DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This office action is in response to the application filed on 11/25/2024.
The Claims 1-12 are currently pending in this application.
Information Disclosure Statement
The information disclosure statement (IDS) submitted by applicant dated 6/20/2025 has been considered by the examiner.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1, 5, 7, and 11 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Cao et al. CN 115145230 hereinafter referred to as Cao.
As per claim 1, Cao discloses an anomaly detection method, applied to a network security device in an Operational Technology (OT) network, the method comprising (Cao [n0040]: "the executing entity of the industrial control network order anomaly detection method can be an electronic device such as an industrial control firewall or an industrial control network gateway"):
performing an instruction parsing process on currently obtained industrial network traffic generated by executing a configured production procedure in the OT network, to obtain control instructions which are sequentially issued by each industrial device in the OT network to perform a corresponding abstract-behavior-switching during execution of the configured production procedure (Cao [FIG. 1], [n0042-n0043], [n0046-n0048], [n0059], [n0064], [n0074]: node transition constitutes abstract-behavior-switching, see e.g., "Step 101: Receive control instructions, which include production process identifiers and instruction parameters; Step 102: Obtain the matching rules for the target process flow based on the production process identifier; wherein, the matching rules include the standard parameters corresponding to the current execution node in the target process flow… In step 101, the control command refers to the command used to control the production process to perform corresponding actions… control instruction controls one of the execution nodes… if the completed node recorded in the electronic equipment is ladle refining, then the next execution node can be known through the process flow template… which is the ingot wall finishing. That is, the ingot wall finishing execution node is the current execution node… The electronic device then sends the legitimate command to the production line equipment corresponding to the target process flow, so that the production line equipment controls the corresponding actuator to perform the corresponding action according to the control command… electronic device to switch to the next execution node");
matching a target control instruction set constituted for each industrial device based on obtained control instructions of the industrial device (Cao [n0043], [n0058]: "Obtain the matching rules for the target process flow based on the production process identifier; wherein, the matching rules include the standard parameters corresponding to the current execution node in the target process flow… electronic device pre-stores the process flow templates corresponding to each production process and associates the process flow templates with the production process identifiers"), with a pre-established control instruction feature library, wherein the control instruction feature library comprises control instruction feature sets constituted by control instructions issued by each industrial device in the OT network for various abstract-behavior-switching (Cao [n0048]: per-node standard parameters constitute the control instruction feature set, see e.g., "matching rule refers to the standard parameters corresponding to the current execution node of the target process… its corresponding standard parameters include: protocol: Modubs; function code: release raw materials; function code sequence combination: x1, x2, x3; interval time: 10s; operation frequency: 2");
in response to a determination that the matching is successful, determining that there is no anomaly in the corresponding abstract-behavior-switching performed by the industrial device during the execution of the configured production procedure (Cao [n0051-n0052]: "instruction parameters match the standard parameters in the rule to be matched exactly, the match is successful… electronic device can determine whether the control command is valid based on the matching result… if it is valid, it indicates that the industrial control network order is normal");
in response to a determination that the matching fails, determining that there is anomaly in the corresponding abstract-behavior-switching performed by the industrial device during the execution of the configured production procedure (Cao [n0051-n0052]: "if at least one parameter does not match, the match fails… electronic device can determine whether the control command is valid based on the matching result. If it is invalid, it indicates that the industrial control network order is abnormal").
As per claim 5, Cao discloses the method according to claim 1, wherein the method further comprises: receiving an edit instruction for a target control instruction in the control instruction feature set (Cao [n0048], [n0058], [n0083-n0084]: operator supplies an edit instruction directed to a control instruction, standard parameter, within the stored feature set/template, see e.g., "For the generated process flow template, operators can also manually modify the standard parameters in the template… manual modification… templates can be modified as needed after learning");
adjusting the target control instruction in the control instruction feature set according to the edit instruction (Cao [n0083]: targeted standard parameter is adjusted in accordance with the modification, see e.g., "operators can also manually modify the standard parameters in the template. For example, the frequency of adding raw materials can be changed from twice to three times").
As per claims 7 and 11, the claims disclose an electronic device corresponding to the method claims 1 and 5 above, and they are rejected, at least for the same reasons.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 2-3, 6, 8-9, and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Cao et al. CN 115145230 hereinafter referred to as Cao in view of Ciocarlie et al. US 20190089722 hereinafter referred to as Ciocarlie.
As per claim 2, Cao teaches the method according to claim 1, wherein in response to a determination that the matching is successful for the target control instruction set of the industrial device, the method further comprises (Cao [n0051-n0052]: "if the instruction parameters match the standard parameters in the rule to be matched exactly, the match is successful… instruction parameters match the standard parameters in the rule to be matched exactly, the match is successful… electronic device can determine whether the control command is valid based on the matching result… if it is valid, it indicates that the industrial control network order is normal"):
based on the target control instruction set of the industrial device, obtaining an abstract behavior state set formed based on abstract behaviors of the industrial device during the configured production procedure (Cao [n0047-n0048], [n0059]: derives the device's node/condition from the control instructions, see e.g., "control instruction controls one of the execution nodes… Instruction parameters refer to the parameters required to control a specific execution node in the corresponding production process… determine the current execution node… based on the execution progress),
wherein the abstract behavior state set comprise: a first state line constituted by abstract behavior states before a corresponding abstract-behavior-switching of the industrial device during the configured production procedure, and a second state line constituted by abstract behavior states after the corresponding abstract-behavior-switching of the industrial device during the configured production procedure (Cao [n0059]: completed-node condition before and the next-node condition after, see e.g., "if the completed node… is ladle refining, then the next execution node… is the ingot wall finishing… ingot wall finishing execution node is the current execution node").
Cao does not explicitly disclose obtaining a pre-established state baseline library, wherein the state baseline library comprises a state baseline set respectively corresponding to each production procedure existing in the OT network, the state baseline set corresponding to each production procedure comprises a corresponding relationship between each normal abstract-behavior-switching existing in the production procedure, a first state baseline constituted by abstract behavior states of each industrial device before the switching, a second state baseline constituted by abstract behavior states of each industrial device after the switching, and a control instruction rule set to be issued by a target industrial device when triggering the normal abstract-behavior-switching, the control instruction rule set comprises a corresponding relationship between a target industrial device involved when triggering the normal abstract-behavior-switching and the control instruction feature set of the target industrial device; matching the target control instruction sets and the abstract behavior state set, with the state baseline library; in response to a determination that the target control instruction sets and the abstract behavior state set are matched with the state baseline set corresponding to the configured production procedure, determining that the control instructions issued by the industrial device during the execution of the configured production procedure are normal, and that the corresponding abstract-behavior-switching triggered by the control instructions issued by the industrial device is normal; and in response to a determination that the target control instruction sets and the abstract behavior state set are not matched with the state baseline set corresponding to the configured production procedure, determining that anomaly exists during the execution of the configured production procedure.
Ciocarlie teaches obtaining a pre-established state baseline library, wherein the state baseline library comprises a state baseline set respectively corresponding to each production procedure existing in the OT network, the state baseline set corresponding to each production procedure comprises a corresponding relationship between each normal abstract-behavior-switching existing in the production procedure, a first state baseline constituted by abstract behavior states of each industrial device before the switching, a second state baseline constituted by abstract behavior states of each industrial device after the switching, and a control instruction rule set to be issued by a target industrial device when triggering the normal abstract-behavior-switching, the control instruction rule set comprises a corresponding relationship between a target industrial device involved when triggering the normal abstract-behavior-switching and the control instruction feature set of the target industrial device (Ciocarlie [0014], [0020], [0028], [0031-0032], [0043], [0045]: builds and stores a learned model of normal device state behavior, operational modes, and the command patterns that drive state transitions, see e.g., "any single message may be completely legal in both syntax and semantics… However, the emergent properties of a set or sequence of such legitimate, well-formed messages can damage or disrupt a system… when individual commands are all legal and well-formed, it can still be determined whether a command sequence is malicious by examining the global, system-level state… establish a reliable, independent model of the system's legal operation… Oracles may receive actual or hypothetical control messages, and parameters regarding the system or its current or past state… provide information on a future state… message provenance component 215 builds models of normal behavior… The exchange of these command and response pairs depends on both the internal state of the devices and the different operational modes… examples of command sequences for different devices");
matching the target control instruction sets and the abstract behavior state set, with the state baseline library (Ciocarlie [0052], [0054]: compares the observed command/state sequence against the learned normal model, see e.g., "an anomaly detection mechanism operating on the history of commands received so far, and raising an alert if the sequence deviates from the learned norm… message provenance tests whether currently-observed message sequences are consistent with the learned model of device interactions");
in response to a determination that the target control instruction sets and the abstract behavior state set are matched with the state baseline set corresponding to the configured production procedure, determining that the control instructions issued by the industrial device during the execution of the configured production procedure are normal, and that the corresponding abstract-behavior-switching triggered by the control instructions issued by the industrial device is normal (Ciocarlie [0054]: treats a sequence consistent with the learned model as normal, see e.g., "model can directly serve as an anomaly detection mechanism… sequences are consistent with the learned model of device interactions");
and in response to a determination that the target control instruction sets and the abstract behavior state set are not matched with the state baseline set corresponding to the configured production procedure, determining that anomaly exists during the execution of the configured production procedure (Ciocarlie [0052]: reports a threat on deviation, see e.g., "model can directly serve as an anomaly detection mechanism… raising an alert if the sequence deviates from the learned norm").
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Cao of checking command instructions against a per-node control instruction feature library with the teachings of Ciocarlie to include a further system state level check against a learned model of normal device state and operational-mode behavior in order to prevent and detect state-level anomalies that could not be detected by instruction-level anomaly checking alone.
As per claim 3, Cao in view of Ciocarlie teaches the method according to claim 2 wherein the method further comprises: identifying an abnormal object existing during the execution of the configured production procedure according to the target control instruction sets, the abstract behavior state set and the state baseline set corresponding to the configured production procedure (Cao [n0068-n0071]: "Generate logs corresponding to control commands and send the logs to the monitoring equipment… If the next node has not been executed for a long time, it indicates that there is a problem with the next execution node, thus enabling quick and accurate problem location and reducing resource consumption"; Ciocarlie [0033], [0064], [0072]: "output of this overall collection and introspection system is threat information that relates to both anomalous message sequences and estimated failure state… can isolate the message frequency between two nodes A and B as an emerging property of the system… report… an anomalous behavior… visualize the affected utility's device state").
As per claim 6, Cao in view of Ciocarlie teaches the method according to claim 2, wherein the method further comprises: receiving an edit instruction for the state baseline set (Cao [n0048], [n0058], [n0083-n0084]: operator supplies an edit instruction directed to a control instruction, standard parameter, within the stored feature set/template, see e.g., "For the generated process flow template, operators can also manually modify the standard parameters in the template… manual modification… templates can be modified as needed after learning"; Ciocarlie [0032], [0043]: learned model of normal device state behavior, see e.g., "builds models of normal behavior… operational modes");
adjusting a target object in a target state baseline set in the state baseline library according to the edit instruction, wherein the target object is a first state baseline, a second state baseline, or a control instruction rule set (Cao [n0083]: targeted standard parameter is adjusted in accordance with the modification, see e.g., "operators can also manually modify the standard parameters in the template. For example, the frequency of adding raw materials can be changed from twice to three times"; Ciocarlie [0032], [0043]: learned model of normal device state behavior, see e.g., "builds models of normal behavior… operational modes").
As per claim 8-9 and 12, the claims disclose an electronic device which corresponds to the method claim 2-3 and 6 above, and they are rejected, at least for the same reasons.
Claims 4 and 10 are rejected under 35 U.S.C. 103 as being unpatentable over Cao et al. CN 115145230 hereinafter referred to as Cao in view of Leong US 20110206055 hereinafter referred to as Leong.
As per claim 4, Cao teaches the method according to claim 1, wherein matching the target control instruction set constituted for each industrial device based on the obtained control instructions of the industrial device (Cao [n0043], [n0058]: "Obtain the matching rules for the target process flow based on the production process identifier; wherein, the matching rules include the standard parameters corresponding to the current execution node in the target process flow… electronic device pre-stores the process flow templates corresponding to each production process and associates the process flow templates with the production process identifiers") with the pre-established control instruction feature library (Cao [n0048]: per-node standard parameters constitute the control instruction feature set, see e.g., "matching rule refers to the standard parameters corresponding to the current execution node of the target process… its corresponding standard parameters include: protocol: Modubs; function code: release raw materials; function code sequence combination: x1, x2, x3; interval time: 10s; operation frequency: 2").
Cao does not explicitly disclose wherein before matching the target control instruction: performing a merging process for identical control instructions sequentially issued by the industrial device to ensure that one identical control instruction is retained in the target control instruction set.
Leong teaches reducing a sequence of identical messages to one retained copy before analysis (Leong [0015], [0023], [0026], [0043-0044]: "performing duplicate packet removal (i.e., packet deduplication)… processing may help reduce the number of packets seen by or forwarded to a monitoring or analysis tool in the network… The first packet with a new hash value is forwarded by the packet switch appliance. Any subsequent packets within a time window that has the same hash value is discarded… identifies a packet as a duplicate packet if at least a portion of the packet is identical to a corresponding portion of another packet received within a predetermined period of time… a packet is identified as a duplicate, then processing logic discards the packet").
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Cao of matching target control instructions with a pre-established control instruction feature library with the teachings of Leong to include deduplication in order to prevent execution errors and inaccurate anomaly determinations.
As per claim 10, the claim discloses an electronic device which corresponds to the method claim 4 above, and they are rejected, at least for the same reasons.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CAROLINE HOANG-ANH NGUYEN whose telephone number is (571)272-8309. The examiner can normally be reached Monday-Thursday 7am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached at (571) 272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/C.H.N./Examiner, Art Unit 2495
/HENRY TSANG/Primary Examiner, Art Unit 2495
Prosecution Insights