Prosecution Insights
Last updated: October 01, 2026
Application No. 18/965,027

METHOD OF MANAGING ABNORMAL NETWORK BEHAVIOR AND DEVICE FOR PERFORMING THE SAME

Final Rejection §103
Filed
Dec 02, 2024
Priority
Feb 16, 2024 — RE 10-2024-0022916 +3 more
Examiner
MACILWINEN, JOHN MOORE JAIN
Art Unit
2454
Tech Center
2400 — Computer Networks
Assignee
Electronics and Telecommunications Research Institute
OA Round
2 (Final)
68%
Grant Probability
Favorable
3-4
OA Rounds
2y 1m
Est. Remaining
95%
With Interview

Examiner Intelligence

Grants 68% — above average
68%
Career Allowance Rate
465 granted / 689 resolved
+9.5% vs TC avg
Strong +28% interview lift
Without
With
+27.9%
Interview Lift
resolved cases with interview
Typical timeline
3y 11m
Avg Prosecution
18 currently pending
Career history
718
Total Applications
across all art units

Statute-Specific Performance

§101
9.5%
-30.5% vs TC avg
§103
55.6%
+15.6% vs TC avg
§102
10.8%
-29.2% vs TC avg
§112
19.5%
-20.5% vs TC avg
Black line = Tech Center average estimate • Based on career data from 689 resolved cases

Office Action

§103
Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Response to Arguments Applicant's arguments filed 7/7/2026 have been fully considered, and are partially persuasive. Applicant begins by noting the claims have been amended in response to the previously presented rejections made under 35 USC 112. Applicant’s arguments are persuasive in view of the clarify claim language. Applicant next addresses the newly presented claim language appearing in independent claims 1 and 7 regarding use of a “target incident identifier (ID) indicating a cause of the signaling storm”. Applicant next addresses their arguments to the modifying Xiong reference (as Xiong was previously relied upon to show previous claim features related to a signaling storm). The Examiner agrees that Xiong does not show the claimed identification of “a cause of the signaling storm” in the manner presently claimed. However, the Examiner additionally notes that the arguments directed to Xiong repeatedly reference or otherwise rely on language not presently recited or otherwise required by pending claims. While Xiong is no longer relied upon, these arguments are not themselves persuasive due to their reliance on unclaimed subject matter (e.g., that “Xiong does not consider, anywhere in its specification, the possibility that a signaling storm or a network attack may be caused by abnormal signaling originating from an NF itself”; that Xiong “neither discloses nor suggests a configuration in which a request includes an identifier (i.e., a Target Incident ID) for distinguishing whether the cause is attributable to a terminal or to an NF, as recited in claim 1 of the present application”; that Xiong “neither discloses nor suggests a configuration in which a consumer NF requests that the NWDAF analyze the cause of a signaling storm targeting a specific NF”, and that Xiong’s teachings are “fundamentally different from the instance identifier of a target NF, which is required as filter information for signaling storm analysis in claim 1 of the present application”). After further search and consideration, a new grounds of rejection has been made in view of Cai (US-20220131966-A1). Cai, like Xiong, discusses management of abnormal network behavior, including consideration of a signaling storm being an abnormal or problematic network behavior (e.g., Cai, Abstract, and [2-7], discussing analysis of obtained traffic statistics which are processed to determined abnormal network behavior (i.e., a signaling storm). Cai additionally suggests providing the claimed “target incident identifier (ID) indicating a cause of the signaling storm” via determination of a “target UE” which is defined as the device “causing the signaling storm” (Cai, [7]); as the “target UE” of Cai identifies “a cause of the signaling storm”, it is within the broadest reasonable interpretation of the claimed “target incident identifier (ID)”. Cai continues to suggest use of the root of the signaling storm when blocking or otherwise mitigating the impact of the storm, which one of ordinary skill in the art would have readily understood as a useful feature to help maintain continued and orderly operation of the monitored network. While not presently relied upon, Feng (Feng, Dongdong, et al. "Research of deep learning and adaptive threshold-based signaling storm prediction and top cause tracking." IEEE Access 11. (Year: 2023)) provides additional disclosure regarding identification of a cause of a signaling storm (e.g., pg. 1, Abstract, L29-L32, pg. 3 R52-R55, and pg. 5, Section C, titled “STORM IDENTIFICATION & TOP CAUSE”). Claim Rejections - 35 USC § 103 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claims 1 and 7 are rejected under 35 U.S.C. 103 as being unpatentable over Oracle (Oracle. "Oracle Communications Networks Data Analytics Function User Guide". Release 22.1.0. https://docs.oracle.com/en/industries/communications/network-data-analytics/22.1.0/. (Year: 2022)) in view of Cai (US-20220131966-A1). Regarding claim 1, Oracle shows a method of managing an network behavior, the method comprising: receiving, from a consumer network function (NF), a request for analytics (pg. 44 lines 47-49, “The consumer NF sends an analytics request . . .”); collecting data for the analytics (pg. 44 lines 54-58; “the OCNWDAF subscribes to the NRF to receive notifications about load and status changes. . . ”) from a fifth-generation core (5GC) NF (pg. 9 lines 19-21; “Oracle Communications Network Data Analytics Function (OCNWDAF) is a Network Function (NF) in the 5G core network of the 5G Network Architecture.”); generating analytics information about the network based on the collected data (pg. 45 lines 1 -2, “The OCNWDAF derives the requested analytics.”); and transmitting the analytics information to the consumer NF (pg. 45 lines 3-8; “The OCNWDAF provides requested NF load analytics to the consumer NF . . .”), wherein the request comprises analytic filter information (pg. 44 lines 49-51, pg. 45 lines 23-31) comprising an instance identification (ID) of a target NF that analytics is to be provided for (pg. 44 lines 49-51 and 54-56, pg. 47 lines 8-11). Oracle does not show management of abnormal network behavior, including consideration of a signaling storm being an abnormal network behavior, and use of a target incident identifier (ID) indicating a cause of the signaling storm. Cai shows management of abnormal network behavior, including consideration of a signaling storm being an abnormal network behavior (Abstract, [2-7]) and use of a target incident identifier (ID) indicating a cause of the signaling storm ([6,15-16,80,99,102-103] discussing use of a “target UE” that identifies the device “causing the signaling storm”). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking implementation disclosure regarding 5G communications networks of Oracle with the signaling storm recovery operations of Cai, facilitated via modifying the request sent by Oracle such that the information available in Cai’s disclosure may be shared, and thus facilitating blocking or otherwise mitigating the impact of the storm, which one of ordinary skill in the art would have readily understood as a useful feature to help maintain continued and orderly operation of the monitored network. Regarding claim 7, Oracle shows managing an network behavior, comprising: receiving, from a consumer network function (NF), a request for analytics (pg. 44 lines 47-49, “The consumer NF sends an analytics request . . .”); collecting data for the analytics (pg. 44 lines 54-58; “the OCNWDAF subscribes to the NRF to receive notifications about load and status changes. . . ”) from a fifth-generation core (5GC) NF (pg. 9 lines 19-21; “Oracle Communications Network Data Analytics Function (OCNWDAF) is a Network Function (NF) in the 5G core network of the 5G Network Architecture.”); generating analytics information about the network based on the collected data (pg. 45 lines 1 -2, “The OCNWDAF derives the requested analytics.”); and transmitting the analytics information to the consumer NF (pg. 45 lines 3-8; “The OCNWDAF provides requested NF load analytics to the consumer NF . . .”), wherein the request comprises analytic filter information (pg. 44 lines 49-51, pg. 45 lines 23-31) comprising an instance identification (ID) of a target NF that analytics is to be provided for (pg. 44 lines 49-51 and 54-56, pg. 47 lines 8-11). Oracle does not show: a processor; and a memory electrically connected to the processor and configured to store instructions executable by the processor, wherein the instructions, when executed by the processor, cause the server device to perform a plurality of operations, the plurality of operations comprising: management of abnormal network behavior, including consideration of a signaling storm being an abnormal network behavior, and use of a target incident identifier (ID) indicating a cause of the signaling storm Cai shows: a processor (Fig. 9 item 902); and a memory electrically connected to the processor and configured to store instructions executable by the processor (Fig. 9 item 901), wherein the instructions, when executed by the processor, cause the server device to perform a plurality of operations, the plurality of operations comprising: management of abnormal network behavior, including consideration of a signaling storm being an abnormal network behavior (Abstract, [2-7]), and use of a target incident identifier (ID) indicating a cause of the signaling storm ([6,15-16,80,99,102-103] discussing use of a “target UE” that identifies the device “causing the signaling storm”). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking implementation disclosure regarding 5G communications networks of Oracle with the signaling storm recovery operations of Cai, facilitated via modifying the request sent by Oracle such that the information available in Cai’s disclosure may be shared, and thus facilitating blocking or otherwise mitigating the impact of the storm, which one of ordinary skill in the art would have readily understood as a useful feature to help maintain continued and orderly operation of the monitored network. Claims 2 – 6 and 8 - 12 are rejected under 35 U.S.C. 103 as being unpatentable over Oracle and Cai, as applied to claims 1 and 7 above, further in view of 3GPP (S2-2409138, "Support of QoS and policy assistance analytics", 3GPP TSG-SA2 Meeting #164, August 19-23, 2024, Maastricht, Netherlands. line and page numbers added. (Year: 2024)). Regarding claim 2, Oracle in view of Cai show wherein the request comprises a threshold (Oracle, pg. 28 lines 54-60, pg. 45 lines 9-14). Oracle in view of Cai does not show all of: wherein the request comprises analytics reporting information comprising a signaling number threshold and a user equipment (UE) number threshold, and the signaling number threshold indicates the number of signalings received within a time period. 3GPP shows wherein the request comprises analytics reporting information comprising a signaling number threshold and a user equipment (UE) number threshold (pg. 3 lines 46-50), and the signaling number threshold indicates the number of signalings received within a time period (pg. 3 lines 44-46). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking disclosure of Oracle in view of Cai with the updated 5G standards implementation guidelines in the 3GPP documentation in order to ensure the resultant invention operates in compliance with the 3GPP standards document, and thus interoperates reliable with other networking devices. Regarding claim 3, Oracle in view of Cai show claim 1. Oracle in view of Cai does not show: wherein the data comprises UE-related context data, and the UE-related context data comprises information regarding a number of session reports received from a user plane function (UPF), and the number of session reports received from the UPF is a number of session reports received from the UPF triggered by a downlink (DL) packet if a PDU session is in a 5G CM(connection management)-idle state. 3GPP shows: wherein the data comprises UE-related context data (pg. 7 lines 24-28), and the UE-related context data comprises information regarding a number of session reports received from a user plane function (UPF) (pg. 7 lines 19-22), and the number of session reports received from the UPF is a number of session reports received from the UPF triggered by a downlink (DL) packet if a PDU session is in a 5G CM(connection management)-idle state (pg. 7 lines 19-22). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking disclosure of Oracle in view of Cai with the updated 5G standards implementation guidelines in the 3GPP documentation in order to ensure the resultant invention operates in compliance with the 3GPP standards document, and thus interoperates reliable with other networking devices. Regarding claim 4, Oracle in view of Cai show claim 1. Oracle in view of Cai does not show: wherein the data comprises NF context data, the NF context data comprises NF load status information, and the NF load status information indicates a current load of an NF and an NF service. 3GPP shows wherein the data comprises NF context data (pg. 7 lines 22-23), the NF context data comprises NF load status information (pg. 8 lines 20-22), and the NF load status information indicates a current load of an NF and an NF service (pg. 8 lines 20-22). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking disclosure of Oracle in view of Cai with the updated 5G standards implementation guidelines in the 3GPP documentation in order to ensure the resultant invention operates in compliance with the 3GPP standards document, and thus interoperates reliable with other networking devices. Regarding claim 5, Oracle in view of Cai show claim 1. Oracle in view of Cai does not show: wherein the data comprises NF feature data; and the NF feature data comprises load information of a connected UPF. 3GPP shows: wherein the data comprises NF feature data; and the NF feature data comprises load information of a connected UPF (pg. 8 lines 8-11). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking disclosure of Oracle in view of Cai with the updated 5G standards implementation guidelines in the 3GPP documentation in order to ensure the resultant invention operates in compliance with the 3GPP standards document, and thus interoperates reliable with other networking devices. Regarding claim 6, Oracle in view of Cai show claim 1. Oracle in view of Cai does not show: wherein the data comprises application function (AF) data indicating application activation time information, and the AF data comprises information regarding: an application ID; user activation time information; a number of UEs; an active time; an inactive time; and a UE ID type. 3GPP shows: wherein the data comprises application function (AF) data indicating application activation time information, and the AF data comprises information regarding: an application ID; user activation time information; a number of UEs; an active time; an inactive time; and a UE ID type (pg. 8 lines 33-48). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking disclosure of Oracle in view of Cai with the updated 5G standards implementation guidelines in the 3GPP documentation in order to ensure the resultant invention operates in compliance with the 3GPP standards document, and thus interoperates reliable with other networking devices. Regarding claim 8, said claim recites limitations corresponding to those addressed in the rejection of claim 2 above. Regarding claim 9, said claim recites limitations corresponding to those addressed in the rejection of claim 3 above. Regarding claim 10, said claim recites limitations corresponding to those addressed in the rejection of claim 4 above. Regarding claim 11, said claim recites limitations corresponding to those addressed in the rejection of claim 5 above. Regarding claim 12, said claim recites limitations corresponding to those addressed in the rejection of claim 6 above. Conclusion Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOHN M MACILWINEN whose telephone number is (571)272-9686. The examiner can normally be reached Monday - Friday, 9:00 - 5:00. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Glenton B Burgess can be reached at (571) 272 - 3949. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. JOHN MACILWINEN Primary Examiner Art Unit 2442 /JOHN M MACILWINEN/Primary Examiner, Art Unit 2454
Read full office action

Prosecution Timeline

Dec 02, 2024
Application Filed
Apr 27, 2026
Non-Final Rejection mailed — §103
Jul 07, 2026
Response Filed
Sep 14, 2026
Final Rejection mailed — §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12744816
CENTRALIZED COMPLIANCE MANAGEMENT PLATFORM FOR SECURITY OBJECTS
2y 8m to grant Granted Sep 22, 2026
Patent 12712804
PACKET TRANSMISSION METHOD, APPARATUS, AND SYSTEM, NETWORK DEVICE, AND STORAGE MEDIUM
2y 7m to grant Granted Aug 18, 2026
Patent 12706934
Systems and methods for active directory protection in zero trust networks
2y 4m to grant Granted Aug 11, 2026
Patent 12689559
AUTOMATED PREVENTATIVE CONTROLS IN DIGITAL WORKFLOW
2y 4m to grant Granted Jul 21, 2026
Patent 12676892
Security policy framework for cloud environments
2y 8m to grant Granted Jul 07, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

3-4
Expected OA Rounds
68%
Grant Probability
95%
With Interview (+27.9%)
3y 11m (~2y 1m remaining)
Median Time to Grant
Moderate
PTA Risk
Based on 689 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month