Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of the Application
2. Claim 1-20 have been examined in this application. This communication is the first action on the merits.
Drawings
3. The drawings filed on 11/5/24 are acceptable for examination proceedings.
Allowable Subject Matter
Claim 6, and 16 recites the similar subject matter and are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim Rejections - 35 USC § 103
4. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
5. Claim 1-4, 7-14, and 17-20 are rejected under 35 U.S.C. 103 as being unpatentable over Coulter (Pub: 2025/0053587) in view of Wittenstein (Pub: 2011/0214187), and further in view of Puri (Pub: 2016/0371489).
6. Regarding claim 1, Coulter teaches A system, comprising: a processor; and a memory communicatively coupled to the processor, wherein the memory comprises one or more instructions which when executed by the processor (e.g., The processing engine 100 can include a processor 102 and a memory 104, each operatively coupled to one another (e.g., via a system bus)) (Para. [0043], Fig.1), cause the processor to: receive event data associated with a plurality of events from at least one data source of a plurality of data sources (e.g., In some embodiments, the processing engine 100 can receive the set of events from the source(s) 145. For example, the processing engine 100 can automatically pull and/or receive events from the source(s) 145. In some embodiments, the source(s) 145 can send new events and/or sets of events to the processing engine 100) (Para. [0046]);
identify duplicate events from the plurality of events within a specific time period from the at least one data source (e.g., In some implementations, the standardizer 106 generates unique hashes for the events and data-frames. In some implementations, the standardizer 106 can store the unique hashes in a ledger (e.g., such as in the database 140) and any duplicates can be noted and/or removed. The standardized data can be used to define a mapping. In some implementations, the mapping can be identified through associated rule mining techniques. In some implementations, the mapping can be used to form the basis of a Graph Neural Network (GNN).) (Para. [0053], also refer to Para. [0057], [0070] for similarity determination which is same as duplicate);
filter out the duplicate events from the plurality of events based on an analysis of the event data (e.g., In some implementations, the standardizer 106 can pre-process data including cleaning, de-duplicating, filtering based on time, filtering based on origin, and/or the like) (Para. [0053]);
identify a set of anomalous events from the plurality of events after filtering out the duplicate events (e.g., The identifier 116 is configured to receive processed data from the machine learning model 108 and review the processed data to determine if an event is anomalous) (Para. [0066]);
Coulter does not specifically teach adjust at least one throttling parameter in real-time based on the identification of the set of anomalous events and a current load on the system
Wittenstein teaches adjust at least one throttling parameter in real-time based on the identification of the set of anomalous events (e.g., Event duration comparator 28010 uses differencer 28020 to compare observed event duration 20040 to predicted event duration 20140, outputting the difference as duration shortfall 28030. Next, adder 28040 adds duration threshold 20110 to the duration shortfall, outputting adjusted duration shortfall 28050. Duration thresher 28060 then tests whether the adjusted duration shortfall is greater than zero, indicating that the event is not anomalous, in which case it outputs a zero 28070 as the duration-anomaly score 20190. For computational efficiency, the thresher may also optionally input frequency-anomaly score 20160; if the frequency-anomaly score is less than frequency threshold 20170, then the event is likewise determined not to be anomalous, and the thresher likewise outputs a duration-anomaly score of zero. In the preferred embodiment, the duration threshold is omitted or set to zero, in order to postpone threat decisions until the anomaly of the entire session can be compared to the anomaly of all other sessions. Alternatively, if the number of detected attacks is expected to be substantially greater than threat processors 1080 (See FIG. 1) can handle, then the duration threshold can be adjusted upwards to throttle the least threatening events. If, on the other hand, the event duration comparator determines that the event is anomalous, then it passes the adjusted duration shortfall through as threshed duration shortfall 28080) (Para. [0288]) and a current load on the system (e.g., and thereby the server models 5030, explicitly take website congestion into account, as thresholded affine functions of the server load.) (Para. [0120])
Because Weinstein is also directed to determines an event to be anomalously, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, having teachings of Coulter and Wittenstein before him/her, to modify the teachings of Coulter to include the teaching of Wittenstein in order to implements the remedial actions through the appropriate components in service traffic processor (Wittenstein: Para. [0305])).
The combination of Coulter, and Wittenstein does not specifically teach and prioritize processing of critical events from the set of anomalous events based on the adjusted at least one throttling parameter.
Puri teaches and prioritize processing of critical events from the set of anomalous events based on the adjusted at least one throttling parameter (e.g., At block 908, the method 900 may include ranking (e.g., by the event ranker 106) each of the known events. The ranking of each of the known events may be based on a probability of anomalousness assigned to each of the known events, and the probability of anomalousness assigned to a known event of the known events may be determined relative to each of the other known events.) (Para. [0120]).
Because Puri is also directed to an event anomaly analysis and prediction method, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, having teachings of Coulter, Wittenstein and Puri before him/her, to modify the combined teachings of Coulter, and Wittenstein to include the teaching of Puri in order to provide techniques for learning, detection, and enforcement suggestions of anomalous activities, with respect to operations of the rules generator 112, the data anomaly analyzer 116, and the device controller 120 (Puri: Para. [0053]).
7. Regarding claim 2, the combination of Coulter, Wittenstein, and Puri teaches system of claim 1, wherein Coulter teaches the processor is further configured to apply clustering to the duplicate events from the at least one data source during one of point state fluctuations or transient state fluctuations (e.g., The machine learning model 108 can include fingerprinting comparative algorithms and clustering techniques such as, for example, ball tree, closest pair of points problem, cluster analysis, content-based image retrieval, curse of dimensionality, digital signal processing, dimension reduction, fixed-radius near neighbors, Fourier analysis, instance-based learning, k-nearest neighbor algorithm, Linear least squares, LSH, MinHash, multidimensional analysis, nearest-neighbor interpolation, neighbor joining, principal component analysis, range search, similarity learning, singular value decomposition, sparse distributed memory, statistical distance, time series, Voronoi diagram, Wavelet, Lempel-Ziv Jaccard distance, bloom filter, SimHash, w-shingling, count-min sketch, concept mining, N-gram, k-mer, rolling hash, rabin fingerprint, vector space model, bag-of-words model, deep pairwise-supervised hashing, Facebook AI similarity search (Faiss), Winnowing and RareChunk, symmetrical covariance matrix, and/or the like) (Para. [0060]).
8. Regarding claim 3, the combination of Coulter, Wittenstein, and Puri teaches system of claim 1, wherein Coulter teaches the processor is further configured to identify event flooding when a number of the plurality of events exceeds a threshold value (e.g., In some implementations, if an ontology similarity is too low, a new ontology label can be created for an event and/or cluster, at 1111. In some implementations, the new ontology label can be created if the catch-all ontology cohort includes a number of events that are greater than a threshold. ) (Para. [0157]).
9. Regarding claim 4, the combination of Coulter, Wittenstein, and Puri teaches system of claim 1, wherein Wittenstein further teaches the at least one throttling parameter includes at least one of a throttling threshold, an event processing rate, and a resource allocation limit (e.g., Alternatively, if the number of detected attacks is expected to be substantially greater than threat processors 1080 (See FIG. 1) can handle, then the duration threshold can be adjusted upwards to throttle the least threatening events. The anomalous event duration detector is used as an efficiency optimization in embodiments where it reduces the computation time or other resource demands.) (Para. [0253]).
10. Regarding claim 7, the combination of Coulter, Wittenstein, and Puri teaches system of claim 1, wherein Wittenstein further teaches the processor is further configured to generate an alert notification (e.g., The above comparisons are combined to generate a score that indicates the likelihood that the current session is a man-in-the-browser attack. The score is used to determine whether or not an alert should be generated to notify the appropriate parties, including the website administrator, the website alert processing system, and other associated website parties ) (Para. [0056]) based on the identification of the event flooding (e.g., For certain types of attacks, however, such as denial-of-service attacks on websites by flooding the websites with requests, denial-of-service attacks on clients by flooding the clients with responses, or attacks defaming or blacklisting clients by attributing unsavory or hostile actions to them, the attackers have no need to receive the website's responses) (Para. [0145]).
11. Regarding claim 8, the combination of Coulter, Wittenstein, and Puri teaches system of claim 1, wherein Coulter further teaches the processor is further configured to generate, on a user interface of at least one display device, a real-time analytics dashboard that displays at least one of key metrics, the current load on the system, an event processing rate, and throttling status of the plurality of events (e.g., In some implementations, the management portal 230 can be used to display a dashboard to the user U1. The dashboard can include information received from the processing engine 200 and/or other components of the processing environment 20. The dashboard can include information such as a system management page, insights into the data, cohorts, data mappings, data relationships, a searching feature, and/or a connection tool. In some embodiments, the processing environment 20 includes an API that can establish connections, enrich data, and/or process data and result searches. The API can be used to lookup each data-frame submitted to the computing platform 250. Resulting entries can be returned as event enrichment. Using an API can be useful if a publicly available event submission website is used or if implemented as a plugin to a vendor.) (Para. [0087]).
12. Regarding claim 9, the combination of Coulter, Wittenstein, and Puri teaches system of claim 1, wherein Coulter further teaches the plurality of events is associated with at least one of unauthorized access, false alarm, environmental interference, network breach, tampering, system failure, and sensor malfunction (e.g., Some techniques described herein allow for a system to reduce the volume of logged data by identifying anomalous events out of a larger set of events. Identifying anomalous events further increases productivity and throughput since a user would review events identified as anomalous instead of a larger set of events. Some techniques described herein increase the fidelity of threat detection by using various methods to identify anomalous events in a variety of methods.) (threat is interpreted as unauthorized access, environmental interference, network breach, tampering etc) (Para. [0026]).
13. Regarding claim 10, the combination of Coulter, Wittenstein, and Puri teaches system of claim 1, wherein Coulter further teaches the set of anomalous events are identified based on one or more anomaly detection algorithms (e.g.,. The machine learning model 108 can include fingerprinting comparative algorithms and clustering techniques such as, for example, ball tree, closest pair of points problem, cluster analysis, content-based image retrieval, curse of dimensionality, digital signal processing, dimension reduction, fixed-radius near neighbors, Fourier analysis, instance-based learning, k-nearest neighbor algorithm, Linear least squares, LSH, MinHash, multidimensional analysis, nearest-neighbor interpolation, neighbor joining, principal component analysis, range search, similarity learning, singular value decomposition, sparse distributed memory, statistical distance, time series, Voronoi diagram, Wavelet, Lempel-Ziv Jaccard distance, bloom filter, SimHash, w-shingling, count-min sketch, concept mining, N-gram, k-mer, rolling hash, rabin fingerprint, vector space model, bag-of-words model, deep pairwise-supervised hashing, Facebook AI similarity search (Faiss), Winnowing and RareChunk, symmetrical covariance matrix, and/or the like) (Para. [0060]).
14. Regarding claim 11, Claim 11 recites a method that implement the system of claim 1, with substantially the same limitations, respectively. Therefore the rejection applied to claim 1, also applies to claim 11 respectively.
15. Regarding claim 12-14, as to claim 12-14, applicant is directed to the citation of claim 2-4, respectively above.
16. Regarding claim 17-18, as to claim 17-18, applicant is directed to the citation of claim 7-8, respectively above.
17. Regarding claim 19, as to claim 19, applicant is directed to the citation of claim 10, respectively above.
18. Regarding claim 20, Claim 20 recites a non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one processor of a system that implement the system of claim 1, with substantially the same limitations, respectively. Therefore the rejection applied to claim 1, also applies to claim 20 respectively.
Wherein Coulter further teaches A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one processor of a system, cause the at least one processor to perform operations (e.g., The processing engine 100 can include a processor 102 and a memory 104, each operatively coupled to one another (e.g., via a system bus)) (Para. [0043], Fig.1).
19. Claim 5, and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Coulter in view of Wittenstein, further in view of Puri, and further in view of Beiser (Pub: 2019/0221090).
20. Regarding claim 5, the combination of Coulter, Wittenstein, Puri teaches the system of claim 1 but does not specifically teach wherein the adjustment of the at least one throttling parameter comprises one of scale up or scale down an event processing rate of the set of anomalous events.
Beiser teaches wherein the adjustment of the at least one throttling parameter comprises one of scale up or scale down an event processing rate of the set of anomalous events (e.g., Self-learning video analytics engine 202 may scale up or down the video frames to a predefined processing resolution or frame rate, and send the raw video frames to abnormality detection application 201).
Because Beiser is also directed to an abnormality detection application, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, having teachings of Coulter, Wittenstein, Puri and Beiser before him/her, to modify the combined teachings of Coulter, Wittenstein, and Puri to include the teaching of Beiser in order to scale abnormality scores to align or normalize all abnormality scores (Beiser: Para. [0064]).
21. Regarding claim 15, as to claim 15, applicant is directed to the citation of claim 5, respectively above.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JIGNESHKUMAR C PATEL whose telephone number is (571)270-0698. The examiner can normally be reached Monday - Friday, 7:00 AM - 5:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kenneth M. Lo can be reached at (571)272-9774. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JIGNESHKUMAR C PATEL/Primary Examiner, Art Unit 2116
Prosecution Insights