Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This office action is in response to the application filed on 06/04/2024. Claim(s) 1-2 and 9-13 is/are pending and are examined. Claims 2-8 are cancelled.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-2, and 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Jin (US 11,055,405 B1), hereinafter Jin in view of Doron (US 11,089,035 B2), hereinafter Doron in further view of Ono (US 2021/0117538 A1), hereinafter Ono.
Regarding Claim(s) 1 and 10 Jin teaches:
An analysis support method performed by an analysis support device that supports ana analysis of an attack scenario in an event that has occurred in a monitored object, the analysis being performed based on raw data related to the event, the analysis support method comprising: (Jin Col. 31 Ln. 25-40 teaches, embodiments are directed to an efficient technique for detecting anomalous events, such as events received by the data intake and query system. (i.e., analysis of an attack scenario in an event that has occurred) Col. 8 Ln. 64-67 teaches, the monitoring component 112 may also monitor and collect performance data related to one or more aspects of the operational state of a client application 110 and/or client device 102. (i.e. monitored object) Col. 4 Ln. 18-35 teaches, each event can be associated with a timestamp that is derived from the raw data in the event. (i.e., raw data of event))
Obtaining the raw data by communicating with the monitored object or communicating with a database that stores the raw data obtained from the monitored object; and (Jin Col. 10 Ln. 28-33 teaches, a forwarder receives data from an input source, such as a data source 202 shown A forwarder initially may receive the data as a raw data stream generated by the input source.)
collating a content of each of the plurality of entries included in the raw data obtained with a content of each of the plurality of entries related to the event included in each of one or more items of previously obtained raw data; (Jin Col. 2 Ln. 43-50 teaches, multiple scores are calculated for an event by comparing the features in the event with multiple frequent patterns spanning one or more granularity levels. )
Jin does not appear to explicitly teach but in related art:
calculating a similarity score for each of the one or more items of previously obtained raw data, by (i) adding a point to the similarity score when the content of each of the plurality of entries included in the raw data obtained is identical to a content of a corresponding one of the plurality of entries related to the event included in the one or more items of previously obtained raw data, and (ii) adding no point to the similarity score or deducting the point from the similarity score when the content of each of the plurality of entries included in the raw data obtained is not identical to the content of the corresponding one of the plurality of entries related to the event included in the one or more items of previously obtained raw data;(Doron Col. 8 Ln. 9-14, Specifically, the engine 230 may search for similar historic sequence matching a newly created sequence ( current sequence signature). The search is performed by comparing the sequence signature representing the current sequence and of the sequence signatures of historic sequences. Col. 8 Ln. 23-25 teaches, the distance metric (for checking the similarity) may be, for example, a cosine similarity between vectors, (i.e. similarity score) where the vectors represent sequence signatures or the cluster centroid. (i.e., The closer to 1, a higher value, the more similar the closer to -1 the less similar. The score increases as there are more matches and the score decreases or does not increase if there is not a match.))
when the one or more items of previously obtained raw data include raw data with a calculated score that is greater than or equal to a predetermined threshold value, determining that the one or more items of previously obtained raw data include similar raw data that is similar to the raw data obtained; and (Doron Col. 8 Ln. 31-37 teaches, when at least one matching historic sequence is found
based on the matching portions of sequence signatures, the subsequent attacks of the matching historic sequence are predicted as potential continuations (i.e., attacks that are likely to follow the current sequence) for the current sequence (attack campaign). A match may be defined when the distance metric is less than a predefined threshold embodiment.)
It would have been obvious to one with ordinary skill the art, prior to the applicant's earliest effective filing date, to combine the teachings of Jin with Doron, to modify the system for anomaly detection using frequent patterns of Jin with the similarity score based on cosine vectors of Doron with the warning importance estimation unit of Ono. The motivation to do so, Doron Col. 7 Ln. 65-67, to determine the subsequent potential step (or attack) in an attack campaign.
Jin in view of Doron does not appear to explicitly teach but in related art:
when the one or more items of previously obtained raw data include the similar raw data,
outputting a previous analysis result for the similar to raw data. (Ono ¶ 110 teaches, the warning importance estimation unit 05 acquires the analysis history from the analysis information calculation unit 04, and presents, according to the importance of the acquired analysis history, the acquired analysis history to an operator via the display device. (i.e., the historical analysis would output data that is historically similar, previously obtained data similar to obtained data))
It would have been obvious to one with ordinary skill the art, prior to the applicant's earliest effective filing date, to combine the teachings of Jin in view of Doron with Ono, to modify the system for anomaly detection using frequent patterns of Jin the similarity score based on cosine vectors of Doron with the warning importance estimation unit of Ono. The motivation to do so, Ono ¶ 64, to allow an operator to choose a proper countermeasure.
Regarding Claim(s) 2 Jin-Doron-Ono teaches:
An analysis support method performed by an analysis support device that supports an analysis of an attack scenario in an event that has occurred in a monitored object, the analysis being performed based on raw data related to the event, the analysis support method comprising: (Jin Col. 31 Ln. 25-40 teaches, embodiments are directed to an efficient technique for detecting anomalous events, such as events received by the data intake and query system. (i.e., analysis of an attack scenario in an event that has occurred) Col. 8 Ln. 64-67 teaches, the monitoring component 112 may also monitor and collect performance data related to one or more aspects of the operational state of a client application 110 and/or client device 102. (i.e. monitored object) Col. 4 Ln. 18-35 teaches, each event can be associated with a timestamp that is derived from the raw data in the event. (i.e., raw data of event))
Obtaining event information including the raw data and a determination result that is obtained by a security information an event management device based on the raw output; and (Jin Col. 36 Ln. 18-30 teaches, The historic events data store includes functionality to store multiple historic events that were deemed to be normal. (i.e., determination result) In other words, the historic events data store 1230 may exclude historic events that were deemed to be anomalies)
Jin does not appear to explicitly teach but in related art:
calculating a similarity score for each of the one or more items of previously obtained event information, by (i) adding a point to the similarity score when the content of each of the plurality of entries included in the event information obtained is identical to a content of a corresponding one of the plurality of entries related to the event included in the one or more items of previously obtained event information, and (ii) adding no point to the similarity score or deducting the point from the similarity score when the content of each of the plurality of entries included in the event information obtained is not identical to the content of the corresponding one of the plurality of entries related to the event included in the one or more items of previously obtained event information;(Doron Col. 8 Ln. 9-14, Specifically, the engine 230 may search for similar historic sequence matching a newly created sequence ( current sequence signature). The search is performed by comparing the sequence signature representing the current sequence and of the sequence signatures of historic sequences. Col. 8 Ln. 23-25 teaches, the distance metric (for checking the similarity) may be, for example, a cosine similarity between vectors, (i.e. similarity score) where the vectors represent sequence signatures or the cluster centroid. (i.e., The closer to 1, a higher value, the more similar the closer to -1 the less similar. The score increases as there are more matches and the score decreases or does not increase if there is not a match.))
when the one or more items of previously obtained event information include event information with a calculated score that is greater than or equal to a predetermined threshold value, determining that the one or more items of previously obtained event information a include similar event information that is similar to the raw event information; and (Doron Col. 8 Ln. 31-37 teaches, when at least one matching historic sequence is found
based on the matching portions of sequence signatures, the subsequent attacks of the matching historic sequence are predicted as potential continuations (i.e., attacks that are likely to follow the current sequence) for the current sequence (attack campaign). A match may be defined when the distance metric is less than a predefined threshold embodiment.)
It would have been obvious to one with ordinary skill the art, prior to the applicant's earliest effective filing date, to combine the teachings of Jin with Doron, to modify the system for anomaly detection using frequent patterns of Jin with the similarity score based on cosine vectors of Doron with the warning importance estimation unit of Ono. The motivation to do so, Doron Col. 7 Ln. 65-67, to determine the subsequent potential step (or attack) in an attack campaign.
Jin in view of Doron does not appear to explicitly teach but in related art:
when the one or more items of previously obtained event information include the similar event information, outputting a previous analysis result for the similar event information. (Ono ¶ 110 teaches, the warning importance estimation unit 05 acquires the analysis history from the analysis information calculation unit 04, and presents, according to the importance of the acquired analysis history, the acquired analysis history to an operator via the display device. (i.e., the historical analysis would output data that is historically similar, previously obtained data similar to obtained data))
It would have been obvious to one with ordinary skill the art, prior to the applicant's earliest effective filing date, to combine the teachings of Jin in view of Doron with Ono, to modify the system for anomaly detection using frequent patterns of Jin the similarity score based on cosine vectors of Doron with the warning importance estimation unit of Ono. The motivation to do so, Ono ¶ 64, to allow an operator to choose a proper countermeasure.
Claim(s) 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Jin-Doron-Ono as applied to claim 1 above, and further in view of Szuflita (US 11,093,634 B1), hereinafter Szu.
Regarding Claim(s) 9 Jin-Doron-Ono teaches:
The analysis support method according to claim 1, comprising: (Jin-Doron-Ono teaches the parent claim above.)
Jin-Doron-Ono does not appear to explicitly teach but in related art:
When the one or more items of previously obtained raw data include the similar raw data, determining whether a user is authorized to view a previous analysis result for the similar raw data; and (Szu Col. 7 Ln. 50-60 teaches, releasing a data set for access, review, analysis by authorized users or groups of user, such as, for example, for ontological analysis and implementation.)
When the user is authorized to view the previous analysis result for the raw data outputting the previous analysis result for the similar raw data. (Szu Col. 7 Ln. 50-60 teaches, releasing a data set for access, review, analysis by authorized users or groups of user, such as, for example, for ontological analysis and implementation.)
It would have been obvious to one with ordinary skill the art, prior to the applicant's earliest effective filing date, to combine the teachings of Jin-Doron-Ono with Szu, to modify the system for anomaly detection using frequent patterns of Jin with the similarity score of Doron with the warning importance estimation unit of Ono with the authorized users being allowed to see and display a data set. The motivation to do so constitutes applying a known technique of allowing authorized users to access data to known devices and/or methods for anomaly detection ready for improvement to yield predictable results allowing only authorized individuals to access the data.
Claim(s) 11, 12, and 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Jin-Doron-Ono as applied to claim 1 above, and further in view of Suk (US 2014/0286577 A1), hereinafter Suk.
Regarding claim(s) 11, 12, and 13 Jin-Doron-Ono teaches:
The analysis support method according to claim 1, (Jin-Doron-Ono teaches the parent claim above.)
Jin-Doron-Ono does not appear to explicitly teach but in related art:
The analysis support method according to wherein, when the calculated score for a first previously obtained raw data included in the one or more items of previously obtained raw data is greater than or equal to the predetermined threshold value, or when the calculated score for the first previously obtained raw data is less than the predetermined threshold value, calculating a score for a second previously obtained raw data included in the one or more items of previously obtained raw data. (Suk ¶ 7 teaches, similarity calculation is performed on the first and second feature points, and, when the magnitude difference between the first and second feature vectors is determined to be greater than the first threshold value, a magnitude of another feature point of the target image is compared with the magnitude of the first threshold value.)
It would have been obvious to one with ordinary skill the art, prior to the applicant's earliest effective filing date, to combine the teachings of Jin-Doron-Ono with Suk, to modify the system for anomaly detection using frequent patterns of Jin the similarity score based on cosine vectors of Doron with the warning importance estimation unit of Ono with the iteration to another data point of Suk. The motivation to do so constitutes applying a known technique of iterating through a set to known devices and/or methods for detection of malicious data ready for improvement to yield predictable results checking each piece of data.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US 2019/0260797 A1 - METHOD AND SYSTEM FOR VERIFYING VALIDITY OF DETECTION RESULT
US 2017/0097980 A1 - DETECTION METHOD AND INFORMATION PROCESSING DEVICE
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JACOB BENEDICT KNACKSTEDT whose telephone number is (703)756-5608. The examiner can normally be reached Monday-Friday 8:00 am - 5:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Linglan Edwards can be reached on (571) 270-5440. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.B.K./Examiner, Art Unit 2408
/LINGLAN EDWARDS/Supervisory Patent Examiner, Art Unit 2408
Prosecution Insights