DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The Amendment filed 01 June 2026 has been received and considered.
Claims 1-27 are pending.
This Action is Final.
Claim Rejections - 35 USC § 101
The rejection under 35 U.S.C. 101 is withdrawn based on the filed amendment and persuasive arguments (see Response pages 8-10).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 2, 15, and 25-27 are rejected under 35 U.S.C. 103 as being unpatentable over Rathod et al. (US 20160241575) in view of Ptasinski et al. (US 9191400).
As per claims 1, 15, 26, and 27, Rathod et al. discloses a medium, system, and method for use in detection of anomalous behavior of a device of a computer system, the method arranged to be performed by a processing system, the method comprising: deriving values, m1,...,MN, of a metric, M , representative of data associated with the device including network traffic data (see paragraphs [0040]-[0044] where the profile has various metrics with values);
modelling a distribution of the values of the metric (see paragraphs [0045]-[0048]); and
determining, in accordance with the distribution of the values of the metric, a probability of observing a more extreme value of the metric than a given value, m, of the metric, wherein the probability is used to determine whether the device is behaving anomalously (see paragraphs [0049]-[0063] where an incoming request is statistically compared against the distribution of the profile to detect an anomaly).
While Rathod et al. discloses the use of models and distributions to detect anomalies there lacks an explicit teaching that modelling a distribution of the values of the metric to extrapolate tails of the distribution beyond a range of the derived values, where one or more models maintain what is considered to be normal behavior for the device, wherein the probability is used to determine whether the device is behaving anomalously in light of what is considered to be normal behavior for the device, and then generating an anomaly alert indicating the anomalous behavior of the device to, at least, one or more network system administrators and/or security officers.
However, Ptasinski et al. teaches modelling a distribution of the values of the metric to extrapolate tails of the distribution beyond a range of the derived values, where one or more models maintain what is considered to be normal behavior for the device, wherein the probability is used to determine whether the device is behaving anomalously in light of what is considered to be normal behavior for the device, and then generating an anomaly alert indicating the anomalous behavior of the device to, at least, one or more network system administrators and/or security officers (see column 9 line 64 through column 11 line 67 where the Maximum Entropy estimation expands the distribution model beyond the viewed data and therefore extrapolates the tails).
At a time before the effect filing date of the invention, it would have been obvious to one of ordinary skill in the art to include the modeling of Ptasinski et al. in the Rathod et al. system.
Motivation to do so would have been to allow for detecting anomalies in encrypted traffic (see Ptasinski et al. column 10 lines 20-23).
As per claims 2 and 25, the modified Rathod et al. and Ptasinski et al. system discloses the probability of observing a more extreme value is the probability of observing a greater value than the given value, m, when the given value is greater than a suitable quantile point of the values, m1,...,mN; and/or wherein the probability of observing a more extreme value is the probability of observing a smaller value than the given value, m, when the given value is less than a suitable quantile point of the values, m1,...,MN, where the suitable quantile point is a median (see Rathod et al. paragraphs [0060]-[0063] determining whether the data point is beyond a standard deviation threshold).
Claims 3-5 and 16-18 are rejected under 35 U.S.C. 103 as being unpatentable over the modified Rathod et al. and Ptasinski et al. system as applied to claim 1 above, and further in view of Eberhardt, III et al. (US 20130198119)(herein after Eberhardt).
As per claim 3, the modified Rathod et al. and Ptasinski et al. system discloses determining, in accordance with the probability of observing a more extreme value, and a probabilistic model of the device, a probability of the given value, m, being the result of anomalous behavior of the device, wherein the probability is used to determine whether the device is behaving anomalously (see Rathod et al. paragraphs [0049]-[0063]), but fails to explicitly disclose this probability is a posterior probability.
However, Eberhardt teaches observing extreme values compared to a probabilistic model to determine a posterior probability (see paragraphs [0029]-[0030]).
At a time before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to determine a posterior probability in the modified Rathod et al. and Ptasinski et al. system.
Motivation to do so would have been to use multiple features to arrive at a probability that an event is anomalous (see Eberhardt paragraph [0029]).
At per claim 4, the modified Rathod et al., Ptasinski et al., and Eberhardt system discloses determining posterior probabilities for a plurality of given values, m,, of a plurality of metrics, M,, wherein the metrics, M,, are representative of the data associated with the device; and in accordance with the posterior probabilities for the given values, m,, determining an overall posterior probability of the device being in an anomalous state, wherein the overall posterior probability is used to determine whether the device is behaving anomalously (see Eberhardt paragraph [0029] the Similarity Score).
As per claim 5, the modified Rathod et al., Ptasinski et al., and Eberhardt system discloses the probabilistic model is a Bayesian model (see Eberhardt paragraphs [0028]-[0030] the use of BBNs which are Bayesian Belief Networks).
As per claims 16-18, the modified Rathod et al., Ptasinski et al., and Eberhardt system discloses the detection of anomalous behavior is performed using a subset of the metrics, wherein the subset is chosen by removing values for which exceeds a threshold probability (see Rathod et al. paragraphs [0058]-[0059] and Eberhardt paragraphs [0092] and [0105]).
Claims 6-8 are rejected under 35 U.S.C. 103 as being unpatentable over the modified Rathod et al., Ptasinski et al., and Eberhardt system as applied to claim 4 above, and further in view of Veeramachaneni et al. (US 20170169360).
As per claims 6-8, the modified Rathod et al., Ptasinski et al., and Eberhardt system discloses the metrics are statistically dependent (see Eberhardt paragraph [0029]), but fails to explicitly disclose the dependencies are modeled using copulas where variables are transformed using a cumulative distribution function of the standard normal distribution and the probability of observing a greater/smaller values than the given values.
However, Veeramachaneni et al. teaches modeling dependencies using copulas where variables are transformed using a cumulative distribution function of the standard normal distribution and the probability of observing a greater/smaller values than the given values (see paragraphs [0068]-[0072]).
At a time before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to include the teachings of Veeramachaneni et al. in the modified Rathod et al., Ptasinski et al., and Eberhardt system.
Motivation to do so would have been to detect rare events (see Veeramachaneni et al. paragraph [0067]).
Claims 9-11 are rejected under 35 U.S.C. 103 as being unpatentable over the modified Rathod et al., Ptasinski et al., and Eberhardt system as applied to claim 5 above, and further in view of Barbat et al. (US 20120209575).
As per claims 9-11, the modified Rathod et al., Ptasinski et al., and Eberhardt system discloses the use of Bayesian models to determine anomalousness relative to a references (see Rathod et al. paragraphs [0049]-[0063] and Eberhardt paragraphs [0028]-[0030]), but fails to explicitly disclose the use of a logarithm of a Bayes factor.
However, Barbat et al. teaches the use of a logarithm of a Bayes factor which will attenuate measures of anomalousness (see paragraphs [0058]-[0059] and [0068]).
At a time before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to use of a logarithm of a Bayes factor in the modified Rathod et al., Ptasinski et al., and Eberhardt system.
Motivation to do so would have been to use previous probabilities in the determination (see Barbat et al. paragraph [0068]).
Claims 12-14 are rejected under 35 U.S.C. 103 as being unpatentable over the modified Rathod et al. and Ptasinski et al. system as applied to claim 1 above, and further in view of Marvasti et al. (US 20150379110).
As per claims 12-14, the modified Rathod et al. and Ptasinski et al. system teaches the use of multiple metrics, but fails to explicitly disclose the distribution of the values of the metric is modeled using extreme value theory; the distribution of the values of the metric is modeled as a generalized Pareto, Gumbel or Frechet distribution; the probability of observing a more extreme value is modeled using a peaks over thresholds method.
However, Marvasti et al. teaches the distribution of the values of the metric is modeled using extreme value theory (see paragraph [0050]); the distribution of the values of the metric is modeled as a generalized Pareto, Gumbel or Frechet distribution (see paragraph [0068]); the probability of observing a more extreme value is modeled using a peaks over thresholds method (see paragraph [0050] POT).
At a time before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art substitute the teachings of Marvasti et al. in place of those in the modified Rathod et al. and Ptasinski et al. system to obtain the predictable result of detecting anomalous behavior using known techniques.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-27 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 10,701,093. Although the claims at issue are not identical, they are not patentably distinct from each other because the ‘093 claims contain each and every limitation of the currently pending claims and therefore anticipate the claims of the present application. More specifically, claims 1-19 of the ‘093 patent contain each limitation of claims 1-25 and claim 20 of the ‘093 patent anticipates claims 26 and 27 of the present application. Where the differences are obvious over Ptasinski et al. as applied above and it would be obvious to modified the claims to include these teachings in order to detect anomalies in encrypted traffic.
Response to Arguments
Applicant’s arguments with respect to claims 1-27 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: the remaining references put forth on the PTO-892 form are directed towards anomaly detection.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL J PYZOCHA whose telephone number is (571)272-3875. The examiner can normally be reached Monday-Thursday 7:30am-5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hadi Armouche can be reached at (571) 270-3618. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Michael Pyzocha/ Primary Examiner, Art Unit 2409
Prosecution Insights