DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
Claims 1, 3-11, and 13-18 are pending in the application. Claims 1, 3-5, 11, 13-14, and 16 are currently amended. Claims 2 and 12 have been canceled. No new claims are currently added.
Response to Arguments
With regard to Applicant’s remarks dated July 25, 2026:
Regarding the rejection of claims 11 and 12 under 35 U.S.C. 101, Applicant’s amendment has been fully considered and is sufficient. Therefore, the rejection has been withdrawn.
Regarding the rejection of claims 4, 11-14 under 35 U.S.C. 112(b), Applicant’s amendment has been fully considered and is sufficient. Therefore, the rejection has been withdrawn.
Regarding the rejection of claims 1-5 and 8-16 under 35 U.S.C. 102(a)(2) and the rejection of claims 6-7 and 17-18 under 35 U.S.C. 103, Applicant’s amendment and arguments have been fully considered. Applicants argue with respect to claim 2 that has been incorporated into independent claim 1 that “paragraph [0041] of Zhang merely discloses a simple comparison between expected values and operational values, and no other paragraph in Zhang appears to describe such analysis operations. Moreover, Kawai and Chen fail to show or suggest this feature.” It appears that Applicants imply that all of the listed analysis operations are required, where the claim only requires one of the listed analyzing operations because of the “at least one” language. Therefore, Examiner maintains that Zhang teaches analyzing the deviation of each measurement associated with the inconsistencies of the reference dataset because Zhang teaches determining a difference between the predicted values and the operating values to provide respective residual values which can be compared to threshold values in par. [0041]. Therefore, reliance on Zhang is maintained.
As to any arguments not specifically addressed, they are the same as those discussed above.
Claim Objections
Claim 15 is objected to because of the following informalities: Applicants failed to correct claim dependency when canceling claim 2, making claim 15 depend from a canceled claim. For the purposes of examination, claim 15 is treated as depending from claim 1. Appropriate correction is required.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1, 3, 5, 8-11, and 13-16 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Zhang et al. (US 2023/0028886 A1).
As to claim 1, Zhang teaches a detection method for detecting an anomaly in an operating electronic system [industrial system] (Fig. 11), the electronic system comprising at least one processor each composed of a plurality of hardware blocks [programmable logic controller (PLC)] (par. [0024], [0055]), each processor executing at least one application [control logic program] (par. [0055]) by interactions of the at least one application with the hardware blocks [executing the control logic programming] (par. [0055]), the detection method comprising:
measuring, during the operation of the electronic system, at least one parameter representative of the interactions of the application with one of the hardware blocks in order to measure the representative parameter [reading the operating values of the process parameters from the data blocks in real time] (par. [0057]);
for each measurement, comparing the measurement with an associated reference dataset to detect inconsistencies between the measurement and the reference dataset [comparing the operating values with the predicted values of the process parameters] (par. [0057]), the reference dataset being representative of the operation of the electronic system when there are no anomalies [normal operation] (par. [0024], [0073]);
sending an alert according to an alert criterion relating to the detected inconsistency or inconsistencies [alerting the controller if the threshold has been exceeded] (par. [0024], [0037], [0057]);
performing at least one analyzing operation selected from the group consisting of: analyzing the nature of the hardware block associated with each inconsistency, analyzing the time frequency of the inconsistencies, and analyzing the deviation of each measurement associated with the inconsistencies of the reference dataset [determining a difference between the predicted values and the operating values to provide respective residual values which can be compared to threshold values] (par. [0041]); and
detecting, depending on each analysis, an anomaly (par. [0054]).
As to claim 3, Zhang teaches that, when at least one alert associated with one of the hardware blocks is transmitted, implementing a next iteration of the detection method starting from said measuring, wherein the set of hardware blocks for which a representative parameter measurement is performed is, at each iteration, included in the set of hardware blocks of the preceding iteration [Zhang anticipates continued monitoring after the replacement command is implemented and anomaly is resolved] (Fig. 11, par. [0077]).
As to claim 5, Zhang teaches that each representative parameter associated with one of the hardware blocks is chosen from the group consisting of: the type of data processed by the hardware block [different process parameter values] (par. [0041]), the type of instructions executed by the hardware block, the number of accesses to the hardware block, the number of computations executed and/or the computation time of the hardware block, the number of malfunctions of the hardware block, the number of interactions on an internal interconnection network to the processor involving the hardware block, and the number of interactions with the exterior of the processor via the hardware block.
As to claim 8, Zhang teaches comparing the or each inconsistency associated with the issued alert with a set of predetermined known anomalies; and categorizing the alert when the or each inconsistency corresponds to one of the known anomalies of the set of anomalies [threshold values for different variables were selected separately and the final alarms were the combination of alarms] (par. [0076]).
As to claim 9, Zhang teaches that the electronic system is a calculator [undefined element] [the local anomaly system operates on the PLC to read the operating values from the data block in real time and performs calculation of values] (par. [0047]-[0049], [0057]) carried on-board a transport platform [undefined element] [anomaly detection system co-located with the industrial system being monitored] (par. [0028]).
As to claim 10, Zhang teaches that the detection method of claim 1 is implemented by a system selected from the group consisting of: a dedicated programmable logic circuit forming one of the hardware blocks of processor [PLC programmable logic controller] (Fig. 5 par. [0015]), a software of an operating system of the electronic system interacting with a memory protected by a memory protection unit, and an application implemented by the electronic system by adding a driver controlling the hardware blocks.
As to claim 11, Zhang teaches a non-transitory readable storage medium on which is stored a computer program comprising program instructions, which, when implemented by a data processing unit cause the data processing unit to perform a detection method according to claim 1 discussed above (par. [0091]-[0092]).
As to claim 13, Zhang teaches the electronic system implementing the detection method according to claim 1 [anomaly detection system co-located with the industrial system being monitored] (par. [0028]).
As to claim 14, Zhang teaches a transport platform [small processing system implementing the local anomaly detection system] (par. [0043]) comprising the electronic system according to claim 13, as discussed above.
As to claim 15, Zhang teaches that said detecting an anomaly detects a cyberattack or a hardware failure of one of the hardware blocks (par. [0024]).
As to claim 16, Zhang teaches that when at least one alert associated with one of the hardware blocks is transmitted, a next iteration of the detection method is implemented starting from said measuring, wherein the set of hardware blocks for which a representative parameter measurement is performed is, at each iteration, included in the set of hardware blocks associated with the alert or alerts [Zhang anticipates continued monitoring after the replacement command is implemented and anomaly is resolved] (Fig. 11, par. [0077]).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. in view of Freeman et al. (US 2022/0237069 A1).
As to claim 4, Zhang teaches that each alert criterion depends on at least one condition on the representative parameters, the detection method further comprising, when an alert associated with one of the hardware blocks is transmitted, implementing a next iteration of the detection method starting from said measuring [Zhang anticipates continued monitoring after the replacement command is implemented and anomaly is resolved] (Fig. 11, par. [0077]).
Zhang fails to expressly teach that the number of conditions on which the alert criterion depends increases for each successive iteration.
Freeman is directed to an intelligent alert reduction in a backup and recovery activity monitoring system (abstract). In particular, Freeman teaches that a number of conditions on which the alert criterion depends increases for each successive iteration [user adjusts the notification settings by sliding the Warning threshold marker 1504 to the right to adjust the setting so that future iterations at these levels will then be considered normal, such as if too many alerts are being generated] (par. [0085], Fig. 15).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system of Zhang by having the number of conditions on which the alert criterion depends increase for each successive iteration in order to reduce the number of alerts of the same type over time and avoid the user from being overwhelmed with an increasing number of alerts (par. [0005] in Freeman).
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. in view of Kawai (US 2022/0221851 A1).
As to claim 6, Zhang teaches that each parameter representative of the operation of one of the hardware blocks is chosen from the respective group consisting of: the number of data of the same type processed by the computation unit(s) [measured process variables] (Fig. 7), the interconnection network(s) or the memory(ies), the number of instructions of the same type executed by the computation unit or units, the energy consumption of the computation unit or units, the temperature of the computation unit or units, the number of successes and/or prediction errors of the branching prediction unit or units, the number of accesses to memory or memories, the number of successes and/or errors of the requests of the cache memory or memories, the number of successes and/or errors of the requests of the memory protection unit or units, the execution time of an instruction in the processing chain or chains, the number of exchanges of information via the internal interconnection network(s) to the processor, the number of exchanges of information via the interconnection network(s) obtained by a given source, the number of exchanges of information via the interconnection network(s) sent to a given destination, and the number of exchanges of information via the input-output device or devices.
While it is inherent that the PLC processor of Zhang contains a plurality of hardware elements/blocks, Zhang fails to expressly show that each hardware block is chosen from the group consisting of: one or more computation units, one or more branching prediction units, one or more internal processor memory registers, one or more cache memories, one or more random-access memories, one or more processing chains, one or more memory protection or address translation units, one or more buses or interconnection networks, and one or more input-output devices.
Kawai is directed to collecting state values of a machine or a device and determining whether any anomaly has occurred in the machine or the device based on the collected state values (abstract). In particular, Kawai teaches a PLC processor having a plurality of hardware blocks, wherein each hardware block is chosen from the group consisting of: one or more computation units, one or more branching prediction units, one or more internal processor memory registers, one or more cache memories, one or more random-access memories, one or more processing chains, one or more memory protection or address translation units, one or more buses or interconnection networks, and one or more input-output devices (Figs. 3 and 4; par. [0042]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system of Zhang by having each hardware block being chosen from the group consisting of: one or more computation units, one or more branching prediction units, one or more internal processor memory registers, one or more cache memories, one or more random-access memories, one or more processing chains, one or more memory protection or address translation units, one or more buses or interconnection networks, and one or more input-output devices in order to perform the anomaly detection by utilizing memory registers to store and retrieve values and input-output devices to receive values for processing.
Claims 7 and 17-18 are rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. in view of Chen et al. (US 2019/0130096 A1).
As to claim 7, Zhang teaches all the elements except that the electronic system comprises a plurality of counting hardware blocks each configured to measure one of the representative parameters, and wherein said measuring comprises measuring a plurality of representative parameters.
Chen is directed to attack detection using hardware performance counters (abstract). In particular, Chen teaches an electronic system comprising a plurality of counting hardware blocks each configured to measure one of the representative parameters, and wherein said measuring comprises measuring a plurality of representative parameters [hardware performance counters (HPCs)] (par. [0016]-[0019]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system of Zhang by having the electronic system comprise a plurality of counting hardware blocks each configured to measure one of the representative parameters, and wherein said measuring comprises measuring a plurality of representative parameters in order to detect anomalies based on data provided by the HPCs (par. [0016] in Chen).
As to claim 17, Zhang teaches that the electronic is configured to measure one of the representative parameters, and wherein said measuring comprises measuring four representative parameters (Fig. 7 shows four parameters that are counted).
Zhang fails to expressly teach that the electronic system comprises a plurality of counting hardware blocks.
Chen is directed to attack detection using hardware performance counters (abstract). In particular, Chen teaches an electronic system comprising a plurality of counting hardware blocks [hardware performance counters (HPCs)] (par. [0016]-[0019]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system of Zhang by having the electronic system comprise a plurality of counting hardware blocks in order to detect anomalies based on data provided by the HPCs (par. [0016] in Chen).
As to claim 18, Zhang teaches all the elements except that the electronic system comprises a plurality of counting hardware blocks each configured to measure one of the representative parameters, and wherein said measuring comprises measuring representative parameters measured by part of the counting hardware blocks.
Chen is directed to attack detection using hardware performance counters (abstract). In particular, Chen teaches an electronic system that comprises a plurality of counting hardware blocks each configured to measure one of the representative parameters, and wherein said measuring comprises measuring representative parameters measured by part of the counting hardware blocks [hardware performance counters (HPCs)] (par. [0016]-[0019]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system of Zhang by having the electronic system comprises a plurality of counting hardware blocks each configured to measure one of the representative parameters, and wherein said measuring comprises measuring representative parameters measured by part of the counting hardware blocks in order to detect anomalies based on data provided by the HPCs (par. [0016] in Chen).
Related Prior Art
Hoogerbrugge (US 2021/0287110 A1) is directed to anomaly detection in a data processing system (abstract). In particular, Hoogerbrugge teaches receiving the program counter values from each processing core and using the values to construct a histogram (par. [0015]) and then utilizing the histogram to train ML model that is used to detect an anomaly (par. [0018]).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to OLEG SURVILLO whose telephone number is (571)272-9691. The examiner can normally be reached 9:00am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ario Etienne can be reached at 571-272-4001. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/OLEG SURVILLO/Primary Examiner, Art Unit 2457
Prosecution Insights