Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to claim(s) 1, 3-21 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Applicant argues that the prior art Martin US 2018/0004948 fails to teach the claims as amended, including frequency and tying said frequency to user profiles.
Examiner asserts that Martin arguable teaches these amendments as it teaches machine learning for anomalies, based on past history, a frequency of actions, connected to a user profile, [0024][0025][0028][0046]
Examiner has included Gasiorek US 2024/0155007 in an effort to expedite prosecution.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 3-21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Martin US 2018/0004948 in view of Gasiorek US 2024/0155007.
As per claim 1. Matin teaches A method, comprising: receiving a plurality of events from a plurality of different digital service platforms; for a specific event included in the plurality of events: determining an abnormality score using an abnormality detection machine learning model; and determining a risk score using a risk detection machine learning model, wherein the risk score is different from the abnormality score; and based on at least the abnormality score and the risk score, determining whether to perform a secondary analysis of the specific event to detect a security threat. [0010]-[0012] [0017]-[0021] (teaches an event detector that calculates a plurality of security scores of events and creating a composite risk score, if the score is above a threshold then forwarding for additional analysis; teaches an example of 3 risk scores, the first being for detection of malware, the latter two being detections of anomalous behavior) [0028] [0034][0044][0046] (teaches use of supervised machine learning models) [0075]-[0077][0082] (train a neural network on entity behavior) Martin teaches standardizing at least one event of the received plurality of events to a common format. [0050][0051][0070] (standard data structure)
Martin teaches a plurality of events associated with a user profile. [0024][0025] (user accounts) Martin teaches the risk detection machine learning model is trained using entity level frequency aggregate to determine whether the specific event is unusual for a user profile. [0028][0069][0071] (teaches behavior learning including learning user behavior) Martin teaches the risk detection learning model is trained on categorical features to determine wither the specific event resembles previously detected security threats. [0076][0077][0115] (trained on history for all assets based on previous security threats)
Gasiorek teaches standardizing at least one event of the plurality of events to a common format associated with a user profile. Gasiorek teaches an abnormality score using a machine learning model where the model uses entity level frequency aggregate to determined whether the specific event is unusual for the user profile. [0013][0015][0041] (user profiles) [0042][0053] (compare score to a threshold) [0043] (normalize data to a unified format; profile data for users, peer data, machine learning to produce a score based on multiple factors, including frequency of actions) [0049]-[0052] (normalization of data, using historical data for a profile, aggregate number of threats in a threat chain to determine an abnormality score)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the current application to use the teaching of Gasiorek with the prior art because it improves security.
As per claim 2. Martin teaches the method of claim 1, further comprising standardizing at least one event of the received plurality of events to a common format. [0050][0051][0070] (standard data structure)
As per claim 3. Martin teaches the method of claim 2, wherein the common format is associated with a sign-in event, the sign-in event including at least one of: one or more repeated clients, one or more repeated actors, one or more repeated targets, or an authentication context. [0019] (repeated login attempts within a time period)
As per claim 4. Martin teaches the method of claim 2, wherein the common format is associated with a user profile, the user profile including at least one of: address, native platform identifier, name, job title, department, location, phone number, permission, or access level. [0015][0036][0069] (address, username)
As per claim 5. Martin teaches the method of claim 2, wherein the common format is associated with at least one of: a message event, a mail filter, a risk event, or an internal email message. [0068] (message email event)
As per claim 6. Martin teaches the method of claim 1, further comprising enriching at least one event of the received plurality of events including by adding additional information to the at least one event. [0015][0042] (include metadata)
As per claim 7. Martin teaches the method of claim 6, wherein the added additional information of the enriched at least one event includes at least: a user-level information, a network quality score, or a count. [0015][0042][0069] (include user metadata)
As per claim 8. Martin teaches the method of claim 1, further comprising determining at least one feature based at least in part on the plurality of events. [0014] [0019] (brute force login attempts between time stamps)
As per claim 9. Martin teaches the method of claim 8, wherein the at least one feature is based at least in part on a comparison of at least one of: a time between two events or a distance between the two events. [0014] [0019] (brute force login attempts between time stamps)
As per claim 10. Martin teaches the method of claim 1, wherein the abnormality detection machine learning model is configured to determine events that are unusual for a particular entity. [0071][0075]-[0077][[0082] (training a neural network with vectors to determined behavior and what constitutes a deviation from normal behavior via a threshold)
As per claim 11. Martin teaches the method of claim 10, wherein the abnormality detection machine learning model is trained at least in part using a frequency aggregate of how often a characteristic of an event has appeared previously. [0071][0075]-[0077][[0082] (training a neural network with vectors, including frequency of behavior of behaviors, to determined behavior and what constitutes a deviation from normal behavior via a threshold)
As per claim 12. The method of claim 1, wherein the risk detection machine learning model is configured to determine events based at least in part on previously detected security threats. ) [0028] [0034][0038][0044][0046] (trained on attack patterns based on prior security threats)
As per claim 13. The method of claim 12, wherein the risk detection machine learning model is trained at least in part using a likelihood of a characteristic of an event appearing based at least in part on known patterns. (attack patterns, machine learning, likelihood of threat )[0021][0028] [0034][0038][0044][0046][0066]
As per claim 14. The method of claim 12, wherein the risk detection machine learning model is trained at least in part using aggregates of categorical features. [0028] [0034][0038][0044][0046] (teaches pattern training for a variety of different categories of attacks)
As per claim 15. The method of claim 1, wherein determining whether to perform the secondary analysis of the specific event to detect the security threat includes determining to perform the secondary analysis in response to the specific event being determined to be not benign. [0041]-[0047] (teaches that if the composite risk score overcomes a first threshold, then an alert is sent for further investigation into the security event)
As per claim 16. The method of claim 1, wherein determining whether to perform the secondary analysis of the specific event to detect the security threat includes determining to perform the secondary analysis in response to at least one of: a determination that the abnormality score meets an abnormality threshold; a determination that the risk score meets a risk threshold; or a determination that a combination of the abnormality score and the risk score meets a combined threshold. [0041]-[0047] (teaches that if the composite risk score overcomes a first threshold then an alert is sent for further investigation into the security event) [0010]-[0012] [0017]-[0021] (teaches an event detector that calculates a plurality of security scores of events and creating a composite risk score, if the score is above a threshold then forwarding for additional analysis; teaches an example of 3 risk scores, the first being for detection of malware, the latter two being detections of anomalous behavior)
As per claim 17. Martin teaches A system, comprising: a processor configured to: receive a plurality of events from a plurality of different digital service platforms; for a specific event included in the plurality of events: determine an abnormality score using an abnormality detection machine learning model; and determine a risk score using a risk detection machine learning model, wherein the risk score is different from the abnormality score; and based on at least the abnormality score and the risk score, determine whether to perform a secondary analysis of the specific event to detect a security threat; and a memory coupled to the processor and configured to provide the processor with instructions. [0010]-[0012] [0017]-[0021] (teaches an event detector that calculates a plurality of security scores of events and creating a composite risk score, if the score is above a threshold then forwarding for additional analysis; teaches an example of 3 risk scores, the first being for detection of malware, the latter two being detections of anomalous behavior) [0028] [0034][0044][0046] (teaches use of supervised machine learning models) [0075]-[0077][0082] (train a neural network on entity behavior)
Martin teaches a plurality of events associated with a user profile. [0024][0025] (user accounts) Martin teaches the risk detection machine learning model is trained using entity level frequency aggregate to determine whether the specific event is unusual for a user profile. [0028][0069][0071] (teaches behavior learning including learning user behavior) Martin teaches the risk detection learning model is trained on categorical features to determine wither the specific event resembles previously detected security threats. [0076][0077][0115] (trained on history for all assets based on previous security threats)
Gasiorek teaches standardizing at least one event of the plurality of events to a common format associated with a user profile. Gasiorek teaches an abnormality score using a machine learning model where the model uses entity level frequency aggregate to determined whether the specific event is unusual for the user profile. [0013][0015][0041] (user profiles) [0042][0053] (compare score to a threshold) [0043] (normalize data to a unified format; profile data for users, peer data, machine learning to produce a score based on multiple factors, including frequency of actions) [0049]-[0052] (normalization of data, using historical data for a profile, aggregate number of threats in a threat chain to determine an abnormality score)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the current application to use the teaching of Gasiorek with the prior art because it improves security.
As per claim 18. Martin teaches the system of claim 17, further comprising enriching at least one event of the received plurality of events including by adding additional information to the at least one event, wherein the added additional information of the enriched at least one event includes at least: a user-level information, a network quality score, or a count. [0015][0042][0069] (include user metadata)
As per claim 19. Martin teaches the system of claim 17, wherein determining whether to perform the secondary analysis of the specific event to detect the security threat includes determining to perform the secondary analysis in response to at least one of: a determination that the abnormality score meets an abnormality threshold; a determination that the risk score meets a risk threshold; or a determination that a combination of the abnormality score and the risk score meets a combined threshold. [0041]-[0047] (teaches that if the composite risk score overcomes a first threshold then an alert is sent for further investigation into the security event) [0010]-[0012] [0017]-[0021] (teaches an event detector that calculates a plurality of security scores of events and creating a composite risk score, if the score is above a threshold then forwarding for additional analysis; teaches an example of 3 risk scores, the first being for detection of malware, the latter two being detections of anomalous behavior)
As per claim 20. Martin teaches A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: receiving a plurality of events from a plurality of different digital service platforms; for a specific event included in the plurality of events: determining an abnormality score using an abnormality detection machine learning model; and determining a risk score using a risk detection machine learning model, wherein the risk score is different from the abnormality score; and based on at least the abnormality score and the risk score, determining whether to perform a secondary analysis of the specific event to detect a security threat. [0010]-[0012] [0017]-[0021] (teaches an event detector that calculates a plurality of security scores of events and creating a composite risk score, if the score is above a threshold then forwarding for additional analysis; teaches an example of 3 risk scores, the first being for detection of malware, the latter two being detections of anomalous behavior) [0028] [0034][0044][0046] (teaches use of supervised machine learning models) [0075]-[0077][0082] (train a neural network on entity behavior)
Martin teaches a plurality of events associated with a user profile. [0024][0025] (user accounts) Martin teaches the risk detection machine learning model is trained using entity level frequency aggregate to determine whether the specific event is unusual for a user profile. [0028][0069][0071] (teaches behavior learning including learning user behavior) Martin teaches the risk detection learning model is trained on categorical features to determine wither the specific event resembles previously detected security threats. [0076][0077][0115] (trained on history for all assets based on previous security threats)
Gasiorek teaches standardizing at least one event of the plurality of events to a common format associated with a user profile. Gasiorek teaches an abnormality score using a machine learning model where the model uses entity level frequency aggregate to determined whether the specific event is unusual for the user profile. [0013][0015][0041] (user profiles) [0042][0053] (compare score to a threshold) [0043] (normalize data to a unified format; profile data for users, peer data, machine learning to produce a score based on multiple factors, including frequency of actions) [0049]-[0052] (normalization of data, using historical data for a profile, aggregate number of threats in a threat chain to determine an abnormality score)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the current application to use the teaching of Gasiorek with the prior art because it improves security.
As per claim 21, Martin teaches a determining whether to perform the secondary analysis of the specific event to detect the security threat includes determining to perform the secondary analysis in response to at least one of a determination that the abnormality score meets an abnormality threshold; a determination that the risk score meets a risk threshold; or a determination that a combination of the abnormality score and the risk score meets a combined threshold. [0020][0047][0075] (pushes to security analyst if score is above a risk threshold, or immediately if an abnormal outlier is detected.)
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHRISTOPHER BROWN whose telephone number is (571)272-3833. The examiner can normally be reached M-F 8-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached at (571) 270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CHRISTOPHER J BROWN/Primary Examiner, Art Unit 2439
Prosecution Insights