CTNF 18/967,577 CTNF 95839 Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Claim Rejections - 35 USC § 103 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-23-aia AIA The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows: 1. Determining the scope and contents of the prior art. 2. Ascertaining the differences between the prior art and the claims at issue. 3. Resolving the level of ordinary skill in the pertinent art. 4. Considering objective evidence present in the application indicating obviousness or nonobviousness. 07-21-aia AIA Claim s 1, 2, 5-13, 18 are rejected under 35 U.S.C. 103 as being unpatentable over Liu ( CN 116992052 B ) in further view of La Conca (US 20250383948 A1) . With respect to claims 1 Liu teaches A computer-implemented method comprising: storing threat intelligence documents (Liu ¶ [0010] Therefore, how to quickly generate summative intelligence information has become an urgent issue to solve, and the threat of intelligence loss has become an urgent issue. Sources usually include short and long texts, such as security news, security blogs, and open-source intelligence. Currently, the existing long-text summarization methods used in the threat intelligence field still lag significantly behind those written by security analysts and cannot be effectively used in security defense.) ; storing, in a graph data store, a graph comprising: entity nodes corresponding to entities extracted from the threat intelligence documents (Liu ¶ [0015] Describe the necessary information nodes corresponding to the scenario category to which the security information belongs and the entity nodes associated with it) ; and a plurality of edges between the entity nodes representative of relationships between the entity nodes extracted from the threat intelligence documents (Liu ¶ [0095] In the embodiments of the present invention, the problem of identifying the critical path subgraph and finding the shortest path among them can be abstracted into two subproblems, namely: how to identify the critical path subgraph containing the above nodes and edges in the information context diagram; and how to find the shortest path to traverse all nodes on the critical path subgraph. ) ; storing data linking the entity nodes and plurality of edges to the threat intelligence documents from which the entity nodes and plurality of edges were extracted (Liu ¶ [0097] Furthermore, searching for all constraint subgraphs on the aggregated graph includes: Step a, storing the necessary information nodes and their corresponding edges in the constraint set as edge tables) ; generating an input for a generative machine learning model comprising: a first entity node of the entity nodes ( ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries) ; a plurality of second entity nodes of the entity nodes, the plurality of second entity nodes connected to the first entity node by connecting edges of the plurality of edges (Liu ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head [first entity] entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries.) ; a subset of the threat intelligence documents from which the first entity node, the plurality of second entity nodes, and the connecting edges were extracted ( Liu ¶ [0079] First, enter in the large model Alpaca: You are a threat intelligence expert. This is an article about malware activity, requiring the attacker xxx to use xxx malware, attacking xxx during xxx time through xxx infection form) ; instructions, which when processed by the generative machine learning model, cause the generative machine learning model to generate a summary text of threat intelligence for the first entity node, based on the first entity node, the plurality of second entity nodes, and the subset of the threat intelligence documents (Liu ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries. Among them, the large model Alpaca can be fine-tuned through internal security knowledge graphs and threat intelligence data. For example, input: Please generate a text summary based on the sequence of triplets. The sequence of triplets is as follows, <APT2333, leverage, D software>, <APT2333, attack, Bank of Y >. The generated summary is as follows: Recently, the Advanced Persistent Threat Group APT2333 exploited a vulnerability in D software to launch a cyberattack on a bank in Country Y. APT2333 is a cyberattack organization from Country X, which has long targeted governments and critical infrastructure. This time, the method of exploiting known software vulnerabilities is consistent with APT2333's previous actions. Although the information obtained from APT2333 attack is still unclear, it indicates that cyberattack activities are ongoing. It is necessary to continuously monitor APT2333 new developments, focusing on the technical methods they use to acquire and exploit software vulnerabilities to more effectively counter future attacks. After generating the abstract content, you can first format the initial letters of the sentence and the half-width punctuation to prevent accidental errors during data transmission. Then output a summary.) providing the input to the generative machine learning model, and in response, receiving the summary text (Liu ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries. Among them, the large model Alpaca can be fine-tuned through internal security knowledge graphs and threat intelligence data. For example, input: Please generate a text summary based on the sequence of triplets. The sequence of triplets is as follows, <APT2333, leverage, D software>, <APT2333, attack, Bank of Y >. The generated summary is as follows: Recently, the Advanced Persistent Threat Group APT2333 exploited a vulnerability in D software to launch a cyberattack on a bank in Country Y. APT2333 is a cyberattack organization from Country X, which has long targeted governments and critical infrastructure. This time, the method of exploiting known software vulnerabilities is consistent with APT2333's previous actions. Although the information obtained from APT2333 attack is still unclear, it indicates that cyberattack activities are ongoing. It is necessary to continuously monitor APT2333 new developments, focusing on the technical methods they use to acquire and exploit software vulnerabilities to more effectively counter future attacks. After generating the abstract content, you can first format the initial letters of the sentence and the half-width punctuation to prevent accidental errors during data transmission. Then output a summary.) Liu does not explicitly disclose however La Conca teaches inserting a summary node into the graph comprising the summary text (La Conca ¶ [0040] A heterogeneous (i.e. enhanced) tree is automatically derived from the homogeneous process tree. The new tree has all the nodes of the process tree plus summary nodes. Each summary node corresponds to a batch and will hold the summary of the summary node's descendant nodes. Summary nodes are inserted between two existing nodes or between a parent node and its children. Each summary node has a summary field which will contain the natural language summary of its descendants. Experimental results proved that using a tree-based representation of logs allowed an LLM to better comprehend the overall session and avoid repetition. Repetition is an example of decreased signal-to-noise ratio as discussed in the above Background.) ; and inserting edges into the graph connecting the summary node to the first entity node and the plurality of second entity nodes (La Conca ¶[0040] A heterogeneous (i.e. enhanced) tree is automatically derived from the homogeneous process tree. The new tree has all the nodes of the process tree plus summary nodes. Each summary node corresponds to a batch and will hold the summary of the summary node's descendant nodes. Summary nodes are inserted between two existing nodes or between a parent node and its children. Each summary node has a summary field which will contain the natural language summary of its descendants. Experimental results proved that using a tree-based representation of logs allowed an LLM to better comprehend the overall session and avoid repetition. Repetition is an example of decreased signal-to-noise ratio as discussed in the above Background. ) It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify threat intelligence monitoring of Liu to include the summary nodes of La Conca in order to increase the efficiency of threat management by looking at summary info. With respect to claim 2 Liu teaches :selecting, as the plurality of second entity nodes, entity nodes within n hops of the first entity node (Liu ¶ [0109] Execute step S104 to determine the shortest path to traverse all nodes in the critical path subdiagram, which may include: determining the main node in the critical path subgraph based on the scenario category to which the long-text security information belongs; Select any two principal nodes and calculate the shortest path between these two principal nodes (Dijkstra algorithm) with other principal nodes acting as intermediate nodes, which is the shortest path for all nodes in the critical path subgraph. Specifically, this can be achieved through the following steps:) With respect to claim 5 Liu teaches comprising: receiving a threat intelligence document of the threat intelligence documents (Liu ¶ [0120] As shown in Figure 2, another aspect of the present invention further includes afunctional module architecture that is exactly consistent with the aforementioned method flow. That is, the embodiments of the present invention also provide a long-text summarization device for the field of threat intelligence, including: intelligence element extraction Module 201, used to extract intelligence elements containing the head entity, tail entity, and their relationships from the input long-text security information; An information context map building module 202, used to construct an information network map based on extracted intelligence elements; A critical path subgraph recognition module 203, used to identify critical path subgraphs in the information velocity diagram, comprising the following nodes: the necessary information node corresponding to the scenario category to which the long text security information belongs and its associated entity node; Aggregated entity nodes and their associated attribute nodes in the entity cluster nodes; and if TTPs information exists, it includes the entity nodes contained in the TTPs; Shortest path determination module 204, used to determine the shortest path traversing all nodes in the critical path subgraph; Summary generation module 205, used to represent the shortest path as a triple sequence of < head entity, relation, and tail entity >, and generate a summary based on the triple sequence.) ; generating an input for a generative machine learning model comprising: content of the threat intelligence document (Liu ¶ [0120] As shown in Figure 2, another aspect of the present invention further includes a functional module architecture that is exactly consistent with the aforementioned method flow. That is, the embodiments of the present invention also provide a long-text summarization devicefor the field of threat intelligence, including: intelligence element extraction Module 201, used to extract intelligence elements containing the head entity, tail entity, and their relationships from the input long-text security information; An information context map building module 202, used to construct an information network map based on extracted intelligence elements; A critical path subgraph recognition module 203, used to identify critical path subgraphs in the information velocity diagram, comprising the following nodes: the necessary information node corresponding to the scenario category to which the long text security information belongs and its associated entity node; Aggregated entity nodes and their associated attribute nodes in the entity cluster nodes; and if TTPs information exists, it includes the entity nodes contained in the TTPs; Shortest path determination module 204, used to determine the shortest path traversing all nodes in the critical path subgraph; Summary generation module 205, used to represent the shortest path as a triple sequence of < head entity, relation, and tail entity >, and generate a summary based on the triple sequence.) ; and instructions, which when processed by the generative machine learning model, cause the generative machine learning model to return a plurality of entity nodes and a plurality of edges defined between respective pairs of entity nodes of the plurality of entity nodes based on the content of the threat intelligent document (Liu ¶ [0123] Furthermore, the information context graph building module is specifically used to: create directed graphs according tothe triple of head entities, tail entities, and their relationships; Based on the security knowledge graph, the directed graph issupplemented with entity nodes and corresponding relationships to obtain an information context map.) ; providing the input to the generative machine learning model and receiving a response comprising the plurality of entities and plurality of relationships (Liu ¶ [0123] Furthermore, the information context graph building module is specifically used to: create directed graphs according tothe triple of head entities, tail entities, and their relationships; Based on the security knowledge graph, the directed graph is supplemented with entity nodes and corresponding relationships to obtain an information context map.) ; storing the plurality of entities and plurality of relationships in the graph data store (Liu¶ [0097] Furthermore, searching for all constraint subgraphs on the aggregated graph includes: Step a, storing the necessary information nodes and their corresponding edges in the constraint set as edge tables) With respect to claims 6 and 15 Liu teaches comprising: generating an input for a generative machine learning model comprising: the plurality of entity nodes and the plurality of edges (Liu ¶ [0120] As shown in Figure 2, another aspect of the present invention further includes a functional module architecture that is exactly consistent with the aforementioned method flow. That is, the embodiments of the present invention also provide a long-text summarization device for the field of threat intelligence, including: intelligence element extraction.) ; instructions, which when processed by the generative machine learning model, cause the generative machine learning model to identify redundant edges or entity nodes amongst the plurality of edges and entity nodes (Liu ¶ [0120] As shown in Figure 2, another aspect of the present invention further includes a functional module architecture that is exactly consistent with the aforementioned method flow. That is, the embodiments of the present invention also provide a long-text summarization device for the field of threat intelligence, including: intelligence element extraction Module 201, used to extract intelligence elements containing the head entity, tail entity, and their relationships from the input long-text security information; An information context map building module 202, used to construct an information network map based on extracted intelligence elements; A critical path subgraph recognition module 203, used to identify critical path subgraphs in the information velocity diagram, comprising the following nodes: the necessary information node corresponding to the scenario category to which the long text security information belongs and its associated entity node; Aggregated entity nodes and their associated attribute nodes in the entity cluster nodes; and if TTPs information exists, it includes the entity nodes contained in the TTPs; Shortest path determination module 204, used to determine the shortest path traversing all nodes in the critical path subgraph; Summary generation module 205, used to represent the shortest path as a triple sequence of < head entity, relation, and tail entity >, and generate a summary based on the triple sequence, ) ; providing the input to the generative machine learning model and receiving a response identifying the redundant edges or entity nodes (Liu ¶ [0120] As shown in Figure 2, another aspect of the present invention further includes a functional module architecture that is exactly consistent with the aforementioned method flow. That is, the embodiments of the present invention also provide a long-text summarization device for the field of threat intelligence, including: intelligence element extraction Module 201, used to extract intelligence elements containing the head entity, tail entity, and their relationships from the input long-text security information; ¶[0126] Furthermore, the critical path subgraph recognition module is specifically used for: presetting a directed information context graph to an undirected information context graph; aggregate the attribute information of entity nodes in the undirected information context graph to obtain the aggregated graph; Search all constrained subgraphs on the aggregated graph to obtain a set of constraint subgraphs; The constraint subgraph is the largest connected subgraph composed of the necessary information [removed redundance] nodes and their corresponding edges corresponding to the scenario category to which the long text security information belongs) ; and storing the plurality of entity nodes and plurality of edges other than the redundant entity nodes or edges in the graph data store (Liu ¶[0127] Furthermore, aggregating the attribute information of entity nodes in the undirected information context graph includes: keeping only the edges between the attribute nodes and entity nodes in the undirected information context graph, while removing the attribute nodes from other sections). With respect to claim 7 Liu teaches comprising retrieving the summary node from the graph data store, and based on the summary node, implementing a mitigation action in a security system (Liu ¶ [0118] The generated summary is as follows: Recently, the Advanced Persistent Threat Group APT2333 exploited a vulnerability in D software to launch a cyberattack on a bank in Country Y. APT2333 is a cyberattack organization from Country X, which has long targeted governments and critical infrastructure. This time, the method of exploiting known software vulnerabilities is consistent with APT2333's previous actions. Although the information obtained from APT2333 attack is still unclear, it indicates that cyberattack activities are ongoing. It is necessary to continuously monitor APT2333 new developments, focusing on the technical methods they use to acquire and exploit software vulnerabilities to more effectively counter future attacks. After generating the abstract content, you can first format the initial letters of the sentence and the half-width punctuation to prevent accidental errors during data transmission. Then output a summary.) With respect to claims 10 and 16 Liu teaches wherein the plurality of entity nodes represents one or more of: a threat actor, an organization that has been attacked, an IP address, a file hash, a threat vector, an operating system, and a common vulnerability and exploit (Liu ¶ [0077] Executing step S101 may include: determining the scenario category of the input long text security information; Based on prompts corresponding to the scenario category, answers about the long text security information are obtained in a Q&A format; The resulting answers are represented as triplets < the head entity, the relationship, the tail entity>. Based on the long-term experience of security analysts, the present invention divides the long-text security information into the following scenario categories: malware activity category, where essential information includes the attacker [threat actor] and the associated malware, activity time, infection chain, and victim information; Ransomware analysis includes essential information as basic information about ransomware, including language encoding, functional functions, infection chain, encryption algorithms used, ransomware tokens, and encrypted file extensions; Exploitation analysis is essential information, including the vulnerability number and the exploitation process; For new malware variant types, essential information includes features added by the new variant or information distinguishing them from the original malware; General intelligence class, where essential information is the default information. In one embodiment of the present invention, a text classification model can be used to determine the scenario category of the input long text security information. Specifically, the input long text security information is encoded using the SecBERT model customized based on the security corpus to obtain the encoding vector; Then, the Softmax model is used to perform multi-scenario classification of the encoding vectors) With respect to claims 11 Liu teaches ) A computer system comprising a processor and a memory, the memory storing instructions, the instructions when executed by the processor causing the system to: ([0133] The present invention also provides an electronic device, comprising a processor and memory connected to the processor, wherein the memory stores multiple instructions, which can be loaded and executed by the processor to enable the processor to execute the method described in Embodiment 1.) retrieve threat intelligence documents; (Liu ¶ [0013] Extracting intelligence elements containing the head entity, tail entity, and their relationships from theinput long-text security information;) generate a plurality of first inputs for a generative machine learning model, the first inputs comprising: contents of a threat intelligence document of the threat intelligence documents (Liu ¶ [0078] For different scenario categories, the present invention can use the finely tuned pre-trained large model Alpaca, which extracts intelligence elements through human-computer dialogue and questions and answers based on artificially accumulated prompts from different scenarios. Specifically, for example, the following steps can be included:¶ [0079] First, enter in the large model Alpaca: You are a threat intelligence expert. This is an article aboutmalware activity, requiring the attacker xxx to use xxx malware, attacking xxx during xxx time through xxxinfection form) ; and instructions, which when processed by the generative machine learning model, cause the generative machine learning model to return a plurality of entity nodes and a plurality of edges defined between respective pairs of entities of the plurality of entities based on the contents of the threat intelligent document (Liu ¶ [0078] For different scenario categories, the present invention can use the finely tuned pre-trained large model Alpaca,which extracts intelligence elements through human-computer dialogue and questions and answers based on artificially accumulated prompts from different scenarios. Specifically, for example, the following steps can be included: [0079] First, enter in the large model Alpaca: You are a threat intelligence expert. This is an article aboutmalware activity, requiring the attacker xxx to use xxx malware, attacking xxx during xxx time through xxxinfection form) ; provide the plurality of first inputs to the generative machine learning model and receive responses comprising the plurality of entity nodes and the plurality of edges (Liu¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries.) ; store, in a graph data store, the plurality of entity nodes and the plurality of edges (Liu ¶ [0087] Execute Step S102: Based on the extracted intelligence elements, construct an informationcontext map, which may include: following the head, entity, and tail Entity and its relationship triplets, establishing directed graphs; Based on the security knowledge graph, the directed graph is supplemented with entity nodes and corresponding relationships to obtain an information context map. In one example, for instance, the original text does not mention APT2333 (Note: a virtual name, not real existing), this attack group is an APT (Advanced Persistent Threat) with a background in CountryX(AdvancedPersistent Threat). Continuous threats at the level) organization, the corresponding geographic nodes and corresponding edges of the relationship are supplemented in the directed graph. For example: <APT2333, located in Country X >.); store data linking the plurality of entity nodes and the plurality of edges to the threat intelligence document from which the plurality of entity nodes and the plurality of edges were extracted; generate a second input for the generative machine learning model comprising instructions that cause the generative machine learning model to generate a summary text of threat intelligence for a first entity node of the plurality of entity nodes, based on the threat intelligence document from which the first entity node was extracted (Liu ¶ [0087] Execute Step S102: Based on the extracted intelligence elements, construct an information context map, which may include: following the head, entity, and tail Entity and its relationship triplets, establishing directed graphs; Based on the security knowledge graph, the directed graph is supplemented with entity nodes and corresponding relationships to obtain an information context map. In one example, for instance, the original text does not mention APT2333 (Note: a virtual name, not real existing), this attack group is an APT (Advanced Persistent Threat) with a background in CountryX(AdvancedPersistent Threat). Continuous threats at the level) organization, the corresponding geographic nodes and corresponding edges of the relationship are supplemented in the directed graph. For example: <APT2333, located in Country X >.) ; provide the second input to the generative machine learning model, and in response receive the summary text (Liu ¶ [0118] The sequence of triplets is as follows, <APT2333, leverage, Dsoftware>, <APT2333, attack, Bank of Y >. The generated summary is as follows: Recently, theAdvanced Persistent Threat Group APT2333 exploited a vulnerability in D software to launch acyberattack on a bank in Country Y. APT2333 is a cyberattack organization from Country X, which haslong targeted governments and critical infrastructure. This time, the method of exploiting knownsoftware vulnerabilities is consistent with APT2333's previous actions. Although the informationobtained from APT2333 attack is still unclear, it indicates that cyberattack activities are ongoing. It isnecessary to continuously monitor APT2333 new developments, focusing on the technical methodsthey use to acquire and exploit software vulnerabilities to more effectively counter future attacks.After generating the abstract content, you can first format the initial letters of the sentence and the half-width punctuation to prevent accidental errors during data transmission. Then output asummary.) Liu does not explicitly disclose however LA Conca teaches and insert a summary node into the graph data store comprising the generated summary text ¶[0034] In another aspect, when executed by the processor, the instructions stored in the memory cause the processor to translate the subgraph to the first summary by translating the subgraph to a plurality of triplets, each triplet comprising three or more words that represent a relationship between a pair of nodes of the subgraph) ; With respect to claim 12, Liu teaches wherein the second input comprises: the first entity node of the plurality of entities (Liu ¶ [0095] In the embodiments of the present invention, the problem of identifying the critical path subgraph and finding the shortest path among them can be abstracted into two subproblems, namely: how to identify the critical path subgraph containing the above nodes and edges in the information context diagram; and how to find the shortest path to traverse all nodes on the critical path subgraph. ) ;; a plurality of second entity nodes of the plurality of entity nodes connected to the first entity by connecting edges of the plurality of edges (Liu ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head [first entity] entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries.) ; a subset of the threat intelligence documents from which the first entity nodes, second entity nodes, and connecting relationships were extracted (Liu ¶ [0079] First, enter in the large model Alpaca: You are a threat intelligence expert. This is an article about malware activity, requiring the attacker xxx to use xxx malware, attacking xxx during xxx time through xxx infection form) ; instructions, which when processed by the generative machine learning model, cause the generative machine learning model to generate the summary text, based on the first entity node, second entity nodes, and the subset of the threat intelligence documents (Liu ¶ [0079] First, enter in the large model Alpaca: You are a threat intelligence expert. This is an article about malware activity, requiring the attacker xxx to use xxx malware, attacking xxx during xxx time through xxx infection form) ; With respect to claim 13 Liu teaches wherein the second entity nodes are entity nodes within 1 hop of the first entity node (Liu ¶ [0109] Execute step S104 to determine the shortest path to traverse all nodes in the critical path subdiagram, which may include: determining the main node in the critical path subgraph based on the scenario category to which the long-text security information belongs; Select any two principal nodes and calculate the shortest path between these two principal nodes (Dijkstra algorithm) with other principal nodes acting as intermediate nodes, which is the shortest path for all nodes in the critical path subgraph. Specifically, this can be achieved through the following steps:) With respect to claim 18, Liu teaches A non-transitory computer-readable medium comprising instructions, which when executed by a processor, cause the processor to (¶[0059] The fourth aspect of the present invention provides an electronic device, comprising a processor and memory connected to the processor, wherein the memory stores multiple instructions, which can be loaded and executed by the processor to enable the processor to execute the method described in the first aspect.) : generate an input for a generative machine learning model comprising: a first entity node of a plurality of entity nodes extracted from threat intelligence documents ( ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries) ; a plurality of second entity nodes of the plurality of entity nodes connected to the first entity node by connecting edges extracted from the threat intelligence documents (Liu ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head [first entity] entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries.) ; the threat intelligence documents from which the first entity nodes, second entity nodes, and the connecting edges were extracted ( Liu ¶ [0079] First, enter in the large model Alpaca: You are a threat intelligence expert. This is an article about malware activity, requiring the attacker xxx to use xxx malware, attacking xxx during xxx time through xxx infection form) ; instructions, which when processed by the generative machine learning model, cause the generative machine learning model to generate a summary text of threat intelligence for the first entity node, based on the first entity node, the second entity nodes and the threat intelligence documents (Liu ¶ [0079] First, enter in the large model Alpaca: You are a threat intelligence expert. This is an article about malware activity, requiring the attacker xxx to use xxx malware, attacking xxx during xxx time through xxx infection form) ; provide the input to the generative machine learning model, and in response receive the summary text (Liu ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries. Among them, the large model Alpaca can be fine-tuned through internal security knowledge graphs and threat intelligence data. For example, input: Please generate a text summary based on the sequence of triplets. The sequence of triplets is as follows, <APT2333, leverage, D software>, <APT2333, attack, Bank of Y >. The generated summary is as follows: Recently, the Advanced Persistent Threat Group APT2333 exploited a vulnerability in D software to launch a cyberattack on a bank in Country Y. APT2333 is a cyberattack organization from Country X, which has long targeted governments and critical infrastructure. This time, the method of exploiting known software vulnerabilities is consistent with APT2333's previous actions. Although the information obtained from APT2333 attack is still unclear, it indicates that cyberattack activities are ongoing. It is necessary to continuously monitor APT2333 new developments, focusing on the technical methods they use to acquire and exploit software vulnerabilities to more effectively counter future attacks. After generating the abstract content, you can first format the initial letters of the sentence and the half-width punctuation to prevent accidental errors during data transmission. Then output a summary.) With respect to claim 19, Liu does not explicitly disclose however Zawadowskiy teaches store the plurality of entity nodes and the connecting edges in a graph of a graph data store Zawadowskiy ¶[0048] In another aspect, when executed by the computer, the instructions stored in the computer-readable storage medium cause the processor to: translate the subgraph to the first summary by translating the subgraph to a plurality of triplets, each triplet comprising three or more words that represent a relationship between a pair of nodes of the subgraph); insert a summary node into the graph comprising the generated summary text; and insert edges into the graph data store connecting the summary node to the first entity node and plurality of second entity nodes Zawadowskiy ¶[0048] In another aspect, when executed by the computer, the instructions stored in the computer-readable storage medium cause the processor to: translate the subgraph to the first summary by translating the subgraph to a plurality of triplets, each triplet comprising three or more words that represent a relationship between a pair of nodes of the subgraph. ) 07-21-aia AIA Claim s 3 are rejected under 35 U.S.C. 103 as being unpatentable over Liu and La Conca in further view of Kumari (US 20210327108 A1) . With respect to claim 3 none of Liu and La Conca don’t explicitly disclose however Kumari teaches comprising: applying a community detection algorithm to the graph to generate a plurality of communities (Kumari ¶ [0021] FIGS. 9A-9B illustrate a graphical user interface for providing visual representations of sub-communities corresponding to a selected community in accordance with one or more embodiments) ; selecting a community of the plurality of communities comprising the first entity node Kumari ¶ [0021] FIGS. 9A-9B illustrate a graphical user interface for providing visual representations of sub-communities corresponding to a selected community in accordance with one or more embodiments) ; selecting entity nodes in the selected community other than the first entity node as the plurality of second entity nodes Kumari ¶ [0021] FIGS. 9A-9B illustrate a graphical user interface for providing visual representations of sub-communities corresponding to a selected community in accordance with one or more embodiments) . It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify threat intelligence monitoring of Liu to include the summary nodes of La Conca to include community detection of Kumari in order to increase the efficiency of threat management by looking at grouped information . 07-21-aia AIA Claim s 4, 14 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Liu, La Conca in further view of Kumari (US 20210327108 A1), Mumme (US 20180034654 A1) and Yap (US 20260030304 A1) With respect to claims 4, 14 and 20 , Liu teaches providing the input to the generative machine learning model and receiving a response comprising the community summary (Liu ¶ [0118] Execute step S105, representing the shortest path as a triple sequence > < the head entity, the relationship, and the tail entity; and generate a summary based on the triplet sequence. Specifically, related abstract generation can be performed based on large models, including the following steps: represent the shortest path as a triplet sequence < the head entity, relation, and tail entity >; Based on dialogue, it uses triple sequences and the large model Alpaca to generate summaries. Among them, the large model Alpaca can be fine-tuned through internal security knowledge graphs and threat intelligence data. For example, input: Please generate a text summary based on the sequence of triplets. The sequence of triplets is as follows, <APT2333, leverage, D software>, <APT2333, attack, Bank of Y >. The generated summary is as follows: Recently, the Advanced Persistent Threat Group APT2333 exploited a vulnerability in D software to launch a cyberattack on a bank in Country Y. APT2333 is a cyberattack organization from Country X, which has long targeted governments and critical infrastructure. This time, the method of exploiting known software vulnerabilities is consistent with APT2333's previous actions. Although the information obtained from APT2333 attack is still unclear, it indicates that cyberattack activities are ongoing. It is necessary to continuously monitor APT2333 new developments, focusing on the technical methods they use to acquire and exploit software vulnerabilities to more effectively counter future attacks. After generating the abstract content, you can first format the initial letters of the sentence and the half-width punctuation to prevent accidental errors during data transmission. Then output a summary.) La Conca further teaches inserting a plurality of summary nodes into the graph, the summary nodes summarizing different ones of the entity nodes (La Conca¶[0034] In another aspect, when executed by the processor, the instructions stored in the memory cause the processor to translate the subgraph to the first summary by translating the subgraph to a plurality of triplets, each triplet comprising three or more words that represent a relationship between a pair of nodes of the subgraph) ; and inserting a community summary node into the graph comprising the generated community summary (La Conca¶ [0034] In another aspect, when executed by the processor, the instructions stored in the memory cause the processor to translate the subgraph to the first summary by translating the subgraph to a plurality of triplets, each triplet comprising three or more words that represent a relationship between a pair of nodes of the subgraph); ) Kumari further teaches applying a community detection algorithm to the graph to generate a plurality of communities (Kumari ¶ [0021] FIGS. 9A-9B illustrate a graphical user interface for providing visual representations of sub-communities corresponding to a selected community in accordance with one or more embodiments;) selecting a community of the plurality of communities (Kumari ¶ [0021] FIGS. 9A-9B illustrate a graphical user interface for providing visual representations of sub-communities corresponding to a selected community in accordance with one or more embodiments;) It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify threat intelligence monitoring of Liu to include the summary nodes of La Conca to include community detection of Kumari in order to increase the efficiency of threat management by looking at grouped information. None of Liu, La Conca and Kumari explicitly disclose but Mumme teaches extracting summary nodes comprised in the selected community (Mumme ¶ [0016] The analytics server may generate a set of summary nodes based on the received notifications. Each summary node may be associated with multiple event notifications. The summary nodes may typically include location information (e.g., geographic location, grid coordinates, etc.) and/or other information related to the event notifications (e.g., number of notifications, sensor data including mean and standard deviation, etc.).) It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify threat intelligence monitoring of Liu to include the summary nodes of La Conca in view of community detection of Kumari to include in order to increase the efficiency of threat management by looking at grouped information. None of Liu La Conca Kumari and Mumme explicitly disclose but Yap teaches generating an input for a generative machine learning model comprising: the summary text of the extracted summary nodes, and instructions, which when processed by the generative machine learning model, cause the generative machine learning model to generate a community summary, based on the summary text of the extracted summary nodes (Yap ¶ [0096] In Example 3, the subject matter of Example 2, wherein the generating of the tree structure further comprises: assigning, for each item in the catalog, the metadata for the item as a description of the leaf node created for the item; and for each non-leaf node in the tree structure: generating a prompt for the LLM that instructs the LLM to summarize the child nodes of the non-leaf node; receiving, from the LLM and in response to the prompt, an output comprising a summary of the non-leaf node; and assigning, to the node, the summary of the node as a description of the non-leaf node.) It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify threat intelligence monitoring of Liu to include the summary nodes of La Conca in view of community detection of Kumari in view of summary nodes of Mumme to include community summary of Yap in order to reduce latency before a decision is provided ([0016], Yap) . 07-21-aia AIA Claim s 8, 9, 17 are rejected under 35 U.S.C. 103 as being unpatentable over Liu, La Conca in further view of Zawadowskiy With respect to claim 8 and 17 Liu and La Conca don’t explicitly disclose however Zawadowskiy taches comprising: causing rendering of a user interface comprising a visual representation of at least part of the graph (Zawadowskiy ¶ [0093] According to some examples, in step 418, the method includes displaying results in a GUI. The GUI can include both the text of the summary and a visual representation of the subgraph. The subgraph provides ground truth, and the summary provides a more easily comprehended mechanism for understanding the subgraph. According to certain non-limiting examples, a user can select a portion of the text of the summary 132, and, in response, the GUI highlights a corresponding portion of the subgraph associated with the selected text. Thus, starting from the text of the summary, a security analyst can quickly find the relevant features in the subgraph that correspond to portions of the text of the summary. Then referring to the corresponding region of the subgraph, the security analyst can verify that, for the relevant features, the relations expressed in the text are consistent with the corresponding region of the subgraph, thereby confirming a correct understanding of the threat.) ; receiving user input selecting the summary node (Zawadowskiy ¶ [0093] According to some examples, in step 418, the method includes displaying results in a GUI. The GUI can include both the text of the summary and a visual representation of the subgraph. The subgraph provides ground truth, and the summary provides a more easily comprehended mechanism for understanding the subgraph. According to certain non-limiting examples, a user can select a portion of the text of the summary 132, and, in response, the GUI highlights a corresponding portion of the subgraph associated with the selected text. Thus, starting from the text of the summary, a security analyst can quickly find the relevant features in the subgraph that correspond to portions of the text of the summary. Then referring to the corresponding region of the subgraph, the security analyst can verify that, for the relevant features, the relations expressed in the text are consistent with the corresponding region of the subgraph, thereby confirming a correct understanding of the threat.) and causing rendering of the summary text (Zawadowskiy ¶ [0093] According to some examples, in step 418, the method includes displaying results in a GUI. The GUI can include both the text of the summary and a visual representation of the subgraph. The subgraph provides ground truth, and the summary provides a more easily comprehended mechanism for understanding the subgraph. According to certain non-limiting examples, a user can select a portion of the text of the summary 132, and, in response, the GUI highlights a corresponding portion of the subgraph associated with the selected text. Thus, starting from the text of the summary, a security analyst can quickly find the relevant features in the subgraph that correspond to portions of the text of the summary. Then referring to the corresponding region of the subgraph, the security analyst can verify that, for the relevant features, the relations expressed in the text are consistent with the corresponding region of the subgraph, thereby confirming a correct understanding of the threat.) It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify threat intelligence monitoring of Liu to include the summary nodes of La Conca include interface of Zawadowskiy in order improve methos of summarizing threat alerts ([0004], Zawadowskiy) With respect to claim 9 Zawadowskiy further teaches comprising: causing rendering of navigation controls for navigating the graph (Zawadowskiy ¶ [0093] According to some examples, in step 418, the method includes displaying results in a GUI. The GUI can include both the text of the summary and a visual representation of the subgraph. The subgraph provides ground truth, and the summary provides a more easily comprehended mechanism for understanding the subgraph. According to certain non-limiting examples, a user can select a portion of the text of the summary 132, and, in response, the GUI highlights a corresponding portion of the subgraph associated with the selected text. Thus, starting from the text of the summary, a security analyst can quickly find the relevant features in the subgraph that correspond to portions of the text of the summary. Then referring to the corresponding region of the subgraph, the security analyst can verify that, for the relevant features, the relations expressed in the text are consistent with the corresponding region of the subgraph, thereby confirming a correct understanding of the threat.) ; and in response to receiving user input at the navigation controls, altering the visual representation of the at least part of the graph rendered on the user interface (Zawadowskiy ¶ [0093] According to some examples, in step 418, the method includes displaying results in a GUI. The GUI can include both the text of the summary and a visual representation of the subgraph. The subgraph provides ground truth, and the summary provides a more easily comprehended mechanism for understanding the subgraph. According to certain non-limiting examples, a user can select a portion of the text of the summary 132, and, in response, the GUI highlights a corresponding portion of the subgraph associated with the selected text. Thus, starting from the text of the summary, a security analyst can quickly find the relevant features in the subgraph that correspond to portions of the text of the summary. Then referring to the corresponding region of the subgraph, the security analyst can verify that, for the relevant features, the relations expressed in the text are consistent with the corresponding region of the subgraph, thereby confirming a correct understanding of the threat.) It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify threat intelligence monitoring of Liu to include the summary nodes of La Conca include interface of Zawadowskiy in order improve methos of summarizing threat alerts ([0004], Zawadowskiy) Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to ATHAR N PASHA whose telephone number is (408)918-7675. The examiner can normally be reached on Monday-Thursday Alternate Fridays, 7:30-4:30 PT. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Daniel Washburn can be reached on (571)272-5551. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /ATHAR N PASHA/Primary Examiner, Art Unit 2657 Application/Control Number: 18/967,577 Page 2 Art Unit: 2657 Application/Control Number: 18/967,577 Page 3 Art Unit: 2657 Application/Control Number: 18/967,577 Page 4 Art Unit: 2657 Application/Control Number: 18/967,577 Page 5 Art Unit: 2657 Application/Control Number: 18/967,577 Page 6 Art Unit: 2657 Application/Control Number: 18/967,577 Page 7 Art Unit: 2657 Application/Control Number: 18/967,577 Page 8 Art Unit: 2657 Application/Control Number: 18/967,577 Page 9 Art Unit: 2657 Application/Control Number: 18/967,577 Page 10 Art Unit: 2657 Application/Control Number: 18/967,577 Page 11 Art Unit: 2657 Application/Control Number: 18/967,577 Page 12 Art Unit: 2657 Application/Control Number: 18/967,577 Page 13 Art Unit: 2657 Application/Control Number: 18/967,577 Page 14 Art Unit: 2657 Application/Control Number: 18/967,577 Page 15 Art Unit: 2657 Application/Control Number: 18/967,577 Page 16 Art Unit: 2657 Application/Control Number: 18/967,577 Page 17 Art Unit: 2657 Application/Control Number: 18/967,577 Page 18 Art Unit: 2657 Application/Control Number: 18/967,577 Page 19 Art Unit: 2657 Application/Control Number: 18/967,577 Page 20 Art Unit: 2657 Application/Control Number: 18/967,577 Page 21 Art Unit: 2657 Application/Control Number: 18/967,577 Page 22 Art Unit: 2657 Application/Control Number: 18/967,577 Page 23 Art Unit: 2657 Application/Control Number: 18/967,577 Page 24 Art Unit: 2657 Application/Control Number: 18/967,577 Page 25 Art Unit: 2657 Application/Control Number: 18/967,577 Page 26 Art Unit: 2657 Application/Control Number: 18/967,577 Page 27 Art Unit: 2657
Prosecution Insights