Prosecution Insights
Last updated: April 19, 2026
Application No. 18/881,635

INTRUSION DETECTION DEVICE AND INTRUSION DETECTION METHOD

Non-Final OA §102§103
Filed
Jan 06, 2025
Examiner
NGUY, CHI D
Art Unit
2435
Tech Center
2400 — Computer Networks
Assignee
Hitachi Astemo, Ltd.
OA Round
1 (Non-Final)
75%
Grant Probability
Favorable
1-2
OA Rounds
3y 7m
To Grant
91%
With Interview

Examiner Intelligence

Grants 75% — above average
75%
Career Allow Rate
376 granted / 501 resolved
+17.0% vs TC avg
Strong +16% interview lift
Without
With
+16.0%
Interview Lift
resolved cases with interview
Typical timeline
3y 7m
Avg Prosecution
22 currently pending
Career history
523
Total Applications
across all art units

Statute-Specific Performance

§101
8.2%
-31.8% vs TC avg
§103
51.9%
+11.9% vs TC avg
§102
18.9%
-21.1% vs TC avg
§112
11.1%
-28.9% vs TC avg
Black line = Tech Center average estimate • Based on career data from 501 resolved cases

Office Action

§102 §103
Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . The Application number 18/881,635 filed on 1/6/2025 has been considered. Claims 1-9 are pending. Priority Acknowledgment is made of applicant’s claim for foreign priority under 35 U.S.C. 119 (a)-(d). The certified copy has been filed on 1/6/2025. Information Disclosure Statement The information disclosure statement (IDS) submitted on 1/6/2025 is being considered by the examiner. Claim Rejections - 35 USC § 102 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention. Claims 1-2 and 5-7 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Chung et al. (US 2019/0312892 hereinafter Chung). Regarding claim 1, Chung discloses an intrusion detection device (FIG. 1-4, i.e. In-Vehicle Network security diagnostic sensor), comprising: a communication unit that transmits and receives a frame to and from an in-vehicle electronic device (FIG. 1-4, ¶ [0064]-[0068]; i.e. receiving and transmitting packets from the Electronic Control Units (ECU) via the Controller Area Network (CAN) communication bus); an attribute acquisition unit that acquires an attribute of the frame (FIG. 1-4, ¶ [0069]-[0077]; i.e. extracting the characteristics that uniquely identify the ECUs that transmit the packets and/or the information of the packets such as CAN_ID); a status acquisition unit that acquires communication control status information indicating a communication control status of the frame by the in-vehicle electronic device (FIG. 1-5, ¶ [0062]; [0069]-[0077]; i.e. obtaining/identifying driving state of the vehicle, a time interval, a frequency or a period with respect to the reception of packets, reception power which is measured at the CAN transceiver as the physical characteristic value of the CAN packets, etc.); and an abnormality detection unit that detects an abnormality of the in-vehicle electronic device on the basis of the attribute and the communication control status (FIG. 1-5, ¶ [0069]-[0077], [0083]-[0084]; i.e. detecting a sign of an abnormality based on the characteristics of the packets, driving state of the vehicle, the transmission state of the packets, etc.). Regarding claim 2, Chung discloses the intrusion detection device according to claim 1, further comprising a frame transmission determination unit that determines whether or not transmission of the frame is allowed on the basis of the attribute and the communication control status, wherein the abnormality detection unit detects an abnormality on the basis of a determination result of the frame transmission determination unit (¶ [0075]). Regarding claim 5, Chung discloses an intrusion detection device, comprising: a communication unit that transmits and receives a frame to and from an in-vehicle electronic device (FIG. 1-4, ¶ [0064]-[0068]; i.e. receiving and transmitting packets from the Electronic Control Units (ECU) via the Controller Area Network (CAN) communication bus); an attribute acquisition unit that acquires an attribute of the frame (FIG. 1-4, ¶ [0069]-[0077]; i.e. extracting the characteristics that uniquely identify the ECUs that transmit the packets and/or the information of the packets such as CAN_ID); a status acquisition unit that acquires communication control status information indicating a communication control status of the frame by the in-vehicle electronic device (FIG. 1-5, ¶ [0062]; [0069]-[0077]; i.e. obtaining/identifying driving state of the vehicle, a time interval, a frequency or a period with respect to the reception of packets, reception power which is measured at the CAN transceiver as the physical characteristic value of the CAN packets, etc.); an abnormality determination unit that detects an abnormality of the in-vehicle electronic device (FIG. 1-5, ¶ [0069]-[0077], [0083]-[0084]; i.e. detecting a sign of an abnormality based on the characteristics of the packets, driving state of the vehicle, the transmission state of the packets, etc.); and a transmission unit that, when the abnormality determination unit detects the abnormality of the in-vehicle electronic device, adds the attribute and the communication control status information to abnormality information indicating the abnormality and transmits the abnormality information (FIG. 1-5, ¶ [0063], [0077], [0177]; i.e. generating and transmitting trouble code and a cybersecurity fzeeze-frame data to the ECU and/or the cyber dashboard). Regarding claim 6, Chung discloses an intrusion detection method, comprising the steps of: transmitting and receiving a frame to and from an in-vehicle electronic device (FIG. 1-4, ¶ [0064]-[0068]; i.e. receiving and transmitting packets from the Electronic Control Units (ECU) via the Controller Area Network (CAN) communication bus); acquiring an attribute of the frame (FIG. 1-4, ¶ [0069]-[0077]; i.e. extracting the characteristics that uniquely identify the ECUs that transmit the packets and/or the information of the packets such as CAN_ID); acquiring communication control status information indicating a communication control status of the frame by the in-vehicle electronic device (FIG. 1-5, ¶ [0062]; [0069]-[0077]; i.e. obtaining/identifying driving state of the vehicle, a time interval, a frequency or a period with respect to the reception of packets, reception power which is measured at the CAN transceiver as the physical characteristic value of the CAN packets, etc.); and detecting an abnormality of the in-vehicle electronic device on the basis of the attribute and the communication control status (FIG. 1-5, ¶ [0069]-[0077], [0083]-[0084]; i.e. detecting a sign of an abnormality based on the characteristics of the packets, driving state of the vehicle, the transmission state of the packets, etc.). Regarding claim 7, Chung discloses the intrusion detection method according to claim 6, further comprising: a first step of determining whether or not transmission of the frame is allowed on the basis of the attribute and the communication control status, wherein the step of detecting the abnormality detects the abnormality on the basis of a determination result of the first step (¶ [0072]-[0075]). Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claims 3-4 and 8-9 are rejected under 35 U.S.C. 103 as being unpatentable over Chung et al. (US 2019/0312892 hereinafter Chung) in view of Sasaki et al. (US 2014/0047255 hereinafter Sasaki). Regarding claim 3, Chung discloses the intrusion detection device according to claim 1. Chung does not explicitly disclose further comprising a status determination unit that determines whether or not the in-vehicle electronic devices belonging to the same group have the same communication control status, wherein the abnormality detection unit detects an abnormality on the basis of a determination result of the status determination unit. However, Sasaki discloses a status determination unit that determines whether or not the in-vehicle electronic devices belonging to the same group have the same communication control status, wherein the abnormality detection unit detects an abnormality on the basis of a determination result of the status determination unit (FIG. 7 & 10, ¶ [0083]-[0086], [0102]). Therefore, it would have been obvious to one of ordinary skill in the art before effective filing date of the claimed invention to combine Chung and Sasaki in order to efficiently detect malfunction or abnormality in the vehicular network management (Sasaki, ¶ [0005]-[0012]). Regarding claim 4, Chung discloses the intrusion detection device according to claim 1, further comprising: a frame transmission determination unit that determines whether or not transmission of the frame is allowed on the basis of the attribute and the communication control status; wherein the abnormality detection unit detects an abnormality of the in-vehicle electronic device on the basis of either a determination result of the frame transmission determination unit or a determination result of the status determination unit (¶ [0072]-[0075]). Chung does not explicitly disclose further comprising a status determination unit that determines whether or not the communication control statuses of the in-vehicle electronic devices belonging to the same group have a certain relationship. However, Sasaki discloses a status determination unit that determines whether or not the communication control statuses of the in-vehicle electronic devices belonging to the same group have a certain relationship (FIG. 7 & 10, ¶ [0083]-[0086], [0102]). Therefore, it would have been obvious to one of ordinary skill in the art before effective filing date of the claimed invention to combine Chung and Sasaki in order to efficiently detect malfunction or abnormality in the vehicular network management (Sasaki, ¶ [0005]-[0012]). Regarding claim 8, Chung discloses the intrusion detection method according to claim 6. Chung does not explicitly disclose determining whether or not the communication control statuses of the in-vehicle electronic devices belonging to the same group have a certain relationship, wherein the step of detecting the abnormality detects the abnormality on the basis of a determination result of the second step. However, Sasaki discloses determining whether or not the communication control statuses of the in-vehicle electronic devices belonging to the same group have a certain relationship, wherein the step of detecting the abnormality detects the abnormality on the basis of a determination result of the second step (FIG. 7 & 10, ¶ [0083]-[0086], [0102]). Therefore, it would have been obvious to one of ordinary skill in the art before effective filing date of the claimed invention to combine Chung and Sasaki in order to efficiently detect malfunction or abnormality in the vehicular network management (Sasaki, ¶ [0005]-[0012]). Regarding claim 9, Chung discloses the intrusion detection method according to claim 6, further comprising: a first step of determining whether or not transmission of the frame is allowed on the basis of the attribute and the communication control status; and wherein the step of detecting the abnormality detects the abnormality on the basis of a determination result of the first step and a determination result of the second step (¶ [0072]-[0075]). Chung does not explicitly disclose further comprising determining whether or not the communication control statuses of the in-vehicle electronic devices belonging to the same group have a certain relationship. However, Sasaki discloses determining whether or not the communication control statuses of the in-vehicle electronic devices belonging to the same group have a certain relationship (FIG. 7 & 10, ¶ [0083]-[0086], [0102]). Therefore, it would have been obvious to one of ordinary skill in the art before effective filing date of the claimed invention to combine Chung and Sasaki in order to efficiently detect malfunction or abnormality in the vehicular network management (Sasaki, ¶ [0005]-[0012]). Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHI D NGUY whose telephone number is (571)270-7311. The examiner can normally be reached Monday-Friday 9-5 ET. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached at (571)270-3351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /C.D.N/Examiner, Art Unit 2435 /AMIR MEHRMANESH/Supervisory Patent Examiner, Art Unit 2435
Read full office action

Prosecution Timeline

Jan 06, 2025
Application Filed
Mar 23, 2026
Non-Final Rejection — §102, §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12598206
DETERMINING EXPLOIT PREVENTION USING MACHINE LEARNING
2y 5m to grant Granted Apr 07, 2026
Patent 12596775
SYSTEM AND METHODS FOR PAIRING EXTERNAL DEVICES TO VIRTUAL REALITY DEVICES
2y 5m to grant Granted Apr 07, 2026
Patent 12574730
METHOD AND SYSTEM FOR ACCESS AND COMMUNICATION CONTROL OF SIM-LESS END DEVICES
2y 5m to grant Granted Mar 10, 2026
Patent 12563395
ACCESSING A DENIED NETWORK RESOURCE
2y 5m to grant Granted Feb 24, 2026
Patent 12561481
DATA SHARING SYSTEM, METHOD AND APPARATUS, AND DEVICE AND MEDIUM
2y 5m to grant Granted Feb 24, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

1-2
Expected OA Rounds
75%
Grant Probability
91%
With Interview (+16.0%)
3y 7m
Median Time to Grant
Low
PTA Risk
Based on 501 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month