DETAILED ACTION
Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
2. Claims 1-17 are presented for examination.
Response to Arguments
3. Applicant’s argument filed on 12/31/2025 with respect claims 1-17 have been fully considered but they are not persuasive.
For claim Rejections - 35 USC § 112: The applicant indicates that the specification specifically recites that "the expression ... 'at least one of A and/or B,'' at least one of A or B,' or 'at least one of A and B' may indicate (1) A, (2) B, or (3) both A and B." For at least these reasons, Applicants respectfully submit that the concerned claim language should not be interpreted as a Markush language. Examiner respectfully disagrees and asserts that the claim recites Markush language since the claim recites a list of alternatively useable species. See MPEP 2173.05(h).
For claim Rejections - 35 USC § 103: The applicant contends that the office action fails to teach or suggest the limitation of "determining an anomaly cause of the SSD based on a subset of the test data, the subset including specific test data based on which the SSD has been determined to have the anomaly." Examiner respectfully disagrees and asserts the reference of Giterman et al. (US 2022/0070190 A1) in paragraphs [0009], [0136]- [0138], and Fig. 2 teaches the such limitation. For example, in one embodiment, an apparatus comprises at least one processing device that includes a processor and a memory, with the processor being coupled to the memory. The at least one processing device is configured to receive storage access protocol commands directed by one or more host devices to storage devices of a storage system over a SAN, to generate statistics relating to the received storage access protocol commands, to process the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the SAN, and to generate an alert indicative of an access anomaly based at least in part on the processing of the generated statistics in the machine learning system. See paragraph [0009].In step 206, the machine learning system on the external server processes the statistics offloaded from the storage array to recognize anomalous access patterns. See paragraph [0136].In step 208, a determination is made as to whether or not any anomalous access pattern has been detected by the machine learning system. If at least one anomalous access pattern has been detected by the machine learning system, the process moves to step 210, and otherwise returns to step 200 as indicated to continue its ongoing processing of storage access protocol commands received from the host devices via the SAN. See paragraph [0137].In step 210, the external server generates at least one alert indicative of an access anomaly corresponding to the detected anomalous access pattern. See paragraph [0138]. Also see Fig. 2 printed below for your convenience.
PNG
media_image1.png
671
728
media_image1.png
Greyscale
As been described above, that an alert indicative of an access anomaly generated based at least in part on anomalous access patterns [test data], and also and as shown in Fig. 2, in step 210 generates at least one alert indicative of an access anomaly corresponding to the detected anomalous access pattern based on anomalous access pattern [test data] has been detected by the machine learning system in step208. Emphasis added.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION. The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
4. Claims 1-17 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention. In regards to claim 1, the claim recites the limitation of "the test data including at least one of self-monitoring, analysis and reporting technology S.M.A.R.T. data, NAND flash cell threshold voltage distribution data, and bit error rate eye diagram data." This feature is a "Markush group" because the claim recites a list of alternatively useable species, and it is improper to use the term "including" instead of "consisting of. See MPEP 2173.05(h). (Emphasis added). Please clarify. Other independent claim 9 recites similar limitations of claim 1. Therefore, is rejected for the same reason of claim 1. Dependent claims 2-8 and 10-17 depend from the base claims 1 and 9 respectively and inherently include limitations therein and therefore are rejected under 35 USC 112, 2nd paragraph as well.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
5. Claims 1-5, 9-13, and 17 are rejected under 35 U.S.C. 103 (a) as being unpatentable over Gaber et al. (US 10,216,558 B1) "herein after as Gaber" in view of Giterman et al. (US 2022/0070190 A1) "herein after as Giterman."
As per claims 1 and 9:
Gaber substantially teaches or discloses an anomaly detection processing method for solid-state drive (SSD), comprising (see abstract): collecting test data of an SSD (see column 6, lines 25-30, herein the process 600 at 602 obtains the feature dataset for the drive from the drive behavior feature datasets repository 206. At 603, process 600 analyzes the drive behavior based on a combination of the raw features and the historical features stored in the drive's features dataset), the test data including at least one of self-monitoring, analysis and reporting technology (S.M.A.R.T.) data, NAND flash cell threshold voltage distribution data, and bit error rate eye diagram data (see column 3, lines 53-56, herein a raw sample SMART data collector module 110 collects samples of the SMART attributes reported by drives 102/106 and relays them to a first application of a feature selection machine learning model 114); determining whether the SSD has an anomaly based on the test data (see column 6, lines 30-34, herein at decision block 604, the process 600 classifies the drive as predicted to fail when the individual drive failure probabilities predicted by the model exceed a certain threshold or meet other criteria for classifying failed and healthy drives). Gaber does not explicitly teach determining an anomaly cause of the SSD based on a subset of the test data, the subset including specific test data based on which the SSD has been determined to have the anomaly. However, Giterman in the same the field of endeavor teaches determining an anomaly cause of the SSD based on a subset of the test data, the subset including specific test data based on which the SSD has been determined to have the anomaly (see paragraph [0009], herein the at least one processing device is configured to receive storage access protocol commands directed by one or more host devices to storage devices of a storage system over a SAN, to generate statistics relating to the received storage access protocol commands, to process the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the SAN, and to generate an alert indicative of an access anomaly based at least in part on the processing of the generated statistics in the machine learning system; paragraphs [0136] - [0138]; and Fig. 2 steps 206- 210). Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the invention, to modify the system of Gaber with the teachings of Giterman by determining an anomaly cause of the SSD based on a subset of the test data, the subset including specific test data based on which the SSD has been determined to have the anomaly. This modification would have been obvious to one of ordinary skill in the art, before the effective filing date of the invention, because one of ordinary skill in the art would have recognized the determining an anomaly cause of the SSD based on a subset of the test data, the subset including specific test data based on which the SSD has been determined to have the anomaly would have improved techniques for detection and remediation of active cyber-attacks such as the above-described ransomware attacks or other types of malicious activity targeting stored data of a storage array or other type of storage system (see paragraph [0004] of Giterman).
As per claims 2 and 10: Giterman teaches that wherein the determining whether the SSD has an the anomaly comprises: determining whether the SSD has the anomaly, based on the S.M.A.R.T. data by using a trained first anomaly detection model, based on the NAND flash cell threshold voltage distribution data by using a second anomaly detection model, or based on the bit error rate eye diagram data by using a trained third anomaly detection model (see paragraph [0009], herein to generate statistics relating to the received storage access protocol commands, to process the generated statistics in a machine learning system trained to recognize anomalous access patterns to the storage devices over the SAN); or determining whether the SSD has the anomaly based on the S.M.A.R.T. data, the NAND flash cell threshold voltage distribution data or the bit error rate eye diagram data, by using a trained anomaly detection model (see paragraph [0097], herein the machine learning system can be trained to recognize these and a wide variety of other anomalous access patterns based on protocol-level statistics maintained by the storage array 105 on a per-device basis [Examiner note: since the claim has been amended to recite a broad limitations, Giterman teaches such limitations).
As per claims 3 and 11: Giterman teaches that wherein the determining the anomaly cause of the SSD comprises: determining, by using a trained anomaly cause analysis model, the anomaly cause of the SSD based on the subset of the test data (see paragraph [0076], herein the protocol-level statistics 121 are processed in a machine learning system 122 trained to recognize anomalous access patterns to the storage devices 106 over the SAN 104. At least one alarm or other type of alert indicative of an access anomaly is generated based at least in part on the processing of the protocol-level statistics 121 in the machine learning system 122, and Fig. 2 steps 206-210).
As per claims 4 and 12: Giterman teaches that before the determining whether the SSD has an anomaly, performing feature extraction on the test data to obtain features of the test data (see paragraph [0093], herein the machine learning system 122 implements one or more machine learning algorithms trained to recognize anomalous access patterns. Access patterns can include features such as command count patterns, data payload size patterns, time-of-day patterns, day-of-month patterns as well as combinations of these and/or other characteristics relating to the manner in which the storage devices 106 are accessed by the host devices 102 over time).
As per claims 5 and 13: Gaber teaches that wherein for the S.M.A.R.T. data, the collecting test data of an SSD comprises: collecting a S.M.A.R.T. data set of the SSD, the S.M.A.R.T. data set including S.M.A.R.T. data (see column 3, lines 53-56, herein a raw sample SMART data collector module 110 collects samples of the SMART attributes reported by drives 102/106 and relays them to a first application of a feature selection machine learning model 114); determining a correlation between each S.M.A.R.T. data in the S.M.A.R.T. data set and whether the SSD has the anomaly; and taking a number of S.M.A.R.T. data with high correlation as the test data for determining whether the SSD has the anomaly (see column 2, lines 40-54, herein Another limitation of rule-based learning of disk drive failure patterns is the difficulty in taking into account the numerous correlations of multiple SMART attributes that can be part of the failure pattern. Some of the SMART attributes display high correlation in their measured values. For example, SMART feature 241, total Logical Block Addresses (LBA) written, is highly correlated with SMART feature 9, power on hours. Correlation between SMART attributes can affect the accuracy of rule-based learning if it is not taken into account by, for example, extracting the correlation level and incorporating it as a feature for the model. In the case of manually-set thresholds for a large number of attributes (e.g. if 80 SMART metrics are collected) most rule-based models can't handle that amount of attributes and their combinations effectively).
As per claim 17: A non-transitory computer-readable medium storing computer-executable instructions thereon, which when executed by at least one processor, cause an electronic apparatus to perform the method of claim 1 (see column 7, lines 56-65, herein Processor 801 may communicate with memory 803, which in one embodiment can be implemented via multiple memory devices to provide for a given amount of system memory. Memory 803 may include one or more volatile storage (or memory) devices such as random access memory (RAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), static RAM (SRAM), or other types of storage devices. Memory 803 may store information including sequences of instructions that are executed by processor 801, or any other device, and Fig. 8).
Allowable Subject Matter
10. Claim 6, 8, 14, and 16 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims and to overcome the rejection(s) under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), 2nd paragraph of base claim 1, set forth in this Office action. Dependent claims 7 and 15 depend from on claims 6 and 14 respectively, and inherently include limitations therein and therefore are allowed as well.
Examiner Notes
6. When amending the claims, applicants are respectfully requested to indicate the portion(s) of the specification which dictate(s) the structure relied on for proper interpretation and also to verify and ascertain the metes and bounds of the claimed invention.
Prior Art
7. The prior art of record, considered pertinent to the applicant’s disclosure, is listed in the attached PTO-892 form.
Conclusion
8. THIS ACTION IS MADE FINAL; Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to OSMAN ALSHACK whose telephone number is (571)272-2069.
The examiner can normally be reached on MON-FRI 8:30 AM-5:00 PM EST, also please fax interview request to (571) 273- 2069.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, ALBERT DECADY can be reached on 5712723819. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/OSMAN M ALSHACK/Examiner, Art Unit 2112
/ALBERT DECADY/Supervisory Patent Examiner, Art Unit 2112