Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
In the remarks filed on 07/28/2026. The applicant amended claims 1,6, 9-13, 18 and 20 are amended. No claims were added.
With respect to claim objections:
Applicant’ claim amendments and remarks filed on 07/28/2026 have been fully considered and overcome some of the claim objections but not all of the claim objections as presented in the non-final office action filed 04/28/2026.
With respect to 112(b) rejections:
Applicant’ claim amendments and remarks filed on 07/28/2026 have been fully considered and have overcome 112(b) rejections as presented in the non-final office action filed 04/28/2026. Thus, 112(b) rejection have been withdrawn.
With respect to 101 rejections:
Applicant’ claim amendments and remarks filed on 07/28/2026 have been fully considered and overcome 101 rejection as presented in the non-final office action filed 04/28/2026. Thus, 101 rejection have been withdrawn.
With respect to double patenting:
Applicant’ claim amendments and remarks filed on 07/28/2026 have been fully considered and does not overcome double patenting as presented in the non-final office action filed 04/28/2026. Applicant states that a terminal Disclaimer over copending application no. 18/176,151 was concurrently filed. However, no Terminal Disclaimer is of record. Accordingly, the provisional nonstatutory double patenting rejection of claims 1,2,13, and 14 over claims 1, 9,10, and 19 of copending Application No. 18/176151 is maintained.
With respect to 35 U.S.C. § 103 rejections:
Applicant's arguments filed on 07/28/2026 have been received and entered.
Applicant's arguments with respect to the newly amended independent claims, see Applicant Arguments 13-15, with respect to the rejection (s) of independent claims 1, and 13 have been fully considered.
Applicant argues that Apostolopoulos (US 20180219888 A1) in view of Wolff (US 20200259852 A1) fails to teach the amended independent claims, particularly the recited unified node structure and the automated response actions based on threat severity. Applicant’s argument have been considered but are not persuasive.
Regarding the unified node, applicant argues that Wolff merely merges two entity objects and therefore does not have a separate unified node associated with source-specific entities. However, Wollf, [0025]-[0026] expressly describe resolving entities from different systems into common entity representation while retaining the underlying entities such that the underlying entities can point to the merged entity and either the raw or merged representation can be referenced. Wolff further teaches graph based representations of resolved entities Apostolopoulos teaches representing entities and their relationships using nodes and edges in a graph. Accordingly, the combined teachings reasonably suggest representing the retained source specific entities and the resolved common entity as related graph nodes. The rejection is based on the combined teachings of the references rather than requiring references individually to expressly recite the limitations.
Applicant’s argument on matching data field values is also non persuasive. Wolff teaches determining that differently identified entities correspond to the same underlying entity using identifying information, including user identifiers, email addresses, IP address information and other entity information and subsequently resolving those entities into common representation. Such entity resolution reasonably teaches or suggests determining that source specific entities represent the same entity by matching identifying data values.
Applicant further argues that the cited art fails to teach “automated response actions based on severity. However, Apostolopoulos teaches determining cybersecurity threats and assigning threat/risk scores indicative of the seriousness of the detected activity, including threat indicator scores ranging from less threatening to more threatening , see [0154], [0181]. Wolff further teaches taking responsive security action based on assessed risk, including flagging entities having high risk scores and taking appropriate action, generating alerts, and performing remedial or system actions, [0029][0043][0050]. Thus, Apostolopoulos teaches the determination of the threat severity while Wolff teaches responsive security actions based upon assessed risk. A POSITA would find it obvious to used determined severity to trigger an appropriate security response to address higher risk threats. Moreover, the claims recite “one or more automated response actions” including alternatives such as generating alert. The claim limitation does not require that every listed response action is performed. Accordingly, the disclosure of automatically generating alerts or other responsive actions based upon assessed security risk is sufficient to teach the claimed limitation. Therefore, when Apostolopoulos and Wolff are considered as a whole and their combined teaching, applicant arguments do not overcome the obviousness with respect to amended independent claims 1 and 13. Thus, 103 rejection for the claims 1 and 13 is maintained.
For claims 10, 12, and 20, Applicant’s argument is fully considered but are moot because the claim amendment introduces new claim limitations that have not previously been considered. Therefore, the new 103 ground of rejection relies on new references in combination as presented below.
Claim Objections
Regarding claims 1, and 13, Claims 1, and 13 are objected to because of the following informalities: In line 11 and 12 respectively “based on the analyzing the graph” should read “based on analyzing the graph”. The claims further recites that “the first node and the second node represent a same entity in the computing environment”. The phrase “a same entity” is grammatically improper should read “the same entity”. Furthermore, the claims recite “a severity associated with each of the one or more cybersecurity threats” thereby permitting a respective severity for each threat, but subsequently recite automated response actions based on “the severity associated with the one or more cybersecurity threats.”. Applicant is required to clarify the relationship between the severity or severities and the one or more cybersecurity threats. Appropriate correction is required.
Regarding claims 9-12 and 20, Claim 9-12 and 20 is objected to because of the following informalities: In line 1, “wherein the managing the graph” should read “wherein managing the graph”. Claim 10 and 11 “wherein the analyzing the graph” should read “wherein analyzing the graph” and claims 12 and 20 “wherein the managing the computing environment incudes” should read “wherein managing the computing environment incudes”. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION. —The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 2 and 14 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 2 and 14 recite the limitation “wherein the cybersecurity threat is any one of: a misconfiguration, a malware code, a weak password, an outdated certificate, an exposure, a vulnerability, and any combination thereof”. However, claims 1 and 13 respectively recite both “a different type of cybersecurity threat” for which each of the at least two disparate cybersecurity monitoring systems is configured to scan and “one or more cybersecurity threats” determined by analyzing the graph. It is therefore unclear which previously recited cybersecurity threat is referenced by “the cybersecurity threat” in claims 2 and 14. Consequently, the metes and bounds of claim 2 and 14 cannot be determined with reasonable certainty. Examiner suggest applicant to clarify the scope of the claims. Dependent claims are also rejected for inheriting the deficiencies set forth above for independent claims. Appropriate correction is required.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based terminal Disclaimer may be filled out completely online using web-screens. An terminal Disclaimer that meets all requirements is auto processed and approved immediately upon submission. For more information about terminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1, 2, 13, and 14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1, 9, 10 and 19 of Application No. 18176151. Although the claims at issue are not identical, they are not patentably distinct from each other because the claimed subject matter of the instant application would have been an obvious variation of the subject matter claimed in copending Application No. 18/176,151, as explained below.
This is a provisional nonstatutory double patenting rejection because the patentably indistinct claims have not in fact been patented.
18940065
18176151
1. A method comprising steps of: receiving a plurality of cybersecurity signals each determined based on monitoring a computing environment by a plurality of cybersecurity monitoring systems, including at least two disparate cybersecurity monitoring systems, wherein the at least two disparate cybersecurity monitoring systems are each configured to scan for a different type of cybersecurity threat in the computing environment;
managing a graph based on the plurality of cybersecurity signals where the graph includes nodes of entities in the computing environment and vertices representing relationships between the nodes, wherein the managing includes utilizing a unified node in the graph for two cybersecurity signals from the at least two disparate cybersecurity monitoring systems, wherein the unified node is connected by vertices to a first node representing an entity based on a first cybersecurity signal from a first one of the at least two disparate cybersecurity monitoring systems and to a second node representing the entity based on a second cybersecurity signal from a second one of the at least two disparate cybersecurity monitoring systems, the unified node being generated based on a determination, by matching one or more data field values, that the first node and the second node represent a same entity in the computing environment;
analyzing the graph stored in a graph database to determine one or more cybersecurity threats in the computing environment and a severity associated with each of the one or more cybersecurity threats; and
managing the computing environment based on the analyzing the graph by performing one or more automated response actions based on the severity associated with the one or more cybersecurity threats, the one or more automated response actions including any of isolating a resource of the computing environment, generating an alert, and initiating a scan of the computing environment by one of the plurality of cybersecurity monitoring systems
1. (Currently Amended) A method for unifying cybersecurity data for threat management, comprising receiving a first cybersecurity signal from a first monitoring system, the first monitoring system configured to monitor a computing environment for a cybersecurity threat; receiving a second cybersecurity signal from a second monitoring system, the second monitoring system is also configured to monitor the computing environment for the cybersecurity threat, wherein the second monitoring system is independent of the first monitoring system and each is configured to scan for different types of cybersecurity threats in the computing environment, and each monitoring system has a respective scanner that independently accesses and collects data from different resources deployed within the computing environment; generating a unified cybersecurity object based on the first cybersecurity signal and the second cybersecurity signal, wherein the first cybersecurity signal and the second cybersecurity signal include different data fields, and wherein the generating includes consolidating the different data fields into the unified cybersecurity object, the consolidating comprising mapping at least one data field from the first cybersecurity signal and at least one different data field from the second cybersecurity signal to a single data field in a predefined data structure, the mapping performed according to stored mapping rules, the generating further comprising correlating the mapped data fields to a common node within a graph-based representation of the computing environment, and establishing relational links (edges) between the unified cybersecurity object and nodes representing related entities or events so that the unified cybersecurity object encapsulates correlated data from heterogeneous monitoring sources; determining a severity level of the cybersecurity threat based on the unified cybersecurity object, the determining including evaluating, within the graph-based representation, the unified cybersecurity object and graph-connected nodes using rules from a rule engine and scan data received from independent monitoring systems, and assigning the severity level based on the correlated evidence; and storing the generated unified cybersecurity object on a graph database, the graph database including a representation of the computing environment. Although, the reference claim 1 does not expressly recite the subsequently added step of performing an automated response based on that determined severity, the addition does not render the instant claim patentability distinct. However, Wolff teaches performing security response actions responsive to determined security risk or threat conditions. Wolff, [0040] discloses a “take action component” configured to address identified security risks or incidents, including automatically modifying underlaying SaaS applications based on a probability that the action is justified. Wollf, [0041] further teaches that models may be used to implement actions such as account disablement and permission modifications by outputting commands or messages to system components. Wolff [0042] teaches detecting potential threats and alerting users and/or administrators to such threats. Wolff [0043] Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date to modify the method of claim 1 of copending Application No. 18/176,151 to perform an automated security response based on the determined severity of the cybersecurity threat as taught by Wolff. The POSITA would have been motivated to make such a modification because Wolff expressly teaches using assessed security risk and detected threat conditions to trigger alerts and corrective or preventative actions, thereby enabling the security system not merely to identify and prioritize security threats, but also to respond to the identified threats and reduce or prevent harmful activity.
Claim 2. The method of claim 1, wherein the cybersecurity threat is any one of: a misconfiguration, a malware code, a weak password, an outdated certificate, an exposure, a vulnerability, and any combination thereof.
Claim 9. The method of claim 1, wherein the cybersecurity threat is any one of: a misconfiguration, a malware code, a weak password, an outdated certificate, an exposure, a vulnerability, and any combination thereof.
Furthermore, Claims 10 and 19 of the reference 18176151 would have been an obvious variation of the subject matter of claims 13 and 14 respectively of instant application.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 6-11, 14-15, and 18-19 are rejected under 35 U.S.C. 103 as being unpatentable over Apostolopoulos (US 20180219888 A1) in view of Wolff (US 20200259852 A1).
Regarding claim 1, Apostolopoulos teaches a method comprising steps of:
receiving a plurality of cybersecurity signals each determined based on monitoring a computing environment by a plurality of cybersecurity monitoring systems, including at least two disparate cybersecurity monitoring systems, (Apostolopoulos, machine data is generated by various components in the information technology (IT) environments, such as servers, sensors, routers, mobile devices, Internet of Things (IoT) devices, etc. Machine-generated data can include system logs, network packet data, sensor data, application program data, error logs, stack traces, system performance data, etc. In general, machine-generated data can also include performance data, diagnostic information, and many other types of data that can be analyzed to diagnose performance problems, monitor user interactions, and to derive other insights, [0039] The security platform introduced here is capable of handling large volumes of data, particularly machine data, from multiple data sources. These data sources may have different data formats and may provide data at very high data rates (e.g., gigabytes of data per second or more), [0095] the data connectors 702 enable the security platform to obtain machine data from various different data sources. (1) Identity/Authentication: e.g., active directory/domain controller, single sign-on (SSO), human resource management system (HRMS), virtual private network (VPN), domain name system (DNS), or dynamic host configuration protocol (DHCP); Activity: e.g., web gateway, proxy server, firewall, Netflow™, data loss prevention (DLP) server, file server, or file host activity logs; Security Products: e.g., endpoint security, intrusion prevention system, intrusion detection system, or antivirus; Software as a Service (SaaS) or Mobile: e.g., AWS™ CloudTrail™, SaaS applications such as Box™ or Dropbox™, or directly from mobile devices, [0017-0121]) Heterogeneous events can be a result of the events originating from different machines, different types of machines (e.g., a firewall versus a DHCP server), being in a different data format, or a combination thereof., [0123] a mechanism to process data from multiple sources in a target computer network to derive anomaly-related or threat-related conclusions in real-time so that an appropriate response can be formulated prior to escalation, [0148]) [Examiner interprets that system generating machine data (i.e., cybersecurity signals) different heterogenous formats from multiple data sources such as IDS, endpoint, firewall, threat feeds etc., as limitation above];
wherein the at least two disparate cybersecurity monitoring systems are each configured to scan for a different type of cybersecurity threat in the computing environment (Apostolopoulos, the data connectors 702 enable the security platform to obtain machine data from various different data sources. (1) Identity/Authentication: e.g., active directory/domain controller, single sign-on (SSO), human resource management system (HRMS), virtual private network (VPN), domain name system (DNS), or dynamic host configuration protocol (DHCP); Activity: e.g., web gateway, proxy server, firewall, Netflow™, data loss prevention (DLP) server, file server, or file host activity logs; Security Products: e.g., endpoint security, intrusion prevention system, intrusion detection system, or antivirus; Software as a Service (SaaS) or Mobile: e.g., AWS™ CloudTrail™, SaaS applications such as Box™ or Dropbox™, or directly from mobile devices, [0017-0121] the security platform includes anomaly models configured to detect a number of different kinds of anomalous activity, such as lateral movement, blacklisted entities, malware communications, rare events, and beacon activity, [0177])[Examiner interprets that ;
managing a graph based on the plurality of cybersecurity signals where the graph includes nodes of entities in the computing environment and vertices representing relationships between the nodes (Apostolopoulos, relationship graph generator 710 generate a single relationship graph for each event; such an event-specific relationship graph may also be called a “mini-graph.” Further, some implementations incorporate the generated relationship graph into the event data that represents the event, in the form of a data structure representing the relationship graph. A graph in the context of this description includes a number of nodes and edges. Each node in the relationship graph represents one of the entities involved in the event, and each edge represents a relationship between two of the entities. In general, any event involves at least two entities with some relationship between them (e.g., a device and a user who accesses the device) and therefore can be represented as an event-specific relationship graph, [0135] this composite relationship graph can include all identified relationships among all identified entities involved in the events that take place over the predetermined period of time, [0145]);
analyzing the graph stored in a graph database to determine one or more cybersecurity threats in the computing environment and a severity associated with each of the one or more cybersecurity threats (Apostolopoulos, A graph library component 1550 handles the storage of the composite relationship graph in a non-volatile storage facility called graph database 1560. In the graph database 1560, the nodes (also referred to as vertices), edges and associated metadata of the composite relationship graph are stored in one or more data files. The nodes and edges of the composite relationship can be partitioned based on the timestamps (from the event data) of the corresponding network activities. Each data file can be designated for storing nodes and edges for a particular time period., [0194] Thus, a decision engine (e.g., including a machine learning model) can identify a security threat represented by a group of nodes in question, including, in the illustrated example, anomaly nodes I1, I2 and I4, user nodes U4, U5 and U7, and device nodes IP3 and IP5, [0197] the process detects a security threat by processing at least a portion (e.g., one or more projections) of the composite relationship graph with a decision engine… The computer system inputs the anomaly relationship graph into the decision engine. The decision engine can then identify a security threat by analyzing the anomalies in any of various different ways, [0215] computing a risk score for each day and according to the features in the unit. The riskiest days can be selected, for example, by taking a threshold or by clustering the days and selecting clusters with higher risks, [0221] a total interest score is computed for each of the components formed above. The total interest score is to reflect a totality of interest generated from all nodes attached to a given link, [0238] after calculating the total interest score for each of the formed components, the total interest score is adjusted, [0239]components with adjusted total interest scores that exceed a certain threshold are identified as threats, the threat score assigned to the component is the component score, which may be scaled in 1-10, [0244]) [Examiner interprets that system storing the graph in graph database, and subsequently analyzing the graph for the security threats, and determining the security threats and assigning quantitive threat/severity score to them as limitation above]; and
managing the computing environment based on the analyzing the graph by performing one or more automated response actions based on the severity associated with the one or more cybersecurity threats, the one or more automated response actions including any of isolating a resource of the computing environment, generating an alert, and initiating a scan of the computing environment by one of the plurality of cybersecurity monitoring systems (Apostolopoulos, a pattern of “account takeover,” followed by an “exfiltration” anomaly would warrant a raised alert level because the pattern tells a logic story that implies a causal relationship, [0240] components with adjusted total interest scores that exceed a certain threshold are identified as threats. For some embodiments, each connected component becomes a “threat” In various embodiments, the threat score assigned to the component is the component score, which may be scaled in 1-10, [0244] after identifying actionable threats, a network security related action can be performed on the identified threat. For example, the threats detected may be employed to automatically trigger an action, such as stopping the intrusion, shutting down network access, locking out users, preventing information theft or information transfer, shutting down software and or hardware processes, and the like, [0245]) [Examiner interprets that system calculating threat/risk scores , identifying actionable threat response based upon those scores, and then automatically performing network security actions such as generating alert, isolating devices as limitation above].
Although, Apostolopoulos teaches entity unification/identity resolution across heterogenous data, [0115], [0130], [0155], [0144], Apostolopoulos does not appear to explicitly teach:
wherein the managing includes utilizing a unified node in the graph for two cybersecurity signals from the at least two disparate cybersecurity monitoring systems, wherein the unified node is connected by vertices to a first node representing an entity based on a first cybersecurity signal from a first one of the at least two disparate cybersecurity monitoring systems and to a second node representing the entity based on a second cybersecurity signal from a second one of the at least two disparate cybersecurity monitoring systems, the unified node being generated based on a determination, by matching one or more data field values, that the first node and the second node represent a same entity in the computing environment;
However, Wolff teaches:
wherein the managing includes utilizing a unified node in the graph for two cybersecurity signals from the at least two disparate cybersecurity monitoring systems (Wolff, a method for representing common entities and actions across heterogeneous datasets from cloud-based application platforms includes extracting user and event data from transaction logs, databases, and/or exposed web services and resolving entities and events from heterogeneous platforms into a common entity and/or a common action or event, The data can be analyzed to identify common “entities” (e.g., users or people) or activities (e.g., data or file manipulations or transmissions) throughout the different logs and databases that may be described using different terminology or captured at a different level of hierarchy across the various platforms. A graph can be constructed in which each identified “user” (as resolved across the various platforms) is assigned to a node, and activities and interactions among the users and/or other entities (e.g., data or files) are modeled as edges connecting the nodes. Using the graph, various security detection use cases can be implemented, such as unauthorized account takeover, insider threats, attack incidents, anomaly detection, and others, [0004] the data entered into the repository is in different formats and/or can have different ranges of values, and data representing the same entity (e.g., a user, a file, etc.) may have different names, extensions, or other metadata associated with it, for example, depending on the cloud service provider from which the entity data was retrieved. As such, an entity resolution process can be used to consolidate and normalize the data such that activities associated with a single individual, file, or process can be viewed or aggregated as a common set, regardless of the naming convention used in the individual cloud-based application platforms, [0023]) [Examiner interprets that system utilizing two source specific representations from heterogenous sources can be resolved into a unified/common representation of the same underlying entity as limitation above];
wherein the unified node is connected by vertices to a first node representing an entity based on a first cybersecurity signal from a first one of the at least two disparate cybersecurity monitoring systems and to a second node representing the entity based on a second cybersecurity signal from a second one of the at least two disparate cybersecurity monitoring systems, the unified node being generated based on a determination, by matching one or more data field values, that the first node and the second node represent a same entity in the computing environment (Wolff, a user may be identified as “CKent.” However, for other applications, such as file sharing applications (e.g., DROPBOX), the same user may be identified as ClarkK. .. The entity resolution process described herein facilitates the consolidation and resolution of these seemingly different entities (e.g., users, files, etc.) such that activities emanating from those users or interactions with the items can be analyzed efficiently and accurately. In some cases, the resolution process includes two phases: a first phase in which multiple entities are resolved to a single entity (e.g., different user names, file names, services, etc. being resolved to a single entity) and a second phase in which the single entity is resolved against an application-agnostic dictionary such that each entity having a similar type (e.g., all users, all files, etc.) are identified using a common term, [0024] in the first phase, a user entity may have email addresses such as bob.jones@domain1.com and bjones@domain1.com. In this instance, the resolution process can be aware of different naming conventions, and can determine that these email addresses represent the same user in the service… , if bobjones@domain1.com has a strong link based on activity data to bob.jones@gmail.com, then the system can infer that these entities represent the same physical user. When the system determines two or more entities should be resolved to a single entity in an application, the two entity objects can be merged, after which both of the underlying entities can now point to the merged entity, allowing for an ability to reference or deference the merged or raw version of the entity, [0025] the resolution process can view the merged entities of all applications, and perform a second pass where entities across multiple systems are resolved into a single entity representation for all systems. As an example, a user bob.jones@domain1.com in application 1 and a user bob.jones@domain1.com in application 2, can be merged into a single user with the email address bobjones@domain1.com. In addition, the example approaches that apply in the previous paragraph related to a single application view (e.g., based on user activity) can be applied in this cross-application resolution process, [0026]) [Examiner interprets that system obtaining separate entity records, comparing identifying information associated with those records, determining that they represent the same real world entity and creating a merged/common representation as limitation above].
Therefore, it would have been obvious to PHOSITA before the effective filing date to modify the teaching of Apostolopoulos to include a concept of the managing includes utilizing a unified node in the graph for two cybersecurity signals from the at least two disparate cybersecurity monitoring systems as taught by Wolff for the purpose of representing common entities and actions across heterogeneous datasets from cloud-based application platforms includes extracting user and event data from transaction logs, databases, and/or exposed web services and resolving entities and events from heterogeneous platforms into a common entity and/or a common action or event into a graph and utilizing the graph for various security detection, such as unauthorized account takeover, insider threats, attack incidents, anomaly detection, and others, [Wolff:0004].
Regarding claim 2, Apostolopoulos and Wolff teaches the method of claim 1, wherein the cybersecurity threat is any one of: a misconfiguration, a malware code, a weak password, an outdated certificate, an exposure, a vulnerability, and any combination thereof (Apostolopoulos, Malicious activities can cause harm to the network's software or hardware, or its users. Malicious activities may include unauthorized access or subsequent unpermitted use of network resources and data (i.e., exposure , vulnerability), [0004] the security platform and techniques introduced here can be applied to detect any type of unusual or anomalous activity involving data access, data transfer, network access, and network use regardless of whether security is implicated or not, [0098])
Regarding claim 3, Apostolopoulos and Wolff teaches the method of claim 1, wherein the plurality of cybersecurity monitoring systems include any one of: an Intrusion detection and prevention system (IDS/IPS), a security information and event management (SIEM) system, an endpoint detection and response (EDR), an external attack surface management (EASM) system, and an identity and access management (IAM) service (Apostolopoulos, the data connectors 702 enable the security platform to obtain machine data from various different data sources. (1) Identity/Authentication: e.g., active directory/domain controller, single sign-on (SSO), human resource management system (HRMS), virtual private network (VPN), domain name system (DNS), or dynamic host configuration protocol (DHCP); Activity: e.g., web gateway, proxy server, firewall, Netflow™, data loss prevention (DLP) server, file server, or file host activity logs; Security Products: e.g., endpoint security, intrusion prevention system, intrusion detection system, or antivirus; Software as a Service (SaaS) or Mobile: e.g., AWS™ CloudTrail™, SaaS applications such as Box™ or Dropbox™, or directly from mobile devices, [0017-0121]).
Regarding claim 6, Apostolopoulos and Wolff teaches the method of claim 1, wherein the unified node is generated based on matching one or more data field values, including matching a value of at least one of: name, media access control (MAC) address, Internet protocol (IP) address, and operating system, from the first cybersecurity signal against a corresponding value from the second cybersecurity signal (Wolff, the data entered into the repository is in different formats and/or can have different ranges of values, and data representing the same entity (e.g., a user, a file, etc.) may have different names, extensions, or other metadata associated with it, for example, depending on the cloud service provider from which the entity data was retrieved, [0023] a user associated with an organization may have user accounts with various cloud applications, and the organization may also have administrative accounts with the cloud applications that have management authority over its user's accounts. By associating user accounts to their proper organization accounts, the resulting data may be used in various ways, including retrieving information about the user activity of users associated with an organization …a user may be identified as “CKent.” However, for other applications, such as file sharing applications (e.g., DROPBOX), the same user may be identified as ClarkK, [0024] in the first phase, a user entity may have email addresses such as bob.jones@domain1.com and bjones@domain1.com. In this instance, the resolution process can be aware of different naming conventions, and can determine that these email addresses represent the same user in the service… , if bobjones@domain1.com has a strong link based on activity data to bob.jones@gmail.com, then the system can infer that these entities represent the same physical user. When the system determines two or more entities should be resolved to a single entity in an application, the two entity objects can be merged, after which both of the underlying entities can now point to the merged entity, allowing for an ability to reference or deference the merged or raw version of the entity, [0025] the resolution process can view the merged entities of all applications, and perform a second pass where entities across multiple systems are resolved into a single entity representation for all systems. As an example, a user bob.jones@domain1.com in application 1 and a user bob.jones@domain1.com in application 2, can be merged into a single user with the email address bobjones@domain1.com. In addition, the example approaches that apply in the previous paragraph related to a single application view (e.g., based on user activity) can be applied in this cross-application resolution process, [0026] Certain cloud service applications may already resolve users to a singular, user-principal-name (“UPN”) field as a unique ID, [0035]) [Examiner interprets that system matching name/user identifier from first source bob.jones@domain1.com and name/user identifier from second source bob.jones@domain1.com and check if they are same user and merging into single/merged entity as limitation above].
Regarding claim 7, Apostolopoulos and Wolff teaches the method of claim 1, wherein the plurality of cybersecurity signals are from any of: vulnerability feeds, threat intelligence, endpoint telemetry, user behavior analytics, and cloud configuration details (Apostolopoulos, the data connectors 702 enable the security platform to obtain machine data from various different data sources. (1) Identity/Authentication: e.g., active directory/domain controller, single sign-on (SSO), human resource management system (HRMS), virtual private network (VPN), domain name system (DNS), or dynamic host configuration protocol (DHCP); Activity: e.g., web gateway, proxy server, firewall, Netflow™, data loss prevention (DLP) server, file server, or file host activity logs; Security Products: e.g., endpoint security, intrusion prevention system, intrusion detection system, or antivirus; Software as a Service (SaaS) or Mobile: e.g., AWS™ CloudTrail™, SaaS applications such as Box™ or Dropbox™, or directly from mobile devices, [0017-0121])
Regarding claim 8, Apostolopoulos and Wolff teaches the method of claim 1, wherein the entities in the computing environment include any of: users, devices, applications, vulnerabilities, and data stores (Apostolopoulos, the data format can assist the field mapper 708 to identify and extract entities from the tokens, and more specifically, the data format can specify which of the extracted tokens represent entities. In other words, the field mapper 708 can perform entity extraction in accordance with those embodiments that can identify which tokens represent entities. An entity can include, for example, a user, a device, an application, a session, a uniform resource locator (URL), or a threat, [0133])
Regarding claim 9, Apostolopoulos and Wolff teaches the method of claim 1, wherein the managing the graph includes, for a given cybersecurity signal of the plurality of cybersecurity signals, one or more of:
creating a new node for the given cybersecurity signal when an entity associated with the given cybersecurity signal is not represented in the graph updating an existing node for the given cybersecurity signal when the entity associated with the given cybersecurity signal is already represented in the graph; and creating or updating the unified node for the given cybersecurity signal when the given cybersecurity signal is determined to represent an entity also represented by another node in the graph from a different one of the plurality of cybersecurity monitoring systems (Wolff, A graph can be constructed in which each identified “user” (as resolved across the various platforms) is assigned to a node, and activities and interactions among the users and/or other entities (e.g., data or files) are modeled as edges connecting the nodes, [0004] entity resolution process can be used to consolidate and normalize the data such that activities associated with a single individual, file, or process can be viewed or aggregated as a common set, regardless of the naming convention used in the individual cloud-based application platforms, [0023] the resolution process can be aware of different naming conventions, and can determine that these email addresses represent the same user in the service.. resolution can occur based on an understanding that activity between two entities is a likely indicator that those entities represent the same user, [0025] the resolution process can view the merged entities of all applications, and perform a second pass where entities across multiple systems are resolved into a single entity representation for all systems, [0026] The data can then be combined and normalized into a centralized data store, where a semantic representation (e.g., generalized dictionary) is used to implement an entity resolution process, as described herein. Once the data is resolved, a graph structure can be produced to assist with visualization and causal analysis, [0041]) [Examiner interprets that system constructing graph (i.e., create node) , normalizing and merging process (i.e., creating /updating node) as limitation above] Same motivation applies as claim 1.
Regarding claim 10, Apostolopoulos and Wolff teaches the method of claim 1, wherein the analyzing the graph (Apostolopoulos, A graph library component 1550 handles the storage of the composite relationship graph in a non-volatile storage facility called graph database 1560. In the graph database 1560, the nodes (also referred to as vertices), edges and associated metadata of the composite relationship graph are stored in one or more data files. The nodes and edges of the composite relationship can be partitioned based on the timestamps (from the event data) of the corresponding network activities. Each data file can be designated for storing nodes and edges for a particular time period., [0194] the process detects a security threat by processing at least a portion (e.g., one or more projections) of the composite relationship graph with a decision engine, During the detection, the process first converts at least a portion of the composite relationship graph (e.g., the anomaly projection) into an anomaly relationship graph. The anomaly relationship graph includes anomaly nodes that represent anomalies and entity nodes that represent entities in the computer network. The computer system inputs the anomaly relationship graph into the decision engine. The decision engine can then identify a security threat by analyzing the anomalies in any of various different ways, [0215] includes:
Apostolopoulos does not explicitly teach:
assigning, by a rule engine, the severity associated with a given cybersecurity threat of the one or more cybersecurity threats based on evaluating the unified node and one or more nodes connected to the unified node by vertices
However, Wolff teaches:
assigning, by a rule engine, the severity associated with a given cybersecurity threat of the one or more cybersecurity threats based on evaluating the unified node and one or more nodes connected to the unified node by vertices (Wolff, A domain expert rule engine 224 can include or utilize a series of processes that allow domain experts to create expert rules and heuristics against the underlying data. A model/rule deployment component 226 can be responsible for execution of the expert rules against the underlying data, for example, to find pieces of data that match one or more rules, [0040] The systems and methods can generate and collect security alerts associated with the users or entities function (e.g., a regression equation or predictive model) can be constructed that quantifies the amount of risk associated with the user or entity across all cloud applications used by the organization. The function can use the user risk factors for each user (or entity) as input parameters and can provide as output a predicted overall risk assessment for the user (or entity). In some instances, for example, each user risk can factor can be associated with a weight that increases or decreases risk. The function or other model can combine the risk factors to generate a risk score for each user. The risk score can provide, for example, an indication of a likelihood that a user will engage (or has an ability to engage) in unauthorized or harmful activity with the cloud applications or data available therein, [0050]) [Examiner system using rule engine to evaluate entity specific risk evaluation as limitation above]; and
adjusting the severity assigned to the given cybersecurity threat based on a security policy enforced on the entity represented by the unified node (Wolff, state data can provide information about all the entities across a network or organization, such as users of the cloud service applications, installed applications, roles, policies, permissions, files, data packages, and other information that may not be identified by activity data…. State data for a user can represent or include, for example, user identifiers, user roles, user permissions, and/or user privileges for the cloud service applications, [0032] enterprises may use the collected data to define and optimize their “threat surface area” by provisioning permissions within each cloud service based on the usage patterns of the individual users and organizational guidelines.. These permissions may be stored and abstracted in a manner that is platform-agnostic, such that rules regarding account access and configuration can be consistent across multiple applications, [0045] The systems and methods can generate and collect security alerts associated with the users or entities function (e.g., a regression equation or predictive model) can be constructed that quantifies the amount of risk associated with the user or entity across all cloud applications used by the organization. The function can use the user risk factors for each user (or entity) as input parameters and can provide as output a predicted overall risk assessment for the user (or entity). In some instances, for example, each user risk can factor can be associated with a weight that increases or decreases risk. The function or other model can combine the risk factors to generate a risk score for each user. The risk score can provide, for example, an indication of a likelihood that a user will engage (or has an ability to engage) in unauthorized or harmful activity with the cloud applications or data available therein, [0050] An example of a preventative control that can be deployed into a cloud application is a conditional access policy that will block attempts to access a cloud application when the user is attempting to authenticate from an unauthorized location, as deemed by the conditional access policy, an optimal conditional access policy can be constructed and, via either an automated API method or manual entry through a cloud application user interface, deployed into the cloud application, [0052]) [Examiner interprets that system considering the entity’s permissions, privileges, and security controls each capable of increasing or decreasing risk for security/risk analysis and enforcing a conditional access policy against the entity as limitation above]. Same motivation apples as claim 1.
Regarding claim 11, Apostolopoulos and Wolff teaches the method of claim 1, wherein the analyzing the graph includes: utilizing graph-based pattern recognition to identify known threat patterns including any of: lateral movement attempts, privilege escalation, and indicators of malware behavior (Apostolopoulos, Examples of graph-based analysis of entity activities include command and control detection analysis, beaconing detector, device, IP, domain and user reputation analysis, lateral movement detector, dynamic fingerprinting for users/devices,[0156])
Regarding claim 13, Claim 13 recite commensurate subject matter as claim 1. Therefore, it is rejected for the same reasons. Except the additional element:
Apostolopoulos further teaches:
A non-transitory computer-readable medium storing instructions that, when executed, cause one or more processors to execute steps (Apostolopoulos, non-transitory machine-readable medium having stored thereon instructions .., [0252]) of:
Regarding claims 14-15, and 18-19 , Claims 14-15, and 18-19 recite commensurate subject matter as claims 2-3, and 6-7. Therefore, they are rejected for the same reasons.
Claims 4, 5, 16 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Apostolopoulos (US 20180219888 A1) in view of Wolff (US 20200259852 A1) in further view of Thomas (20230114719 A1).
Regarding claim 4, Apostolopoulos and Wolff teaches the method of claim 1, wherein the plurality of cybersecurity monitoring systems include a cloud-based system (Apostolopoulos, The security platform may be cloud-based and may employ big data techniques to process a vast quantity of high data rate information in a highly scalable manner. the security platform may be hosted in the cloud and provided as a service, [0096])
Apostolopoulos does not explicitly teach:
the plurality of cybersecurity monitoring systems include a cloud-based system configured for zero trust management of endpoints in the computing environment
However, Thomas teaches:
the plurality of cybersecurity monitoring systems include a cloud-based system configured for zero trust management of endpoints in the computing environment (Thomas, The security events may include asynchronous data from the plurality of compute instances… The cloud service may include one or more of a web application, a cloud storage service, an electronic mail application, an authentication service, a zero trust network access resource, a cloud computing service, and a virtualization platform, [0007] compute instances 10-26 may communicate with cloud applications, such as a SaaS application 156, [0052] the security management facility 122 may provide for network access control, which generally controls access to and use of network connections… in the security agent of an endpoint 12, in a wireless access point 11 or firewall 10, as part of application protection 150 provided by the cloud, e.g., from the threat management facility 100 or other network resource(s), [0058]The event collection facility 164 may be used to collect events from any of a wide variety of sensors that may provide relevant events from an asset, such as sensors on any of the compute instances, firewalls, [0077] the cloud service 1808 may be a zero trust network access resource providing secure access to applications and the like for users associated with an enterprise network, [0259]) [Examiner interprets that system managing endpoints, enforcing access policies using zero trust network access resource as limitation above].
Therefore, it would have been obvious to PHOSITA before the effective filing date to modify the teaching of Apostolopoulos and Wolff to include a concept the plurality of cybersecurity monitoring systems include a cloud-based system configured for zero trust management of endpoints in the computing environment as taught by Thomas for the purpose of using zero trust network access resource for providing secure access to applications and the like for users associated with an enterprise network [Thomas:0259].
Regarding claim 5, Apostolopoulos, Wolff, and Thomas teaches the method of claim 4, wherein the cloud-based system generates logs each being one of the plurality of cybersecurity signals managed in the graph (Apostolopoulos, . Machine-generated data can include system logs, network packet data, sensor data, application program data, error logs, stack traces, system performance data, etc. In general, machine-generated data can also include performance data, diagnostic information, and many other types of data that can be analyzed to diagnose performance problems, monitor user interactions, and to derive other insights, [0039] components which may generate machine data from which events can be derived include, but are not limited to, web servers, application servers, databases, firewalls, routers, operating systems, and software applications that execute on computer systems, mobile devices, sensors, Internet of Things (IoT) devices, etc. The data generated by such data sources can include, for example and without limitation, server log files, activity log files, configuration files, messages, network packet data, performance measurements, sensor measurements, etc., [0046] The security platform may be cloud-based and may employ big data techniques to process a vast quantity of high data rate information in a highly scalable manner. the security platform may be hosted in the cloud and provided as a service, [0096])
Regarding claims 16-17, Claims 16-17 recite commensurate subject matter as claims 4-5. Therefore, they are rejected for the same reasons.
Claims 12 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Apostolopoulos (US 20180219888 A1) in view of Wolff (US 20200259852 A1) in further view of Quintero (US 20190130105 A1) in further view of Saxena (US 20170286172 A1).
Regarding claim 12, Apostolopoulos, and Wolff teaches the method of claim 1, wherein the managing the computing environment includes, responsive to a first cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems detecting a cybersecurity threat on a resource of the computing environment and a second cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems not detecting the cybersecurity threat on the resource (Quintero, Antivirus software is used to detect malware. Different antivirus software may use different detection techniques and algorithms, a malware file may be detected by one antivirus program and not by a different antivirus program. By analyzing a file using multiple different antivirus software programs, both false negatives in which malicious content is not detected and false positives in which innocuous content is flagged may be reduced, [0004]the server computing system 102 identifies files 114 stored within the particular folder 112 by the data store 108. For example, the files 114 can include the files 110, or a subset of the files 110. The server computing system 102 provides the files 114 to each of the computing units 106, at step C. Each of the computing units 106 scans each of the files 114 using the respective AV 116, at step D, [0020] each of the computing devices 106 provides a status 120 to the server computing system, [0021] the computing device 106a associated with the AV 116a is able compare the indicated status 120a of the particular file 115 against the statuses 120b, 120c of the particular file 115 as indicated by the AV 116b, 116c, respectively. Specifically, by doing such comparison, the computing device 106a can determine whether the status 120a is aligned with or differs from the statuses 120b, 120c, In some examples, by having such info, in particular, if the status 120a differs from the statuses 120b, 120c, the computing device 106a can adjust parameter(s) associated with scanning of the particular file, including updating a signature of the AV 116a, [0024] , each of the computing devices 106 provides a status 140 to the server computing system 102, at step L. That is, in response to the computing units 106 re-scanning each of the files 114 using the respective AVs 116, each of the computing devices 106 determines the status of each of the files 114—e.g., a potential malicious state of the files 114, [0027] the analysis tab 452, when selected, displays data indicating the particular AVs (e.g., the AVs 116) that have indicated the selected file 450 as potentially malicious and the particular AVs that have indicated the selected file 450 as safe (e.g., “clean”), [0041]) [Examiner interprets that system an AV determining that the file is clean or does not contain malicious content reasonably corresponds to “not detecting the cybersecurity threat on the resource”].
Therefore, it would have been obvious to PHOSITA before the effective filing date to modify the teaching of Apostolopoulos, and Wolff to include a concept of responsive to a first cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems detecting a cybersecurity threat on a resource of the computing environment and a second cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems not detecting the cybersecurity threat on the resource as taught by Quintero for the purpose of analyzing a file using multiple different antivirus software programs, both false negatives in which malicious content is not detected and false positives in which innocuous content is flagged may be reduced [Quintero:0004].
Quintero does not appear to explicitly teach:
Response thereto generating an instruction that configures the second cybersecurity monitoring system to initiate a scan of the resource for the cybersecurity threat
However, Saxena teaches:
Response thereto generating an instruction that configures the second cybersecurity monitoring system to initiate a scan of the resource for the cybersecurity threat (Saxena, trigger event analyzer 206 of FIG. 2 triggers a memory scan in response to security events detected by external security application(s) .. he trigger event analyzer 206 of FIG. 2 responds to the external security events by triggering a scan of the corresponding memory, triggering a fully system scan, and/or changing an aggressiveness of current or scheduled scans, [0062] when one of the example external computing platforms 400 detects a suspicious pattern (and/or other type of malware indication), the example network interface driver 120 of FIG. 4 receives information regarding the suspicious pattern immediately.. when the example security application 114 detects malicious code, the example security application 114 (e.g., via the security services communicator 212) cooperates with the example real time reporter 402 to facilitate conveyance of the corresponding information to, for example, the external computing platforms 400. In some examples, the information conveyed via the real time reporter 402 of FIG. 4 includes instructions or indication of, for example, a type of memory and/or process that should be a target of a corresponding scan (e.g., by the example external computing platforms 100), [0081] a scenario involves IP addresses requested by the computing platform 100 being detected as suspicious on one or more of the external computing platforms 400 and the one or more external computing platforms 400 feeding the suspicious IP address signature back to the computing platform 100 to be the subject of a scan, [0084] the example scan initiator 204 determines whether a security task (e.g., a scan of one or more regions of the memory 112) is to be configured (block 1106). For example, the scan initiator 204 may receive newly discovered malware-indicative information (e.g., via the real time receiver 404 of the example network interface driver 120 of FIG. 4) and instructions to configure a scan of the computing platform 100 for the malware-indicative information, the scan initiator 204 sets the security task to be continuously run (e.g., until otherwise notified). In some examples, the scan initiator 204 sets the security task to be periodically and/or randomly run. Further, the example scan pattern selector 208 selects one or more of the malware-indicative patterns 200 as a basis for the security task (block 1110). In some examples, the selected pattern(s) correspond to the newly discovered malware-indicative information (e.g., received via the real time receiver 404 of the example network interface driver 120), [0125]) [Examiner interprets that system receiving malware indicative information from external environment, triggering event analyzer to initiate an immediate scan as a response , and with the scan target selector using the received malware information in carrying out that scan as limitation above].
Therefore, it would have been obvious to PHOSITA before the effective filing date to modify the teaching of Apostolopoulos, Wolff, and Quintero to include a concept of response thereto generating an instruction that configures the second cybersecurity monitoring system to initiate a scan of the resource for the cybersecurity threat as taught by Saxena for the purpose of receiving newly discovered malware-indicative information and instructions to configure a scan of the computing platform 100 for the malware-indicative information [Saxena:0125].
Regarding claim 20, Apostolopoulos, and Wolff teaches the non-transitory computer-readable medium of claim 13, wherein the entities in the computing environment include any of: users, devices, applications, vulnerabilities, and data stores (Apostolopoulos, the data format can assist the field mapper 708 to identify and extract entities from the tokens, and more specifically, the data format can specify which of the extracted tokens represent entities. In other words, the field mapper 708 can perform entity extraction in accordance with those embodiments that can identify which tokens represent entities. An entity can include, for example, a user, a device, an application, a session, a uniform resource locator (URL), or a threat, [0133]).
Apostolopoulos and Wolff does not appear to explicitly teach:
wherein the managing the computing environment includes, responsive to a first cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems detecting a cybersecurity threat on a resource of the computing environment and a second cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems not detecting the cybersecurity threat on the resource, generating an instruction that configures the second cybersecurity monitoring system to initiate a scan of the resource for the cybersecurity threat.
However, Quintero teaches:
the managing the computing environment includes, responsive to a first cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems detecting a cybersecurity threat on a resource of the computing environment and a second cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems not detecting the cybersecurity threat on the resource (Quintero, Antivirus software is used to detect malware. Different antivirus software may use different detection techniques and algorithms, a malware file may be detected by one antivirus program and not by a different antivirus program. By analyzing a file using multiple different antivirus software programs, both false negatives in which malicious content is not detected and false positives in which innocuous content is flagged may be reduced, [0004]the server computing system 102 identifies files 114 stored within the particular folder 112 by the data store 108. For example, the files 114 can include the files 110, or a subset of the files 110. The server computing system 102 provides the files 114 to each of the computing units 106, at step C. Each of the computing units 106 scans each of the files 114 using the respective AV 116, at step D, [0020] each of the computing devices 106 provides a status 120 to the server computing system, [0021] the computing device 106a associated with the AV 116a is able compare the indicated status 120a of the particular file 115 against the statuses 120b, 120c of the particular file 115 as indicated by the AV 116b, 116c, respectively. Specifically, by doing such comparison, the computing device 106a can determine whether the status 120a is aligned with or differs from the statuses 120b, 120c, In some examples, by having such info, in particular, if the status 120a differs from the statuses 120b, 120c, the computing device 106a can adjust parameter(s) associated with scanning of the particular file, including updating a signature of the AV 116a, [0024] , each of the computing devices 106 provides a status 140 to the server computing system 102, at step L. That is, in response to the computing units 106 re-scanning each of the files 114 using the respective AVs 116, each of the computing devices 106 determines the status of each of the files 114—e.g., a potential malicious state of the files 114, [0027] the analysis tab 452, when selected, displays data indicating the particular AVs (e.g., the AVs 116) that have indicated the selected file 450 as potentially malicious and the particular AVs that have indicated the selected file 450 as safe (e.g., “clean”), [0041])[Examiner interprets that system an AV determining that the file is clean or does not contain malicious content reasonably corresponds to “not detecting the cybersecurity threat on the resource”].
Therefore, it would have been obvious to PHOSITA before the effective filing date to modify the teaching of Apostolopoulos, and Wolff to include a concept of responsive to a first cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems detecting a cybersecurity threat on a resource of the computing environment and a second cybersecurity monitoring system of the at least two disparate cybersecurity monitoring systems not detecting the cybersecurity threat on the resource as taught by Quintero for the purpose of analyzing a file using multiple different antivirus software programs, both false negatives in which malicious content is not detected and false positives in which innocuous content is flagged may be reduced [Quintero:0004].
Apostolopoulos, Wolff, and Quintero does not appear to explicitly teach:
Response thereto generating an instruction that configures the second cybersecurity monitoring system to initiate a scan of the resource for the cybersecurity threat
However, Saxena teaches:
Response thereto generating an instruction that configures the second cybersecurity monitoring system to initiate a scan of the resource for the cybersecurity threat (Saxena, trigger event analyzer 206 of FIG. 2 triggers a memory scan in response to security events detected by external security application(s) .. he trigger event analyzer 206 of FIG. 2 responds to the external security events by triggering a scan of the corresponding memory, triggering a fully system scan, and/or changing an aggressiveness of current or scheduled scans, [0062] when one of the example external computing platforms 400 detects a suspicious pattern (and/or other type of malware indication), the example network interface driver 120 of FIG. 4 receives information regarding the suspicious pattern immediately.. when the example security application 114 detects malicious code, the example security application 114 (e.g., via the security services communicator 212) cooperates with the example real time reporter 402 to facilitate conveyance of the corresponding information to, for example, the external computing platforms 400. In some examples, the information conveyed via the real time reporter 402 of FIG. 4 includes instructions or indication of, for example, a type of memory and/or process that should be a target of a corresponding scan (e.g., by the example external computing platforms 100), [0081] a scenario involves IP addresses requested by the computing platform 100 being detected as suspicious on one or more of the external computing platforms 400 and the one or more external computing platforms 400 feeding the suspicious IP address signature back to the computing platform 100 to be the subject of a scan, [0084] the example scan initiator 204 determines whether a security task (e.g., a scan of one or more regions of the memory 112) is to be configured (block 1106). For example, the scan initiator 204 may receive newly discovered malware-indicative information (e.g., via the real time receiver 404 of the example network interface driver 120 of FIG. 4) and instructions to configure a scan of the computing platform 100 for the malware-indicative information, the scan initiator 204 sets the security task to be continuously run (e.g., until otherwise notified). In some examples, the scan initiator 204 sets the security task to be periodically and/or randomly run. Further, the example scan pattern selector 208 selects one or more of the malware-indicative patterns 200 as a basis for the security task (block 1110). In some examples, the selected pattern(s) correspond to the newly discovered malware-indicative information (e.g., received via the real time receiver 404 of the example network interface driver 120), [0125]) [Examiner interprets that system receiving malware indicative information from external environment, triggering event analyzer to initiate an immediate scan as a response , and with the scan target selector using the received malware information in carrying out that scan as limitation above].
Therefore, it would have been obvious to PHOSITA before the effective filing date to modify the teaching of Apostolopoulos, Wolff, and Quintero to include a concept of response thereto generating an instruction that configures the second cybersecurity monitoring system to initiate a scan of the resource for the cybersecurity threat as taught by Saxena for the purpose of receiving newly discovered malware-indicative information and instructions to configure a scan of the computing platform 100 for the malware-indicative information [Saxena:0125].
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US 10893059 B1 : “relates generally to cyber security and more particularly to verifying and enhancing detection of a cyber-attack on a network.
US 7574740 B1: “provides an integration of intrusion detection and vulnerability assessment functions for determining the priority of an alert in response to detection of an intrusion event in a computer network”
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAMIKSHYA POUDEL whose telephone number is (703)756-1540. The examiner can normally be reached 7:30 AM - 5PM Mon- Fri.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, SHEWAYE GELAGAY can be reached at (571)272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/S.N.P./Examiner, Art Unit 2436
/SHEWAYE GELAGAY/Supervisory Patent Examiner, Art Unit 2436
