Remarks
Claims 1-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 6, 8, 14, and 16 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 6 recites the limitation "the second number of most least confident data samples from each individual storage". There is insufficient antecedent basis for this limitation in the claim. Moreover, since most and least are opposites, this is also indefinite since one of ordinary skill in the art cannot determine what a “most least confident data sample” may possibly be. Claim 14 has the same issues and is rejected for the same reasons.
Claim 8 recites the limitation "the data sample corresponding to the event" in the final limitation. There is insufficient antecedent basis for this limitation in the claim. Claim 16 has the same issue and is rejected for the same reasons.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 17-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim(s) does/do not fall within at least one of the four categories of patent eligible subject matter because the claims are directed to a “computer-readable storage medium”, which is known in the art to include carrier waves, for example, which are non-statutory. Thus, the medium is not statutory for claim 17 as well as its dependent claims 18-20.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1, 2, 4-6, 8-10, 12-14, 16, 17, and 19 are rejected under 35 U.S.C. 102(a)(1) and/or 102(a)(2) as being anticipated by Herwadkar (U.S. Patent Application Publication 2019/0102553).
Regarding Claim 1,
Herwadkar discloses a computer implemented method comprising:
Receiving, by a processor, data samples associated with events detected in a computer network (Exemplary Citations: for example, Abstract, Paragraphs 33, 67 (and following exemplary attributes in following paragraphs), 121, 122, 146-149, and associated figures; receiving query, attributes, or the like, for example);
Distributing, by the processor, the data samples into a plurality of storages (Exemplary Citations: for example, Abstract, Paragraphs 49, 54, 108-110, 122, 127, and associated figures; putting representations of the above into buckets, such as by use of locality sensitive hashing, onto whitelists, onto lists for exact matching, and the like, for example);
Obtaining, by the processor, and based on one or more storages of the plurality of storages, a first set of data samples, wherein the one or more storages satisfy a first criteria (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; data from a bucket or model, which may be relevant to a given query (e.g., as in paragraph 152-153), for example);
Obtaining, by the processor, and based on a first sampling on individual storage of rest storages in the plurality of storages, a second set of data samples (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; any data from another/other bucket(s)/model(s), for example);
Obtaining, by the processor, and based on a second sampling across the rest storages in the plurality of storages, a third set of data samples (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; any data from another/other bucket(s)/model(s) that could be considered a different sampling in any fashion, such as in selecting another attribute relevant to another query, for example);
Generating, by the processor, and based on the first set of data samples, the second set of data samples, and the third set of data samples, a training dataset (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; training dataset may be any data used to train the models, such as the prior models prior to updating, buckets, vectors, queries, attributes, hashes, etc., for example); and
Providing, by the processor, and to a computer device, the training dataset to train a malware detection model (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; training based on the above, for example).
Regarding Claim 9,
Claim 9 is a system claim that corresponds to method claim 1 and is rejected for the same reasons.
Regarding Claim 17,
Claim 17 is a medium claim that corresponds to method claim 1 and is rejected for the same reasons.
Regarding Claim 2,
Herwadkar discloses that distributing, by the processor, the data samples into a plurality of storages further comprises: storing, by the processor, and based on a locality sensitive hashing (LSH) algorithm, similar data samples to a same storage (Exemplary Citations: for example, Abstract, Paragraphs 49, 54, 108-110, 122, 127, and associated figures).
Regarding Claim 10,
Claim 10 is a system claim that corresponds to method claim 2 and is rejected for the same reasons.
Regarding Claim 4,
Herwadkar discloses that obtaining, by the processor, and based on a first sampling on individual storage of rest storages in the plurality of storages, a second set of data samples further comprises:
Selecting, by the processor, and from each individual storage, a first number of most recent data samples (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; this could be any number of samples, such as zero or all samples within a bucket, for example);
Selecting, by the processor, and from each individual storage, a second number of least confident data samples (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; least confident determinations, such as lowest 1-2% or zero, for example); and
Generating, by the processor, and based on the first number of most recent data samples and the second number of least confident data samples, the second set of data samples (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures).
Regarding Claim 12,
Claim 12 is a system claim that corresponds to method claim 4 and is rejected for the same reasons.
Regarding Claim 19,
Claim 19 is a medium claim that corresponds to method claim 4 and is rejected for the same reasons.
Regarding Claim 5,
Herwadkar discloses prior to selecting, by the processor, and from each individual storage, the second number of least confident data samples, removing, by the processor, the first number of most recent data samples from each individual storage (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; all selected at first removed when not relevant, or removing zero samples, for example).
Regarding Claim 13,
Claim 13 is a system claim that corresponds to method claim 5 and is rejected for the same reasons.
Regarding Claim 6,
Herwadkar discloses prior to obtaining, by the processor, and based on the second sampling across the rest storages in the plurality of storages, the third set of data samples, removing, by the processor, the second number of most least confident data samples from each individual storage (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; removing bottom 1-2% or irrelevant samples, or removing zero samples, for example).
Regarding Claim 14,
Claim 14 is a system claim that corresponds to method claim 6 and is rejected for the same reasons.
Regarding Claim 8,
Herwadkar discloses for each of the events detected in the computer network (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 48-63, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures),
Inputting, by the processor, information associated with the event to the malware detection model (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 48-63, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; extracting attributes, generating vectors, hashes, or the like, for example);
Executing, by the processor, the malware detection model to generate a detection result, the detection result indicating a confidence level that the event is malicious (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 48-63, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; executing model for the above, for example); and
Generating, by the processor, the data sample corresponding to the event, the data sample including the information and the confidence level (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 48-63, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures; determination of anomaly with confidence, for example).
Regarding Claim 16,
Claim 16 is a system claim that corresponds to method claim 8 and is rejected for the same reasons.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 3, 11, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Herwadkar in view of Nguyen (10,572,811)
Regarding Claim 3,
Herwadkar discloses that the first criteria correspond to a threshold number of the data samples in a storage, and a number of data samples in each of the one or more storages is equal to or less than the threshold number, wherein the threshold number is determined based on a distribution function (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures);
But may not explicitly disclose that the distribution function comprises an empirical cumulative distribution function.
Nguyen, however, discloses that the distribution function comprises an empirical cumulative distribution function (Exemplary Citations: for example, Column 17, lines 24-52, Column 18, line 65 to Column 19, line 7 and associated figures; empirical cumulative distribution function, for example). At the time of applicant’s invention, which is before any effective filing date of the claimed invention, it would have been obvious to try incorporating the distribution function of Nguyen into the distribution based analysis system of Herwadkar because one of ordinary skill in the art would be choosing from a finite number of identified, predictable solutions (i.e. the options discussed in the cited portions of Nguyen) with a reasonable expectation of success (i.e. they all succeed in Nguyen as distribution functions). Alternatively, it would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to perform a simple substitution of the distribution function (e.g., hash-based bucketing, or histogram based distribution) in Herwadkar with another distribution function (e.g., the ECDF of Nguyen).
Regarding Claim 11,
Claim 11 is a system claim that corresponds to method claim 3 and is rejected for the same reasons.
Regarding Claim 18,
Claim 18 is a medium claim that corresponds to method claim 3 and is rejected for the same reasons.
Claims 7, 15, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Herwadkar in view of Chen (Chen, Yen-Chi, “Lecture 9: Monte Carlo Simulations and Sampling”, STAT 535: Statistical Machine Learning, Autumn 2019, 1-26, obtained from https://faculty.washington.edu/yenchic/19A_stat535/Lec9_MC.pdf).
Regarding Claim 7,
Herwadkar discloses that the second sampling is performed using an algorithm based on individual sizes of the plurality of storages (Exemplary Citations: for example, Abstract, Paragraphs 33, 45, 49, 51, 52-55, 57, 61, 108-110, 123-125, 127-129, 132, 135, 143, 144, 152-153, and associated figures);
But does not appear to explicitly disclose that the algorithm comprises a Monte Carlo sampling algorithm with a power transformation.
Chen, however, discloses that the algorithm comprises a Monte Carlo sampling algorithm with a power transformation (Exemplary Citations: for example, Lecture 9 discusses a variety of Monte Carlo algorithms, for example; e.g., sections 9.2-9.3 (with subsections), for example); and
That the second sampling is performed using a Monte Carlo sampling algorithm with a power transformation based on individual sizes of the plurality of storages (Exemplary Citations: for example, Lecture 9 discusses a variety of Monte Carlo algorithms, for example; e.g., sections 9.2-9.3 (with subsections), for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the Monte Carlo sampling techniques of Chen into the distribution based analysis system of Herwadkar in order to increase extensibility of the system by allowing for additional sampling algorithms to be used, to allow the system to be compatible with extremely well-known Monte Carlo sampling, and/or to allow for use of the best sampling for any given situation.
Regarding Claim 15,
Claim 15 is a system claim that corresponds to method claim 7 and is rejected for the same reasons.
Regarding Claim 20,
Claim 20 is a medium claim that corresponds to method claim 7 and is rejected for the same reasons.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Jeffrey D Popham whose telephone number is (571)272-7215. The examiner can normally be reached Monday through Friday 9:00-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey D. Popham/Primary Examiner, Art Unit 2432
Prosecution Insights