DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This communication is in response to the amendments filed on 02/18/2026. Claims 2-21 are currently pending in the application. claim 1 remained cancelled from the application.
Response to Arguments
Applicant’s arguments with respect to claim 2 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 2-7, 9-13, and 16-18 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1, 3-7, 9,11, 13, 15, and 17-19 of U.S. Patent No. 12047391. Although the claims at issue are not identical, they are not patentably distinct from each other because the respective limitations of the application No. 18750815 are conspicuously found in the limitations of the patent No. 12047391.
Claim 2
Claim 1 of Pat. No. 12047391
Claim 2 of present application
A method, comprising: receiving, at a first computer system having a machine learning system configured to execute at least one machine learning model, an electronic processing request having a plurality of features and corresponding to at least one action in a processing system; using a network interface device of the first computer system, making a remote network call via an embedding loader to a second, separate computer system to access an embedding layer of the at least one machine learning model, wherein the second, separate computer system also has a separate memory storage, contents of which are not accessible by the first computer system having the machine learning system except via a network connection and the embedding layer is located in the memory storage of the second computer system; receiving, at the first computer system having the machine learning system and from the embedding layer of the second computer system, a plurality of embedding vectors associated with the plurality of features, wherein the embedding layer is configured to map a feature in the plurality of features to an embedding vector in the plurality of the embedding vectors; and generating, by processing the plurality of embedding vectors by the at least one machine learning model in the machine learning system, an indication indicating whether the at least one action is associated with a security breach in the processing system.
A method, comprising: receiving, at a first computer system having a machine learning system configured to execute at least one machine learning model, an electronic processing request having a plurality of features; making a remote network call via an embedding loader to a second computer system, separate from the first computer system, to access an embedding layer of the at least one machine learning model, wherein the second computer system has a separate memory storage that stores the embedding layer of the at least one machine learning model separately from the rest of the at least one machine learning model, and wherein the embedding layer is configured to map a feature in the plurality of features to an embedding vector in the plurality of the embedding vectors; receiving, at the first computer system having the machine learning system and from the embedding layer of the second computer system, a plurality of embedding vectors associated with the plurality of features; and generating, by processing the plurality of embedding vectors by the at least one machine learning model in the machine learning system, a response to the electronic processing request.
As could be seen from the above table, all the limitations of the claim 2 of the present application are present in the claim 1 of pat. No 12047391 except storing the embedding layer of the at least one machine learning model separately from the rest of the at least one machine learning model. One of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify claim 1, of Pat. No. 12047391 to include storing the embedding layer of the at least one machine learning model separately from the rest of the at least one machine learning model to improve resource utilization and cost.
Claim 3
Claim 3 of Pat. No. 12047391
Claim 3 of Present application
The method of claim 1, wherein a memory storage that stores the embedding layer is a non-volatile memory that is larger than a random-access memory that stores the machine learning system.
The method of claim 2, wherein a memory storage that stores the embedding layer is a non-volatile memory that is larger than a random-access memory that stores the at least one machine learning model.
As could be seen from the above table, all the limitations of the claim 3 of the present application are present in the claim 3 of pat. No 12047391.
Claim 4
Claim 4 of Pat. No. 12047391
Claim 4 of Present application
The method of claim 1, wherein the machine learning system includes a first machine learning model configured to process a first subset of embedding vectors from the plurality of embedding vectors and a second machine learning model configured to process a second subset of embedding vectors from the plurality of embedding vectors, wherein the second subset of embedding vectors is received at a different time than the first subset of embedding vectors; and wherein the generating further comprises: generating, by processing the first subset of embedding vectors by the first machine learning model, a first indication; and generating, using the second machine learning model, a second indication from the second machine learning model, and wherein the indication indicating whether the at least one action is associated with the security breach is a combination of the first indication and the second indication.
The method of claim 2, wherein the machine learning system includes a first machine learning model configured to process a first subset of embedding vectors from the plurality of embedding vectors and a second machine learning model configured to process a second subset of embedding vectors from the plurality of embedding vectors.
As could be seen from the above table, all the limitations of the claim 4 of the present application are present in the claim 4 of pat. No 12047391.
Claim 5
Claim 5 of Pat. No. 12047391
Claim 5 of present application
The method of claim 1, wherein the machine learning system includes a first machine learning model and a second machine learning model configured to process the embedding vector from the plurality of embedding vectors; and wherein the generating further comprises: generating, using the first machine learning model, a first indication using the embedding vector in the plurality of embedding vectors; and generating, using the second machine learning model, a second indication using the embedding vector in the plurality of embedding vectors, wherein the indication is a combination of the first indication and the second indication.
The method of claim 4, further comprising: generating, by processing the first subset of embedding vectors by the first machine learning model, a first indication; generating, by processing the second subset of embedding vectors by the second machine learning model, a second indication; and generating the response from the first indication and the second indication.
As could be seen from the above table, all the limitations of the claim 5 of the present application are present in the claim 5 of pat. No 12047391.
Claim 6
Claim 6 of Pat. No. 12047391
Claim 6 of present application
The method of claim 1, wherein a portion of features in the plurality of features are associated with actions in the at least one action that are generated based on events that occur in the processing system.
The method of claim 2, wherein a portion of features in the plurality of features in the electronic processing request are generated based on events that occur in an electronic processing system.
As could be seen from the above table, all the limitations of the claim 6 of the present application are present in the claim 6 of pat. No 12047391.
Claim 7
Claim 7 of Pat. No. 12047391
Claim 7 of present application
The method of claim 6, wherein a portion of embeddings in the plurality of embedding vectors are continuously retrieved based on the portion of features; and wherein the generating continuously updates the indication by processing the portion of embeddings through the at least one machine learning model.
The method of claim 6, wherein a portion of embedding vectors in the plurality of embedding vectors are continuously retrieved based on the portion of features; and wherein the generating continuously generates additional responses to the electronic processing request by processing the portion of embedding vectors through the at least one machine learning model.
As could be seen from the above table, all the limitations of the claim 7 of the present application are patently indistinguishable from claim 7 of pat. No 12047391.
Claim 9 of Pat. No. 12047391
Claim 9 of present application
The method of claim 1, further comprising: refreshing the embedding layer with mappings between at least one new feature and at least one new embedding vector without retraining the at least one machine learning model in the machine learning system that generates the indication using the at least one new embedding vector.
The method of claim 2, further comprising: refreshing the embedding layer with mappings between at least one new feature and at least one new embedding vector without retraining the at least one machine learning model in the machine learning system that generates the response using the at least one new embedding vector.
As could be seen from the above table, all the limitations of the claim 9 of the present application are patently indistinguishable from the limitations of claim 9 of pat. No 12047391.
Claim 10
Claim 11 of Pat. No. 12047391
Claim 10 of present application
A system, comprising: a first computer device configured to store an embedding layer of machine learning models in a machine learning system in a memory, the embedding layer trained to map a plurality of embedding vectors with a plurality of features, wherein the embedding layer is configured to map a feature in the plurality of features to an embedding vector in the plurality of the embedding vectors, wherein the memory is a non-volatile memory; and a second computer device that is at a different physical location from the first computer device, the second computer device configured to: store the machine learning system comprising the machine learning models in a second memory, the second memory smaller than the memory that stores the embedding layer in the first computer device wherein the size of the embedding layer is larger than the size of the second memory; receive an electronic processing request having features corresponding to at least one action in a processing system; requesting, over a network connection, access to the embedding layer in the first computer device; receiving from the embedding layer stored in the first computer device, embedding vectors from the plurality of embedding vectors that are mapped to the features in the electronic processing request; process the embedding vectors using at least one machine learning model in the machine learning system; and generate, based on the processing, an indication indicating whether the at least one action is associated with an anomaly in the processing system.
A system, comprising: a first computer device configured to: store a machine learning system comprising machine learning models in a first memory; receive an electronic processing request having features; request, over a network connection, access to an embedding layer of the machine learning system, wherein the embedding layer is stored in a second memory of a second computer device separate from the first computer device, wherein the second memory is larger than the first memory, and wherein the embedding layer is trained to map a plurality of features to a plurality of embedding vectors; receive from the embedding layer a subset of embedding vectors from the plurality of embedding vectors that are mapped to the features in the electronic processing request; and process the subset of embedding vectors using at least one machine learning model in the machine learning system to generate a response to the electronic processing request.
As could be seen from the above table, all the limitations of the claim 10 of the present application are conspicuously present in claim 11 of pat. No 12047391.
Claim 11
Claim 13 of pat. No. 12047391
Claim 11 of present application
The system of claim 11, wherein the machine learning system includes a first machine learning model configured to process a first subset of embedding vectors from the embedding vectors and a second machine learning model configured to process a second subset of embedding vectors from the embedding vectors, wherein the second subset of embedding vectors is different from the first subset of embedding vectors; and wherein the second computer device is further configured to: generate, by processing the first subset of embedding vectors through the first machine learning model, a first indication; and generate, using the second machine learning model, a second indication from the second machine learning model, and wherein the indication indicating whether the at least one action is associated with the anomaly is a combination of the first indication and the second indication.
The system of claim 10, wherein the machine learning system includes a first machine learning model configured to process a first subset of embedding vectors from the embedding vectors and a second machine learning model configured to process a second subset of embedding vectors from the embedding vectors, wherein the second subset of embedding vectors is different from the first subset of embedding vectors.
As could be seen from the above table, all the limitations of the claim 11 of the present application are conspicuously present in claim 13 of pat. No 12047391.
Claim 12
Claim 13 of Pat. No. 12047391
Claim 12 of present application
The system of claim 11, wherein the machine learning system includes a first machine learning model configured to process a first subset of embedding vectors from the embedding vectors and a second machine learning model configured to process a second subset of embedding vectors from the embedding vectors, wherein the second subset of embedding vectors is different from the first subset of embedding vectors; and wherein the second computer device is further configured to: generate, by processing the first subset of embedding vectors through the first machine learning model, a first indication; and generate, using the second machine learning model, a second indication from the second machine learning model, and wherein the indication indicating whether the at least one action is associated with the anomaly is a combination of the first indication and the second indication.
The system of claim 11, wherein the first computer device is further configured to: generate, by processing the first subset of embedding vectors through the first machine learning model, a first indication; generate, by processing the second subset of embedding vectors through the second machine learning model, a second indication; and combine the first indication and the second indication into the response.
As could be seen from the above table, all the limitations of the claim 12 of the present application are conspicuously present in claim 13 of pat. No 12047391.
Claim 13
Claim 15 of Pat. No. 12047391
Claim 13 of present application
The system of claim 11, wherein the at least one machine learning model in the machine learning system is an event driven machine learning model configured to process the embedding vectors associated with the features as the features are received at the second computer device, wherein the features are generated in real-time by actions in the at least one action that occur in response to a user interaction with the processing system.
The system of claim 10, wherein the at least one machine learning model in the machine learning system is an event driven machine learning model configured to process the embedding vectors associated with the features as the features are received at the first computer device, wherein the features are generated in real-time by actions that occur in response to a user interaction with a processing system.
As could be seen from the above table, all the limitations of the claim 13 of the present application are conspicuously present in claim 15 of pat. No 12047391.
Claim 16
Claim 17 of Pat. No. 12047391
Claim 16 of present application
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause machines to perform operations, the operations comprising: receiving, at a first machine of machines, the first machine having a machine learning system with at least one machine learning model stored thereon, an electronic processing request having a plurality of features, the plurality of features corresponding to at least one action in a processing system; making, using an application programming interface (API) stored in part on the first machine and in part on a second machine of the machines, a remote network request from the first machine to the second machine to access an embedding layer of the at least one machine learning model stored at the second machine, wherein the second machine is in a separate physical location from the first machine; retrieving, from the embedding layer, a plurality of embedding vectors associated with the plurality of features, wherein the embedding layer is configured to map a feature in the plurality of features to an embedding vector in the plurality of the embedding vectors; and generating, by processing the plurality of embedding vectors through the at least one machine learning model in the machine learning system, an indication indicating whether the at least one action classifies an event in the processing system.
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause machines to perform operations, the operations comprising: receiving, at an embedding loader communicatively connected to a first machine and a second machine separate from the first machine, an electronic processing request having a plurality of features, the plurality of features corresponding to at least one event in a processing system; making
a remote network request from the embedding loader to the second machine to access an embedding layer stored in memory of the second machine; receiving, at the embedding loader a remote network response having a plurality of embedding vectors associated with the plurality of features, wherein the embedding layer is configured to map a feature in the plurality of features to an embedding vector in the plurality of the embedding vectors; and providing the plurality of embedding vectors to the first machine for processing using at least one machine learning model in a plurality of machine learning models stored in a memory of the first machine, wherein the plurality of embedding vectors are passed through the at least one machine learning model to generate a response that classifies the at least one event in the processing system.
As could be seen from the above table, all the limitations of the claim 16 of the present application are conspicuously present in claim 17 of pat. No 12047391.
Claim 17
Claim 18 of Pat. No. 12047391
Claim 17 of present application
The non-transitory machine-readable medium of claim 17, wherein a memory store that stores the embedding layer on the second machine is larger in memory size than a memory store of the first machine that stores the at least one machine learning model.
The non-transitory machine-readable medium of claim 16, wherein the memory that stores the embedding layer on the second machine is larger in memory size than the memory that stores the at least one machine learning model on the first machine.
As could be seen from the above table, all the limitations of the claim 17 of the present application are conspicuously present in claim 18 of pat. No 12047391.
Claim 18
Claim 19 of Pat. No. 12047391
Claim 18 of present application
The non-transitory machine-readable medium of claim 17, wherein the plurality of embedding vectors are processed by multiple machine learning models in the machine learning system.
The non-transitory machine-readable medium of claim 16, wherein the plurality of embedding vectors are processed by multiple machine learning models on the first machine.
As could be seen from the above table, all the limitations of the claim 18 of the present application are conspicuously present in claim 19 of pat. No 12047391.
The tables above indicate a non-statutory double patenting on the present application.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 16, and 18-21 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by US PGPub. No. 20180219895 to Silver et al. (hereinafter Silver).
Regarding claim 16, Silver discloses a non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause machines to perform operations (¶0068-¶0070, “…computer system 1400 performs specific operations by processor 1407 executing one or more sequences of one or more instructions contained in system memory 1408. Such instructions may be read into system memory 1408 from another computer readable/usable medium, such as static storage device 1409 or disk drive 1410…”), the operations comprising:
receiving, at an embedding loader communicatively connected to a first machine and a second machine separate from the first machine (¶0030-¶0031, FIG. 1, “… an example network 101 comprises one or more hosts (e.g. assets, clients, computing entities), such as host entities 114, 116, and 118, that may communicate with one another through one or more network devices, such as a network switch 104. The network 101 may communicate with external networks through one or more network border devices as are known in the art, such as a firewall 103…”), (¶0036, FIG. 1, “The anomaly detection module 108 may be configured to monitor or tap the network switch 104 (embedding loader) to passively analyze the internal network traffic in a way that does not hamper or slow down network traffic (e.g. by creating a copy of the network traffic for analysis). Anomaly detection module 108 is an external module or physical computer that is coupled to the switch or firewall….”, wherein the switch or firewall could be seen as the claimed first machine and the computer system running the anomaly detection module 108 is interpreted as the claimed second, separate machine), an electronic processing request having a plurality of features, the plurality of features corresponding to at least one event in a processing system (FIG. 1, ¶0030-¶0033, “FIG. 1 illustrates an example environment 100 in which an anomaly detection module 108 may be implemented to learn representations (plurality of features) of network traffic flow. Here, an example network 101 comprises one or more hosts (e.g. assets, clients, computing entities), such as host entities 114, 116, and 118, that may communicate with one another through one or more network devices, such as a network switch 104…”), (¶0051, “The first recurrent layer is connected to the second, and the second to the third via new sets of randomized weights at 303. The recurrent layers transform the input sequence into complex features representations, which once the sequence has finished, projects these representations into an embedding layer. The final recurrent layer is then connected to a projection layer, which ultimately serves as the embedding layer at 307 once training is complete…”), and (¶0057, “After training is completed, the system can take any novel (e.g., unseen) network flow data for a given connection, and project it into the embedding space. Once a system has been trained to predict network anomaly behavior in a network flow given the underlying time series data, novel network flows can be presented to the system. Those network flows will be embedded in the learned vector space and mapped to a protocol”);
making, a remote network request from the embedding loader to the second machine to access an embedding layer stored in memory of the second machine (FIG. 1, ¶0036, “The anomaly detection module 108 may be configured to monitor or tap the network switch 104 to passively analyze the internal network traffic in a way that does not hamper or slow down network traffic (e.g. by creating a copy of the network traffic for analysis). In some embodiments, the anomaly detection module 108 is an external module or physical computer that is coupled to the switch 104. While in some embodiments, the anomaly detection module 108 may be directly integrated as an executable set of instructions into network components, such as the switch 104 or a firewall 103. While still, in some embodiments the anomaly detection module 108 may be integrated into one or more hosts, in a distributed fashion (e.g. each host may have its own set copy of the distributed instructions and the hosts collectively agree to follow or adhere to instructions per protocol to collect and analyze network traffic). While in some embodiments, the anomaly detection module 108 can be implemented within one or more virtual machine(s) or containers (e.g., operating system level virtualized-application containers, such as Docker containers and/or LXC containers) sitting on one or more physical hosts. Still in some embodiments the anomaly detection module 108 may be integrated into a single host that performs monitoring actions for the network 101.”), (¶0069-¶0070,);
receiving, at the embedding loader a remote network response having a plurality of embedding vectors associated with the plurality of features (¶0032, “given sequences of network flow data for connections on a network 101, the system 100 can represent the network traffic data in a compact form which will allow the system to predict whether or not the connection is anomalous (e.g., whether the connection indicates a potential threat to the network). The system 100 can also automatically learn representations that enable clustering and visualizing similar types of connections and protocols without having to build in a priori assumptions regarding the types of network services and traffic that might be expected on the network 101.”), ¶0015), wherein the embedding layer is configured to map a feature in the plurality of features to an embedding vector in the plurality of the embedding vectors (¶0043, “…Analysis is performed on the network data to analyze any network anomalies at 207. Similar patterns of traffic flow with similar protocols and data transmission statistics will be mapped into similar regions of the embedded space (map a feature in the plurality of features to an embedding vector). The embedded vectors for a set of connections can then be clustered together or can be used to make predictions about the connection itself…”), (¶0056-¶0057); and
providing the plurality of embedding vectors to the first machine for processing using at least one machine learning model in a plurality of machine learning models stored in a memory of the first machine (FIG. 1, ¶0030-¶0033, “FIG. 1 illustrates an example environment 100 in which an anomaly detection module 108 may be implemented to learn representations (plurality of features) of network traffic flow. Here, an example network 101 comprises one or more hosts (e.g. assets, clients, computing entities), such as host entities 114, 116, and 118, that may communicate with one another through one or more network devices, such as a network switch 104…”), wherein the plurality of embedding vectors are passed through the at least one machine learning model to generate a response that classifies the at least one event in the processing system (¶0015, ¶0029, ¶0032, and ¶0057-¶0058; Machine learning used to detect anomalous traffic patterns in a network using vector embeddings), (¶0034, “By projecting network traffic flow traffic into an embedding space, the system can represent a sequence of flow data as a static vector which preserves meaningful information about the connection it represents. Given the embedding vector derived from the connection traffic, the system can then use a downstream classifier in order to predict whether or not the connection looks more like standard SSH or HTTP traffic.”), (¶0046-¶0049, “FIG. 3 shows a flowchart of an approach to implement vector embedding of network traffic according to some embodiments of the invention. The system learns an embedding by using an architecture known as a Recurrent Neural Network (RNN).… A LTSM is a specific RNN architecture that is well-suited to learn from experience to classify, process, and predict time series with time lags of unknown size. The architecture of LSTMs is composed of units called memory blocks. A memory block contains memory cells with self-connections storing (or remembering) the temporal state of the network in addition to special multiplicative units called gates to control the flow of information…The value at the projection layer at the final time-step is used as the actual embedding value for the network traffic, and that value is then passed to an output layer of neurons, wherein each neuron represents one of the Y protocols the connection could have occurred on. Structured in this way, the model can be viewed as taking in an input sequence of flow data, constructing a static representation or embedding of that traffic once the full sequence of inputs has been presented, then outputting a set of values (or probabilities) corresponding to a prediction about which protocol was used in the network flow from which the input sequence was generated.”).
Regarding claim 18, Silver discloses the non-transitory machine-readable medium of claim 16, wherein the plurality of embedding vectors are processed by multiple machine learning models on the first machine (¶0059, “FIG. 4 is a flowchart of an approach to implement vector embedding of network traffic according to some embodiments of the invention. In some embodiments, two (i.e. in a bidirectional architecture) recurrent neural networks (RNNs), each comprised by several layers of long short-term memory (LSTM) units, etc.”), (¶0060, “This type of network comprises two subnetworks: one that processes the timeseries in time order (the “Forward Network”) and one that processes the timeseries in reverse-time order (the “Backward Network”). When a timeseries is presented to the network, each of these subnetworks produces a timeseries of its own—these output timeseries are antecedent to the subnetworks' projections of the timeseries into a space that contains the information necessary for network anomaly analysis…”).
Regarding claim 19, Silver discloses the non-transitory machine-readable medium of claim 16, wherein the at least one event is part of an event stream generated in the processing system (¶0006, “an approach is described to learn a projection from a sequence of flow data to an embedding space that not only preserves information about the sequential statistics of the flow data itself, but also about other pertinent information such as protocol related information. These learned embeddings are useful for detecting anomalous traffic patterns, clustering similar network connections, determining which hosts have similar connection patterns, and visualizing sequential traffic data in a simple and effective matter.”, wherein the event is the network data flow, the plurality of features are the information about the sequential statistics and protocol related information about the data flow, and the actions such as projection from a sequence of flow data to an embedding space, detecting anomalous traffic patterns, clustering similar network connections, determining which hosts have similar connection patterns are based on the network data flow (event)).
Regarding claim 20, Silver discloses the non-transitory machine-readable medium of claim 16, wherein the embedding loader is separate from the second machine (FIG. 1, wherein switch 104 (embedding loader) is separate from the computer system running the anomaly detection module 108) and the remote network request is made using an application programming interface shared between the embedding loader and the second machine (FIG. 1, ¶0030, “FIG. 1 illustrates an example environment 100 in which an anomaly detection module 108 may be implemented to learn representations of network traffic flow. Here, an example network 101 comprises one or more hosts (e.g. assets, clients, computing entities), such as host entities 114, 116, and 118, that may communicate with one another through one or more network devices, such as a network switch 104…”), (¶0036-¶0037, “The anomaly detection module 108 may be configured to monitor or tap the network switch 104 to passively analyze the internal network traffic in a way that does not hamper or slow down network traffic (e.g. by creating a copy of the network traffic for analysis). In some embodiments, the anomaly detection module 108 is an external module or physical computer that is coupled to the switch 104. While in some embodiments, the anomaly detection module 108 may be directly integrated as an executable set of instructions into network components, such as the switch 104 or a firewall 103…In the illustrated environment, the hosts may connect to one another using different network communication protocols such as ICMP, TCP or UDP. The anomaly detection module 108 may be configured to work as a passive analysis device that can receive, store, and analyze all network traffic sent/received by a single host, or a multitude of hosts. In some embodiments, all network communications may be passed through the switch 104 and the anomaly detection module 108 may tap or span (TAP/SPAN) the switch 104 to access and create a copy of the network communications…”).
Regarding claim 21, Silver discloses the non-transitory machine-readable medium of claim 16, wherein the embedding loader is separate from the first machine (FIG. 1, wherein the switch 104 is separate from the firewall 103 and the hosts 114-118) and providing the plurality of embedding vectors further comprising:
making a second remote network request to the first machine (¶0066, “… the system can use sequences of these embeddings, to build new, higher-order embeddings that represent larger temporal scales, as well as full embeddings for a host or server across a number of connections.”), (¶0030, “…an example network 101 comprises one or more hosts (e.g. assets, clients, computing entities), such as host entities 114, 116, and 118, that may communicate with one another through one or more network devices, such as a network switch 104. The network 101 may communicate with external networks through one or more network border devices as are known in the art, such as a firewall 103. For instance, host 114 may communicate with an external server on node 108 through network protocols such as ICMP, TCP and UDP.”).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 2, and 4-9 are rejected under 35 U.S.C. 103 as being unpatentable over US PGPub. No. 20180219895 to Silver et al. (hereinafter Silver) in view of US. Pat. No. 11803752 to Liu et al. (hereinafter Liu).
Regarding claim 2, Silver discloses a method, comprising:
receiving, at a first computer system having a machine learning system configured to execute at least one machine learning model, an electronic processing request having a plurality of features (FIG. 1, ¶0030-¶0033, “FIG. 1 illustrates an example environment 100 in which an anomaly detection module 108 may be implemented to learn representations (plurality of features) of network traffic flow. Here, an example network 101 comprises one or more hosts (e.g. assets, clients, computing entities), such as host entities 114, 116, and 118, that may communicate with one another through one or more network devices, such as a network switch 104…”);
making a remote network call via an embedding loader to a second computer system, separate from the first computer system, to access an embedding layer of the at least one machine learning model, wherein the second computer system has a separate memory storage that stores the embedding layer of the at least one machine learning model and wherein the embedding layer is configured to map a feature in the plurality of features to an embedding vector in the plurality of the embedding vectors (¶0036, “The anomaly detection module 108 may be configured to monitor or tap the network switch 104 to passively analyze the internal network traffic in a way that does not hamper or slow down network traffic (e.g. by creating a copy of the network traffic for analysis). the anomaly detection module 108 is an external module or physical computer that is coupled to the switch 104 (embedding loader. While in some embodiments, the anomaly detection module 108 may be directly integrated as an executable set of instructions into network components, such as the switch 104 or a firewall 103. While still, in some embodiments the anomaly detection module 108 may be integrated into one or more hosts, in a distributed fashion (e.g. each host may have its own set copy of the distributed instructions and the hosts collectively agree to follow or adhere to instructions per protocol to collect and analyze network traffic) (making a remote network call)…”), (¶0043, “…Analysis is performed on the network data to analyze any network anomalies at 207. Similar patterns of traffic flow with similar protocols and data transmission statistics will be mapped into similar regions of the embedded space (map a feature in the plurality of features to an embedding vector). The embedded vectors for a set of connections can then be clustered together or can be used to make predictions about the connection itself…”);
receiving, at the first computer system having the machine learning system and from the embedding layer of the second computer system, a plurality of embedding vectors associated with the plurality of features (¶0033-¶0034, “As described in more detail below, the anomaly detection module 108 operates by performing semi-supervised machine learning for learning representations (or embeddings) of network flow traffic which can then be used to identify, cluster, and make predictions regarding the security and anomalous patterns of traffic in the network 101. The system operates on raw network flow data, which are used as inputs to a deep-learning architecture 110 that learns to embed the data into a more meaningful vector space. These embeddings are designed to leverage representation learning in order to determine how network traffic data can be effectively understood through Machine Learning (ML) and Artificial Intelligence (AI). Further details regarding an approach to use the trained model are described below in conjunction with the description of FIGS. 3 and 4. By projecting network traffic flow traffic into an embedding space, the system can represent a sequence of flow data as a static vector which preserves meaningful information about the connection it represents…”), (¶0043, “..The embedded vectors for a set of connections can then be clustered together or can be used to make predictions about the connection itself. Due to the deep-learning architecture, a sequence of network flow will provide a high-level encapsulation of network properties. As such, different static representations of time sequences of varying lengths may be properly compared to each other.”); and
generating, by processing the plurality of embedding vectors by the at least one machine learning model in the machine learning system, a response to the electronic processing request (¶0032, “given sequences of network flow data for connections on a network 101, the system 100 can represent the network traffic data in a compact form which will allow the system to predict whether or not the connection is anomalous (e.g., whether the connection indicates a potential threat to the network). The system 100 can also automatically learn representations that enable clustering and visualizing similar types of connections and protocols without having to build in a priori assumptions regarding the types of network services and traffic that might be expected on the network 101.”), ¶0015.
However, Silver does not explicitly disclose storing the embedding layer of the at least one machine learning model separately from the rest of the at least one machine learning model.
Liu discloses storing the embedding layer of the at least one machine learning model separately from the rest of the at least one machine learning model (Col. 1, lines 45-49, “one or more implementations of the present specification provide a separation in the deployment of machine learning model and its associated embedding processing. These techniques, among others, reduce the costs of model running and better utilize resource capabilities.”), (Col. 2, lines 53-67 to Col. 3, line 1-8, “According to the model-based prediction method and apparatus in the one or more implementations of the present specification, because the model and the embedding are deployed separately, when memory of a single machine is insufficient, other, separate memory can be used to store the model or the embedding, thereby reducing the costs of model running and maintenance. In other words, a single machine does not need specialized expansion or addition of memory to accommodate both the model and embedding, which typically would be accompanied with high expense and technological complications. The separate deployment also provides the flexibility of multiple-to-one, one-to-multiple, and/or multiple-to-multiple associations between models and embeddings, in addition to the typical one-to-one association between the two for traditional, single environment deployment of the entire machine learning system...”)
Thus, one of ordinary skill in the art would have found it obvious before the effective filing date of applicant’s claimed invention to modify the method of Silver to include storing the embedding layer of the at least one machine learning model separately from the rest of the at least one machine learning model as disclosed by Liu and be motivated in doing so in order to reduce the costs of model running and better utilize resource capabilities-Liu Col. 1, line 45-49 in parts.
Regarding claim 4, Silver in view of Liu discloses the method of claim 2.
Silver further discloses wherein the machine learning system includes a first machine learning model configured to process a first subset of embedding vectors from the plurality of embedding vectors and a second machine learning model configured to process a second subset of embedding vectors from the plurality of embedding vectors (¶0059, “FIG. 4 is a flowchart of an approach to implement vector embedding of network traffic according to some embodiments of the invention. In some embodiments, two (i.e. in a bidirectional architecture) recurrent neural networks (RNNs), each comprised by several layers of long short-term memory (LSTM) units, etc.”), (¶0060, “This type of network comprises two subnetworks: one that processes the timeseries in time order (the “Forward Network”) and one that processes the timeseries in reverse-time order (the “Backward Network”). When a timeseries is presented to the network, each of these subnetworks produces a timeseries of its own—these output timeseries are antecedent to the subnetworks' projections of the timeseries into a space that contains the information necessary for network anomaly analysis…”).
Regarding claim 5, Silver in view of Liu discloses the method of claim 4.
Silver further discloses further comprising:
generating, by processing the first subset of embedding vectors by the first machine learning model, a first indication (¶0043, “Analysis is performed on the network data to analyze any network anomalies at 207. Similar patterns of traffic flow with similar protocols and data transmission statistics will be mapped into similar regions of the embedded space. The embedded vectors for a set of connections can then be clustered together or can be used to make predictions about the connection itself. Due to the deep-learning architecture, a sequence of network flow will provide a high-level encapsulation of network properties. As such, different static representations of time sequences of varying lengths may be properly compared to each other.”), (¶0060, “…Once each subnetwork has produced its own output timeseries, the last and final state of each timeseries is projected to an output layer that predicts a probability for each protocol in an effort to reproduce a one-hot representation.”, wherein the one-hot is interpreted as the first indication produced by the machine learning model);
generating, by processing the second subset of embedding vectors by the second machine learning model, a second indication (¶0060, “…Once each subnetwork has produced its own output timeseries, the last and final state of each timeseries is projected to an output layer that predicts a probability for each protocol in an effort to reproduce a one-hot representation. In some embodiments, the one hot representation may be used for a “target” against which the system's performance is evaluated”), and
generating the response from the first indication and the second indication (¶0064, “The system then takes both outputs from the forward network and backwards network to the projection layer (or embedding layer) at 407, and, finally, from the projection layer to the output layer 409, via sets of weights.”, wherein the two timeseries outputs forwarded are combined at the final output layer 409 for anomaly prediction).
Regarding claim 6, Silver in view of Liu discloses the method of claim 2.
Silver further discloses wherein a portion of features in the plurality of features in the electronic processing request are generated based on events that occur in an electronic processing system (¶0006, “an approach is described to learn a projection from a sequence of flow data to an embedding space that not only preserves information about the sequential statistics of the flow data itself, but also about other pertinent information such as protocol related information. These learned embeddings are useful for detecting anomalous traffic patterns, clustering similar network connections, determining which hosts have similar connection patterns, and visualizing sequential traffic data in a simple and effective matter.”, wherein the event is the network data flow, the plurality of features are the information about the sequential statistics and protocol related information about the data flow, and the actions such as projection from a sequence of flow data to an embedding space, detecting anomalous traffic patterns, clustering similar network connections, determining which hosts have similar connection patterns are based on the network data flow (event)).
Regarding claim 7, Silver in view of Liu discloses the method of claim 6.
Silver further discloses wherein a portion of embedding vectors in the plurality of embedding vectors are continuously retrieved based on the portion of features (¶0006, “an approach is described to learn a projection from a sequence of flow data to an embedding space that not only preserves information about the sequential statistics of the flow data itself, but also about other pertinent information such as protocol related information…”, wherein it is inherent that traffic would always be flowing in a computing network); and
wherein the generating continuously generates additional responses to the electronic processing request by processing the portion of embedding vectors through the at least one machine learning model (¶0056, “Once a prediction is made however, the network weights can be updated during training with backpropagation (through time), such that the next time the network sees a similar input time-series, it will be more likely to predict the correct protocol. Over time, as the weights are updated in this manner, the network not only becomes increasingly likely to correctly predict the protocol over which network traffic occurred, but moreover, the activity at the projection layer (i.e., the embeddings of the network traffic input sequence) will map similar input sequences to similar embedding values”).
Regarding claim 8, Silver in view of Liu discloses the method of claim 6.
Silver further discloses wherein the events are part of an event stream and the response identifies fraud based on the events in the event stream (¶0066, “The protocol embeddings can successfully be used as inputs to a variety of downstream algorithms that are meant to identify malicious and anomalous network flows. As mentioned, the system can use these embeddings to predict whether or not an attacker is abusing or misusing a particular port and protocol, as occurs when an attacker hides a tunnel in an otherwise innocuous protocol such as HTTP. Furthermore, the system can use sequences of these embeddings, to build new, higher-order embeddings that represent larger temporal scales, as well as full embeddings for a host or server across a number of connections.”), (¶0032-(¶0033, “given sequences of network flow data for connections on a network 101, the system 100 can represent the network traffic data in a compact form which will allow the system to predict whether or not the connection is anomalous (e.g., whether the connection indicates a potential threat to the network)…”)
Regarding claim 9, Silver in view of Liu discloses the method of claim 2.
Silver further discloses further comprising:
refreshing the embedding layer with mappings between at least one new feature and at least one new embedding vector without retraining the at least one machine learning model in the machine learning system that generates the response using the at least one new embedding vector (¶0056, “Once a prediction is made however, the network weights can be updated during training with backpropagation (through time), such that the next time the network sees a similar input time-series, it will be more likely to predict the correct protocol. Over time, as the weights are updated in this manner, the network not only becomes increasingly likely to correctly predict the protocol over which network traffic occurred, but moreover, the activity at the projection layer (i.e., the embeddings of the network traffic input sequence) will map similar input sequences to similar embedding values”, wherein accurate predictions are made with continuous backpropagation and not by retraining the machine learning model.).
Claims 10-12, 15 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over US PGPub. No. 20180219895 to Silver et al. (hereinafter Silver) in view of US PGPub. No. 20160247080 to Trantham et al. (hereinafter Trantham).
Regarding claim 10, Silver discloses a system, comprising:
a first computer device (FIG. 1, ¶0036, switch 104 or firewall 103) configured to:
store a machine learning system comprising machine learning models in a first memory (¶0033-¶0034, FIG. 1, “Network traffic flow data is projected/mapped into embedding space…”), (¶0036, FIG. 1, physical computer or hosts memory that host the anomaly detection module 108);
receive an electronic processing request having features (¶0051, “The first recurrent layer
is connected to the second, and the second to the third via new sets of randomized weights at 303. The recurrent layers transform the input sequence into complex features representations, which once the sequence has finished, projects these representations into an embedding layer. The final recurrent layer is then connected to a projection layer, which ultimately serves as the embedding layer at 307 once training is complete…”), and (¶0057, “After training is completed, the system can take any novel (e.g., unseen) network flow data for a given connection, and project it into the embedding space. Once a system has been trained to predict network anomaly behavior in a network flow given the underlying time series data, novel network flows can be presented to the system. Those network flows will be embedded in the learned vector space and mapped to a protocol”);
request, over a network connection, access to an embedding layer of the machine learning
system (FIG. 1, ¶0036, “Anomaly detection module 108 is an external module or physical computer that is coupled to the switch or firewall…”, The switch or firewall control the access request to module 108), wherein the embedding layer is stored in a second memory of a second computer device separate from the first computer device (¶0036, “…the anomaly detection module 108 is an external module or physical computer that is coupled to the switch 104. While in some embodiments, the anomaly detection module 108 may be directly integrated as an executable set of instructions into network components, such as the switch 104 or a firewall 103. While still, in some embodiments the anomaly detection module 108 may be integrated into one or more hosts, in a distributed fashion (e.g. each host may have its own set copy of the distributed instructions and the hosts collectively agree to follow or adhere to instructions per protocol to collect and analyze network traffic), (¶0069-¶0070,), and
wherein the embedding layer is trained to map a plurality of features to a plurality of embedding vectors (FIG. 1, ¶0033- ¶0034, Network traffic flow data is projected/mapped into embedding space.), (¶0056, “… Over time, as the weights are updated in this manner, the network not only becomes increasingly likely to correctly predict the protocol over which network traffic occurred, but moreover, the activity at the projection layer (i.e., the embeddings of the network traffic input sequence) will map similar input sequences to similar embedding values.”), As seen in ¶0020-¶0027, such mapping makes use of embedding vectors.;
receive from the embedding layer a subset of embedding vectors from the plurality of embedding vectors that are mapped to the features in the electronic processing request
(¶0043, “…Similar patterns of traffic flow with similar protocols and data transmission statistics will be mapped into similar regions of the embedded space. The embedded vectors for a set of connections can then be clustered together or can be used to make predictions about the connection itself. Due to the deep-learning architecture, a sequence of network flow will provide a high-level encapsulation of network properties. As such, different static representations of time sequences of varying lengths may be properly compared to each other.”), (¶0034), (¶0051, FIG. 3, “…The first recurrent layer is connected to the second, and the second to the third via new sets of randomized weights at 303. The recurrent layers transform the input sequence into complex features representations, which once the sequence has finished, projects these representations into an embedding layer. The final recurrent layer is then connected to a projection layer, which ultimately serves as the embedding layer at 307 once training is complete. The value at the embedding layer at this point is taken to be the embedding representation for the whole sequence. Finally, the projection layer is connected to an output layer 309, which contains a node for each of the possible protocols on which the input sequence may occur.”), (¶0057), and
process the subset of embedding vectors using at least one machine learning model in the
machine learning system to generate a response to the electronic processing request (¶0015, ¶0029, ¶0032, ¶0057-¶0058; Machine learning used to detect anomalous traffic patterns in a network using vector embeddings).
However, Silver does not explicitly disclose wherein the embedding layer is stored in a second memory of a second computer device separate from the first computer device, wherein the second memory is larger than the first memory.
Trantham discloses wherein the embedding layer is stored in a second memory of a second computer device separate from the first computer device, wherein the second memory is larger than the first memory (¶0018, “a large computation may be distributed by a host to an array of storage compute devices”), (¶0047, “… All of the bits previously stored in the scan chain 710 have been transferred to the nonvolatile storage 720. In some cases, this storage may be done a bit at a time. According to various implementations, the system first accumulates bits in a volatile buffer which are then stored to nonvolatile memory in larger accumulations, such as bytes, pages, logical blocks, etc.”);
Thus, one of ordinary skill in the art would have found it obvious before the effective filing date of applicant’s invention to modify the system of Silver to incorporate the teaching of
a memory storage that stores the embedding layer is a non-volatile memory that is larger than a random-access memory that stores the machine learning system as disclosed by Trantham and be motivated in doing so because the larger non-volatile memory will act as a buffer wherein the aggregated data from the random-access memory (volatile memory) could be stored. RAM also loses integrity after loss of power.
Regarding claim 11, Silver in view of Trantham discloses the system of claim 10.
Silver further discloses wherein the machine learning system includes a first machine learning model configured to process a first subset of embedding vectors from the embedding vectors and a second machine learning model configured to process a second subset of embedding vectors from the embedding vectors, wherein the second subset of embedding vectors is different from the first subset of embedding vectors (¶0059, “FIG. 4 is a flowchart of an approach to implement vector embedding of network traffic according to some embodiments of the invention. In some embodiments, two (i.e. in a bidirectional architecture) recurrent neural networks (RNNs), each comprised by several layers of long short-term memory (LSTM) units, etc.”), (¶0060, “This type of network comprises two subnetworks: one that processes the timeseries in time order (the “Forward Network”) and one that processes the timeseries in reverse-time order (the “Backward Network”). When a timeseries is presented to the network, each of these subnetworks produces a timeseries of its own—these output timeseries are antecedent to the subnetworks' projections of the timeseries into a space that contains the information necessary for network anomaly analysis…”, wherein antecedent is interpreted wherein the second subset of embedding vectors is received at a different time than the first subset of embedding vectors).
Regarding claim 12, Silver in view of Trantham discloses the system of claim 11.
Silver further discloses wherein the first computer device is further configured to: generate, by processing the first subset of embedding vectors through the first machine learning model, a first indication (¶0043, “Analysis is performed on the network data to analyze any network anomalies at 207. Similar patterns of traffic flow with similar protocols and data transmission statistics will be mapped into similar regions of the embedded space. The embedded vectors for a set of connections can then be clustered together or can be used to make predictions about the connection itself. Due to the deep-learning architecture, a sequence of network flow will provide a high-level encapsulation of network properties. As such, different static representations of time sequences of varying lengths may be properly compared to each other.”), (¶0060, “…Once each subnetwork has produced its own output timeseries, the last and final state of each timeseries is projected to an output layer that predicts a probability for each protocol in an effort to reproduce a one-hot representation.”, wherein the one-hot is interpreted as the first indication produced by the machine learning model);
generate, by processing the second subset of embedding vectors through the second machine learning model, a second indication (¶0060, “…Once each subnetwork has produced its own output timeseries, the last and final state of each timeseries is projected to an output layer that predicts a probability for each protocol in an effort to reproduce a one-hot representation. In some embodiments, the one hot representation may be used for a “target” against which the system's performance is evaluated”; and
combine the first indication and the second indication into the response (¶0064, “The system then takes both outputs from the forward network and backwards network to the projection layer (or embedding layer) at 407, and, finally, from the projection layer to the output layer 409, via sets of weights.”, wherein the two timeseries outputs forwarded are combined at the final output layer 409 for anomaly prediction).
Regarding claim 15, Silver in view of Trantham discloses the system of claim 10.
Silver further discloses wherein the first computer device is further configured to:
receive a new electronic processing request having new features (¶0066, “… the system can use sequences of these embeddings, to build new, higher-order embeddings that represent larger temporal scales, as well as full embeddings for a host or server across a number of connections.”); and
update the embedding layer on the second computer device with new embedding vectors corresponding to the new features without retraining the machine learning models (¶0056, “Once a prediction is made however, the network weights can be updated during training with backpropagation (through time), such that the next time the network sees a similar input time-series, it will be more likely to predict the correct protocol. Over time, as the weights are updated in this manner, the network not only becomes increasingly likely to correctly predict the protocol over which network traffic occurred, but moreover, the activity at the projection layer (i.e., the embeddings of the network traffic input sequence) will map similar input sequences to similar embedding values”, wherein accurate predictions are made with continuous backpropagation and not by retraining the machine learning model.).
Regarding claim 17, Silver discloses the non-transitory machine-readable medium of claim 16.
However, Silver does not explicitly disclose the following limitation:
wherein the memory that stores the embedding layer on the second machine is larger in memory size than the memory that stores the at least one machine learning model on the first machine.
Trantham discloses wherein the memory that stores the embedding layer on the second machine is larger in memory size than the memory that stores the at least one machine learning model on the first machine (¶0018, “a large computation may be distributed by a host to an array of storage compute devices”), (¶0047, “… All of the bits previously stored in the scan chain 710 have been transferred to the nonvolatile storage 720. In some cases, this storage may be done a bit at a time. According to various implementations, the system first accumulates bits in a volatile buffer which are then stored to nonvolatile memory in larger accumulations, such as bytes, pages, logical blocks, etc.”);
Thus, one of ordinary skill in the art would have found it obvious before the effective filing date of applicant’s invention to modify the system of Silver to incorporate the teaching of
a memory storage that stores the embedding layer is a non-volatile memory that is larger than a random-access memory that stores the machine learning system as disclosed by Trantham and be motivated in doing so because the larger non-volatile memory will act as a buffer wherein the aggregated data from the random-access memory (volatile memory) could be stored. RAM also loses integrity after loss of power.
Claims 3, is rejected under 35 U.S.C. 103 as being unpatentable over US PGPub. No. 20180219895 to Silver et al. (hereinafter Silver) in view of US. Pat. No. 11803752 to Liu et al. (hereinafter Liu) and further in view of US PGPub. No. 20160247080 to Trantham et al. (hereinafter Trantham).
Regarding claim 3, Silver in view of Liu discloses the method of claim 2.
However, Silver in view of Liu does not explicitly disclose the following limitation:
wherein a memory storage that stores the embedding layer is a non-volatile memory that is larger than a random-access memory that stores the at least one machine learning model.
Trantham in the same field of invention discloses wherein a memory storage that stores the embedding layer is a non-volatile memory that is larger than a random-access memory that stores the at least one machine learning model (¶0047, “… All of the bits previously stored in the scan chain 710 have been transferred to the nonvolatile storage 720. In some cases, this storage may be done a bit at a time. According to various implementations, the system first accumulates bits in a volatile buffer which are then stored to nonvolatile memory in larger accumulations, such as bytes, pages, logical blocks, etc.”).
Thus, one of ordinary skill in the art would have found it obvious before the effective filing date of applicant’s invention to modify the method of Silver and Liu to incorporate the teaching of a memory storage that stores the embedding layer is a non-volatile memory that is larger than a random-access memory that stores the machine learning system as disclosed by Trantham and be motivated in doing so because the larger non-volatile memory will act as a buffer wherein the aggregated data from the random-access memory (volatile memory) could be stored. RAM also loses integrity after loss of power.
Claim 13-14 are rejected under 35 U.S.C. 103 as being unpatentable over US PGPub. No 20180219895 to Silver et al. (hereinafter Silver) in view of US PGPub. No. 20160247080 to Trantham et al. (hereinafter Trantham) and further in view of US PGPub. No 20210374384 to Munkberg et al. (hereinafter Munkberg).
Regarding claim 13, Silver in view of Trantham discloses the system of claim 10.
However, Silver in view of Trantham does not explicitly disclose the following limitation:
wherein the at least one machine learning model in the machine learning system is an event driven machine learning model configured to process the embedding vectors associated with the features as the features are received at the first computer device,
wherein the features are generated in real-time by actions that occur in response to a user interaction with a processing system.
Munkberg discloses wherein the at least one machine learning model in the machine learning system is an event driven machine learning model configured to process the embedding vectors associated with the features as the features are received at the first computer device (¶0173, “In at least one embodiment, DLA(s) may quickly and efficiently execute neural networks, especially CNNs, on processed or unprocessed data for any of a variety of functions, including, for example and without limitation: a CNN for object identification and detection using data from camera sensors; a CNN for distance estimation using data from camera sensors; a CNN for emergency vehicle detection and identification and detection using data from microphones; a CNN for facial recognition and vehicle owner identification using data from camera sensors; and/or a CNN for security and/or safety related events.”, wherein embeddings are generated from the event data by the sample reducer to produce context features ¶0063),
wherein the features are generated in real-time by actions that occur in response to a user interaction with a processing system (¶0568, “ In at least one embodiment, real-time or near real-time processing may be particularly useful where a virtual instrument supports an ultrasound device or other imaging modality where immediate visualizations are expected or required for accurate diagnoses and analyses.”), (¶0556, “… In at least one embodiment, virtualized environments may be used to generate a virtual interactive display or environment (e.g., a virtual environment) for interaction by users of a system (e.g., doctors, nurses, radiologists, etc.). In at least one embodiment, visualization services 3720 may include an internal visualizer, cinematics, and/or other rendering or image processing capabilities or functionality (e.g., ray tracing, rasterization, internal optics, etc.”).
Thus, one of ordinary skill in the art would have found it obvious before the effective filing date of applicant’s claimed invention to modify the system of Silver to include a real-time generation of features as disclosed by Munkberg and be motivated in doing so in order to detect network anomaly or threat as they occur.
Regarding claim 14, Silver in view of Trantham and further in view of Munkberg discloses the system of claim 13.
Silver further discloses wherein the event driven machine learning model is configured to generate the response that identifies fraud in the processing system based on the features that are generated in real-time by the actions (¶0066, “The protocol embeddings can successfully be used as inputs to a variety of downstream algorithms that are meant to identify malicious and anomalous network flows. As mentioned, the system can use these embeddings to predict whether or not an attacker is abusing or misusing a particular port and protocol, as occurs when an attacker hides a tunnel in an otherwise innocuous protocol such as HTTP. Furthermore, the system can use sequences of these embeddings, to build new, higher-order embeddings that represent larger temporal scales, as well as full embeddings for a host or server across a number of connections.”), (¶0032-(¶0033, “given sequences of network flow data for connections on a network 101, the system 100 can represent the network traffic data in a compact form which will allow the system to predict whether or not the connection is anomalous (e.g., whether the connection indicates a potential threat to the network)…”).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MUDASIRU K OLAEGBE whose telephone number is (571)272-2082. The examiner can normally be reached MON-FRI. 7.30AM-5.30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached at 5712723739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MUDASIRU K OLAEGBE/Examiner, Art Unit 2495
/FARID HOMAYOUNMEHR/Supervisory Patent Examiner, Art Unit 2495
Prosecution Insights