DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
This is a reply to the amendment filed on 03/06/2026, in which, claim(s) 1-20 are pending. Claim(s) 1 and 11 are amended. No claim(s) are cancelled or newly added.
Response to Arguments
Claim Rejections - 35 U.S.C. § 102 and 35 U.S.C. § 103:
Applicants’ arguments, see pages 10-12, filed 03/06/2026, regarding the U.S.C. 102 and 103 rejections of claims 1-20 have been fully considered and are not persuasive.
Applicant’s arguments with respect to the amended limitation “generating at least one first candidate rule corresponding to a fixed network behavior of the at least one electronic device based on the plurality of first packet features” of claim(s) 1 and 11 have been considered but are moot in view of the new ground(s) of rejection.
Applicants argue that “setting a network firewall whitelist for managing the plurality of network packets transmitted by the at least one electronic device on the network based on the at least one first candidate rule…none of Saavedra and Jia expressly discloses or suggestively teaches”.
Applicant’s interpretation of the reference has been noted; however, examiner respectfully disagrees. Jia teaches setting up a network firewall whitelist based on the rules ([0046] & [0071], “allow lists (as whitelist) can be sent to firewalls of subscribing customers for filtering network traffic in their enterprise networks”, “rules can apply one or more signatures or other matching criteria or heuristics”).
Therefore, the rejection is maintained.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claims 1-2, 8-12, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Saavedra et al. (US 20190182213 A1) in view of Li et al. (US 2023/0092522 A1) further in view of Jia et al. (US 2024/0039893 A1).
Regarding Claims 1, Saavedra discloses A network management device, comprising:
a transceiver interface, being communicatively connected to at least one electronic device, wherein the at least one electronic device transmits a plurality of network packets through a network ([0338], “As shown in FIG. 3, the network element/network aggregation device (also referred to in this disclosure simply as the “device” or the “network aggregation device”) 23 includes (in this particular embodiment shown for illustration) a network connection termination module 25 that includes representative transceiver interfaces 14, 15 and 16”, [0346], “The network aggregation engine 11 may receive traffic from client network connection device 18 through a network connection 17 provided through a transceiver interface 16”); and
a processor, being electrically connected to the transceiver interface ([0345], “The network aggregation engine 11 may be implemented in software for execution by a processor in the network aggregation device 23”), and being configured to perform the following operations:
in response to the at least one electronic device transmitting the plurality of network packets, retrieving a plurality of network packet information corresponding to the plurality of network packets ([0092], “a packet generally contains the information required to direct the packet”, [0346], “The network aggregation engine 11 may receive traffic (i.e. the plurality of network packets) from client network connection”);
determining a plurality of first packet features corresponding to the at least one electronic device based on the plurality of network packet information ([0321], “inspect/examine the destination IP address and other information in the packet”);
Saavedra does not explicitly teach but Li teaches
generating at least one first candidate rule corresponding to a fixed network behavior of the at least one electronic device based on the plurality of first packet features ([0149], “The server stores the client fingerprints of all historical network data packets in the device fingerprint database”, [0186], “storing the behavior pattern (as a fixed network behavior) in the database”, [0108], “translates the behavior of the target network data packet into a rule”, i.e., generates the rule corresponding to the fixed network behavior”),
Saavedra and Li are analogous art as they are in the same field of endeavor of information security. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Li with the disclosure of Saavedra. The motivation/suggestion would have been to improve the accuracy of data packet security detection (Li, [0006]).
The combined teaching of Saavedra and Li does not explicitly teach but Jia teaches
setting a network firewall whitelist for managing the plurality of network packets transmitted by the at least one electronic device on the network based on the at least one first candidate rule ([0046], “rules can apply one or more signatures or other matching criteria or heuristics, such as for security policy enforcement for subscriber/IP flows”, [0071], “An action can then be performed using the block lists and/or allow lists as shown at 430 (e.g., updated block lists and allow lists (as whitelist) can be sent to firewalls of subscribing customers for filtering network traffic in their enterprise networks, such as data appliance 102 for enterprise network 140 as shown in FIG. 1)”).
Saavedra, Li and Jia are analogous art as they are in the same field of endeavor of information security. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Jia with the combined teaching of Saavedra and Li. The motivation/suggestion would have been to provide security services to a variety of entities (Jia, [0057]).
Regarding Claims 2 and 12, the combination of Saavedra, Li and Jia teaches
wherein each of the plurality of network packet information comprises at least one of a media access control address, a packet time, a communication protocol, a source internet protocol, a source port, a destination Internet protocol, a destination port, a packet size, a packet content or a combination thereof (Saavedra, [0321], “inspect/examine the destination IP address and other information in the packet”)
Regarding Claims 8 and 18, the combination of Saavedra, Li and Jia teaches
receiving a firewall log (Saavedra, [0200], “firewall logs being processed”);
retrieving a plurality of second packet features corresponding to the at least one electronic device from the firewall log (Saavedra, [0201-0202], “At-least-once consumption semantics may ensure that each log message is processed at least once by the message processing pipeline”, “A message processing pipeline may generate and/or associate a token (“tokenise”) for each message in a message queue and store same, for example, in a data structure”);
generating at least one second candidate rule corresponding to the at least one electronic device based on the plurality of second packet features (Saavedra, [0321], “inspect/examine the destination IP address and other information in the packet”, [0202], “the message processing pipeline may also check for any threshold violations Threshold violations can be violations based on a mathematical function (Count, Max, etc) over a time period. Examples include the number of matches for a specific rule over a given time or total matches on a firewall over a given time”); and
managing the plurality of network packets transmitted by the at least one electronic device on the network based on the at least one first candidate rule and the at least one second candidate rule (Saavedra, [0200], “Remediation actions could be the addition of a null route to stop the traffic from hitting the CPE, an email alert being sent to the OPS staff, a deny rule being sent to all CPE devices”).
Regarding Claims 9 and 19, the combination of Saavedra, Li and Jia teaches
wherein the processor receives the firewall log from a network device, and the at least one electronic device is communicatively connected to the network device (Saavedra, [0200], “A syslog server may receive log entries that are shipped or transmitted from one or more client site network components or CPEs…firewall logs being processed”, [0358-0361], “Fig. 5”, “aggregated network connections 70, 71 and 72 may be built by network aggregation devices 63, 64 and 65”, “A client network node 67”).
Regarding Claims 10 and 20, the combination of Saavedra, Li and Jia teaches
wherein the at least one electronic device transmits the plurality of network packets through the network device ([0358-0361], “Fig. 5”, “aggregated network connections 70, 71 and 72 may be built by network aggregation devices 63, 64 and 65”, “A client network node 67”).
Regarding Claim 11, Saavedra discloses
A network management method, being adapted for use in a network management device, wherein the network management method comprises the following steps:
determining, based on a plurality of network packet information corresponding to a plurality of network packets transmitted by at least one electronic device, a plurality of first packet features corresponding to the at least one electronic device ([0092], “a packet generally contains the information required to direct the packet”, [0346], “The network aggregation engine 11 may receive traffic (i.e. the plurality of network packets) from client network connection”, [0321], “inspect/examine the destination IP address and other information in the packet”);
Saavedra does not explicitly teach but Li teaches
generating at least one first candidate rule corresponding to a fixed network behavior of the at least one electronic device based on the plurality of first packet features ([0149], “The server stores the client fingerprints of all historical network data packets in the device fingerprint database”, [0186], “storing the behavior pattern (as a fixed network behavior) in the database”, [0108], “translates the behavior of the target network data packet into a rule”, i.e., generates the rule corresponding to the fixed network behavior”),
Saavedra and Li are analogous art as they are in the same field of endeavor of information security. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Li with the disclosure of Saavedra. The motivation/suggestion would have been to improve the accuracy of data packet security detection (Li, [0006]).
The combined teaching of Saavedra and Li does not explicitly teach but Jia teaches
setting a network firewall whitelist for managing the plurality of network packets transmitted by the at least one electronic device on a network based on the at least one first candidate rule ([0046], “rules can apply one or more signatures or other matching criteria or heuristics, such as for security policy enforcement for subscriber/IP flows”, [0071], “An action can then be performed using the block lists and/or allow lists as shown at 430 (e.g., updated block lists and allow lists (as whitelist) can be sent to firewalls of subscribing customers for filtering network traffic in their enterprise networks, such as data appliance 102 for enterprise network 140 as shown in FIG. 1)”).
Saavedra, Li and Jia are analogous art as they are in the same field of endeavor of information security. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Jia with the combined teaching of Saavedra and Li. The motivation/suggestion would have been to provide security services to a variety of entities (Jia, [0057]).
Claims 3-5, and 13-15, are rejected under 35 U.S.C. 103 as being unpatentable over Saavedra et al. (US 20190182213 A1) in view of Li et al. (US 2023/0092522 A1) further in view of Jia et al. (US 2024/0039893 A1) and further in view of Nobakht et al. (US 2022/0201013 A1).
Regarding Claims 3 and 13, the combination of Saavedra, Li and Jia does not explicitly teach but Nobakht teaches wherein the operation of determining the plurality of first packet features corresponding to the at least one electronic device comprises the following operations:
comparing the plurality of network packet information of the plurality of network packets to calculate an occurrence frequency corresponding to the plurality of network packets ([0054], “The packet switch 114 analyzes the power spectral density data to show at what frequencies various packet sequences are occurring”, “The packet switch 114 compares the expected flows to the detected flows to detect any unexpected flows”); and
determining the plurality of first packet features corresponding to the at least one electronic device based on the occurrence frequency corresponding to the plurality of network packets ([0054], “The packet switch 114 compares the expected flows to the detected flows to detect any unexpected flows”).
Saavedra, Li, Jia and Nobakht are analogous art as they are in the same field of endeavor of information security. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Nobakht with the combination of Saavedra, Li and Jia. The motivation/suggestion would have been for detecting malicious traffic flows in a network (Nobakht, Abstract).
Regarding Claims 4 and 14, the combination of Saavedra, Li and Jia does not explicitly teach but Nobakht teaches wherein the operation of determining the plurality of first packet features corresponding to the at least one electronic device comprises the following operations:
comparing the plurality of network packet information of the plurality of network packets to calculate an occurrence frequency and a packet time corresponding to the plurality of network packets ([0054], “The packet switch 114 analyzes the power spectral density data to show at what frequencies various packet sequences are occurring”, [0049], “the packet switch 114 computes 408 inter-arrival times”); and
determining the plurality of first packet features corresponding to the at least one electronic device based on the occurrence frequency and the packet time corresponding to the plurality of network packets ([0054], “The packet switch 114 compares the expected flows to the detected flows to detect any unexpected flows”, [0051], “The results of the inter-arrival times nonlinear ratio 416 and the packet duration nonlinear ratio 424 are combined 430 and used to compute 432 one or more histograms”).
Saavedra, Li, Jia and Nobakht are analogous art as they are in the same field of endeavor of information security. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Nobakht with the combination of Saavedra, Li and Jia. The motivation/suggestion would have been for detecting malicious traffic flows in a network (Nobakht, Abstract).
Regarding Claims 5 and 15, the combination of Saavedra, Li and Jia does not explicitly teach but Nobakht teaches wherein the operation of determining the plurality of first packet features corresponding to the at least one electronic device comprises the following operations:
comparing the plurality of network packet information of the plurality of network packets to calculate an occurrence frequency, a packet time, and a packet size corresponding to the plurality of network packets ([0054], “The packet switch 114 analyzes the power spectral density data to show at what frequencies various packet sequences are occurring”, [0049], “the packet switch 114 computes 408 inter-arrival times”, [0034], “packet size”); and
determining the plurality of first packet features corresponding to the at least one electronic device based on the occurrence frequency, the packet time, and the packet size corresponding to the plurality of network packets ([0054], “The packet switch 114 compares the expected flows to the detected flows to detect any unexpected flows”, [0051], “The results of the inter-arrival times nonlinear ratio 416 and the packet duration nonlinear ratio 424 are combined 430 and used to compute 432 one or more histograms”, [0034], “the system can add resolution and/or accuracy to the information about the packets being analyzed, such as, but not limited to, number of packets in each flow, type of packets, packet size, frequency”).
Saavedra, Li, Jia and Nobakht are analogous art as they are in the same field of endeavor of information security. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Nobakht with the combination of Saavedra, Li and Jia. The motivation/suggestion would have been for detecting malicious traffic flows in a network (Nobakht, Abstract).
Claims 6-7, and 16-17, are rejected under 35 U.S.C. 103 as being unpatentable over Saavedra et al. (US 20190182213 A1) in view of Li et al. (US 2023/0092522 A1) further in view of Jia et al. (US 2024/0039893 A1) and further in view of Hugo Filipe Parreira Pernicha (US 2016/0191466 A1).
Regarding Claims 6 and 16, the combination of Saavedra, Li and Jia does not explicitly teach but Pernicha teaches wherein the processor further performs the following operations:
calculating a rule weight corresponding to each of the at least one first candidate rule ([0054], “policy rule optimization module 208 can be configured to automatically optimize the updated set of policy rules by grouping a first sub-set of policy rules of the updated set of policy rules, reordering a second sub-set of policy rules of the updated set of policy rules and/or deleting a third sub-set of policy rules of the updated set of policy rules based on weights assigned to particular types of traffic, preference settings, priority settings, network traffic characteristics and/or network usage statistics for the policy rules of the updated set of policy rules”);
determining at least one application rule from the at least one first candidate rule based on the rule weights ([0085], “determined automatically based on one or more of the weight of each rule”); and
managing the plurality of network packets transmitted by the at least one electronic device on the network based on the at least one application rule ([0086], “the updated policy rule set has a policy rule at index 1 resulting from a partial merger of former policy rules associated with index 1 and index 2 of FIG. 5C, with the source being 192.168.0.0/23 and allowing issuance of packets to all destinations using DNS, HTTP and/or HTTPS services”),
Saavedra, Li, Jia and Pernicha are analogous art as they are in the same field of endeavor of information security. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Pernicha with the combination of Saavedra, Li and Jia. The motivation/suggestion would have been for dynamically optimized rule-based security policy management (Pernicha, Abstract).
Regarding Claims 7 and 17, the combination of Saavedra, Li, Jia and Pernicha teaches wherein the operation of managing the plurality of network packets transmitted by the at least one electronic device on the network comprises the following operations:
determining whether a network packet to be transmitted conforms to the at least one application rule (Pernicha, [0086], “the updated policy rule set has a policy rule at index 1 resulting from a partial merger of former policy rules associated with index 1 and index 2 of FIG. 5C, with the source being 192.168.0.0/23 and allowing issuance of packets to all destinations using DNS, HTTP and/or HTTPS services”); and
in response to the network packet to be transmitted conforming to the at least one application rule, allowing the at least one electronic device to transmit the network packet to be transmitted on the network (Pernicha, [0086], “the updated policy rule set has a policy rule at index 1 resulting from a partial merger of former policy rules associated with index 1 and index 2 of FIG. 5C, with the source being 192.168.0.0/23 and allowing issuance of packets to all destinations using DNS, HTTP and/or HTTPS services”).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHENG-FENG HUANG whose telephone number is (571)272-6186. The examiner can normally be reached Monday-Friday: 9 am - 5 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni A Shiferaw can be reached at (571) 272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CHENG-FENG HUANG/Primary Examiner, Art Unit 2497
Prosecution Insights