DETAILED ACTION
1. This action is responsive to an amendment filed on 3/10/2026.
2. Claims 1-20 are pending. Claims 1, 8 and 15 are independent. Claims 1, 2, 6, 8, 9, 13, 15, 16 and 20 are currently amended. Amendments to the claims have been entered.
Response to Arguments
3. Applicant's arguments have been fully considered; however, they are not persuasive based on new ground(s) of rejection.
Claim Objections
4. Claims 6, 13 and 20 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim Rejections - 35 USC § 112
5. The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
6. Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1, also claims 8 and 15 similarly, recites “determining the threshold comprising periodically for each of one or more time periods in a time interval forming a time series identifying a set of top subnets having traffic above a traffic threshold” (emphasis added). It is unclear whether this limitation to be interpreted as “periodically … forming a time series” or “periodically … identifying a set of top subnets having traffic above a traffic threshold” and whether “each of one or more time periods” or “a time interval” is “forming a time series”.
Accordingly, other dependent claims 2-7, 9-14 and 16-20 are also rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, based on their dependency of the rejected claims 1, 8 and 15.
Claim Rejections - 35 USC § 103
7. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
8. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
9. Claims 1-5, 7-12 and 14-19 are rejected under 35 U.S.C. 103 as being unpatentable over Mattia (US PG Pub. 2020/0389430) in view of Voros (US PG Pub. 2022/0353284) and further in view of Jones (US PG Pub. 20200389430).
As regarding claims 1, 8 and 15, Mattia discloses A computer-implemented method comprising:
detecting by a system a request [abstract and para. 7; receiving requests], responsive to the detecting of the request, computing by a Compute component of the system a plurality of internet protocol addresses in a subnet [abstract and para. 7; determining, in responding to receiving the requests, IP addresses or subnet list];
Mattia does not explicitly disclose computing by an Analysis component of the system a threat metric for each of the plurality of internet protocol addresses; and
determining by a Reputation component of the system a threat score for the subnet wherein the threat score is based on the threat metric and wherein the threat score is compared to a threshold; however, Voros discloses it [para. 27, 33-34 and para. 40-45; calculating score based on matrix and feature vectors || para. 92; the score being compared to a threshold value].
It would have been obvious to one of ordinary skill in the art at the time the effective filing of the invention to modify Mattia’s system to further comprise the omitted claim limitations, as disclosed by Voros, in order to identify the source of malicious content [Voros para. 33].
Mattia and Voros do not disclose determining the threshold comprising periodically for each of one or more time periods in a time interval forming a time series identifying a set of top subnets having traffic above a traffic threshold, for each subnet in the set of top subnets, determining a number of active Internet Protocol (IP) addresses wherein the threshold is determined based on an outlier of IP addresses in the time series. However, Jones discloses it [para. 55-60].
It would have been obvious to one of ordinary skill in the art at the time the effective filing of the invention to modify Mattia and Voros’s system to further comprise the omitted claim limitations, as disclosed by Jones, in order to detect anomalous activities.
Mattia, Voros and Jones further disclose sending by the system the threat score that measures a vulnerability of whether the subnet is a source of a malicious attack [Mattia para. 45, 79 and claim 1]; receiving the output of the infrastructure classifier 112, including a classification of maliciousness, prediction of maliciousness, metrics, scores, and/or confidence values].
As regarding claims 2, 9 and 16, Mattia, Voros and Jones further disclose The computer-implemented method of claim 1, wherein the threat score is based on a percentage of internet protocol addresses of the subnet exceeding a threshold [Voros para. 47 and 77].
As regarding claims 3, 10 and 17, Mattia, Voros and Jones further disclose The computer-implemented method of claim 1, wherein the computing the threat metric comprises determining an assertion of a component of each of the plurality of internet protocol addresses [Voros para. 32-33; determining reputation].
As regarding claims 4, 11 and 18, Mattia, Voros and Jones further disclose The computer-implemented method of claim 1, further comprising sending an action based on a security policy [Voros para. 31, 92 and 94; remedial actions].
As regarding claims 5, 12 and 19, Mattia, Voros and Jones further disclose The computer-implemented method of claim 1, wherein the computing the threat metric for each of the plurality of internet protocol addresses is based on a threat attribute [Voros para. 77].
As regarding claims 7 and 14, Mattia, Voros and Jones further disclose The computer-implemented method of claim 6, wherein the statistical algorithm comprises an Interquartile Range algorithm [Jones para. 55].
Conclusion
Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to THONG P TRUONG whose telephone number is (571)270-7905. The examiner can normally be reached on M-F 8:30AM - 5:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached on 57127267986798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/THONG TRUONG/
Examiner, Art Unit 2433
/JEFFREY C PWU/Supervisory Patent Examiner, Art Unit 2433