource allocation or (2) managing personal behavior (including teachings or following rules or instructions) and additionally or alternatively as “Mental Processes” which pertains to (3) concepts performed in the human mind (including observations or evaluations or judgments) or (4) using pen and paper as a physical aid and additionally or alternatively as “Mathematical Concepts” which pertains to (5) mathematical calculations or (6) mathematical relationships.
Dependent Claims 2-4, 6-10, 12-14 and 16-20 further narrow the abstract ideas, and are therefore still ineligible for the reasons previously provided in Steps 2A Prong 2 and Step 2B for Independent Claims 1 and 11. Dependent Claims 5 and 15: With respect to reliance on the additional element of (e.g., “knapsack algorithm”) as shown in Dependent Claims 5 and 15 when considered both individually and as an ordered combination (as a whole) with these recited claim limitations, these additional elements do not provide limitations that are indicative of integration into a practical application under step 2a prong 2 and also do not amount to significantly more than the judicial exceptions under step 2B due to the following: (1) field of use limitations -> such as applying an abstract idea to a new or particular field of use (cybersecurity risk assessment) is generally insufficient on its own to confer eligibility (see MPEP § 2106.05 (h)). The focus remains on the underlying abstract nature of the process. The claims describe a result (optimizing loss reduction) without specifying how this results in a concrete, non-abstract technical solution beyond the calculations themselves. (2) Lack of a specific technical solution -> such as the claims lack a concrete, machine-specific implementation or a specific non-conventional technol solution to a technical problem. Alternatively, these additional elements shown in Dependent Claims 5 and 15 do not provide limitations that are indicative of integration into a practical application under step 2a prong 2 and also do not amount to significantly more than the judicial exceptions under step 2B due to the following: reciting mere instructions to implement an abstract idea on a computer or using a computer as a tool to “apply” the recited judicial exceptions by providing the results to the user on a computer (see MPEP § 2106.05 (f)).
The ordered combination of elements in the Dependent Claims (including the limitations inherited from the parent claim(s)) add nothing that is not already present as when the elements are taken individually. There is no indication that the combination of elements improves the functioning of a computer or improves any other technology. Accordingly, the subject matter encompassed by the dependent claims fails to amount to a practical application or significantly more than the abstract idea itself. Therefore, under Step 2B, Claims 1-20 does not include additional elements that are sufficient to amount to significantly more than the recited judicial exceptions. Thus, Claims 1-20 are ineligible with respect to the 35 U.S.C. § 101 analysis.
Claim Rejections - 35 USC § 103
11. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
12. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
13. Claims 1-7 and 11-17 are rejected under 35 U.S.C. 103 as being unpatentable over US PG Pub (US 2018/0322292 A1) hereinafter Tedeschi, in view of US PG Pub (US 2016/0197953 A1) hereinafter King-Wilson, in view of NPL Document: "Handling of synergy into an algorithm for project portfolio selection." Recent Advances on Hybrid Intelligent Systems. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013. 417-430, hereinafter Rivera, Gilberto, et al., and in further view of Foreign Patent Application (WO 2016/118979 A2) hereinafter Siebel, et. al.
Regarding Independent Claim 1, Tedeschi method of optimizing cyber security projects teaches the following:
- identifying cyber security related projects used to protect entity assets (see at least Tedeschi: ¶ [0012] & ¶ [0016] & ¶ [0030-0035] & ¶ [0091]. Tedeschi notes that the organization may use the initial assessment report to identify projects to address assessment objectives, by category, which are not currently being addressed within the organization. See also Tedeschi at ¶ [0012]: Cybersecurity information protection against unauthorized disclosure, alteration or modification, disruption, or destruction of systems or data is an important tool in protecting these assets. See also Tedeschi at ¶ [0016]: NIST SP 800-53 defines a set of functions for implementing the security standards. These categories include Identify, Protect, Detect, Respond, and Recover. Each of these functions include one or more categories, as well as one or more cybersecurity objectives. See also Tedeschi at ¶ [0030-0035] noting “controls to protect assets or critical functions”. See also Tedeschi at [0091]: Multiple project/assessment objective data records imported into framework database may identify projects or assessment objectives to be fulfilled by the organization's information system, to enhance cybersecurity by providing access authorization, providing security safeguards at system boundaries, and maintaining audit records.)
Tedeschi method of optimizing cyber security projects does not explicitly disclose, but King-Wilson in the analogous art for optimizing cyber security projects teaches the following limitations:
- calculating frequency (see at least King-Wilson: ¶ [0070-0074]. King-Wilson notes that the activity predictor 14 receives the observed threat data 9 from the database 10, for example by retrieving the data automatically or in response to user instruction, extrapolates future event frequency and produces a profile 13 of predicted threat activity, which includes a list of predicted threats and their expected frequency of occurrence. Each predicted threat is defined using an identifier, a name, a description, a frequency of occurrence, a category (or categories) of system attacked and a corresponding damage level for each system.) and severity distributions for cyber security threats using a Loss Distribution Approach (see at least King-Wilson: ¶ [0022] & ¶ [0058-0062] & ¶ [0068]. King-Wilson notes that the severity score (“SeverityScore”) is a measure of the impact of a successful threat. It is not a measure of the prevalence or exposure to the threat, but rather an indication of the damage that would be caused to the target system. Severity score may also be referred to as “damage level”. In this example, the severity score is a value lying in a range between 1 and 10. For example, a value of 1 can represent trivial impact and a value of 10 may represent a catastrophic effect. However, the severity score may be defined as “low”, “medium”, “high” or “critical”. See also King-Wilson at ¶ [0058]: Each observed threat is defined using an identifier, a name, a description of the threat, a temporal profile specifying frequency of occurrence of the threat, a target (or targets) for the threat and a severity score for the (or each) target. See also King-Wilson at ¶ [0022]: The apparatus may be configured to store at least one of the losses and the combined loss in a storage device. The apparatus may be configured to display at least one of the losses and the combined loss on a display device. See also King-Wilson at ¶ [0068].)
- performing Monte Carlo simulations to generate aggregate loss distributions (see at least King-Wilson: ¶ [0021] & ¶ [0028-0030] & ¶ [0082-0084] & ¶ [0174]. King-Wilson notes that the model can be implemented using a Monte Carlo simulation. This involves generating thousands of scenarios of what may happen and then calculating summary statistics from the results. See also King-Wilson at ¶ [0021]: The apparatus may be configured to determine said predicted threat activity using a Monte Carlo method. See also King-Wilson at ¶ [0028-0030]: King Wilson notes that the apparatus may comprise a third module configured to determine loss for each of a plurality of operational processes dependent on the downtimes of each of said systems and to add losses for said plurality of processes so as to obtain a combined loss arising from the threat activity. Determining loss for each of a plurality of operational processes dependent on the downtimes of the systems, adding losses for the plurality of processes to obtain a combined loss arising from the threat activity. See also King-Wilson at ¶ [0082-0084]: The predicted loss calculator 24 receives the system risk 22 and data 25 listing operational processes from a database 26, then predicts the loss for each operational process, aggregates the results for each process and outputs predicted loss data 12. The predicted loss calculator 24 considers the system risk 22 for the IT systems 30, 30 1, 30 2, 30 3, 30 4, . . . , 30 m, on which each process 31, 31 A, 31 B, 31 c, 31 D, 31 E, . . . , 31 m, depends via dependencies 32 and the value of the process and aggregates values 12 A, 12 B, 12 c, 12 D, 12 E, . . . , 12 m, for each process so as to produce a value 12 sum, as for all processes.) based on the frequency (see at least King-Wilson: ¶ [0070-0074]. King-Wilson notes that the activity predictor 14 receives the observed threat data 9 from the database 10, for example by retrieving the data automatically or in response to user instruction, extrapolates future event frequency and produces a profile 13 of predicted threat activity, which includes a list of predicted threats and their expected frequency of occurrence. Each predicted threat is defined using an identifier, a name, a description, a frequency of occurrence, a category (or categories) of system attacked and a corresponding damage level for each system.) and severity distributions (see at least King-Wilson: ¶ [0022] & ¶ [0058-0062] & ¶ [0068]. King-Wilson notes that the severity score (“SeverityScore”) is a measure of the impact of a successful threat. It is not a measure of the prevalence or exposure to the threat, but rather an indication of the damage that would be caused to the target system. Severity score may also be referred to as “damage level”. In this example, the severity score is a value lying in a range between 1 and 10. For example, a value of 1 can represent trivial impact and a value of 10 may represent a catastrophic effect. However, the severity score may be defined as “low”, “medium”, “high” or “critical”. See also King-Wilson at ¶ [0058]: Each observed threat is defined using an identifier, a name, a description of the threat, a temporal profile specifying frequency of occurrence of the threat, a target (or targets) for the threat and a severity score for the (or each) target. See also King-Wilson at ¶ [0022]: The apparatus may be configured to store at least one of the losses and the combined loss in a storage device. The apparatus may be configured to display at least one of the losses and the combined loss on a display device. See also King-Wilson at ¶ [0068].).
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi method for optimizing cyber security projects with the aforementioned teachings of: calculating frequency and severity distributions for cyber security threats using a Loss Distribution Approach & performing Monte Carlo Simulations to generate aggregate loss distributions based on the frequency and severity distributions, and in further view of King-Wilson, whereby the activity predictor receives the observed threat data from the database, for example by retrieving the data automatically or in response to user instruction, extrapolates future event frequency and produces a profile of predicted threat activity, which includes a list of predicted threats and their expected frequency of occurrence. The predicted threat activity profile may be stored in a database (see at least King-Wilson: ¶ [0070]). Additionally, the system of King-Wilson seeks to provide an improved apparatus for and a method of assessing threat to a computer network or computer networks and that stochastic modelling can help to model the effect of low-frequency, high-impact events when assessing threats involving computer networks. This can be used, for example, in capital modelling, pricing insurance and cost benefit analysis when improving network security (see at least King-Wilson: ¶ [0010-0012]).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by King-Wilson, the results of the combination were predictable.
Tedeschi / King-Wilson method of optimizing cyber security projects does not explicitly disclose, but NPL Document: "Handling of synergy into an algorithm for project portfolio selection." Recent Advances on Hybrid Intelligent Systems. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013. 417-430, hereinafter Rivera, Gilberto, et al. in the analogous art for optimizing cyber security projects teaches the following limitations:
- computing redundancy and synergy coefficients for pairs of the cyber security related projects using weighted matrix calculations (see at least Rivera, Gilberto, et al: Page 421 & Pages 423-425. Rivera teaches that Negative synergy on objective values: The benefit of two or more projects decreases when are together. For example, a project A that benefits to 100 people and a Project B benefiting 200 people. But if there are 50 people in common between both projects, the benefit of supporting both projects is 250 people instead of 300 as expected. Redundancy: Two projects can not be supported simultaneously. For example, a Project A: Building a hospital, and a Project B: building a school. But if the hospital needs to be built on the same ground that the school, only one of them can receive budget. Decrease in the cost: Two projects decrease the costs if both are supported simultaneously. For example, a project A: has a total cost of 250 monetary units, of which uses 100 to buy expensive computer equipment, and a Project B: it has a cost of 200 monetary units and also need to use similar equipment. If possible, and both projects have no problem sharing the common resource, the cost of financing both resources is 350 monetary units instead of 450 as expected. Presenting a large set of solutions will complicate the decision process of the DM, even if the solutions found belong to the Pareto front, moreover finding a single function that matches the DM’s preference, such as a weighted sum, is not simple and nor guaranteed for real problems. See also Rivera at Page 423: RPM has an algorithm that develops a comprehensive search with dynamic programming to find all optimal portfolios, which then are indexed according to the DM’s criteria through a weighted sum of the objectives. The synergy is handling by means of adding artificial projects and extra redundancy relations. See also Rivera at Pages 424-425: Rivera teaches that the benefit function is shown in Formula 13, where x is the current portfolio, i is the candidate project for being added to x, ηi is known as local knowledge, and is a measure of benefit of the project i, τi,j is the pheromone between projects i and j, and w is a weight factor between local knowledge and the pheromone. Examiner notes that the pheromone is modeled as a two-dimensional matrix with a size N×N, where N is the total of projects, so τ has two entries. τi,j is the preference of having the projects i and j in the same portfolio.)
- solving, based on the aggregate loss distributions and redundancy and synergy coefficients (see at least Rivera, Gilberto, et al: Page 421 & Pages 423-426. Rivera teaches that Negative synergy on objective values: The benefit of two or more projects decreases when are together. For example, a project A that benefits to 100 people and a Project B benefiting 200 people. But if there are 50 people in common between both projects, the benefit of supporting both projects is 250 people instead of 300 as expected. Redundancy: Two projects can not be supported simultaneously. For example, a Project A: Building a hospital, and a Project B: building a school. But if the hospital needs to be built on the same ground that the school, only one of them can receive budget. Decrease in the cost: Two projects decrease the costs if both are supported simultaneously. For example, a project A: has a total cost of 250 monetary units, of which uses 100 to buy expensive computer equipment, and a Project B: it has a cost of 200 monetary units and also need to use similar equipment. If possible, and both projects have no problem sharing the common resource, the cost of financing both resources is 350 monetary units instead of 450 as expected. Presenting a large set of solutions will complicate the decision process of the DM, even if the solutions found belong to the Pareto front, moreover finding a single function that matches the DM’s preference, such as a weighted sum, is not simple and nor guaranteed for real problems. See also Rivera at Page 423: RPM has an algorithm that develops a comprehensive search with dynamic programming to find all optimal portfolios, which then are indexed according to the DM’s criteria through a weighted sum of the objectives. The synergy is handling by means of adding artificial projects and extra redundancy relations. See also Rivera at Pages 424-425: Rivera teaches that the benefit function is shown in Formula 13, where x is the current portfolio, i is the candidate project for being added to x, ηi is known as local knowledge, and is a measure of benefit of the project i, τi,j is the pheromone between projects i and j, and w is a weight factor between local knowledge and the pheromone. Examiner notes that the pheromone is modeled as a two-dimensional matrix with a size N×N, where N is the total of projects, so τ has two entries. τi,j is the preference of having the projects i and j in the same portfolio.), an optimization programming problem algorithm (see at least Rivera, Gilberto, et. al: Page 421 & Pages 423-425. Rivera teaches that P-ACO (Pareto Ant Colony Optimization) is an algorithm based on the known metaheuristic of Ant Colony to generate the Pareto front with the most efficient portfolios. Each ant generates a candidate portfolio, and the amount of pheromone deposited by such ant is inversely proportional to the number of solutions that dominate it. The algorithm stores the solutions that have never been dominated, which form an approximation of the Pareto front. P-ACO is able to deal with the synergy between projects, salient characteristic in the algorithm. The algorithm only considers the handling of synergy between groups of two projects. No consideration is made about the DM’s preferences and the synergy is handling by modifying the multiobjective function.), using an optimization engine (see at least Rivera, Gilberto, et. al: Page 426. Rivera notes that computer equipment dual-processor Xeon (TM) CPU 3.06 GHz in parallel and 4 GB RAM.) comprising an evolutionary algorithm (see at least Rivera, Gilberto, et. al: Page 418 & Page 421 & Pages 423-425. Rivera teaches providing the means of algorithms pertaining to the social portfolio problem (SPP), also pareto ant colony optimization (ACO) algorithm, robust portfolio modeling algorithm, scatter search for project portfolio selection and deterministic heuristic algorithms shown at Pages 423-424.), to identify project synergies (see at least Rivera, Gilberto, et. al: Page 426 & Figs. 2-3 on (Pages 427-428). Rivera teaches Addressed synergy types: Redundancy and synergy in objective functions (negative and positive). For instances of 25 projects, there are between three and six synergetic relations; for instances of 100 projects, between 12 and 24. See also Rivera noting the project synergies of instances of 100 projects in Fig. 2 and synergy showing the execution time on instances of 100 projects in Fig. 3.) to select a subset of cyber security related projects that optimize expected loss reduction from cyber security related threats (see at least Rivera, Gilberto, et al: Pages 418-419 & Page 421. Rivera teaches that previous works on the formation of project portfolio with synergy have been proposed [3, 6, 18, 20], it has made evident the lack of methods that also include the decision maker’s preferences. This work presents an Ant Colony Optimization (ACO) Algorithm that searches a Pareto frontier subset that matches the DM’s criteria for selecting a portfolio. From a set of all proposed projects competing for resources, denoted as X, a portfolio may be defined as a subset of them. See also Rivera at Page 424: The next project selection jx is the next project to be incorporated in portfolio x, X is the project list, Ω(x,i) is a function that evaluates the expected benefit to incorporate i to portfolio x, L is the roulette selection function based on Ω(x,i), ℓ is a function that randomly selects an available project. See also Rivera at [abstract] on Page 417: With a number of candidate projects bigger than those ones that can be funded, the organization faces the problem of selecting a portfolio of projects that maximizes the expected benefits. See also Rivera at Page 427: For instances of 100 projects, it was not possible to perform an enumerative search. The preference model was applied to the results provided by each version of the algorithm, and the amount of NOS found for each was counted. Figure 2 presents these results. The performance difference in favor of “synergy in the objective function” was 15% on average. Furthermore, significant differences in the execution time were observed. In Figure 3 shows the time run consumed by each version of the algorithm. The time reduction averaged 11% by using “synergy in the objective function”. See also Rivera at Page 428: On the test instances used, there was an average increase of 15% in performance, and a 11% reduction of consumed time, by adapting the objective function instead of adding artificial projects.).
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson method for optimizing cyber security projects with the aforementioned teachings of: computing redundancy and synergy coefficients for pairs of the cyber security related projects using weighted matrix calculations and solving, based on the aggregate loss distributions and redundancy and synergy coefficients, an optimization programming problem algorithm, using an optimization engine comprising an evolutionary algorithm, to identify project synergies to select a subset of cyber security related projects that optimize expected loss reduction from cyber security related threats, and in further view of Rivera, whereby several algorithms have been developed to solve SPP with synergy, which range from deterministic heuristic algorithms to more sophisticated metaheuristic techniques. The options in the handling of synergy have been basically two: 1) Modifying the Multi-objective evaluation function and 2) Adding artificial projects representing the synergic group, and then add redundancy relations that prevent the artificial project appears at the same portfolio that some project of that group (see at least Rivera: [on Page 423]).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by Rivera, the results of the combination were predictable.
Tedeschi / King-Wilson / NPL Document: "Handling of synergy into an algorithm for project portfolio selection." Recent Advances on Hybrid Intelligent Systems. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013. 417-430, hereinafter Rivera, Gilberto, et al. method of optimizing cyber security projects does not explicitly disclose, but Siebel in the analogous art for optimizing cyber security projects teaches the following limitations:
- automatically managing a configuration of an application to implement the subset of cyber security related projects (see at least Siebel: ¶ [0091] & ¶ [0096] & ¶ [0129] & ¶ [0213]. Siebel teaches that implementations may obtain, aggregate, store, manage, process, and/or expose extremely large volumes of data from various sources as well as provide powerful and integrated data management, analytic, machine learning, application development, and/or other tools. Some embodiments may include a model driven architectures that includes a type system. In at least one implementation, a PaaS platform is disclosed for the design, development, deployment, and operation of IoT applications and business processes. See at least Siebel at ¶ [0091]: IoT platform development efforts to date are attempts to develop a solution from differing subsets of the many independent software components that are collectively known as the open-source Apache Hadoop™ stack. See at least Siebel at ¶ [0129]: System 200 is used and extended over time, continual support for new patterns/optimizations or other features useful for big data, IoT, and/or cyber-physical systems can be implemented to benefit a large number of types and/or applications. If improvements to a machine learning algorithm have been made, these improvements will be immediately available to any other types or applications that utilize that algorithm, potentially without any changes needed to the other types or business logic for applications. See at least Siebel at ¶ [0213]: Mathematically, they determine the strength of the growth as a function of the square of the number of applications. Additional scaling factors may determine the degree of synergy between the applications within an integrated, cloud based, enterprise platform, and therefore the extent to which data integrated for one application can be used for another application. Mathematically, they determine how quickly the total cost of each additional application decreases relative to the previous application. See at least Siebel at ¶ [0323]: “Commercial object-relational mapping data access frameworks such as Hibernate may be used to prepare the data access frameworks. There are, however, trade-offs to consider related to the level of control for data access performance optimization. Master data should be accessed and updated using service-oriented architecture principles to expose features as services accessible over VPN.” See at least Siebel at ¶ [0406-0409]: Communications by or between smart devices, head-end systems, processing nodes, storage nodes, applications, a service bus, or any other system may be encrypted. For example, secured data communications may utilize robust and configurable security protocols such as SSL, IPsec or any other secure communications.), wherein the configuration is based on the optimization programming problem algorithm (see at least Siebel: ¶ [0129] & ¶ [0363] & ¶ [0446-0447] & ¶ [0550]. Siebel teaches that the benchmark performance and set up for a configuration illustrated in FIG. 19. See also Siebel at ¶ [0367]: The benchmark tests were conducted using a custom benchmark energy platform hosted on Amazon Web Services (AWS). The components and configurations of the benchmark platform architecture are included in Table 2 below. See also Siebel at ¶ [0446-0447]: The application is used to support day-to-day operations, including remote configuration changes. System operators and engineers may use the sensor and network health application to: prioritize operational issues across millions of different, distributed assets and make more informed maintenance decisions and “remotely update asset configuration at the individual asset level or for a cluster of assets using the bulk action functionality”. See also Siebel noting “optimization programming problem algorithm” at ¶ [0550]. For example; the machine learning and predictions module 3217 can implement one or more varieties of machine learning algorithms to enhance analytics on industry data. The machine learning and predictions module 3217 can perform a variety of functions, such as processing basic statistics, such as summary statistics, correlations, stratified sampling, hypothesis testing, and random data generation; classification and regression using linear models (e.g., SVMs, logistic regression, linear regression, generalized linear models), decision trees, naive Bayes; collaborative filtering, such as alternating least squares (ALS); clustering, such as k-means; dimensionality reduction, such as singular value decomposition (SVD), principal component analysis (PCA); feature extraction and transformation; feature selection, such as orthogonal matching pursuit and greedy forward selection; and optimization (developer), such as stochastic gradient descent, limited-memory BFGS (L-BFGS), and Newton's method.)
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera method for optimizing cyber security projects with the aforementioned teachings of: automatically managing a configuration of an application to implement the subset of cyber security related projects, wherein the configuration is based on the optimization programming problem algorithm, and in further view of Siebel, whereby scaling factors may determine the degree of synergy between the applications within an integrated, cloud based, enterprise platform, and therefore the extent to which data integrated for one application can be used for another application. Mathematically, they determine how quickly the total cost of each additional application decreases relative to the previous application (see at least Siebel: ¶ [0213].). In summary, significant up-front and ongoing costs can be avoided by taking the platform approach of FIG. 8 instead of deploying multiple point applications of FIG. 9. These cost savings result from lower cost application and data integration costs; avoided hardware and software infrastructure costs; lower ongoing maintenance, support, and operations costs; and avoided procurement expenses (see at least Siebel: ¶ [0214].).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by Siebel, the results of the combination were predictable.
Regarding Independent Claim 11, Tedeschi system of optimizing cyber security projects teaches the following:
- a processor (see at least Tedeschi: ¶ [0042] & Fig. 1. Tedeschi notes that each server 110 may include one or more processors executing specific computer-executable instructions within a memory coupled to each server 110.);
- a non-transitory, processor-readable storage medium, wherein the non-transitory, processor-readable storage medium comprises one or more programming instructions that, when executed, cause the processor to (see at least Tedeschi: ¶ [0042-0043] & Figs. 1-2.):
- identifying cyber security related projects used to protect entity assets (see at least Tedeschi: ¶ [0012] & ¶ [0016] & ¶ [0030-0035] & ¶ [0091]. Tedeschi notes that the organization may use the initial assessment report to identify projects to address assessment objectives, by category, which are not currently being addressed within the organization. See also Tedeschi at ¶ [0012]: Cybersecurity information protection against unauthorized disclosure, alteration or modification, disruption, or destruction of systems or data is an important tool in protecting these assets. See also Tedeschi at ¶ [0016]: NIST SP 800-53 defines a set of functions for implementing the security standards. These categories include Identify, Protect, Detect, Respond, and Recover. Each of these functions include one or more categories, as well as one or more cybersecurity objectives. See also Tedeschi at ¶ [0030-0035] noting “controls to protect assets or critical functions”. See also Tedeschi at [0091]: Multiple project/assessment objective data records imported into framework database may identify projects or assessment objectives to be fulfilled by the organization's information system, to enhance cybersecurity by providing access authorization, providing security safeguards at system boundaries, and maintaining audit records.)
Tedeschi system of optimizing cyber security projects does not explicitly disclose, but King-Wilson in the analogous art for optimizing cyber security projects teaches the following limitations:
- calculating frequency (see at least King-Wilson: ¶ [0070-0074]. King-Wilson notes that the activity predictor 14 receives the observed threat data 9 from the database 10, for example by retrieving the data automatically or in response to user instruction, extrapolates future event frequency and produces a profile 13 of predicted threat activity, which includes a list of predicted threats and their expected frequency of occurrence. Each predicted threat is defined using an identifier, a name, a description, a frequency of occurrence, a category (or categories) of system attacked and a corresponding damage level for each system.) and severity distributions for cyber security threats using a Loss Distribution Approach (see at least King-Wilson: ¶ [0022] & ¶ [0058-0062] & ¶ [0068]. King-Wilson notes that the severity score (“SeverityScore”) is a measure of the impact of a successful threat. It is not a measure of the prevalence or exposure to the threat, but rather an indication of the damage that would be caused to the target system. Severity score may also be referred to as “damage level”. In this example, the severity score is a value lying in a range between 1 and 10. For example, a value of 1 can represent trivial impact and a value of 10 may represent a catastrophic effect. However, the severity score may be defined as “low”, “medium”, “high” or “critical”. See also King-Wilson at ¶ [0058]: Each observed threat is defined using an identifier, a name, a description of the threat, a temporal profile specifying frequency of occurrence of the threat, a target (or targets) for the threat and a severity score for the (or each) target. See also King-Wilson at ¶ [0022]: The apparatus may be configured to store at least one of the losses and the combined loss in a storage device. The apparatus may be configured to display at least one of the losses and the combined loss on a display device. See also King-Wilson at ¶ [0068].)
- performing Monte Carlo simulations to generate aggregate loss distributions (see at least King-Wilson: ¶ [0021] & ¶ [0028-0030] & ¶ [0082-0084] & ¶ [0174]. King-Wilson notes that the model can be implemented using a Monte Carlo simulation. This involves generating thousands of scenarios of what may happen and then calculating summary statistics from the results. See also King-Wilson at ¶ [0021]: The apparatus may be configured to determine said predicted threat activity using a Monte Carlo method. See also King-Wilson at ¶ [0028-0030]: King Wilson notes that the apparatus may comprise a third module configured to determine loss for each of a plurality of operational processes dependent on the downtimes of each of said systems and to add losses for said plurality of processes so as to obtain a combined loss arising from the threat activity. Determining loss for each of a plurality of operational processes dependent on the downtimes of the systems, adding losses for the plurality of processes to obtain a combined loss arising from the threat activity. See also King-Wilson at ¶ [0082-0084]: The predicted loss calculator 24 receives the system risk 22 and data 25 listing operational processes from a database 26, then predicts the loss for each operational process, aggregates the results for each process and outputs predicted loss data 12. The predicted loss calculator 24 considers the system risk 22 for the IT systems 30, 30 1, 30 2, 30 3, 30 4, . . . , 30 m, on which each process 31, 31 A, 31 B, 31 c, 31 D, 31 E, . . . , 31 m, depends via dependencies 32 and the value of the process and aggregates values 12 A, 12 B, 12 c, 12 D, 12 E, . . . , 12 m, for each process so as to produce a value 12 sum, as for all processes.) based on the frequency (see at least King-Wilson: ¶ [0070-0074]. King-Wilson notes that the activity predictor 14 receives the observed threat data 9 from the database 10, for example by retrieving the data automatically or in response to user instruction, extrapolates future event frequency and produces a profile 13 of predicted threat activity, which includes a list of predicted threats and their expected frequency of occurrence. Each predicted threat is defined using an identifier, a name, a description, a frequency of occurrence, a category (or categories) of system attacked and a corresponding damage level for each system.) and severity distributions (see at least King-Wilson: ¶ [0022] & ¶ [0058-0062] & ¶ [0068]. King-Wilson notes that the severity score (“SeverityScore”) is a measure of the impact of a successful threat. It is not a measure of the prevalence or exposure to the threat, but rather an indication of the damage that would be caused to the target system. Severity score may also be referred to as “damage level”. In this example, the severity score is a value lying in a range between 1 and 10. For example, a value of 1 can represent trivial impact and a value of 10 may represent a catastrophic effect. However, the severity score may be defined as “low”, “medium”, “high” or “critical”. See also King-Wilson at ¶ [0058]: Each observed threat is defined using an identifier, a name, a description of the threat, a temporal profile specifying frequency of occurrence of the threat, a target (or targets) for the threat and a severity score for the (or each) target. See also King-Wilson at ¶ [0022]: The apparatus may be configured to store at least one of the losses and the combined loss in a storage device. The apparatus may be configured to display at least one of the losses and the combined loss on a display device. See also King-Wilson at ¶ [0068].).
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi system for optimizing cyber security projects with the aforementioned teachings of: calculating frequency and severity distributions for cyber security threats using a Loss Distribution Approach & performing Monte Carlo Simulations to generate aggregate loss distributions based on the frequency and severity distributions, and in further view of King-Wilson, whereby the activity predictor receives the observed threat data from the database, for example by retrieving the data automatically or in response to user instruction, extrapolates future event frequency and produces a profile of predicted threat activity, which includes a list of predicted threats and their expected frequency of occurrence. The predicted threat activity profile may be stored in a database (see at least King-Wilson: ¶ [0070]). Additionally, the system of King-Wilson seeks to provide an improved apparatus for and a method of assessing threat to a computer network or computer networks and that stochastic modelling can help to model the effect of low-frequency, high-impact events when assessing threats involving computer networks. This can be used, for example, in capital modelling, pricing insurance and cost benefit analysis when improving network security (see at least King-Wilson: ¶ [0010-0012]).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by King-Wilson, the results of the combination were predictable.
Tedeschi / King-Wilson system of optimizing cyber security projects does not explicitly disclose, but NPL Document: "Handling of synergy into an algorithm for project portfolio selection." Recent Advances on Hybrid Intelligent Systems. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013. 417-430, hereinafter Rivera, Gilberto, et al. in the analogous art for optimizing cyber security projects teaches the following limitations:
- computing redundancy and synergy coefficients for pairs of the cyber security related projects using weighted matrix calculations (see at least Rivera, Gilberto, et al: Page 421 & Pages 423-425. Rivera teaches that Negative synergy on objective values: The benefit of two or more projects decreases when are together. For example, a project A that benefits to 100 people and a Project B benefiting 200 people. But if there are 50 people in common between both projects, the benefit of supporting both projects is 250 people instead of 300 as expected. Redundancy: Two projects can not be supported simultaneously. For example, a Project A: Building a hospital, and a Project B: building a school. But if the hospital needs to be built on the same ground that the school, only one of them can receive budget. Decrease in the cost: Two projects decrease the costs if both are supported simultaneously. For example, a project A: has a total cost of 250 monetary units, of which uses 100 to buy expensive computer equipment, and a Project B: it has a cost of 200 monetary units and also need to use similar equipment. If possible, and both projects have no problem sharing the common resource, the cost of financing both resources is 350 monetary units instead of 450 as expected. Presenting a large set of solutions will complicate the decision process of the DM, even if the solutions found belong to the Pareto front, moreover finding a single function that matches the DM’s preference, such as a weighted sum, is not simple and nor guaranteed for real problems. See also Rivera at Page 423: RPM has an algorithm that develops a comprehensive search with dynamic programming to find all optimal portfolios, which then are indexed according to the DM’s criteria through a weighted sum of the objectives. The synergy is handling by means of adding artificial projects and extra redundancy relations. See also Rivera at Pages 424-425: Rivera teaches that the benefit function is shown in Formula 13, where x is the current portfolio, i is the candidate project for being added to x, ηi is known as local knowledge, and is a measure of benefit of the project i, τi,j is the pheromone between projects i and j, and w is a weight factor between local knowledge and the pheromone. Examiner notes that the pheromone is modeled as a two-dimensional matrix with a size N×N, where N is the total of projects, so τ has two entries. τi,j is the preference of having the projects i and j in the same portfolio.)
- solving, based on the aggregate loss distributions and redundancy and synergy coefficients (see at least Rivera, Gilberto, et al: Page 421 & Pages 423-426. Rivera teaches that Negative synergy on objective values: The benefit of two or more projects decreases when are together. For example, a project A that benefits to 100 people and a Project B benefiting 200 people. But if there are 50 people in common between both projects, the benefit of supporting both projects is 250 people instead of 300 as expected. Redundancy: Two projects can not be supported simultaneously. For example, a Project A: Building a hospital, and a Project B: building a school. But if the hospital needs to be built on the same ground that the school, only one of them can receive budget. Decrease in the cost: Two projects decrease the costs if both are supported simultaneously. For example, a project A: has a total cost of 250 monetary units, of which uses 100 to buy expensive computer equipment, and a Project B: it has a cost of 200 monetary units and also need to use similar equipment. If possible, and both projects have no problem sharing the common resource, the cost of financing both resources is 350 monetary units instead of 450 as expected. Presenting a large set of solutions will complicate the decision process of the DM, even if the solutions found belong to the Pareto front, moreover finding a single function that matches the DM’s preference, such as a weighted sum, is not simple and nor guaranteed for real problems. See also Rivera at Page 423: RPM has an algorithm that develops a comprehensive search with dynamic programming to find all optimal portfolios, which then are indexed according to the DM’s criteria through a weighted sum of the objectives. The synergy is handling by means of adding artificial projects and extra redundancy relations. See also Rivera at Pages 424-425: Rivera teaches that the benefit function is shown in Formula 13, where x is the current portfolio, i is the candidate project for being added to x, ηi is known as local knowledge, and is a measure of benefit of the project i, τi,j is the pheromone between projects i and j, and w is a weight factor between local knowledge and the pheromone. Examiner notes that the pheromone is modeled as a two-dimensional matrix with a size N×N, where N is the total of projects, so τ has two entries. τi,j is the preference of having the projects i and j in the same portfolio.), an optimization programming problem algorithm (see at least Rivera, Gilberto, et. al: Page 421 & Pages 423-425. Rivera teaches that P-ACO (Pareto Ant Colony Optimization) is an algorithm based on the known metaheuristic of Ant Colony to generate the Pareto front with the most efficient portfolios. Each ant generates a candidate portfolio, and the amount of pheromone deposited by such ant is inversely proportional to the number of solutions that dominate it. The algorithm stores the solutions that have never been dominated, which form an approximation of the Pareto front. P-ACO is able to deal with the synergy between projects, salient characteristic in the algorithm. The algorithm only considers the handling of synergy between groups of two projects. No consideration is made about the DM’s preferences and the synergy is handling by modifying the multiobjective function.), using an optimization engine (see at least Rivera, Gilberto, et. al: Page 426. Rivera notes that computer equipment dual-processor Xeon (TM) CPU 3.06 GHz in parallel and 4 GB RAM.) comprising an evolutionary algorithm (see at least Rivera, Gilberto, et. al: Page 418 & Page 421 & Pages 423-425. Rivera teaches providing the means of algorithms pertaining to the social portfolio problem (SPP), also pareto ant colony optimization (ACO) algorithm, robust portfolio modeling algorithm, scatter search for project portfolio selection and deterministic heuristic algorithms shown at Pages 423-424.), to identify project synergies (see at least Rivera, Gilberto, et. al: Page 426 & Figs. 2-3 on (Pages 427-428). Rivera teaches Addressed synergy types: Redundancy and synergy in objective functions (negative and positive). For instances of 25 projects, there are between three and six synergetic relations; for instances of 100 projects, between 12 and 24. See also Rivera noting the project synergies of instances of 100 projects in Fig. 2 and synergy showing the execution time on instances of 100 projects in Fig. 3.) to select a subset of cyber security related projects that optimize expected loss reduction from cyber security related threats (see at least Rivera, Gilberto, et al: Pages 418-419 & Page 421. Rivera teaches that previous works on the formation of project portfolio with synergy have been proposed [3, 6, 18, 20], it has made evident the lack of methods that also include the decision maker’s preferences. This work presents an Ant Colony Optimization (ACO) Algorithm that searches a Pareto frontier subset that matches the DM’s criteria for selecting a portfolio. From a set of all proposed projects competing for resources, denoted as X, a portfolio may be defined as a subset of them. See also Rivera at Page 424: The next project selection jx is the next project to be incorporated in portfolio x, X is the project list, Ω(x,i) is a function that evaluates the expected benefit to incorporate i to portfolio x, L is the roulette selection function based on Ω(x,i), ℓ is a function that randomly selects an available project. See also Rivera at [abstract] on Page 417: With a number of candidate projects bigger than those ones that can be funded, the organization faces the problem of selecting a portfolio of projects that maximizes the expected benefits. See also Rivera at Page 427: For instances of 100 projects, it was not possible to perform an enumerative search. The preference model was applied to the results provided by each version of the algorithm, and the amount of NOS found for each was counted. Figure 2 presents these results. The performance difference in favor of “synergy in the objective function” was 15% on average. Furthermore, significant differences in the execution time were observed. In Figure 3 shows the time run consumed by each version of the algorithm. The time reduction averaged 11% by using “synergy in the objective function”. See also Rivera at Page 428: On the test instances used, there was an average increase of 15% in performance, and a 11% reduction of consumed time, by adapting the objective function instead of adding artificial projects.).
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson system for optimizing cyber security projects with the aforementioned teachings of: computing redundancy and synergy coefficients for pairs of the cyber security related projects using weighted matrix calculations and solving, based on the aggregate loss distributions and redundancy and synergy coefficients, an optimization programming problem algorithm, using an optimization engine comprising an evolutionary algorithm, to identify project synergies to select a subset of cyber security related projects that optimize expected loss reduction from cyber security related threats, and in further view of Rivera, whereby several algorithms have been developed to solve SPP with synergy, which range from deterministic heuristic algorithms to more sophisticated metaheuristic techniques. The options in the handling of synergy have been basically two: 1) Modifying the Multi-objective evaluation function and 2) Adding artificial projects representing the synergic group, and then add redundancy relations that prevent the artificial project appears at the same portfolio that some project of that group (see at least Rivera: [on Page 423]).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by Rivera, the results of the combination were predictable.
Tedeschi / King-Wilson / NPL Document: "Handling of synergy into an algorithm for project portfolio selection." Recent Advances on Hybrid Intelligent Systems. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013. 417-430, hereinafter Rivera, Gilberto, et al. system of optimizing cyber security projects does not explicitly disclose, but Siebel in the analogous art for optimizing cyber security projects teaches the following limitations:
- automatically managing a configuration of an application to implement the subset of cyber security related projects (see at least Siebel: ¶ [0091] & ¶ [0096] & ¶ [0129] & ¶ [0213]. Siebel teaches that implementations may obtain, aggregate, store, manage, process, and/or expose extremely large volumes of data from various sources as well as provide powerful and integrated data management, analytic, machine learning, application development, and/or other tools. Some embodiments may include a model driven architectures that includes a type system. In at least one implementation, a PaaS platform is disclosed for the design, development, deployment, and operation of IoT applications and business processes. See at least Siebel at ¶ [0091]: IoT platform development efforts to date are attempts to develop a solution from differing subsets of the many independent software components that are collectively known as the open-source Apache Hadoop™ stack. See at least Siebel at ¶ [0129]: System 200 is used and extended over time, continual support for new patterns/optimizations or other features useful for big data, IoT, and/or cyber-physical systems can be implemented to benefit a large number of types and/or applications. If improvements to a machine learning algorithm have been made, these improvements will be immediately available to any other types or applications that utilize that algorithm, potentially without any changes needed to the other types or business logic for applications. See at least Siebel at ¶ [0213]: Mathematically, they determine the strength of the growth as a function of the square of the number of applications. Additional scaling factors may determine the degree of synergy between the applications within an integrated, cloud based, enterprise platform, and therefore the extent to which data integrated for one application can be used for another application. Mathematically, they determine how quickly the total cost of each additional application decreases relative to the previous application. See at least Siebel at ¶ [0323]: “Commercial object-relational mapping data access frameworks such as Hibernate may be used to prepare the data access frameworks. There are, however, trade-offs to consider related to the level of control for data access performance optimization. Master data should be accessed and updated using service-oriented architecture principles to expose features as services accessible over VPN.” See at least Siebel at ¶ [0406-0409]: Communications by or between smart devices, head-end systems, processing nodes, storage nodes, applications, a service bus, or any other system may be encrypted. For example, secured data communications may utilize robust and configurable security protocols such as SSL, IPsec or any other secure communications.), wherein the configuration is based on the optimization programming problem algorithm (see at least Siebel: ¶ [0129] & ¶ [0363] & ¶ [0446-0447] & ¶ [0550]. Siebel teaches that the benchmark performance and set up for a configuration illustrated in FIG. 19. See also Siebel at ¶ [0367]: The benchmark tests were conducted using a custom benchmark energy platform hosted on Amazon Web Services (AWS). The components and configurations of the benchmark platform architecture are included in Table 2 below. See also Siebel at ¶ [0446-0447]: The application is used to support day-to-day operations, including remote configuration changes. System operators and engineers may use the sensor and network health application to: prioritize operational issues across millions of different, distributed assets and make more informed maintenance decisions and “remotely update asset configuration at the individual asset level or for a cluster of assets using the bulk action functionality”. See also Siebel noting “optimization programming problem algorithm” at ¶ [0550]. For example; the machine learning and predictions module 3217 can implement one or more varieties of machine learning algorithms to enhance analytics on industry data. The machine learning and predictions module 3217 can perform a variety of functions, such as processing basic statistics, such as summary statistics, correlations, stratified sampling, hypothesis testing, and random data generation; classification and regression using linear models (e.g., SVMs, logistic regression, linear regression, generalized linear models), decision trees, naive Bayes; collaborative filtering, such as alternating least squares (ALS); clustering, such as k-means; dimensionality reduction, such as singular value decomposition (SVD), principal component analysis (PCA); feature extraction and transformation; feature selection, such as orthogonal matching pursuit and greedy forward selection; and optimization (developer), such as stochastic gradient descent, limited-memory BFGS (L-BFGS), and Newton's method.)
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera system for optimizing cyber security projects with the aforementioned teachings of: automatically managing a configuration of an application to implement the subset of cyber security related projects, wherein the configuration is based on the optimization programming problem algorithm, and in further view of Siebel, whereby scaling factors may determine the degree of synergy between the applications within an integrated, cloud based, enterprise platform, and therefore the extent to which data integrated for one application can be used for another application. Mathematically, they determine how quickly the total cost of each additional application decreases relative to the previous application (see at least Siebel: ¶ [0213].). In summary, significant up-front and ongoing costs can be avoided by taking the platform approach of FIG. 8 instead of deploying multiple point applications of FIG. 9. These cost savings result from lower cost application and data integration costs; avoided hardware and software infrastructure costs; lower ongoing maintenance, support, and operations costs; and avoided procurement expenses (see at least Siebel: ¶ [0214].).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by Siebel, the results of the combination were predictable.
Regarding Dependent Claims 2 and 12, Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects teaches the limitations of Independent Claims 1 and 11 above, and King-Wilson further teaches the method / system for optimizing cyber security projects comprising:
- wherein calculating frequency (see at least King-Wilson: ¶ [0070-0074]. King-Wilson notes that the activity predictor 14 receives the observed threat data 9 from the database 10, for example by retrieving the data automatically or in response to user instruction, extrapolates future event frequency and produces a profile 13 of predicted threat activity, which includes a list of predicted threats and their expected frequency of occurrence. Each predicted threat is defined using an identifier, a name, a description, a frequency of occurrence, a category (or categories) of system attacked and a corresponding damage level for each system.) and severity distributions (see at least King-Wilson: ¶ [0022] & ¶ [0058-0062] & ¶ [0068]. King-Wilson notes that the severity score (“SeverityScore”) is a measure of the impact of a successful threat. It is not a measure of the prevalence or exposure to the threat, but rather an indication of the damage that would be caused to the target system. Severity score may also be referred to as “damage level”. In this example, the severity score is a value lying in a range between 1 and 10. For example, a value of 1 can represent trivial impact and a value of 10 may represent a catastrophic effect. However, the severity score may be defined as “low”, “medium”, “high” or “critical”. See also King-Wilson at ¶ [0058]: Each observed threat is defined using an identifier, a name, a description of the threat, a temporal profile specifying frequency of occurrence of the threat, a target (or targets) for the threat and a severity score for the (or each) target. See also King-Wilson at ¶ [0022]: The apparatus may be configured to store at least one of the losses and the combined loss in a storage device. The apparatus may be configured to display at least one of the losses and the combined loss on a display device. See also King-Wilson at ¶ [0068].) comprises using a Poisson distribution for frequency and a log-normal distribution for severity (see at least King-Wilson: ¶ [0171] & ¶ [0173-0176]. King-Wilson notes that a Poisson distribution for the number of viruses or attack can be used and a lognormal distribution for the impact of the virus can be employed. A Poisson distribution uses one parameter, for example, the expected number of attacks. Parameter uncertainty can be allowed for through prudent assumptions specified by the user. See also King-Wilson at ¶ [0176]: A total cost can be calculated by multiplying the number of successful viruses or attacks by an assumed cost. The appropriate number of times can be sampled from the lognormal distribution and summed to get the total cost.).
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects with the aforementioned teachings of: wherein calculating frequency and severity distributions comprises using a Poisson distribution for frequency and a log-normal distribution for severity, and in further view of King-Wilson, whereby the activity predictor receives the observed threat data from the database, for example by retrieving the data automatically or in response to user instruction, extrapolates future event frequency and produces a profile of predicted threat activity, which includes a list of predicted threats and their expected frequency of occurrence. The predicted threat activity profile may be stored in a database (see at least King-Wilson: ¶ [0070]). Additionally, the system of King-Wilson seeks to provide an improved apparatus for and a method of assessing threat to a computer network or computer networks and that stochastic modelling can help to model the effect of low-frequency, high-impact events when assessing threats involving computer networks. This can be used, for example, in capital modelling, pricing insurance and cost benefit analysis when improving network security (see at least King-Wilson: ¶ [0010-0012]).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by King-Wilson, the results of the combination were predictable.
Regarding Dependent Claims 3 and 13, Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects teaches the limitations of Independent Claims 1 and 11 above, and King-Wilson further teaches the method / system for optimizing cyber security projects comprising:
- wherein the Monte Carlo simulations (see at least King-Wilson: ¶ [0021] & ¶ [0174].) comprise simulating a number of cyber security threat events and simulating severities for each event (see at least King-Wilson: ¶ [0174-0175] & ¶ [0209-0211]. King-Wilson notes that the model control system 51 can be used by a user to view and analyze simulations 53 for any given virus or attack. The user can control the modelling process using instructions 54, which may include, for example, setting whether an allowance should be made for parameter uncertainty. Thus, the user can iteratively change models and so settle upon an appropriate model, for example, the model which is judged to be the most realistic. The model control system 51 can control the threat assessment 11 with little or no real-time user input, e.g. vary inputs in a predefined manner and judge results according to predefined measure. See at least King-Wilson: ¶ [0022] & ¶ [0058-0062] & ¶ [0068]. King-Wilson notes that the severity score (“SeverityScore”) is a measure of the impact of a successful threat. It is not a measure of the prevalence or exposure to the threat, but rather an indication of the damage that would be caused to the target system. Severity score may also be referred to as “damage level”. In this example, the severity score is a value lying in a range between 1 and 10. For example, a value of 1 can represent trivial impact and a value of 10 may represent a catastrophic effect. However, the severity score may be defined as “low”, “medium”, “high” or “critical”. See also King-Wilson at ¶ [0058]: Each observed threat is defined using an identifier, a name, a description of the threat, a temporal profile specifying frequency of occurrence of the threat, a target (or targets) for the threat and a severity score for the (or each) target. See also King-Wilson at ¶ [0022]: The apparatus may be configured to store at least one of the losses and the combined loss in a storage device. The apparatus may be configured to display at least one of the losses and the combined loss on a display device. See also King-Wilson at ¶ [0068].) to calculate aggregate losses (see at least King-Wilson: ¶ [0022] & ¶ [0082-0084].)
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects with the aforementioned teachings of: wherein the Monte Carlo simulations comprise simulating a number of cyber security threat events and simulating severities for each event to calculate aggregate loss, and in further view of King-Wilson, whereby a stochastic model for low frequency/high impact events is used. This involves specifying probability distributions for the number of events and the impact of each of those events. A Poisson distribution for the number of viruses or attack can be used and a lognormal distribution for the impact of the virus can be employed. A Poisson distribution uses one parameter, for example, the expected number of attacks. Parameter uncertainty can be allowed for through prudent assumptions specified by the user. The model can be implemented using a Monte Carlo simulation. This involves generating thousands of scenarios of what may happen and then calculating summary statistics from the results (see at least King-Wilson: ¶ [0173-0175]).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by King-Wilson, the results of the combination were predictable.
Regarding Dependent Claims 4 and 14, Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects teaches the limitations of Independent Claims 1 and 11 above, and Rivera further teaches the method / system for optimizing cyber security projects comprising:
- wherein computing redundancy and synergy coefficients comprises calculating weighted averages based on weights of individual project costs within a portfolio of project costs (see at least Rivera, Gilberto, et al: Figs. 2-3 & Page 421 & Pages 423-425. Rivera teaches that Negative synergy on objective values: The benefit of two or more projects decreases when are together. For example, a project A that benefits to 100 people and a Project B benefiting 200 people. But if there are 50 people in common between both projects, the benefit of supporting both projects is 250 people instead of 300 as expected. Redundancy: Two projects can not be supported simultaneously. For example, a Project A: Building a hospital, and a Project B: building a school. But if the hospital needs to be built on the same ground that the school, only one of them can receive budget. Decrease in the cost: Two projects decrease the costs if both are supported simultaneously. For example, a project A: has a total cost of 250 monetary units, of which uses 100 to buy expensive computer equipment, and a Project B: it has a cost of 200 monetary units and also need to use similar equipment. If possible, and both projects have no problem sharing the common resource, the cost of financing both resources is 350 monetary units instead of 450 as expected. Presenting a large set of solutions will complicate the decision process of the DM, even if the solutions found belong to the Pareto front, moreover finding a single function that matches the DM’s preference, such as a weighted sum, is not simple and nor guaranteed for real problems. See also Rivera at Page 423: RPM has an algorithm that develops a comprehensive search with dynamic programming to find all optimal portfolios, which then are indexed according to the DM’s criteria through a weighted sum of the objectives. The synergy is handling by means of adding artificial projects and extra redundancy relations. See also Rivera at Pages 424-425: Rivera teaches that the benefit function is shown in Formula 13, where x is the current portfolio, i is the candidate project for being added to x, ηi is known as local knowledge, and is a measure of benefit of the project i, τi,j is the pheromone between projects i and j, and w is a weight factor between local knowledge and the pheromone. Examiner notes that the pheromone is modeled as a two-dimensional matrix with a size N×N, where N is the total of projects, so τ has two entries. τi,j is the preference of having the projects i and j in the same portfolio.)
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects with the aforementioned teachings of: wherein computing redundancy and synergy coefficients comprises calculating weighted averages based on weights of individual project costs within a portfolio of project costs, and in further view of Rivera, whereby several algorithms have been developed to solve SPP with synergy, which range from deterministic heuristic algorithms to more sophisticated metaheuristic techniques. The options in the handling of synergy have been basically two: 1) Modifying the Multi-objective evaluation function and 2) Adding artificial projects representing the synergic group, and then add redundancy relations that prevent the artificial project appears at the same portfolio that some project of that group (see at least Rivera: [on Page 423]).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by Rivera, the results of the combination were predictable.
Regarding Dependent Claims 5 and 15, Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects teaches the limitations of Independent Claims 1 and 11 above, and Rivera further teaches the method / system for optimizing cyber security projects comprising:
- wherein the optimization programming problem algorithm (see at least Rivera, Gilberto, et. al: Page 421 & Pages 423-425. Rivera teaches that P-ACO (Pareto Ant Colony Optimization) is an algorithm based on the known metaheuristic of Ant Colony to generate the Pareto front with the most efficient portfolios. Each ant generates a candidate portfolio, and the amount of pheromone deposited by such ant is inversely proportional to the number of solutions that dominate it. The algorithm stores the solutions that have never been dominated, which form an approximation of the Pareto front. P-ACO is able to deal with the synergy between projects, salient characteristic in the algorithm. The algorithm only considers the handling of synergy between groups of two projects. No consideration is made about the DM’s preferences and the synergy is handling by modifying the multi-objective function.) comprises a Knapsack algorithm (see at least Rivera, Gilberto, et. al: Page 418 & Page 421 & Pages 423-425. Rivera teaches providing the means of algorithms pertaining to the social portfolio problem (SPP), also pareto ant colony optimization (ACO) algorithm, robust portfolio modeling algorithm, scatter search for project portfolio selection and deterministic heuristic algorithms shown at Pages 423-424.) that selects projects subject to budget constraints (see at least Rivera: Page 419-421 & Page 424. Rivera notes that it is also common that projects are associated with some form of grouping that influences the decision of the DM. For example, in a private company, projects may be associated to departments (e.g. marketing, sales, production or human resources), in this case a balanced DM would try to ensure a minimum of the total budget for each, and would prevent either of them unjustifiably monopolizes most of the budget. Let Li and Ui be respectively the minimum and maximum budget that an area I can get (Li ≤ Ui ≤ B). The area for a project i may be defined as ai. For each area j, any portfolio x must satisfy the constraint. See also Rivera at Page 421: Two projects cannot be supported simultaneously. For example, a Project A: Building a hospital, and a Project B: building a school. But if the hospital needs to be built on the same ground that the school, only one of them can receive budget. Although finding Pareto front is important [4, 9], the problem does not is completely solved [5, 11, 12, 13, 23]. Now the DM will choose which portfolio will be selected to receive the budget. See also Rivera at Page 424: During ACOS-SPP constructing phase, each ant selects a portfolio, choosing project by project until the budget is over. The way for selecting next project to portfolio is named selecting rule.)
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects with the aforementioned teachings of: wherein the optimization programming problem algorithm comprises a Knapsack algorithm that selects projects subject to budget constraints, and in further view of Rivera, whereby based on the provided information a 35 U.S.C. 103 obviousness rejection is supported. The reference teaches optimizing project portfolios under budget constraints using metaheuristics (such as Ant-Colony optimization, Scatter Search, or robust portfolio modeling). It is well-known in the art that a Knapsack algorithm is a foundational combinational optimization technique used specifically for resource allocation under constraints, essentially forming a subset of metaheuristic approaches or a standard alternative for project selection. Modifying the reference to use a Knapsack algorithm is a predictable variation, providing a known solution for maximizing project portfolio value under a budget constraint. The feature “Knapsack algorithm that selects projects subject to budget constraints” is deemed obvious in view of the Rivera reference. The Rivera reference specifically teaches utilizing metaheuristics or scatter search for project portfolio selection to choose projects while adhering to financial budget constraints. The Knapsack algorithm is recognized as a fundamental combinational optimization problem used to select projects by maximizing value without exceeding a budget. A person having ordinary skill in the art (PHOSITA) would find it obvious to apply a Knapsack algorithm to Rivera’s project selection problem because it is a standard, known, and predictable technique for optimizing resource allocation under constraints, offering a simple and effective alternative to more complex heuristic searches (like ant-colony or scatter search) for the same result. The combination merely represents the application of a known technique (Knapsack) to a known problem (project portfolio selection) to yield predictable results (see MPEP § 2143 (g) or see MPEP § 2143 (c)).
Alternatively, the Rivera reference discloses the preamble and the function of the claim, specifically: “an optimization programming problem algorithm…. That selects projects subject to budget constraints Rivera reference. The Rivera reference teaches that the optimization algorithm comprises “Ant-Colony optimization algorithm or metaheuristics algorithm or Scatter Search for Project Portfolio Selection” in the Rivera reference. While the reference may not specifically use the term “Knapsack algorithm” for the particular method named, the Knapsack algorithm is a well-known, foundational combinational optimization approach for subset selection under budget constraints. Modifying the selection process of the reference to use a Knapsack algorithm (or a metaheuristic, which is a broader class encompassing various search techniques) to select projects within a budget would be a simple matter of selecting known, interchangeable optimization techniques (e.g., swapping a genetic algorithm a type of metaheuristic, for a greedy solver on a knapsack algorithm) to solve a standard resource allocation problem.
Therefore, it would have been obvious to a PHOSITA to apply a Knapsack algorithm to the portfolio selection problem outlined in the reference, as it represents a known, logic substitution of one optimization method for another in the same field of endeavor (see MPEP § 2143 (b)).
The Knapsack algorithm is a foundational, well-known technique in combinatorial optimization for solving project portfolio selection problems under budgetary constraints. The reference teaches using metaheuristics to solve such constraints. Applying a Knapsack algorithm, instead of the metaheuristics mentioned in the reference, is a mere substitution of known optimization techniques. A person of ordinary skill in the art (POSITA) would have found it obvious to use a Knapsack algorithm to achieve the known, intended goal of selecting an optimal set of projects under budget restrictions. The claimed limitation represents a routine optimization choice, yielding predictable results (the optimal selection of projects), thus making the substitution obvious (see MPEP § 2143 (f)).
Regarding Dependent Claims 6 and 16, Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects teaches the limitations of Independent Claims 1 and 11 above, and Rivera further teaches the method / system for optimizing cyber security projects comprising:
- wherein the subset of cyber security related projects (see at least Rivera: Page 419 & Page 421. Rivera notes that from a set of all proposed projects competing for resources, denoted as X, a portfolio may be defined as a subset of them. This work presents an Ant Colony Optimization (ACO) Algorithm that searches a Pareto frontier subset that matches the DM’s criteria for selecting a portfolio.) comprises projects selected to maximize expected loss reduction subject to a budget constraint (see at least Rivera: [abstract] & Pages 419-420. Rivera teaches that Social Portfolio Problem (SPP) consists in identifying one or more portfolios that Solve Formula 6 subject to the constraints expressed in Equations 1 and 2. In this case, the maximization concept is based on Pareto efficiency. In this case, the dimension of its solution space is 2N, and if taken into account additional considerations such as synergy, partial support, project scheduling or risky conditions, the problem complexity and the number of possible solutions tend to increase. See also Rivera at [abstract]: With a number of candidate projects bigger than those ones that can be funded, the organization faces the problem of selecting a portfolio of projects that maximizes the expected benefits. The selection is made on the evaluation of project groups and not on the evaluation of single projects. See also Rivera at [0419]: Let Li and Ui be respectively the minimum and maximum budget that an area i can get (Li ≤ Ui ≤ B). The area for a project i may be defined as ai. For each area j, any portfolio x must satisfy the constraint: Formula 2.).
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects with the aforementioned teachings of: wherein the subset of cyber security related projects comprises projects selected to maximize expected loss reduction subject to a budget constraint, and in further view of Rivera, the Rivera reference explicitly teaches a method of financial optimization to select projects for risk mitigation under a budget. Using a known optimization technique (maximizing loss reduction within a budget) on a specific type of project (cybersecurity) is a routine application of known tools to a new area. The known work of prioritizing, evaluating, and selecting projects to maximize loss reduction would prompt variations of it for use in cybersecurity risk management, as the "design incentives" of optimizing risk mitigation budgets are identical to those found in general business management (see MPEP § 2143 (f)). The application of financial optimization models (e.g., calculating expected loss reduction) to cybersecurity risks would have yielded a predictable result—namely, a prioritized list of cyber investments that maximizes security outcomes within a constrained budget.
While the reference may not specifically use the term "cyber security," the limitation "projects selected to maximize expected loss reduction subject to a budget constraint" is fully taught in the context of risk management. Replacing "general risk" with "cybersecurity risk" is a simple substitution of one subject for another [Rationale B] or applying a known technique (financial modeling) to a known area of risk (cyber) [Rationale D].
Regarding Dependent Claims 7 and 17, Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects teaches the limitations of Independent Claims 1 and 11 above, and Rivera further teaches the method / system for optimizing cyber security projects comprising:
- wherein the subset of cyber security related projects (see at least Rivera: Page 419 & Page 421. Rivera notes that from a set of all proposed projects competing for resources, denoted as X, a portfolio may be defined as a subset of them. This work presents an Ant Colony Optimization (ACO) Algorithm that searches a Pareto frontier subset that matches the DM’s criteria for selecting a portfolio.) comprises projects having positive expected loss reduction values after accounting for redundancy and synergy effects (see at least Rivera: Figs. 2-3 & Page 420-421 & Page 426. Rivera teaches that interactions between projects may affect the evaluation of portfolios. Among synergy types to be found are Synergy positive on objective values. When two or more projects are complemented for increasing profits. For example, a Project A: creating a recreational park, and a Project B: Paving a road. Each one individually benefits certain amount of people, but if the recreation park (project A) is on the road to be paved (project B) both increase their value. The park becomes more accessible to people, and increase the number of persons that use the road. See also Rivera at Page 426: Addressed synergy types: Redundancy and synergy in objective functions (negative and positive). For instances of 25 projects, there are between three and six synergetic relations; for instances of 100 projects, between 12 and 24.)
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera / Siebel method / system for optimizing cyber security projects with the aforementioned teachings of: wherein the subset of cyber security related projects comprises projects having positive expected loss reduction values after accounting for redundancy and synergy effects, and in further view of Rivera, the primary difference is that the Rivera reference teaches generic projects, while the claim specifies cybersecurity-related projects. "When there is a design need or market pressure to solve a problem and there are a finite number of identified, predictable solutions, a person of ordinary skill has good reason to pursue the known options within his or her technical grasp." KSR Int'l Co. v. Teleflex Inc., 550 U.S. 398 (2007). Given the increasing need for cyber security, selecting a subset of IT security projects to optimize loss reduction is a known problem with a finite number of solutions (e.g., risk analysis modeling). The Rivera reference teaches that applying loss reduction, redundancy, and synergy calculations to a subset of projects yields a "positive expected loss reduction" (a predictable result). Applying this well-known, predictable mathematical/risk-management approach to the field of cyber security projects would have been "obvious to try" with a reasonable expectation of success (see MPEP § 2143 (e)).
Alternatively, the Rivera reference teaches maximizing value/reducing loss in projects via synergy/redundancy analysis. Selecting cybersecurity projects for this analysis is a known optimization technique. It is optimization of a known result (positive expected loss reduction) by applying it to a specific, relevant category of projects (cybersecurity). Therefore, it would have been obvious to one of ordinary skill in the art at the time of the invention to take the known method of identifying a subset of projects with positive expected loss reduction (accounting for synergy/redundancy) from [Rivera Reference] and apply it to cybersecurity-related projects to achieve the predictable result of positive expected loss reduction in a cybersecurity context (see MPEP § 2143 (g)).
The claimed invention is specifically directed to "cybersecurity related projects," whereas reference Rivera teaches projects generally. It would have been obvious to a Person Having Ordinary Skill in The Art (PHOSITA) to apply the project selection method of reference Rivera to cybersecurity projects, as known work in project management is readily applicable to the domain of cybersecurity risk management. Given the rising importance of cybersecurity, applying established portfolio optimization techniques—which account for redundancy and synergy—to maximize positive expected loss reduction in cybersecurity initiatives is a logical application of known techniques, yielding predictable results (see MPEP § 2143 (f)).
14. Claims 8 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over US PG Pub (US 2018/0322292 A1) hereinafter Tedeschi, in view of US PG Pub (US 2016/0197953 A1) hereinafter King-Wilson, in view of NPL Document: "Handling of synergy into an algorithm for project portfolio selection." Recent Advances on Hybrid Intelligent Systems. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013. 417-430, hereinafter Rivera, Gilberto, et al., in further view of Foreign Patent Application (WO 2016/118979 A2) hereinafter Siebel, et. al., and in further view of US PG Pub (US 2018/0302306 A1) hereinafter Carroll, et. al.
Regarding Dependent Claims 8 and 18, Tedeschi / King-Wilson / Rivera / Siebel method / system of optimizing cyber security projects does not explicitly disclose, but Carroll in the analogous art for optimizing cyber security projects does disclose the following:
- wherein the subset of cyber security related projects (see at least Carroll: ¶ [0011] & ¶ [0080] & ¶ [0219-0221]. Carroll teaches that the example computing environment is implemented as part of a test bed project for cybersecurity research and development, which can simulate enterprise computing environments, including virtual users that perform activities and interact with other entities in the environment. See also Carroll at ¶ [0011]: The network analysis tool identifies subsets of network assets that have similar network behavior based on a measure of similarity or dissimilarity between pairs of the frequent item sets.) excludes projects having redundancy coefficients exceeding a threshold (see at least Carroll: ¶ [0071] & ¶ [0124] & ¶ [0219-0221] & ¶ [0278]. Carroll notes that to determine multi-hop network dependencies, the network analysis tool can determine whether a peak exists in the cross-correlation coefficients. That is, after correlation coefficients for all lags have been calculated, the network analysis tool can detect peaks in one of several ways. In one approach, the network analysis determines a maximum value of the correlation coefficients and checks whether the maximum value is above a peak threshold. If so (maximum value satisfies the peak threshold), a peak is considered to exist. Otherwise, a peak is not considered to exist. See also Carroll at ¶ [0124]: The network analysis tool can also perform data deduplication to remove redundant flow records. See also Carroll at ¶ [0219-0221]: The pairs AB, AD, and CD are present within the time interval. Other pairs are not present. The matrix includes redundant values (above the diagonal or below the diagonal), which need not be counted. Alternatively, the co-occurrence matrix includes count values for the respective pairs of possible letters in a time interval, as shown in the following simplified example. Again, the matrix includes redundant values (above the diagonal or below the diagonal), which need not be counted.).
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera / Siebel method / system of optimizing cyber security projects for at least in part automating remediation in an enterprise system with the aforementioned teachings of: wherein the subset of cyber security related projects excludes projects having redundancy coefficients exceeding a threshold, and in further view of Carroll, whereby the network analysis tool can update its assessment of dependencies between network assets on a near-real-time basis, using network flow information from a recent time period to give a near-current perspective on the state of a computer network. By reacting to network changes, this can further improve the quality and speed of decision-making processes based on the identified dependencies (see at least Carroll: ¶ [0255). Also through input to a graphical user interface, an analyst (user) can select network assets, combinations of network assets, or dependencies that should be ignored in subsequent analysis because such network assets, combinations, dependencies, etc. represent “false positives” in the output. Or, as another example, through input to a graphical user interface, the analyst (user) can select network assets, combinations of network assets, or dependencies that should get extra attention, weight or detail in subsequent analysis because such network assets, combinations, dependencies, etc. are of particular interest to the analyst, or are confirmed to be part of meaningful results. The reinforcement learning module (220) can also tune control parameters based on feedback from within the network analysis tool (210), e.g., based on thresholds defined so as to remove from consideration events that are insignificant or are outliers (see at least Carroll: ¶ [0071].)
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by Carroll, the results of the combination were predictable.
15. Claims 9-10 and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over US PG Pub (US 2018/0322292 A1) hereinafter Tedeschi, in view of US PG Pub (US 2016/0197953 A1) hereinafter King-Wilson, in view of NPL Document: "Handling of synergy into an algorithm for project portfolio selection." Recent Advances on Hybrid Intelligent Systems. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013. 417-430, hereinafter Rivera, Gilberto, et al., in further view of Foreign Patent Application (WO 2016/118979 A2) hereinafter Siebel, et. al., and in further view of US PG Pub (US 2018/0167414 A1) hereinafter O’Reilly.
Regarding Dependent Claims 9 and 19, Tedeschi / King-Wilson / Rivera / Siebel method / system of optimizing cyber security projects does not explicitly disclose, but O’Reilly in the analogous art for optimizing cyber security projects does disclose the following:
- wherein the subset of cyber security related projects comprises projects selected based on utility values that aggregate multiple dimensions including financial and non-financial aspects (see at least O’Reilly: ¶ [0036] & ¶ [0041] & ¶ [0084] & ¶ [0099]. O’Reilly teaches that score(s) to generate query scripts based upon organizational data, utility, and compliance requirements. Specifically, the suggestion engine generates a series of questions (cognitive scripts) concerning compliance status in order to identify where the system under evaluation 98 stands at a more granular level with respect to the cybersecurity controls. See also O’Reilly at ¶ [0031]: The profile information may include, but is not limited to, revenue of the organization, budget for the organization, sector of the organization, and/or number of Information Security Professionals employed at the organization. See also O’Reilly at ¶ [0041]: The cybersecurity scoring and recommendation system 99 may then capture information from this data, in order to model utility functions, and provide tailored strategies for improving compliance. See also O’Reilly at ¶ [0084]: The dashboard view 198 may further include a navigational bar 201 that enumerates the system utilities and optimizations provided by the cybersecurity scoring and recommendation system 99 to an authorized user. The authorized user may select the optimizations tab to view the results of a cost versus impact algorithm that projects to a target score. See also O’Reilly at ¶ [0099] & Fig. 6B: Graphical interface 243 may provide a Pareto Efficient frontier optimization based upon cost, risk, and other variables to an authorized user. Text block 244 is a header that indicates that the authorized user should enter values associated with the organizational utility for the system under evaluation 98 so that the Gap between the current score and target score may be optimized according to one or more embodiments described herein. For example, the user may provide values for categories 245 that include, but are not limited to, “Risk,” “Cost,” “People,” Process,” and “Technology.” See also O’Reilly noting Fig. 6B and ¶ [abstract].).
It would have been obvious for one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the teachings of Tedeschi / King-Wilson / Rivera / Siebel method / system of optimizing cyber security projects for at least in part automating remediation in an enterprise system with the aforementioned teachings of: wherein the subset of cyber security related projects comprises projects selected based on utility values that aggregate multiple dimensions including financial and non-financial aspects, and in further view of O’Reilly, whereby the cyber security system is provided that sums and scores one or more cybersecurity controls for different client computing systems that each have different attributes, needs, and interests. In addition, the cybersecurity system provides to each different client computing system auto-suggestions that suggest one or more ways in which the client computing system may improve the confidentiality, integrity, and availability of the information stored on the client computing system and/or improve the confidentiality, integrity, and availability of the underlying characteristics of the client computing system. In addition, the cybersecurity system verifies that the functioning of the client computing system has improved (see at least O’Reilly: ¶ [abstract]).
Further, the claimed invention is merely a combination of old elements in a similar field of optimizing cyber security projects, and in the combination each element merely would have performed the same function as it did separately, and one of ordinary skill in the art would have recognized that, given the existing technical ability to combine the elements as evidenced by O’Reilly, the results of the combination were predictable.
Regarding Dependent Claims 10 and 20, Tedeschi / King-Wilson / Rivera / Siebel / O’Reilly method / system of optimizing cyber security projects teaches the limitations of Claims 1, 9, 11 and 19 above, and O’Reilly further teaches the method / system of optimizing cyber security projects comprising:
- wherein the multiple dimensions comprise one or more of financial aspects, knowledge gained, environmental impacts, or social impacts of the cyber security related projects, or any combination thereof (see at least O’Reilly: ¶ [0029] & ¶ [0084-0087] & ¶ [0100]. O’Reilly notes that knowledge is collected, anonymized, and stored 180 for use by system services within the cybersecurity scoring and recommendation system 99. See also O’Reilly at ¶ [0084]: The authorized user may select the optimizations tab to view the results of a cost versus impact algorithm that projects to a target score. See also O’Reilly at ¶ [0087] & Fig. 4B: More specifically, and with reference to the exemplary and detailed spider chart 205 as depicted in FIG. 4B, the 18 control families include: Access Control, Audit and Accountability, Awareness and Training, Security Assessment and Authorization, Configuration Management, Contingency Planning, Identification and Authentication, Incident Response, Maintenance, Media Protection, Physical and Environmental Protection, Planning, Personnel Security, Risk Assessment, System and Services Acquisition, System and Communications Protection, System and Information Integrity, and Program Management. See also O’Reilly at Fig. 6B: O’Reilly notes cost 245 at Fig. 6B and efficient frontier which are financial or econometric measurements which are referred to as financial aspects. See also O’Reilly at ¶ [0100]: Organizations evaluate the likelihood and impact of cyber events (threats, breaches, exfiltration, reputational damage, and vulnerabilities) and compute: L×I per control (where L is likelihood, and I is Impact).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
Foreign Patent Applications
WO 2020/046286 A1 – “Integrated Cybersecurity Risk Assessment and State Monitoring for Electrical Power Grid”, hereinafter Wang, et. al. Wang teaches at the ¶ [abstract] that “A plurality of monitoring nodes may each generate a time-series of current monitoring node values representing current operation of components of an electrical power grid. A cybersecurity monitoring computer platform may receive the current monitoring node values and pre-process them to generate a risk prior knowledge result. At least some of the components may be ranked to create a set of critical components based on a constrained optimizer that has the risk prior knowledge as an input. The cybersecurity monitoring computer platform may then monitor the set of critical components to generate a cybersecurity result (e.g., representing normal operation, a cyber-attack, or a fault in the electrical power grid) to be transmitted.”
CA 3022864 A1 -> “Method and Device for Managing Security in a Computer Network”, hereinafter Hasan. Hasan notes at ¶ [abstract]: “Method and device for managing security in a computer network include algorithms of iterative intelligence growth, iterative evolution, and evolution pathways; sub-algorithms of information type identifier, conspiracy detection, media scanner, privilege isolation analysis, user risk management and foreign entities management; and modules of security behavior, creativity, artificial threat, automated growth guidance, response/generic parser, security review module and monitoring interaction system.”
WO 2013/113532 A1 – “A Method and a System to Detect Malicious Software”, hereinafter Suarez, et. al. Suarez notes at ¶ [abstract]: “A method of the invention said detection of malicious software, or malware, is performed at least by applying security event correlation rules to a network. It is characterized in that it comprises: - capturing malware by means of a honeynet collector; - deploying a virtual network dedicated for each captured malware; - inferring correlation information from captured malware and events collected from execution of said captured malware in each virtual network; and - generating event correlation rules from said inferred correlation information by means or artificial intelligence techniques.”
WO 2014/122662 A1 – “Method and Product for Providing a Predictive Security Product and Evaluating Existing Security Products”, hereinafter Boutnaru, et. al. Boutnaru notes at ¶ [abstract]: “A method, product and computer program product for effecting an Evolutionary Process on malware, the method including the steps of: (a) receiving a malware specimen; (b) generating variants of the malware specimen; (c) evaluating the variants and awarding each the variant a Fitness Score; (d) selecting the variants having at least a predefined the Fitness Score.”
EP 2882159 B1 – “Profiling Cyber Threats Detected in A Target Environment And Automatically Generating One Or More Rule Bases For An Expert System Usable To Profile Cyber Threats Detected In A Target Environment”, hereinafter Laidlaw, et. al. Laidlaw notes that “a specific virtual IT control environment 402 was built with a specific integrated NSM solution and vulnerable web applications that can be successfully exploited by SQLIAs. From the configuration of this control environment 402, it is possible to derive the most important attacker characteristics and how they relate to each other from this process.”
US PG Publication Documents
US 2013/0347116 A1 – “Threat Evaluation System and Method”, hereinafter Flores, et. al. Flores teaches at the ¶ [abstract] that “Systems and methods of evaluation of threats to elements of a client computer application having a cyber reference library, an opponent catalog and a network model. The systems and methods produce a set of analyst reports evaluating the threats to the client computer application.”
US Patent # (US 9,401,926 B1) – “System and Method for Implementation of Cyber Security”, hereinafter Dubrow, et. al. Dubrow teaches at the ¶ [abstract]: “The present invention provides a system and method designed to continually monitor and evaluate an IT system. More specifically, the present invention teaches a system and method which continually monitors and evaluates the software, networks and devices of an IT system while providing reports and analysis for identified risks. Further, the present invention teaches a system and method which provides analysis and reports regarding the value and costs of identified risks.”
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DERICK HOLZMACHER whose telephone number is (571) 270-7853. The examiner can normally be reached on Monday-Friday 9:00 AM – 6:30 PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Brian Epstein can be reached on 571-270-5389. The fax phone number for the organization where this application or proceeding is assigned is 571-270-8853.
Information regarding the status of an application may be obtained from Patent Center. Status information for published applications may be obtained from Patent Center. Status information for unpublished applications is available through Patent Center for authorized users only. Should you have questions about access to Patent Center, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/DERICK J HOLZMACHER/Patent Examiner, Art Unit 3625A
/SARA GRACE BROWN/Primary Examiner, Art Unit 3625
Prosecution Insights