Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-8 have been examined.
Claim Rejections - 35 USC §112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 3, 4 and 5 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim language in the following claims is not clearly understood:
As per claim 3, line 3, it is unclear what is meant by “in such a way”.
As per claim 4, line 4, it is unclear what is meant by “similar” (i.e., it is a relative term)
As per claim 5, line 3, it is unclear what is meant by “similar” (i.e., it is a relative term)
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-8 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by De Jesus Valdes et al, WO 02/19077 (hereinafter De Jesus Valdes).
As per claim 1, De Jesus Valdes teaches the invention as claimed comprising:
processing circuitry (fig. 3) configured to:
create a group for each of predetermined communication features for alerts indicating that communication has been detected as abnormal communication that is different in pattern from normal communication (pg. 5, lines 13-22; pg. 6, lines 1-10; pg. 9, lines 3-10; pg. 9, line 28-pg. 10, line 15; pg. 13, lines 1-6; pg. 1, lines 21-28; pg. 5, liens 23-30, e.g., create alert class/mega alert thread for each of predetermined communication features for alerts indicating that communication has been detected as abnormal communication); and
identify for each of the created groups of alerts, a cause of notification of the alerts (pg. 13, lines 10-13; pg. 23, lines 1-6; pg. 16, lines 19-23; pg. 17, lines 13-17, e.g., identify for each mega alert thread, a cause of notification of alert (e.g., same sensor same attack)).
As per claim 2, De Jesus Valdes teaches the invention as claimed in claim 1 above. De Jesus Valdes further teach wherein the processing circuitry is further configured to create the group in which the same communication source IP address, communication destination IP address, and communication destination port number are used as a predetermined communication feature (pg. 6, lines 1-10; pg. 18, lines 8-10).
As per claim 3, De Jesus Valdes teaches the invention as claimed in claim 1 above. De Jesus Valdes further teach wherein the processing circuitry is further configured to identify the cause by determining whether communication of the group has been learned in such a way as to allow for output of whether the communication is normal or abnormal (pg. 9, line 29-pg. 10, line 15).
As per claim 4, De Jesus Valdes teaches the invention as claimed in claim 3 above. De Jesus Valdes further teach wherein the processing circuitry is further configured to in a case where the communication of the group has been learned, identify the cause by determining whether a feature of the communication of the group is similar to a learned feature (pg. 9, line 29-pg. 10, line 15; pg. 12, line 28-pg. 13, line 6).
As per claim 5, De Jesus Valdes teaches the invention as claimed in claim 4 above. De Jesus Valdes further teach wherein the processing circuitry is further configured to for the communication of the group, in a case where the feature of the communication of the group is similar to the learned feature, identify the cause by determining a degree of deviation of a value for detection as abnormal communication from a predetermined threshold (pg. 9, line 29-pg. 10, line 15; pg. 12, line 28-pg. 13, line 6).
As per claim 6, De Jesus Valdes teaches the invention as claimed in claim 1 above. De Jesus Valdes further teach wherein the processing circuitry is further configured to determine whether there is a periodicity in occurrence times of the alerts for each of the groups (pg. 13, lines 10-13. e.g., alert reports of same attack separated in time for a thread).
As per claims 7 and 8, they are rejected for the same reason as claim 1 above.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should
be directed to Philip Lee whose telephone number is (571)272-3967. The examiner can normally be
reached on 6a-3p M-F.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor,
Glenton Burgess can be reached on 571-272-3949. The fax phone number for the organization where this
application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application
Information Retrieval (PAIR) system. Status information for published applications may be obtained
from either Private PAIR or Public PAIR. Status information for unpublished applications is available
through Private PAIR only. For more information about the PAIR system, see http://pair- direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer
Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR
CANADA) or 571-272-1000.
/PHILIP C LEE/Primary Examiner, Art Unit 2454
Prosecution Insights