DETAILED ACTION
This first non-final action is in response to applicants’ original filing on 11/13/2024. Claims 1-16 are currently pending and have been considered as follows.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Priority
Acknowledgment is made of applicants’ claim for foreign priority under 35 U.S.C. 119(a)-(d). The certified copy has been retrieved on 01/28/2025.
Drawings
The drawings filed on 11/13/2024 are accepted.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 11/13/2024 has been placed in the application file, and the information referred therein has been considered as to the merits.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-16 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 recites the limitation "the actual network state" in lines 15-16. There is insufficient antecedent basis for this limitation in the claim.
Claims 2-8, which depend upon Claim 1, inherit the same insufficient antecedent basis and are also rejected under 35 U.S.C. 112(b).
Claim 4 recites the limitation "the warning signal" in line 1. There is insufficient antecedent basis for this limitation in the claim.
Claim 8 recites the limitation "the next packet" in line 2. There is insufficient antecedent basis for this limitation in the claim.
Claim 9 recites the limitation "the actual network state" in line 17. There is insufficient antecedent basis for this limitation in the claim.
Claims 10-16, which depend upon Claim 9, inherit the same insufficient antecedent basis and are also rejected under 35 U.S.C. 112(b).
Claim 16 recites the limitation "the next packet" in line 2. There is insufficient antecedent basis for this limitation in the claim.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 4-6, 9, and 12-14 are rejected under 35 U.S.C. 103 as being unpatentable over Hetherington et al. (US 20200097810 A1, IDS submitted 11/13/2024, hereinafter Hetherington) in view of Braendle et al. (US 20110307936 A1, hereinafter Braendle).
As to Claim 1:
Hetherington discloses a computer-implemented method for monitoring network traffic (e.g. Hetherington “Multiple techniques may be used for performing anomaly detection in time-series data” [0033]; “The steps of FIG. 6 constitute merely one of many methods that may be performed for time series forecasting and anomaly detection” [0101]), the method comprising:
receiving network traffic packets from at least one network probe (e.g. Hetherington “training data set of time series data is received as input. Along with the training data, other inputs received by the system include a specification for the machine learning model to be used” [0102]; network packet data [0185]; [0186]; data source [0116]);
pre-processing network traffic packets to generate pre-processed network traffic data in a form of a time series containing at least one statistical value for at least one parameter for a plurality of packets each network traffic data item of the time series being representative of network traffic packets (301) from a selected time window (302) (e.g. Hetherington “the original time-series data is augmented with automatically generated statistical features, and the augmented time-series data is provided as inputs” [0051]-[0053]; [0080]“at step 604, a different moving average configuration is selected and an augmented training data set is generated according to the selected moving average configuration. The augmented training data set derived from the moving average features may have different parameter values than the augmented training data set derived in a previous iteration of step 604” [0103]; “generating sets of time-series data from the input time-series data, each set of time-series data of said set of time-series including a respective set of features that are each calculated using a window based statistical function, each feature of said respective set of features having a window size, the window size of each feature of said respective set of features being different than the window size of each other feature of said respective set of features” [Claim 1]);
providing a plurality of machine learning models configured to predict network traffic data for upcoming traffic based on the pre-processed network traffic data of traffic received so far, wherein each machine learning model is dedicated to a distinct statistical value for a distinct parameter (e.g. Hetherington “The system 100 may have stored within it, several machine learning models 120 that may be used for training. These machine learning models may include, without limitation, Random Forest 122, Autoencoder 124, Multilayer Perceptron 126, and Recurrent Neural Networks (RNN)/Long Short-Term Memory (LSTM) 128” [0045]; “the specification of a desired machine learning model may be made from a displayed selection of machine learning models 730, the selection including, but not limited to, Random Forest 732, Auto Encoder 734, Multilayer Perceptron 736 and RNN LSTM 738” [0110]; “The Selected Feature Search Module generates a series of moving window configurations that is then used by the Augmented Time-Series Training Dataset Generation Module 706 to use the input training data and generate multiple augmented training data sets” [0111]; “for each set of time-series data of said sets of time-series data: generating a respective trained machine learning model by at least training a machine learning model based on said each of set of time-series data” [Claim 1]);
training the machine learning models with the pre-processed network traffic data and deriving an evaluation score for each machine learning model (e.g. Hetherington “the selected machine learning model is then trained by the Selected Machine Learning Model Training Module 707 for each of the multiple augmented training data sets” [0112]; “The augmented training data set that led to training the best scoring machine learning model is used to establish the feature space parameter values that are then used by the Augmented Time Series Data Generation Module 710 to generate augmented time series data for any input time series to be input 750 to the trained machine learning model” [0114]; “generating a respective predication accuracy score for said respective trained machine learning model” [Claim 1]);
based on the evaluation score, selecting at least one machine learning model of the trained machine learning models for monitoring of upcoming network traffic (e.g. Hetherington “the trained machine learning models generated using each of the augmented training data sets is evaluated by the Model Evaluation Module 708 in order to determine the trained machine learning model with the best evaluation scores. Subsequent to evaluation, the trained machine learning model with the best evaluation scores is established as the trained machine learning model 709 to perform time series forecasting and anomaly detection for any input time series data 760” [0113]; “selecting a respective trained machine learning model that yields a best prediction accuracy score as a selected trained machine learning model for making predictions and identifying anomalies given input time-series data” [Claim 5]);
But Hetherington does not specifically disclose:
monitoring the upcoming network traffic to detect anomalous events by comparing the actual network state with a network state simulation generated using the selected at least one machine learning model; and
generating a warning if the actual network state does not match the generated network state simulation, wherein the network state is represented by a statistical value for a parameter specific to the selected model.
However, the analogous art Braendle does disclose monitoring the upcoming network traffic to detect anomalous events by comparing the actual network state with a network state simulation generated using the selected at least one machine learning model (e.g. Braendle “automated generation of a model of the expected communication in a control system network based on available system information; (2) automated generation of configuration data for various network security measures based on a generated model” [0021]; “the security parameters may include parameters for expected data traffic, and the method may include automatically monitoring data traffic, and signaling a lack of expected data traffic in dependence upon such parameters” [0027]; “automatically monitoring network data traffic, and signaling a lack of expected data traffic in dependence upon such parameters” [0034]; “monitors the network data traffic for missing expected traffic, in accordance with information contained in the received configuration data” [0037]; [0043]) and generating a warning if the actual network state does not match the generated network state simulation, wherein the network state is represented by a statistical value for a parameter specific to the selected model (e.g. Braendle “automated generation of a model of the expected communication in a control system network based on available system information; (2) automated generation of configuration data for various network security measures based on a generated model; and (3) a method/tool to monitor and alert on the absence of expected traffic based on the generated model” [0021]; “The security parameters may include parameters for expected data traffic, and the security unit may then be configured for automatically monitoring network data traffic, and signaling a lack of expected data traffic in dependence upon such parameters” [0034]; “The missing traffic detector 55 watches for desired data traffic. If such desired data traffic is not detected, then a security breach is inferred, and an alarm is raised. The configuration data provides a model of expected traffic describing the characteristics of the traffic, e.g. source, destination, service used and frequency of expected occurrence. The missing traffic detector 55 then operates to detect the absence of such expected traffic and on such absence, raises an alert” [0043]). Hetherington and Braendle are analogous art because they are from the same field of endeavor in network data modeling.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Hetherington and Braendle before him or her, to modify the disclosure of Hetherington with the teachings of Braendle to include monitoring the upcoming network traffic to detect anomalous events by comparing the actual network state with a network state simulation generated using the selected at least one machine learning model and generating a warning if the actual network state does not match the generated network state simulation, wherein the network state is represented by a statistical value for a parameter specific to the selected model as claimed. The suggestion/motivation for doing so would have been to take available system design information from control systems and transform it into a model of the communication, or configuration data to detect any missing expected traffic in the system (Braendle [0009]). Therefore, it would have been obvious to combine Hetherington and Braendle to obtain the invention as specified in the instant claim(s).
As to Claim 4:
Hetherington in view of Braendle discloses the method according to claim 1, further comprising outputting the warning signal via a graphical user interface (GUI) or an application program interface (API) (e.g. Hetherington “graphical user interface (GUI) in accordance with one or more embodiments. An input device connected to the system may cause a GUI 800 to be displayed on a device. In some embodiments, the GUI 800 includes an interface” [0115]-[0120]; see also Braendle “An input interface 50 is provided for receiving input data, and supplies system description data to a parser 51 for generating an intermediate representation from that system description data” [0036]; “If the data is incorrect in any way, an appropriate notice is generated (step S4) and presented to an appropriate interface” [0038]; “the various elements illustrated in the drawings can be implemented by discrete hardware components configured to carry out the features of the respective elements. For instance, the interface 50” [0078]). The Examiner supplies the same rationale for the combination of references Hetherington and Braendle as in Claim 1.
As to Claim 5:
Hetherington in view of Braendle discloses the method according to claim 1, further comprising determining an optimal time window length from a plurality of time window lengths within predefined limits (e.g. Hetherington find the optimal set of window based statistical features [0052]; “to select an optimal window size and number of moving average features for time-series forecasting and anomaly detection using machine learning models” [0053]; “An optimal set of moving averages may be generated using less computing power. The optimal set may include fewer features or may include window averages that are based on smaller window sizes. A smaller number of window averages to compute and smaller window sizes require less computing resources to compute during preprocessing. An optimal set of window averages may mean a smaller number of features are used for machine learning training and real-time use of the machine learning models. Machine learning models that use less features are trained and executed more efficiently using less computer resources and may have better predicative quality and accuracy” [0127]).
As to Claim 6:
Hetherington in view of Braendle discloses the method according to claim 1, further comprising determining whether the statistical values have a standard distribution and if so, selecting at least one statistical machine learning model, and otherwise selecting at least one autoregressive machine learning model for training (e.g. Hetherington “The general approach for detecting anomalies is to fit a statistical model to the normal behavior of the time series and then identify if new data deviates from the statistical properties learned from the normal behavior of the time-series” [0034]; “The 3σ test merely looks at data that fall outside three standard deviations of a normal distribution of data and identify these as outliers to the data…” [0035]; “Statistical models used for anomaly detection typically fall into the following categories:” [0036]; “Regression/Model based. A model is fit to the training data (normal behavior) and residuals are computed on the predicted data based on the learned model. Some examples are autoregressive moving average (ARMA) models, autoregressive integrated moving average (ARIMA) models …” [0037]; normal distribution [0038]).
As to Claim 9:
Hetherington discloses a network monitoring system (e.g. Hetherington FIG. 11 computer system [0176]-[0187]) comprising:
a data interface for receiving network traffic packets from at least one network probe (e.g. Hetherington communication interface coupled to network link for data communication [0184]; data source [0116]);
a data pre-processor (e.g. Hetherington “a hardware processor” [0176]) for pre-processing network traffic packets to generate pre-processed network traffic data in a form of a time series containing statistics for the network traffic packets, each network traffic data item of the time series being representative of network traffic packets from a selected time window (e.g. Hetherington “the original time-series data is augmented with automatically generated statistical features, and the augmented time-series data is provided as inputs” [0051]-[0053]; [0080]“at step 604, a different moving average configuration is selected and an augmented training data set is generated according to the selected moving average configuration. The augmented training data set derived from the moving average features may have different parameter values than the augmented training data set derived in a previous iteration of step 604” [0103]; “generating sets of time-series data from the input time-series data, each set of time-series data of said set of time-series including a respective set of features that are each calculated using a window based statistical function, each feature of said respective set of features having a window size, the window size of each feature of said respective set of features being different than the window size of each other feature of said respective set of features” [Claim 1]);
a configurator (e.g. Hetherington “a basic software system 1000 that may be employed for controlling the operation of computing system 1100” [0162]) comprising a plurality of machine learning models configured to predict network traffic data for upcoming traffic based on the pre-processed network traffic data of traffic received so far, wherein each machine learning model is dedicated to a distinct statistical value for a distinct parameter (e.g. Hetherington “The system 100 may have stored within it, several machine learning models 120 that may be used for training. These machine learning models may include, without limitation, Random Forest 122, Autoencoder 124, Multilayer Perceptron 126, and Recurrent Neural Networks (RNN)/Long Short-Term Memory (LSTM) 128” [0045]; “the specification of a desired machine learning model may be made from a displayed selection of machine learning models 730, the selection including, but not limited to, Random Forest 732, Auto Encoder 734, Multilayer Perceptron 736 and RNN LSTM 738” [0110]; “The Selected Feature Search Module generates a series of moving window configurations that is then used by the Augmented Time-Series Training Dataset Generation Module 706 to use the input training data and generate multiple augmented training data sets” [0111]; “for each set of time-series data of said sets of time-series data: generating a respective trained machine learning model by at least training a machine learning model based on said each of set of time-series data” [Claim 1]), and a controller (e.g. Hetherington “a basic software system 1000 that may be employed for controlling the operation of computing system 1100” [0162]) configured to:
train the machine learning models with the pre-processed network traffic data;
derive an evaluation score for each machine learning model (e.g. Hetherington “the selected machine learning model is then trained by the Selected Machine Learning Model Training Module 707 for each of the multiple augmented training data sets” [0112]; “The augmented training data set that led to training the best scoring machine learning model is used to establish the feature space parameter values that are then used by the Augmented Time Series Data Generation Module 710 to generate augmented time series data for any input time series to be input 750 to the trained machine learning model” [0114]; “generating a respective predication accuracy score for said respective trained machine learning model” [Claim 1]); and
based on the evaluation score, select at least one machine learning model of the trained machine learning models for monitoring of upcoming network traffic (e.g. Hetherington “the trained machine learning models generated using each of the augmented training data sets is evaluated by the Model Evaluation Module 708 in order to determine the trained machine learning model with the best evaluation scores. Subsequent to evaluation, the trained machine learning model with the best evaluation scores is established as the trained machine learning model 709 to perform time series forecasting and anomaly detection for any input time series data 760” [0113]; “selecting a respective trained machine learning model that yields a best prediction accuracy score as a selected trained machine learning model for making predictions and identifying anomalies given input time-series data” [Claim 5]); and
an anomalies detector (e.g. Hetherington anomaly detector [0161]);
But Hetherington does not specifically disclose:
monitor the upcoming network traffic to detect anomalous events by comparing the actual network state with a network state simulation generated using the selected at least one machine learning model; and
generate a warning if the actual network state does not match the generated network state simulation, wherein the network state is represented by a statistical value for a parameter specific to the selected model.
However, the analogous art Braendle does disclose monitor the upcoming network traffic to detect anomalous events by comparing the actual network state with a network state simulation generated using the selected at least one machine learning model (e.g. Braendle “automated generation of a model of the expected communication in a control system network based on available system information; (2) automated generation of configuration data for various network security measures based on a generated model” [0021]; “the security parameters may include parameters for expected data traffic, and the method may include automatically monitoring data traffic, and signaling a lack of expected data traffic in dependence upon such parameters” [0027]; “automatically monitoring network data traffic, and signaling a lack of expected data traffic in dependence upon such parameters” [0034]; “monitors the network data traffic for missing expected traffic, in accordance with information contained in the received configuration data” [0037]; [0043]) and generate a warning if the actual network state does not match the generated network state simulation, wherein the network state is represented by a statistical value for a parameter specific to the selected model (e.g. Braendle “automated generation of a model of the expected communication in a control system network based on available system information; (2) automated generation of configuration data for various network security measures based on a generated model; and (3) a method/tool to monitor and alert on the absence of expected traffic based on the generated model” [0021]; “The security parameters may include parameters for expected data traffic, and the security unit may then be configured for automatically monitoring network data traffic, and signaling a lack of expected data traffic in dependence upon such parameters” [0034]; “The missing traffic detector 55 watches for desired data traffic. If such desired data traffic is not detected, then a security breach is inferred, and an alarm is raised. The configuration data provides a model of expected traffic describing the characteristics of the traffic, e.g. source, destination, service used and frequency of expected occurrence. The missing traffic detector 55 then operates to detect the absence of such expected traffic and on such absence, raises an alert” [0043]). Hetherington and Braendle are analogous art because they are from the same field of endeavor in network data modeling.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Hetherington and Braendle before him or her, to modify the disclosure of Hetherington with the teachings of Braendle to include monitor the upcoming network traffic to detect anomalous events by comparing the actual network state with a network state simulation generated using the selected at least one machine learning model and generate a warning if the actual network state does not match the generated network state simulation, wherein the network state is represented by a statistical value for a parameter specific to the selected model as claimed. The suggestion/motivation for doing so would have been to take available system design information from control systems and transform it into a model of the communication, or configuration data to detect any missing expected traffic in the system (Braendle [0009]). Therefore, it would have been obvious to combine Hetherington and Braendle to obtain the invention as specified in the instant claim(s).
As to Claim 12:
Hetherington in view of Braendle discloses the network monitoring system according to claim 9, wherein the anomalies detector is configured to output the warning via a graphical user interface (GUI) or an application program interface (API) (e.g. Hetherington “graphical user interface (GUI) in accordance with one or more embodiments. An input device connected to the system may cause a GUI 800 to be displayed on a device. In some embodiments, the GUI 800 includes an interface” [0115]-[0120]; see also Braendle “An input interface 50 is provided for receiving input data, and supplies system description data to a parser 51 for generating an intermediate representation from that system description data” [0036]; “If the data is incorrect in any way, an appropriate notice is generated (step S4) and presented to an appropriate interface” [0038]; “the various elements illustrated in the drawings can be implemented by discrete hardware components configured to carry out the features of the respective elements. For instance, the interface 50” [0078]). The Examiner supplies the same rationale for the combination of references Hetherington and Braendle as in Claim 9.
As to Claim 13:
Hetherington in view of Braendle discloses the network monitoring system according to claim 9, wherein the configurator is configured to determine an optimal time window length from a plurality of time window lengths within predefined limits (e.g. Hetherington find the optimal set of window based statistical features [0052]; “to select an optimal window size and number of moving average features for time-series forecasting and anomaly detection using machine learning models” [0053]; “An optimal set of moving averages may be generated using less computing power. The optimal set may include fewer features or may include window averages that are based on smaller window sizes. A smaller number of window averages to compute and smaller window sizes require less computing resources to compute during preprocessing. An optimal set of window averages may mean a smaller number of features are used for machine learning training and real-time use of the machine learning models. Machine learning models that use less features are trained and executed more efficiently using less computer resources and may have better predicative quality and accuracy” [0127]).
As to Claim 14:
Hetherington in view of Braendle discloses the network monitoring system according to claim 9, wherein the configurator is configured to determine whether the statistical values have a standard distribution and if so, select at least one statistical machine learning model, and otherwise selecting at least one autoregressive machine learning model for training (e.g. Hetherington “The general approach for detecting anomalies is to fit a statistical model to the normal behavior of the time series and then identify if new data deviates from the statistical properties learned from the normal behavior of the time-series” [0034]; “The 3σ test merely looks at data that fall outside three standard deviations of a normal distribution of data and identify these as outliers to the data…” [0035]; “Statistical models used for anomaly detection typically fall into the following categories:” [0036]; “Regression/Model based. A model is fit to the training data (normal behavior) and residuals are computed on the predicted data based on the learned model. Some examples are autoregressive moving average (ARMA) models, autoregressive integrated moving average (ARIMA) models …” [0037]; normal distribution [0038]).
Claims 2 and 10 are rejected under 35 U.S.C. 103 as being unpatentable over Hetherington in view of Braendle as applied to Claims 1 and 9, and further in view of Sharp (US 20050182841 A1).
As to Claim 2:
Hetherington in view of Braendle discloses the method according to claim 1, but does not specifically disclose:
pre-processing the network traffic packets individually for each connection, wherein a connection is identified by at least one of: a sender identifier, a recipient identifier, a communication port and a transmission protocol.
However, the analogous art Sharp does disclose pre-processing the network traffic packets individually for each connection, wherein a connection is identified by at least one of: a sender identifier, a recipient identifier, a communication port and a transmission protocol (e.g. Sharp “The IP source address of the IP header, the IP destination address of the IP header, the TCP source address of the TCP header, and the TCP destination address of the TCP header together uniquely define a single "connection context" with which the packet is associated” [0024]; [0042]; “generate a hash from the socket address of an incoming packet. The socket address (sometimes called a "4-tuple" or a "flow tuple") includes the incoming packet's: source IP address (SRCIP), destination IP address (DSTIP), source TCP port (SRCP), and destination TCP port (DSTP)… to identify the connection context of the packet” [0076]; “processing a plurality of packets, wherein each packet has a socket address, each socket address comprising a destination IP address, a source IP address, a destination TCP port address, and a source TCP port address… determine that a TCP connection identified by the socket address of the first incoming packet is a TCP connection being handled by the network interface device, and performing on the network interface device substantially all TCP and IP protocol processing on the first incoming packet” [Claim 1]). Hetherington, Braendle, and Sharp are analogous art because they are from the same field of endeavor in network data processing.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Hetherington, Braendle, and Sharp before him or her, to modify the combination of Hetherington and Braendle with the teachings of Sharp to include pre-processing the network traffic packets individually for each connection, wherein a connection is identified by at least one of: a sender identifier, a recipient identifier, a communication port and a transmission protocol as claimed. The suggestion/motivation for doing so would have been for avoiding the funneling problem involving TCP, UDP, and IP protocols (Sharp [0098]). Therefore, it would have been obvious to combine Hetherington, Braendle, and Sharp to obtain the invention as specified in the instant claim(s).
As to Claim 10:
Hetherington in view of Braendle discloses the network monitoring system according to claim 9, but does not specifically disclose:
pre-process the network traffic packets individually for each connection, wherein a connection is identified by at least one of: a sender identifier, a recipient identifier, a communication port and a transmission protocol.
However, the analogous art Sharp does disclose pre-process the network traffic packets individually for each connection, wherein a connection is identified by at least one of: a sender identifier, a recipient identifier, a communication port and a transmission protocol (e.g. Sharp “The IP source address of the IP header, the IP destination address of the IP header, the TCP source address of the TCP header, and the TCP destination address of the TCP header together uniquely define a single "connection context" with which the packet is associated” [0024]; [0042]; “generate a hash from the socket address of an incoming packet. The socket address (sometimes called a "4-tuple" or a "flow tuple") includes the incoming packet's: source IP address (SRCIP), destination IP address (DSTIP), source TCP port (SRCP), and destination TCP port (DSTP)… to identify the connection context of the packet” [0076]; “processing a plurality of packets, wherein each packet has a socket address, each socket address comprising a destination IP address, a source IP address, a destination TCP port address, and a source TCP port address… determine that a TCP connection identified by the socket address of the first incoming packet is a TCP connection being handled by the network interface device, and performing on the network interface device substantially all TCP and IP protocol processing on the first incoming packet” [Claim 1]). Hetherington, Braendle, and Sharp are analogous art because they are from the same field of endeavor in network data processing.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Hetherington, Braendle, and Sharp before him or her, to modify the combination of Hetherington and Braendle with the teachings of Sharp to include pre-process the network traffic packets individually for each connection, wherein a connection is identified by at least one of: a sender identifier, a recipient identifier, a communication port and a transmission protocol as claimed. The suggestion/motivation for doing so would have been for avoiding the funneling problem involving TCP, UDP, and IP protocols (Sharp [0098]). Therefore, it would have been obvious to combine Hetherington, Braendle, and Sharp to obtain the invention as specified in the instant claim(s).
Claims 7 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Hetherington in view of Braendle as applied to Claims 1 and 9, and further in view of WOHLGEMUTH et al. (US 20150113190 A1, hereinafter Wohlgemuth).
As to Claim 7:
Hetherington in view of Braendle discloses the method according to claim 1, but does not specifically disclose:
including a number of packets within a time window in the pre-processed network traffic data.
However, the analogous art Wohlgemuth does disclose including a number of packets within a time window in the pre-processed network traffic data (e.g. Wohlgemuth “allows the network device 100 to process a given number of packets during a given period of time using fewer PPNs 104” [0031]; [0045]). Hetherington, Braendle, and Wohlgemuth are analogous art because they are from the same field of endeavor in network data processing.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Hetherington, Braendle, and Wohlgemuth before him or her, to modify the combination of Hetherington and Braendle with the teachings of Wohlgemuth to include including a number of packets within a time window in the pre-processed network traffic data as claimed. The suggestion/motivation for doing so would have been for reducing latency associated with processing each packet (Wohlgemuth [0045]). Therefore, it would have been obvious to combine Hetherington, Braendle, and Wohlgemuth to obtain the invention as specified in the instant claim(s).
As to Claim 15:
Hetherington in view of Braendle discloses the network monitoring system according to claim 9, but does not specifically disclose:
include a number of packets within a time window in the pre-processed network traffic data.
However, the analogous art Wohlgemuth does disclose include a number of packets within a time window in the pre-processed network traffic data (e.g. Wohlgemuth “allows the network device 100 to process a given number of packets during a given period of time using fewer PPNs 104” [0031]; [0045]). Hetherington, Braendle, and Wohlgemuth are analogous art because they are from the same field of endeavor in network data processing.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Hetherington, Braendle, and Wohlgemuth before him or her, to modify the combination of Hetherington and Braendle with the teachings of Wohlgemuth to include a number of packets within a time window in the pre-processed network traffic data as claimed. The suggestion/motivation for doing so would have been for reducing latency associated with processing each packet (Wohlgemuth [0045]). Therefore, it would have been obvious to combine Hetherington, Braendle, and Wohlgemuth to obtain the invention as specified in the instant claim(s).
Claims 8 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Hetherington in view of Braendle as applied to Claims 1 and 9, and further in view of Cabezas et al. (US 20050188241 A1, hereinafter Cabezas).
As to Claim 8:
Hetherington in view of Braendle discloses the method according to claim 1, but does not specifically disclose:
at least one parameter for a plurality of packets is a time until arrival of the next packet, a length of a payload carried by a packet, an entropy of the payload or a hash function of the payload.
However, the analogous art Cabezas does disclose at least one parameter for a plurality of packets is a time until arrival of the next packet, a length of a payload carried by a packet, an entropy of the payload or a hash function of the payload (e.g. Cabezas “In protocols which employ variable length payloads, often the header (21) includes a "packet length" or "payload size" indicator or parameter to assist the receiving unit in properly interpreting the packet” [0059]). Hetherington, Braendle, and Cabezas are analogous art because they are from the same field of endeavor in network data processing.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Hetherington, Braendle, and Cabezas before him or her, to modify the combination of Hetherington and Braendle with the teachings of Cabezas to include at least one parameter for a plurality of packets is a time until arrival of the next packet, a length of a payload carried by a packet, an entropy of the payload or a hash function of the payload as claimed. The suggestion/motivation for doing so would have been to assist the receiving unit in properly interpreting the packet (Cabezas [0059]). Therefore, it would have been obvious to combine Hetherington, Braendle, and Cabezas to obtain the invention as specified in the instant claim(s).
As to Claim 16:
Hetherington in view of Braendle discloses the network monitoring system according to claim 9, but does not specifically disclose:
at least one parameter for a plurality of packets is a time until arrival of the next packet, a length of a payload carried by a packet, an entropy of the payload or a hash function of the payload.
However, the analogous art Cabezas does disclose at least one parameter for a plurality of packets is a time until arrival of the next packet, a length of a payload carried by a packet, an entropy of the payload or a hash function of the payload (e.g. Cabezas “In protocols which employ variable length payloads, often the header (21) includes a "packet length" or "payload size" indicator or parameter to assist the receiving unit in properly interpreting the packet” [0059]). Hetherington, Braendle, and Cabezas are analogous art because they are from the same field of endeavor in network data processing.
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Hetherington, Braendle, and Cabezas before him or her, to modify the combination of Hetherington and Braendle with the teachings of Cabezas to include at least one parameter for a plurality of packets is a time until arrival of the next packet, a length of a payload carried by a packet, an entropy of the payload or a hash function of the payload as claimed. The suggestion/motivation for doing so would have been to assist the receiving unit in properly interpreting the packet (Cabezas [0059]). Therefore, it would have been obvious to combine Hetherington, Braendle, and Cabezas to obtain the invention as specified in the instant claim(s).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicants’ disclosure.
Ghorbani et al. (US 20090326899 A1)
Raugas et al. (US 20150128263 A1)
Duffield et al. (US 20160105462 A1)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Kenneth Chang whose telephone number is (571)270-7530. The examiner can normally be reached Monday - Friday 9:30am-5:30pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi Arani can be reached at 571-272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KENNETH W CHANG/Primary Examiner, Art Unit 2438
PNG
media_image1.png
35
280
media_image1.png
Greyscale
02/11/2026