Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
Remarks
This Final action is in response to communications filed on 06/30/2026 claim(s) 1, 6, 9 and 10 is/are amended per Applicant's request. Therefore, claims 1-10 are presently pending in the application and have been considered as follows.
The amendment has overcome the previous 35 USC 112(b) rejection directed to claim(s) 1-3 and 6.
Response to Arguments
Applicant’s arguments, see page 8 of Applicant’s response, filed 02/05/2018, with respect to the rejection(s) of claim(s) 6-7 under 102 have been fully considered and are persuasive. Applicant’s amendments to the claims have overcome the rejection on record. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made over US 9654485 to Neumann in view of US 20180337939 to Agarwal
For the purpose of compact prosecution the Examiner will address the arguments with regards to the 35 USC 101.
-The applicants’ remarks on page 6 with respect to:
“Without admitting the Office Action's arguments as being correct, Applicant has amended claim 1 to recite "present, to a user, an attack database in which a type of a constituent element in which a threat is expected to occur is set for each threat, and cause the user to select a threat that may occur in a constituent element of a system; and calculate a likelihood of occurrence of the threat selected by the user, based on a similarity between an attack scenario indicating a chronological sequence of a plurality of attack methods up to occurrence of the threat and a past scenario.".”
“The inclusion of these features further links the claims to a practical application of the alleged abstract idea. The specification as filed at paragraph [0009] describes the advantages of these features as reducing the technical difficulty in determining a likelihood of occurrence of a threat. The inclusion of operations of presenting to the user an attack database and performing the calculation based on a user selection link the claim to these advantages. A person operating alone with only the human mind would need a high degree of technical skill to determine the likelihood of occurrence of a threat, the device by presenting to the user the database and doing calculations based on the user's selection is able to reduce the requirements of technical skill by the user. The operation of presenting, to a user, an attack database cannot be performed by the human mind. Thus, the claim is directed to a practical application of the alleged abstract idea. Claim 10 is similarly amended and similarly is directed to a practical application of the alleged abstract idea. Claims 1, 9, and 10 and their dependent claims are, consequently, directed to patent eligible subject matter under step 2A prong two of the Alice/Mayo test. Reconsideration and withdrawal of this rejection are respectfully requested.”
Have been carefully considered but are non-persuasive;
The examiner respectfully disagrees and notes that the applicant argues that the amended limitation concerning presentation of the attack database integrates the claim analysis into a practical application because it reduces the technical skill required of the user. The amendment has been considered as an additional element under Step 2A, prong 2. However, when the claim is considered as a whole, presenting stored threat information and receiving a user selection of a threat merely identifies the threat upon which the recited similarity and likelihood analysis is performed. The additional elements do not apply the resulting likelihood to improve operation of the security analysis device, the analyzed system, or another technology. Accordingly, although the amendment adds additional elements to the claim, those elements do not integrate the recited judicial exception into practical application and applicant arguments do not overcome the rejection under 35 U.S.C 101 and are considered unpersuasive.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-10 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e. an abstract idea) without significantly more.
Step 1: This part of the eligibility analysis evaluates whether the claim falls within any statutory category. See MPEP 2106.03. The claims recite a method and system. These are directed to a machine, a series of steps or acts and manufacture, and fall within one of the statutory categories of invention. (Step 1: YES).
Step 2A, Prong One: This part of the eligibility analysis evaluates whether the claim integrates the recited judicial exception into a practical application of the exception or whether the claim is “directed to” the judicial exception. This evaluation is performed by (1) identifying whether there are any additional elements recited in the claim beyond the judicial exception, and (2) evaluating those additional elements individually and in combination to determine whether the claim integrates the exception into a practical application. See MPEP 2106.04(d).
Claim 1, 9 and 10 are directed to an abstract idea because the following claim limitations recite an abstract idea:
A device, method and manufacture comprising:
calculate a likelihood of occurrence of the threat selected by the user, based on a similarity between an attack scenario indicating a chronological sequence of a plurality attack methods up to occurrence of the threat and a past scenario indicating a chronological sequence of a plurality of attack methods in an attack case that has occurred previously (mathematical concept/mental process: a human-being comparing sequence of historical and hypothetical events to mathematically/logically determine the probability of a future event);
Claims 1, 9 and 10 recite the following additional elements:
Wherein the device is a “security analysis device comprising processing circuitry”;
Wherein the threat occurs to a “constituent element of a system”
Wherein the method is for “security analysis”
Where the manufacture is a “non-transitory computer readable medium storing a security analysis program that causes a computer to function as a security analysis device”
An attack database in which a type of a constituent element in which a threat is expected to occur is set for each threat
present, to a user and cause the user to select a threat that may occur in a constituent element of a system
Step 2A, Prong Two: This part of the eligibility analysis evaluates whether the claim integrates the recited judicial exception into a practical application of the exception or whether the claim is “directed to” the judicial exception. This evaluation is performed by (1) identifying whether there are any additional elements recited in the claim beyond the judicial exception, and (2) evaluating those additional elements individually and in combination to determine whether the claim as a whole integrates the exception into a practical application.
The claims fail to achieve a technical solution to a technical problem. Thus, the claim fails to provide an improvement to the function of a computer or to a technology itself. The claim culminates with calculating a likelihood of occurrence of a threat. See MPEP 2106.04(d)(1) and 2106.05(a). The additional elements are recited at a high level of generality and amount to merely using computers as a tool to implement the abstract idea. Thus, the additional elements are considered mere instruction to apply the abstract idea. See MPEP 2106.05(f). Even when viewed in combination, these additional elements do not integrate the recited judicial exception into a practical application (Step 2A, Prong Two: NO), and the claim is directed to the judicial exception. (Step 2A: YES).Therefore, the examiner must find that the claims fail to integrate the abstract idea into a practical application.
Step 2B:
This part of the eligibility analysis evaluates whether the claim as a whole amounts to significantly more than the recited exception i.e., whether any additional element, or combination of additional elements, adds an inventive concept to the claim. See MPEP 2106.05.
One way to determine integration into a practical application is when the claimed invention improves the functioning of a computer or improves another technology or technical field. To evaluate an improvement to a computer or technical field, the specification must set forth an improvement in technology and the claim itself must reflect the disclosed improvement. See MPEP 2106.04(d)(1) and 2106.05(a).
Likewise, to step 2A prong 2, the claims fail to achieve a technical solution to a technical problem. Thus, the claim fails to provide an improvement to the function of a computer or to a technology itself. The claim culminates with calculating a likelihood of occurrence of a threat. See MPEP 2106.04(d)(1) and 2106.05(a). The additional elements are recited at a high level of generality and amount to merely using computers as a tool to implement the abstract idea. Thus, the additional elements are considered mere instruction to apply the abstract idea. See MPEP 2106.05(f). Even when viewed in combination, these additional elements do not integrate the recited judicial exception into a practical application (Step 2A, Prong Two: NO), and the claim is directed to the judicial exception. (Step 2A: YES). Therefore, the examiner must find that the claims fail to amount to significantly more than the abstract idea itself, even when the additional elements are considered alone and in combination with the abstract idea. (Step 2B: NO).
Therefore, the claims are directed to an abstract idea without significantly more and are unpatentable.
Claims 2-8
Regarding claims 2-8 the following claim limitations recite an abstract idea
(Claim 2) Arranging the attack scenario and past scenario chronologically as character strings and calculating a similarity between the character strings. (mathematical concept/mental process: the human-being ordering data points in a sequence of symbols and mathematically comparing the sequences .)
(Claim 3) Using a Levenshtein distance to calculate a similarity between the character string of the attack scenario and the character string of the past scenario. (mathematical concept: the human-being using a mathematical formula to compare the similarity between symbols .)
(Claim 4) Generating an amplified scenario by changing a chronological sequence of a plurality of attack methods constituting the past scenario or deleting one or more attack methods of the plurality of attack methods constituting the past scenario and calculating the likelihood of occurrence taking into consideration a similarity between the attack scenario and the amplified scenario. (mental process/mathematical concept: the human-being generating hypothetical scenario by rearranging or deleting events and mathematically comparing similarity between the scenarios.)
(Claim 5) calculates a similarity between an evaluation target portion that is part of the attack scenario and an evaluation target portion that is part of the past scenario as a similarity between the attack scenario and the past scenario. (mental process/mathematical concept: the human-being selecting subsets of data and mathematically comparing the subsets.)
(Claim 6) combining a likelihood of occurrence calculated by a first method and the likelihood of occurrence calculated by the processing circuitry so as to calculate a new likelihood of occurrence the first method being different from a second method used to calculate the likelihood of occurrence calculated by the processing circuitry. (mathematical concept: the human-being using standard mathematical formula to calculate a probability utilizing calculated probabilities.)
(Claim 7) re-calculating a likelihood of occurrence of the threat based on a similarity between the attack scenario and a log scenario indicating a chronological sequence of an attack method carried out against the system. (mental process/mathematical concept: the human-being updating the probability based on new data.)
(Claim 8) calculates a risk value in the constituent element based on the likelihood of occurrence calculated by the processing circuitry and worth of an information asset existing in the constituent element. (mental process/mathematical concept: the human-being evaluating or mathematically calculating impact risk based on value.)
Claims 2-8 recites the additional elements:
Wherein the device is a “security analysis device comprising processing circuitry”;
Wherein the threat occurs to a “constituent element of a system”
Step 2A, Prong 2 and Step 2B
Claims 2-8 fail to recite any new additional elements relative to base claims 1, 7 and 14. Thus, the analysis and findings for step 2A, prong 2 and step 2B incorporate the analysis and findings of claims 1, 7 and 14 however, the analysis and findings include consideration of claims 2, 8 and 15 as a whole. Therefore, claims 2-8 are directed to an abstract idea without significantly more and is unpatentable.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability should not be negated by the manner in which the invention was made.
Claims 1, 5-7, 9 and 10 are rejected under 35 U.S.C. 103 as being unpatentable over US 9654485 to Neumann in view of US 20180337939 to Agarwal
Claim 1
Neumann teaches security analysis device[e.g. Neumann; Col 8 Ln 49-50] comprising processing circuitry [e.g. Neumann; Col 13 Ln 34-50]
While Neumann teaches the security analysis device of claim 1, and teaches a user interface module that facilitates receipt of input data from a user for configuring operations of the security monitor framework [Col 14 Ln 10-21], And at the profiles used by the security monitoring framework may initially be configured from human knowledge particular attacks [Col 19 Ln 50-56], Neumann does not explicitly teach configuring the system to present, to a user, an attack database in which a type of a constituent element in which a threat is expected to occur is set for each threat, and cause the user to select a threat that may occur in a constituent element of a system.
However, Agarwal teaches this feature:
configuring the system to present, to a user, an attack database in which a type of a constituent element in which a threat is expected to occur is set for each tthreat andcause the user to select a threat that may occur in a constituent element of a system.[e.g. Agarwal; Para. 0052-0056, 0063-0066, 0086, 0103, 0132- A database storing threats and threat model components and associating each threat with one or more components through the database (e.g. attack database associating threats with constituent elements), wherein each component includes a stored component “type” (e.g. type of a constituent element). Agarwal further teaches presenting through the user interface threats associated with a selected component, allowing the user to add or remove threats associated with that component (e.g. user selection of a threat that may occur in the constituent element) and treating those associated threats as “relevant threats” when the component is included in the modeled system. Lastly, Agarwal teaches presenting the relevant threats in a threat report, permitting an individual threat to be selected by clicking its row and determining a likelihood of the threat being realized for each threat.]
Therefore, it would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to include, the above limitations in the invention as disclosed by Neumann because Neumann recognizes that security analysts and profile development may be challenging in laborers and require highly trained personnel while Agarwal teaches Its model and system allows users to quickly and efficiently assess relevant threats and to permit non security experts to participate in the threat modeling process and benefit from the outputs of the system, see paragraph 0146 of Agarwal.
Thus, in the resulting combination Agarwal’s database interfaces are used during configuration to associate threats with typed constituent elements, present threats relevant to the modeled system and permit the user to select a threat associated with a constituent element while Neumann’s attack profile analysis is used to calculate the likelihood of occurrence of that selected threat.
Neumann further teaches
calculate a likelihood of occurrence of the threat selected by the user, [e.g. Neumann; Col 12 Ln 30-51, Col 16 Ln 12-31] based on a similarity between an attack scenario indicating a chronological sequence of a plurality attack methods up to occurrence of the threat and a past scenario indicating a chronological sequence of a plurality of attack methods in an attack case that has occurred previously. [e.g. Neumann; Col 2 Ln 8 – Col 4 Ln 61, Col 12 Ln 30-51, Col 14 Ln 40-59, Col 15 Ln – Col 20 Ln 11, Col 24 Ln 31- Col 26 Ln 11, Col 27 Ln 12-19; Neumann discloses s Attack identification module 226 correlating behavioral fragments against known attack profiles, a multi-phase attack includes temporally related attack behaviors (e.g. chronological sequence of a plurality of attack methods), attack profiles are based on known and previously identified attacks (e.g. past scenarios), the tax score may reflect correlation with attack profiles of past attacks and represents a likelihood of attack, attack variations are identified from similarity and behavioral characteristics or behavioral fragments to an existing correlation profile or attack profile (e.g. calculating a likelihood based on similarity between an attack scenario and a past scenario)]
Claim 5
Neumann and Agarwal teach the security analysis device according to claim 1, wherein the processing circuitry calculates a similarity between an evaluation target portion that is part of the attack scenario and an evaluation target portion that is part of the past scenario as a similarity between the attack scenario and the past scenario. [e.g. Neumann; Col 2 Ln 8 – Col 4 Ln 61, Col 12 Ln 30-51, Col 14 Ln 40-59, Col 15 Ln – Col 20 Ln 11, Col 24 Ln 31- Col 26 Ln 11, Col 27 Ln 12-19; Neumann discloses sequence of behavioral data elements representing behaviors stored in a profile. The profile being through experiential knowledge of previously encountered benign events and/or previous detected attacks. Neumann further discloses that a profile may consist of a multi-phase attack and discloses the attack may include an initial receipt, callback operation and receipt of a larger package from a server that the examiner has interpreted broadly and reasonably as a chronological sequence up to occurrence of a threat. The correlated behavioral fragments map to an attack scenario and the known attack profiles map to a past scenario. Lastly Neuman determines an attack score which may represent an actual attack or potential attack (e.g. likelihood of occurrent of a threat to a constituent of a system) based on how similar the correlated behavioral fragments are to the known attack profiles.]
Claim 6
Neumann teaches security analysis device according to claim 1, wherein the processing circuitry combines a likelihood of occurrence calculated by a first method and the likelihood of occurrence calculated by the processing circuitry so as to calculate a new likelihood of occurrence, the first method being different from a second method used to calculate the likelihood of occurrence calculated by the processing circuitry. [e.g. Neumann; Col 2 Ln 8 – Col 4 Ln 61, Col 12 Ln 30-51, Col 14 Ln 40-59, Col 15 Ln – Col 20 Ln 11, Col 24 Ln 31- Col 26 Ln 11, Col 27 Ln 12-19; Neumann discloses combining likelihood scores of different methods (e.g. port behavior, beacon detection, etc.) to determine an update likelihood score.]
Claim 7
Neumann and Agarwal teach the security analysis device according to claim 1, wherein the processing circuitry re-calculates a likelihood of the occurrence of the threat based on a similarity between the attack scenario and a log scenario indicating a chronological sequence of an attack method carried out against the system. [e.g. Neumann; Col 2 Ln 8 – Col 4 Ln 61, Col 5 Ln 46 – Col 6 Ln 9, Col 12 Ln 30-51, Col 14 Ln 40-59, Col 15 Ln – Col 20 Ln 11, Col 24 Ln 31- Col 26 Ln 11, Col 27 Ln 12-19; Neumann discloses recursively scanning cache and adjusting the attack score.]
Regarding claims 9 and 10 they are method and manufacture claims essentially corresponding to the above recitations, and they are rejected, at least, for the same reasons.
Claims 2 and 3 are rejected under 35 U.S.C. 103 as being unpatentable over US 9654485 to Neumann in view of US 20180337939 to Agarwal and further in view of US 20180046800 AOKI et al. (hereinafter “Aoki”)
Claim 2
While Neumann and Agarwal teaches the security analysis device according to claim 1 and teaches calculating similarity between chronological events the combination fails to explicitly teach however, Aoki teaches: wherein the attack scenario is a character string in which characters respectively identifying a plurality of attack methods are arranged according to a chronological sequence up to occurrence of the threat, wherein the past scenario is a character string in which the characters are arranged according to a chronological sequence in the attack case, and wherein the processing circuitry calculates a similarity between the character string of the attack scenario and the character string of the past scenario as a similarity between the attack scenario and the past scenario. [e.g. Aoki; Para. 0012, 0045, 0127; Aoki discloses assigning events uniquely identifiable character and calculating a Levenshtein distance between the character strings to determine a similarity.]
Therefore, it would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to include the above limitations in the invention as disclosed by Neumann and Agarwal with the benefit of improving the efficiency of detection as disclosed by Aoki Para. 0094
Claim 3
While Neumann and Agarwal teach the security analysis device according to claim 2 and teaches calculating similarity between chronological events the combination fails to explicitly teach, however, Aoki teaches: wherein the processing circuitry uses a Levenshtein distance to calculate a similarity between the character string of the attack scenario and the character string of the past scenario. [e.g. Aoki; Para. 0012, 0045, 0127; Aoki discloses assigning events uniquely identifiable character and calculating a Levenshtein distance between the character strings to determine a similarity.]
Therefore, it would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to include the above limitations in the invention as disclosed by Neumann and Agarwal with the benefit of improving the efficiency of detection as disclosed by Aoki Para. 0094.
Claims 4 is rejected under 35 U.S.C. 103 as being unpatentable over US 9654485 to Neumann in view of US 20180337939 to Agarwal and further in view of US 20220053012 to NISHIJIMA et al. (hereinafter “Nishjimia”)
Claim 4
While Neumann and Agarwal teaches the security analysis device according to claim 1 and teaches calculating similarity between chronological events the combination fails to explicitly teach however, Nishjimia teaches: wherein the processing circuitry generates an amplified scenario by changing a chronological sequence of a plurality of attack methods constituting the past scenario or deleting one or more attack methods of the plurality of attack methods constituting the past scenario, and wherein the processing circuitry calculates the likelihood of occurrence taking into consideration a similarity between the attack scenario and the amplified scenario. [e.g. Nishjimia; Claim 1, Para. 0009, 0097, 0148; Nishjimia discloses simulating attacks through an agent by transitioning states to generate new attack scenarios (e.g. amplified scenario).]
Therefore, it would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to include the above limitations in the invention as disclosed by Neumann and Agarwal with the benefit of countering constantly changing attacks as indicated by Nishjimia para 0003-0004.
Claims 8 is rejected under 35 U.S.C. 103 as being unpatentable over US 9654485 to Neumann in view of US 20180337939 to Agarwal and further in view of US 20060156407 to Cummins
Claim 8
While Neumann and Agarwal teach the security analysis device according to claim 1 and teaches calculating similarity between chronological events the combination fails to explicitly teach, however, Cummins teaches: wherein the processing circuitry calculates a risk value in the constituent element based on the likelihood of occurrence calculated by the processing circuitry and worth of an information asset existing in the constituent element. [e.g. Cummins; Para. 0017, 0018, 0047, 0048; Cummins discloses calculating risk based on cost or worth of an asset.]
Therefore, it would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to include the above limitations in the invention as disclosed by Neumann and Agarwal with the advantage of identifying vital systems for an organization and reducing potential damages caused by interruption as disclosed in para 0018 of Cummins.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHRISTOPHER C HARRIS whose telephone number is (571)270-7841. The examiner can normally be reached Monday through Friday between 8:00 AM to 4:00 PM CST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey L Nickerson can be reached on (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CHRISTOPHER C HARRIS/Primary Examiner, Art Unit 2432
Prosecution Insights