DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
This office action is in response to amendment/reconsideration filed on 05/27/2026, the amendment/reconsideration has been considered. Claims 1, 11 and 17 have been amended. Claims 1-20 are pending for examination as cited below.
Response to Arguments
Applicant’s arguments with respect to the amended claim(s) filed on 05/27/2026 have been considered but are moot in view of the new grounds of rejection necessitated by claim amendments.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Amin et al. (Pub. No.: US 2020/0177618 A1), hereinafter “Amin” in view of Noel et al. “Understanding Complex Network Attack Graphs through Clustered Adjacency Matrices, 12/05/2005” hereinafter “Noel”.
As to claim 1. Amin discloses, a computerized system (Amin, Abstract) comprising:
one or more computer processors; and computer memory storing computer-useable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations (Amin, Abstract), the operations comprising:
accessing a graph, the graph representing relationships between entities of a computing environment and storing security information about the computing environment (Amin, [0005], an agile security platform for enterprise-wide cyber-security.);
generating a matrix from the graph, wherein an entry of the matrix indicates a connection, or lack of connection, between two nodes of the graph (Amin, [0006-0007], determining a path hardness value for each attack path of the set of attack paths within the network, path hardness values being determined based on a state correlation matrix that correlates action states relative to each other, and a decay factor that represents a reduction in effort required to repeatedly perform an action of an action state);
using the connectivity score, generating an insight related to the security of the computing environment (Amin, [0007], generating an alert, the alert indicating at least a portion of an attack path associated with the path hardness value); and
communicating the insight to a security management client (Amin, [0033]).
Amin however is silent to disclose explicitly, generating an adjacency matrix from the graph, wherein the adjacency matrix comprises a plurality of matrix entries that describe nodes in the security graph and at least one authorized operation of a first node with respect to a second node.
Noel however discloses a similar concept in the same field of endeavor including, generating an adjacency matrix from the graph, wherein the adjacency matrix comprises a plurality of matrix entries that describe nodes in the security graph and at least one authorized operation of a first node with respect to a second node (Noel, fig.8-10, section, 4.3, Figure 10 shows another intrusion alarm associated
with the multi-step reachability matrix from Figure 6. This time, we project to the main diagonal in each direction, i.e., along columns and rows, to explore forward and backward steps from this alarm. In this way, we can predict the origin of the attack (from the backward direction) and the impact of the attack (from the forward direction). Projecting along the row to the main diagonal, we reach a column that has non-zero entries only within the 2nd main-diagonal block (block A2,2). In fact, these non-zero entries are all of unity value, indicating that these are all one-step attacks. In other words, only an attack from one of the machines in block A2,2 could have led to the detected intrusion, and that could have happened within one attack step.).
Therefore, before the effective filing date of the instant application it would have been obvious to one of the ordinary skilled in the art to incorporate the teachings of “Noel” into those of Amin to provide method to apply adjacency matrix clustering to network attack graphs for attack correlation, prediction, and hypothesizing. We self-multiply the clustered adjacency matrices to show attacker reachability across the network for a given number of attack steps, culminating in transitive closure for attack prediction over all possible number of steps. This reachability analysis provides a concise summary of the impact of network configuration changes on the attack graph. Using our framework, we also place intrusion alarms in the context of vulnerability-based attack graphs, so that false alarms become apparent and missed detections can be inferred. We introduce a graphical technique that shows multiple-step attacks by matching rows and columns of the clustered adjacency matrix. This allows attack impact/responses to be identified and prioritized according to the number of attack steps to victim machines, and allows attack origins to be determined. Our techniques have quadratic complexity in the size of the attack graph.
As to claim 2. The combined system of Amin and Noel discloses the invention substantially including, wherein the insight is an identification of an attack path in the computing environment (Amin, [0033], the user 112 can include a cyber-security expert that views and responds to dashboards, alerts, and/or notifications of the agile security platform using the client device 102.).
As to claim 3. The combined system of Amin and Noel discloses the invention substantially including, wherein analyzing the matrix comprises executing matrix operations, the matrix operations comprising any of: matrix exponentiation, sparse matrix optimization, and block matrix multiplication (Amin, [0095]).
As to claim 4. The combined system of Amin and Noel discloses the invention substantially including, where analyzing the matrix comprises executing a block matrix multiplication on the graph organized as blocks (Amin, [0039], in the organization according to policy, without understanding of the impact on separated operational processes. Hardening of a system should be a decision of the enterprise to drive security alignment with the enterprise. Also see fig.5, [0083])).
As to claim 5. The combined system of Amin and Noel discloses the invention substantially including, wherein analyzing the matrix comprises executing matrix exponentiation that raises the matrix to the power k to discover a number paths of the length k between nodes (Amin, [0048], the analytics module 230 processes an AG to identify and extract information regarding critical nodes, paths for every source-destination pair (e.g., shortest, hardest, stealthiest), most critical paths, and critical vulnerabilities, among other features of the AG. If remediations are applied within the enterprise network, the AgiHack service 208 updates the AG. The matrix exponentiation is a known mathematical calculation as evident by Pierson et al. US 6560727 B1).
As to claim 6. The combined system of Amin and Noel discloses the invention substantially including, wherein analyzing the matrix comprises any of: path discovery, connectivity analysis, clustering coefficient calculation, and modularity calculation (Amin, [0048]).
As to claim 7. The combined system of Amin and Noel discloses the invention substantially including, the operations further comprising generating an actionable recommendation based on the insight and a Key Performance Indicator (KPI) associated with a threshold (Amin, [0048]).
As to claim 8. The combined system of Amin and Noel discloses the invention substantially including, the operations further comprising detecting anomalies in the computing environment by performing real-time monitoring of the computing environment by way of the graph and the matrix, wherein real-time monitoring triggers generating alerts in response to detecting anomalies (Amin, [0064], With regard to the defender perspective, an AG can capture the holistic view of the attack opportunity in the entire network. It provides the ability to grasp potential exploitation of vulnerabilities along attack paths and their respective consequences in the particular context. Also see [0066]).
As to claim 9. The combined system of Amin and Noel discloses the invention substantially including, the operations further comprising:
communicating, from the security management client, a request for security information about the computing environment (Amin, fig.6, [0104], Graph data is received (602). For example, the AgiHack service 208 receives graph data from the AgiDis service 214 of FIG. 2. In some examples, and as described in detail herein, the graph data defines a graph that is representative of an enterprise network.);
in response to communicating the request, receiving a visualization of security information comprising one or more insights computed from the graph and the matrix (Amin, fig.6, [0104], A state graph is provided (606). For example, and as described herein, the state graph depicts the AG as sets of configuration nodes, impact nodes, and rule nodes with edges therebetween (see, e.g., FIG. 4).); and
causing display of the visualization on the security management client (Amin, fig.6, [0104]).
As to claim 10. The combined system of Amin and Noel discloses the invention substantially including, the operations further comprising:
receiving an indication to execute a remediation action associated with the insight (Amin, [0033]); and
communicating the indication to execute the remediation action to cause execution of the remediation action (Amin, [0033]).
As to claim 11. Is rejected for same rationale as applied to claim 1 above.
As to claim 12. Is rejected for same rationale as applied to claim 3 above.
As to claim 13. Is rejected for same rationale as applied to claim 4 above.
As to claim 14. Is rejected for same rationale as applied to claim 5 above.
As to claim 15. Is rejected for same rationale as applied to claim 6 above.
As to claim 16. Is rejected for same rationale as applied to claim 2 above.
As to claim 17. Is rejected for same rationale as applied to claim 1 above.
As to claim 18. Is rejected for same rationale as applied to claim 1 and the dependent claims of claim 1 as cited above.
As to claim 19. Is rejected for same rationale as applied to claim 5 above.
As to claim 20. Is rejected for same rationale as applied to claim 6 above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See the attached PTO-892.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TAUQIR HUSSAIN whose telephone number is (571)270-1247. The examiner can normally be reached M-F 7:00 - 8:00 with IFP.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Vivek Srivastava can be reached at 571 272-7304. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Tauqir Hussain/Primary Examiner, Art Unit 2446
Prosecution Insights