DETAILED ACTION
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This Office Action is in response to the communication filed on 03/20/2026.
Claims 1, 3, 6, 8, 10, 13, 15, 17, and 20 have been amended.
Claims 1-20 are pending for consideration.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed 03/20/2026 have been fully considered but they are not persuasive.
Regarding claim 1, Applicant argues that Abbaszadeh, Giani, and Genc fail to teach "wherein the sequence of failures comprises an initial failure of one component of the one or more components, and at least one subsequent failure in a dependent component of the one or more components that is triggered by the initial failure".
Examiner disagrees. Genc defines a cascading failure as (Genc: see Col 1 lines 25 - 31, "Accordingly, the failure of a power grid component may result in failure of other power grid components and combinations of the failures may result in a large power blackout. Typically, a failure of a power grid component that may trigger failure of other power grid components is referred to as a cascading failure or a cascading fault").
Applicant argues that the motivation to combine the Abbaszadeh, Giani, and Genc is overly broad, and focuses only on the alleged analogous nature of the references. It would have been obvious to POSITA to combine the detection or identification of a cascading failure utilizing Genc's method for determination with the anomaly classification of faults and cyberattacks of Giani because a cascading failure mimics stealthy cyberattacks. By classifying the anomaly, the number of false positive cyberattacks would be decreased and system remediation efforts can be determined more efficiently.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 2, 4, 6, 7, 8, 9, 11, 13, 14, 15, 16, 18, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Giani et al. (U.S. 10,841,322)(hereinafter Giani) in view of Genc et al. (U.S. 8,504,214)(hereinafter Genc).
Regarding claims 1, 8, and 15, Giani teaches monitoring, via at least one processor, data of one or more components within a cyber-physical system in real time (Giani: see Fig 10 item 1010; Col 1 lines 62-65, "According to some embodiments, a plurality of monitoring nodes may each generate a series of current monitoring node values over time that represent a current operation of the industrial asset")
determining, via the at least one processor, a plurality of anomalies from the monitored data using a condition-based maintenance model and a cyber-defense model (Giani: see Col 1 lines 65-67 - Col 2 line 1, " A node classification computer may determine, for each monitoring node, a classification result indicating whether each monitoring node is in a normal or abnormal state"), wherein the condition-based maintenance model and the cyber-defense model are configured to determine unexpected behaviors in the data representing at least one of a component failure and an evidence of a cyberattack, within the cyber-physical system (Giani: see Col 5 lines 8-12, "At S240, the system may perform, localization (e.g., to determine which node caused the abnormal operation) and/or disambiguation (e.g., to determine if an abnormal condition is a result of a fault or a cyber-attack as described herein)");
determining, via the at least one processor, that the plurality of anomalies correspond to the evidence of the cyberattack upon determining the plurality of anomalies are not related to the cascading fault (Giani: see Col 9 lines 37-43, "At S630, a disambiguation engine may associate a Hidden Markov Model (“HMM”) with each monitoring node. For each node in an abnormal state, at S640 the HMM associated with that monitoring node is executed to determine a disambiguation result indicating if the abnormal state is a result of an attack or a fault"); and
generating, via the at least one processor, one or more alerts for a user associated with the plurality of anomalies, upon determining that the plurality of anomalies correspond to the component failure or the evidence of the cyberattack (Giani: see Col 13 claim 1 lines 31-33, "and output a current status of each monitoring node based on the associated classification result and the disambiguation result").
However, Giani does not teach determining, via the at least one processor, that the plurality of anomalies is related to a cascading fault using the condition-based maintenance model and the cyber-defense model, wherein the cascading fault corresponds to a sequence of failures of the one or more components within the cyber-physical system, wherein the sequence of failures comprises an initial failure of one component of the one or more components, and at least one subsequent failure in a dependent component of the one or more components that is triggered by the initial failure.
Nevertheless, Genc-which is in the same field of endeavor- teaches determining, via the at least one processor, that the plurality of anomalies is related to a cascading fault using the condition-based maintenance model and the cyber-defense model, wherein the cascading fault corresponds to a sequence of failures of the one or more components within the cyber-physical system (Genc: see Fig. 3; Col 9 lines 9-17, "Subsequent to the generation of the respective new infectiousness states by one or more of the agents at step 308, the cascading fault flag 56 (see FIG. 1) may be generated by the diagnoser layer 16 at step 310. As used herein, the term "cascading fault flag" may be used to refer to a value that identifies one or more cascading faults in a self-healing power grid. In one embodiment, the diagnoser layer 16 may generate the cascading fault flag 56 based upon one or more cascading faults in the self-healing power grid 10"), wherein the sequence of failures comprises an initial failure of one component of the one or more components, and at least one subsequent failure in a dependent component of the one or more components that is triggered by the initial failure (Genc: see Col 1 lines 25 - 31, "Accordingly, the failure of a power grid component may result in failure of other power grid components and combinations of the failures may result in a large power blackout. Typically, a failure of a power grid component that may trigger failure of other power grid components is referred to as a cascading failure or a cascading fault").
Giani and Genc are analogous art because they are from the same field of endeavor. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine Giani’s anomaly detection and classification method for distinguishing between a component failure/fault or cyberattack with Genc’s method for identifying and healing detected cascading faults. The suggestion/motivation for doing so would be to reduce the time and resources needed to address or mitigate an outage, fault, or attack of a cyber-physical system by decreasing the number of false positive cyberattacks.
Regarding claims 2, 9, and 16, Giani teaches the one or more components comprises at least one of a flight control module, a navigation module, a communication module, a surveillance and monitoring module, a weather module, a safety and alerting module, and an engine monitoring module (Giani: see Col 6 lines 30-35).
Regarding claims 4, 11, and 18, Giani teaches the component failure corresponds to an abnormal behavior or breakdown of the one or more components within the cyber-physical system (Giani: see Col 3 lines 51-66).
Regarding claim 6 and 13, Giani teaches displaying, via the at least one processor, the one or more alerts to the user, for taking an appropriate action in response to the plurality of anomalies determined cyber-physical system (Giani: see Col 4 lines 34-43; Col 10 lines 50-56).
Regarding claims 7 and 14, Giani teaches the one or more alerts comprise at least one of visual alerts, auditory alerts, textual alerts, tactile alerts, or remote alerts (Giani: see Fig. 22; Col 10 lines 50-56).
Regarding claim 20, Giani teaches the at least one processor (Giani: see Fig. 10 item 1010) is configured to display the one or more alerts to the user, for taking an appropriate action in response to the plurality of anomalies determined within the cyber-physical system, wherein the one or more alerts comprise at least one of visual alerts, auditory alerts, textual alerts, tactile alerts, or remote alerts (Giani: see Fig. 22; see Col 4 lines 34-43; Col 10 lines 50-56).
Claims 3, 5, 10, 12, 17, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Giani and Genc, as applied to claims 1, 2, 4, 6, 7, 8, 9, 11, 13, 14, 15, 16, 18, and 20 above, and in further view Ladd et al. (U.S. 11,201,884)(hereinafter Ladd).
Regarding claims 3, 10, and 17, Giani and Genc teach the invention detailed above.
However, Giani and Genc fail to teach the plurality of anomalies correspond to at least one of test information, faults and interrupts in bus, disordering of communications, memory footprint of devices within the avionics and vetronics network, communication timing, contents within packet moving back and forth.
Nevertheless, Ladd-which is in the same field of endeavor- the plurality of anomalies correspond to at least one of test information, faults and interrupts in bus, disordering of communications, memory footprint of devices within the avionics and vetronics network, communication timing, contents within packet moving back and forth (Ladd: see Col 6 lines 54-58, "In response to detecting anomalous behavior on at least one communication bus 104, 106, 108 that is indicative of a malfunction or a cyber-attack, the bus monitoring system 134 may alert the pilot 120 or other personnel or take other suitable corrective action"; Col 8 lines 6-15, "The data processing and analysis module 204 generally operates to analyze bus traffic and identify anomalous bus behaviors. In this example, the data processing and analysis module 204 includes an intrusion detection system (IDS) 212, which receives bus traffic sent over one or more communication buses via one or more of the interfaces 210. The intrusion detection system 212 also analyzes the bus traffic to identify anomalous transmissions or other anomalous bus behaviors, which may be indicative of malfunctions or cyber-attacks").
Giani, Genc, and Ladd are analogous art because they are from the same field of endeavor. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine the anomaly classification method of Giani and Genc with Ladd’s identification of anomalies to indicate malfunctions or cyberattacks. The suggestion/motivation for doing so would be to further assist in classifying an anomaly as a component failure or cyberattack by mapping known anomalies to a component failure or cyberattack.
Regarding claims 5, 12, and 19, Giani, Genc, and Ladd teach evidence of the cyberattack corresponds to interference, disruption, malfunction, or compromise of the one or more components caused by cyber threats such as hacking, malware, or other forms of cyberattacks (Ladd: see Col 3 lines 62-67 - Col 4 line 1, "This can be done to detect malfunctions of the communication bus itself or malfunctions of components coupled to the bus. This can also or alternatively be done to detect possible cyber-attacks, such as the injection of faults, malware, or other exploits onto the communication bus or the presence of faults, malware, or other exploits in components coupled to the communication bus"). Motivation to combine Giani, Genc, and Ladd in the instant claims, is the same as that in claims 3, 10, and 17.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KELAH JANAE MCFARLAND-BARNES whose telephone number is (571)272-5953. The examiner can normally be reached Monday through Friday 8:00am until 4:00pm Central Time.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn D Feild can be reached at 571-272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KELAH JANAE MCFARLAND-BARNES/Examiner, Art Unit 2431
/LYNN D FEILD/Supervisory Patent Examiner, Art Unit 2431
Prosecution Insights