DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Office Action is in response to the Amendment filed on 7/1/2026.
In instant Amendment, claims 1, and 3-13 have been amended; claim 2 has been canceled; claims 16-21 have been newly added; claims 1, 11 and 12 are independent claims. Claims 1 and 3-21 have been examined and are pending. This Action is made Final.
The examiner notes the IDS filed on 7/13/2026 has been considered.
Response to Arguments
The claim objection to claims 1-12 are withdrawn as claims 1-12 have been amended.
The rejections of claims 2-9 under 35 U.S.C. § 112(b) or 35 U.S.C. § 112(b) are withdrawn as the claims have been amended.
The rejection(s) of claim 13 under 35 U.S.C. § 101 (i.e., non-statutory subject matter) is withdrawn as the claim(s) have been amended; however, the remaining 35 U.S.C. § 101 rejection(s) for the claim(s) being directed to an abstract idea without being integrated into a practical application or being significantly more is maintained along with the remaining non-statutory subject matter rejection(s).
Applicant Argues: The Office asserts that the claims are directed to a mental process. The claims are amended to recite that the threat detection controller utilizes at least one large language model to process and provide threat detection-related tasks for the threat detection components, process data given as input for the threat detection components, convert received information to a format required by the threat detection components or the threat detection system, and process and provide the received information received from the threat detection components. These are not mental processes that can practically be performed in the human mind. An individual is not capable of changing the format of data.
Further, similarly to Example 39 (neural network training), the present invention is not "directed to" an abstract idea merely because computation/data-processing is involved, where the claims are anchored to a specific technical architecture and cannot be mentally performed.
Even assuming, arguendo, that the claims recite a judicial exception, the claims are subject-matter eligible under Step 2A, Prong (2).
Examiner’s Response: The examiner respectfully disagrees. The examiner respectfully notes that the limitations of “...detect cyber threats...,” “process and provide thread detection related tasks...,” “process data given as input...,” “convert received information to a format required...,” and “process and provide the received information received...” are directed to mental processes as said steps could be performed in the human mind when broadly interpreted. These additional elements are described at a high level in Applicant’s specification without any meaningful detail about their structure or configuration. The examiner notes that “threat detection system” and “threat detection components” are elements in the steps that are recited at a high-level of generality such that it amounts no more than mere instructions to apply the exception using a generic computer component and merely invoke such additional elements as a tool to perform the abstract idea. See MPEP 2106.05(f). Accordingly, these additional elements, even in combination, do not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea. Therefore, the examiner finds this argument not persuasive.
Applicant Argues: In the second prong, examiners evaluate whether a claim as a whole integrates the judicial exception into a practical application of the alleged exception. Examiners evaluate integration into a practical application by: (a) identifying whether there are any additional elements recited in the claim beyond the judicial exception(s); and (b) evaluating those additional elements individually and in combination to determine whether they integrate the exception into a practical application. Importantly, the MPEP provides that revised Step 2A does not evaluate whether an additional element is well-understood, routine, or conventional activity, and examiners are reminded that a claim that includes conventional elements may still integrate an exception into a practical application.
The Office asserts that the additional elements do not integrate the abstract idea into a practical application because the additional elements perform generic computer content distributing functions routinely used in the information technology field.
The claims are amended to recite additional elements that impose a meaningful limit on the judicial exception. Specifically, the claims are amended to recite that the threat detection controller processes and provides threat detection- related tasks for the threat detection components, processes data given as input for the threat detection components, converts received information to a format required by the threat detection components or the threat detection system, and processes and provides the received information received from the threat detection components.
These features impose a meaningful limit on the judicial exception and in a manner that integrates the exception into a practical application.
Examiner’s Response: The examiner respectfully disagrees. As noted, above the examiner respectfully notes that the limitations of “...detect cyber threats...,” “process and provide thread detection related tasks...,” “process data given as input...,” “convert received information to a format required...,” and “process and provide the received information received...” are directed to mental processes as said steps could be performed in the human mind when broadly interpreted. These additional elements are described at a high level in Applicant’s specification without any meaningful detail about their structure or configuration. The examiner notes that “threat detection system” and “threat detection components” are elements in the steps that are recited at a high-level of generality such that it amounts no more than mere instructions to apply the exception using a generic computer component and merely invoke such additional elements as a tool to perform the abstract idea. See MPEP 2106.05(f). Accordingly, these additional elements, even in combination, do not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea. Therefore, the examiner finds this argument not persuasive.
Applicant Argues: Even if the present invention is deemed to be directed to a judicial exception, the claims recite additional elements that amount to significantly more than the judicial exception (Step 2B).
For instance, "[t]he second step of the Alice test is satisfied when the claim limitations involve more than performance of well-understood, routine, [and] conventional activities previously known to the industry." Berkheimer v. HP Inc., 881 F.3d 1360, 1367 (Fed. Cir. 2018) (emphasis added). Moreover, at this second step of the analysis, the elements of each claim must be examined both individually and as an ordered combination to determine whether the additional elements transform the nature of the claim into a patent eligible application. Id at 1366; see also MPEP 2106.05(d).
The claims recite processing and providing threat detection-related tasks for the threat detection components, processing data given as input for the threat detection components, converting received information to a format required by the threat detection components or the threat detection system, and processing and providing the received information received from the threat detection components.
These are additional elements beyond the alleged judicial exception of a method performed in the human mind. Like in DDR, the claimed solution here is necessarily rooted in computer technology to address a problem specifically arising in the realm of networked cybersecurity systems: heterogeneous threat detection components (e.g., endpoint agents, server-side detectors) that speak different data formats and require different task inputs cannot natively coordinate. The present invention converts information into the format each component requires, processes/routs data as input to those components, and (3) controls the components' operation based on their outputs. That is a specific technical solution to a technical coordination problem in a networked security architecture, not a generic instruction to apply an LLM. The claimed limitations are not simply an attempt to generally link the abstract idea to a technological environment or particular field of use.
Under Berkheimer, 881 F.3d at 1367, and MPEP 2106.05(d), the elements must be examined individually and as an ordered combination. Here, an LLM interposed between
heterogeneous, distributed threat detection components spanning endpoints and servers, performing format conversion, task/instruction routing, and closed-loop control based on component outputs - is not a well-understood, routine, or conventional configuration in the threat detection field. Like DDR, the claimed architecture is necessarily rooted in computer network technology to overcome a problem specifically arising in distributed cybersecurity systems (component heterogeneity and format incompatibility), rather than using a computer as a tool to carry out a process humans already performed.
Accordingly, when viewed as a combination, the additional elements thus yield claims as a whole that amount to significantly more than the alleged abstract idea (Step 2B:
YES).
Accordingly, withdrawal of the § 101 rejection is respectfully requested.
Examiner’s Response: The examiner respectfully notes The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception because, when considered separately and as an ordered combination, they do not add significantly more to the exception. As discussed above with respect to integration of the abstract idea into a practical application, the operation/elements of “threat detection system comprises at least one endpoint and at least one server”, “utilizing by the thread detection system at least two threat detection components...”,” utilizing, by the thread the threat detection controller at least one large language model...” amounts to no more than mere instructions to apply the exception using a generic computer component and do not add anything that is not already present when they are considered individually or in combination. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. Therefore, under Step 2B, there are no meaningful limitations in claim 1, and similar claim(s) 8 and 15 that transform the judicial exception into a patent eligible application such that the claims amount to significantly more than the judicial exception itself. Of note the examiner only noted content distribution as routine and MPEP 2106.05(d)(11) notes that receiving or transmitting data over a network have been recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity. Therefore, the examiner finds this argument not persuasive.
Applicant's arguments filed 7/1/20206 have been fully considered but they are not persuasive.
Applicant Argues: In the Office Action, at page 9, claims 1-15 were rejected under 35 U.S.C. § 102 as being anticipated by US 2023/0315856 to Lee ("Lee"). Claim 2 is cancelled, without prejudice or disclaimer. This rejection is respectfully traversed.
[...]
In contrast to the present invention, Lee does not disclose or suggest utilizing, by a threat detection system, at least two threat detection components to detect cyber threats that are connected to a controller. More specifically, Lee does not disclose a threat detection controller using an LLM within a multi-component threat detection system to process and provide threat-detection-related tasks for threat detection components, process component inputs, convert received information into component- or system-required formats, and process information received from threat detection components.
Therefore, Lee does not disclose all the features of amended independent claim 1, and claim 1 is patentably distinguished over the reference relied upon. Claims 3-15 depend either directly or indirectly from amended independent claim 1, and are therefore patentably distinguished over the reference relied upon for at least the reasons discussed above. Accordingly, withdrawal of the § 102 rejection is respectfully requested.
Examiner’s Response: The examiner respectfully disagrees. The examiner respectfully notes that ¶[0029] discusses For example, management systems can be configured to run regularly scheduled scans on compute devices, and/or receive predetermined, regularly scheduled check-in communications from one or more compute devices. In some instances, management systems can be configured to send data, information, signals, or messages to the devices (e.g., compute devices), sources, servers, etc. In some instances, for example, management systems can manage usage policies in a set of compute devices, and manage installation, in the set of compute devices, of security software such as firewalls or antivirus software. A management system can receive, for example, via firewalls installed in the compute devices, messages or data associated with the state of the compute devices related to activity, any deviations in activity profiles detected, security levels maintained or not maintained, threats detected, web threats blocked, any changes or breaches in policies, etc., and/or generate alerts or summary reports for further analysis discusses firewalls and antivirus which are noted to be two threat detection components as argued. Further, ¶[0044] discusses The NL analysis device 101 can be configured to perform actions based on analysis of data. For example, the task to be performed via the management system can include generating summary of analytical data related to states of security associated with one or more endpoints under the management of the management system. Based on the summary, the NL analysis device 101 can receive instructions from a user and perform one or more actions such as send message to endpoints, block or permit communications between endpoints or servers, quarantine an endpoint, generate, and send an alert to a user regarding a status of one or more endpoints, and/or the like. The examiner respectfully notes that the NL analysis device is “a threat detection controller using an LLM within a multi-component threat detection system (i.e., see components above) to process and provide threat-detection-related tasks for threat detection components, process component inputs, convert received information into component- or system-required formats, and process information received from threat detection components.” The examiner notes that the amended new limitations can found in the rejection below with the corresponding citations. Thus, Lee does teach “to process and provide threat-detection-related tasks for threat detection components, process component inputs, convert received information into component- or system-required formats, and process information received from threat detection components,” see rejection below. Therefore, the examiner finds this argument not persuasive.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1 and 3-21 are rejected under 35 USC 101 as being directed to an abstract idea without being integrated into a practical application or being significantly more.
Regarding claim 1, and representative claim(s) 11-15, the claim recites the limitations of “...detect cyber threats...,” “process and provide thread detection related tasks...,” “process data given as input...,” “convert received information to a format required...,” and “process and provide the received information received...”
Broadly interpreted, the aforementioned steps are directed to mental processes as said steps could be performed in the human mind. Therefore, the claims recite an abstract idea.
Said abstract idea and/or judicial exception is not integrated into a practical application as the claim does not recite any other active steps that could be considered that the abstract idea is being integrated into a practical application. It is noted that the claim recites the operations “threat detection system comprises at least one endpoint and at least one server”, “utilizing by the thread detection system at least two threat detection components...”,” utilizing, by the thread the threat detection controller at least one large language model...” However, said operations are not sufficient to consider that the abstract idea is being interpreted into a practical application. Said operations are recited at a high level of generality (i.e., as generic computer components that are connected performing generic computer functions when utilized) such that it amounts no more than mere instructions to apply the exception or abstract idea using generic computer components. Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
The claims do not include additional elements/limitations/embodiments that are sufficient to amount to significantly more than the judicial exception because the additional elements when considered both individually and as an ordered combination do not amount to significantly more than the abstract idea. As mentioned above, although the claims recite additional elements, said elements taken individually or as a combination, do not result in the claim amounting to significantly more than the abstract idea because as the additional elements perform generic functions used in routinely information technology field. As discussed above, the additional elements recited at a high-level of generality such that they amount to no more than mere instructions to apply the exception using a generic computer component. Therefore, the claim is directed to non-statutory subject matter.
Regarding claims 3-10 and 16-21; the dependent claims are also rejected under 35 U.S.C. 101 as being directed to non-statutory subject matter for the same reasons addressed above as the claims recite an abstract idea without being integrated into a practical application or significantly more.
Claim(s) 14 and 15 are rejected under 35 U.S.C. 101 as being directed to non-statutory subject matter
Regarding Claim 14; claim 14 is rejected under 35 U.S.C. 101 as being directed to non-statutory statutory subject matter. The claim is directed to a computer program, which is software per se and is not directed to eligible subject matter. See MPEP 2106.03.
Regarding claim 15; claims 15 is rejected under 35 U.S.C. 101 because the claims is directed to non-statutory subject matter. Claim 15 recites “[a] computer-readable medium”. Under a recent precedential opinion, the scope of the recited “computer-readable medium” encompasses transitory media such as signals or carrier waves, where, as here the Specification does not limit the computer readable storage medium to non-transitory forms. See Ex parte Mewherter, 107 USPQ2d 1857, 1862 (PTAB 2013) (precedential) (holding recited machine-readable storage medium ineligible under § 35 U.S.C. 101 since it encompassed transitory media). The Examiner respectfully suggests that the claim be amended to either “A non-transitory computer-readable medium” or “a computer-readable storage device” to make the claim statutory under 35 USC 101; (emphasis added).
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1, 3-16 and 18-21 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Lee et al. (US 2023/0315856 A1).
Regarding Claim 1;
Lee discloses a method for threat detection in a threat detection system ([0029] - cybersecurity management systems, can often be configured to monitor, evaluate, manage, and/or maintain activity or security associated with communications, artifacts, compute devices, data storage devices, servers, and/or hosts of that are of interest and [0057]), including one or more of at least one endpoint ([0029] - ...compute devices, data storage devices, ... and/or hosts of that are of interest....) and at least one server ([0029] = ...servers...), wherein the method comprising
utilizing by the threat detection system at least two threat detection components to detect cyber threats ([0029] – For example, management systems can be configured to run regularly scheduled scans on compute devices, and/or receive predetermined, regularly scheduled check-in communications from one or more compute devices. In some instances, management systems can be configured to send data, information, signals, or messages to the devices (e.g., compute devices), sources, servers, etc. In some instances, for example, management systems can manage usage policies in a set of compute devices, and manage installation, in the set of compute devices, of security software such as firewalls or antivirus software. A management system can receive, for example, via firewalls installed in the compute devices, messages or data associated with the state of the compute devices related to activity, any deviations in activity profiles detected, security levels maintained or not maintained, threats detected, web threats blocked, any changes or breaches in policies, etc., and/or generate alerts or summary reports for further analysis and [0044] and [0057]);
utilizing, by the threat detection controller, at least one large language model ([0024] and [0048] and [0056]-[0057] - The NL interface manager 211 can be configured to generate a user interface that can be used to receive natural language queries or phrases from a human user based on which the processor 210 can implement auto-completion, auto-correction, and/or intent inference, as described herein, to generate system commands compatible with a management system.... The NL interface manager 211 can be configured to generate the NL interface 550 in FIG. 5, for example, to provide control tools to receive natural language phrases or queries from a user indicating an intent to perform a task via a management system) to
process and provide threat detection related tasks for the threat detection components ([0046] and [0056] - The NL interface manager 211 can be configured to generate a user interface that can be used to receive natural language queries or phrases from a human user based on which the processor 210 can implement auto-completion, auto-correction, and/or intent inference, as described herein, to generate system commands compatible with a management system),
process data given as input for the threat detection components ([0046] and [0056] - The NL interface manager 211 can be configured to generate a user interface that can be used to receive natural language queries or phrases from a human user based on which the processor 210 can implement auto-completion, auto-correction, and/or intent inference, as described herein, to generate system commands compatible with a management system),,
convert received information to a format required by the threat detection components or the threat detection system ([0046] - In some instances, the NL analysis device 201 can implement an NL interface to receive natural language instructions and transform the natural language instructions into system commands compatible with the management system to perform one or more system tasks via the management system.)
process and provide the received information received from the threat detection components ([0057] - Thee NL interface manager 211 can be configured to populate the NL interface, for example, NL interface 550, with information that can associated with performing system tasks via the management system. For example, the NL interface 550 can be used to display summary information that can be obtained as results from executing system commands by providing natural language requests. The example shown in FIG. 5 includes results displayed in the interface 550 related to security monitoring conducted by a cybersecurity management system. As shown in FIG. 5, the NL interface 550 shows a first summary 560 of alerts generated in the system, with categories of alerts as high, medium, and low level of threat. The NL interface 550 shows, in a second summary 562, a list of recently received alerts in the high threat level category, with the time stamp of each alert received. In a third summary 564, the NL interface 550 shows endpoint activity status indicating how many endpoints managed by the management system were active and how many were inactive, and for what period of time. Other options of summary information can be obtained by selecting tabs for example to view a summary of user activity associated with each endpoint or a group of endpoints, etc. The fourth summary 566 shows a count of web threats blocked by the management system and a number of policy violations blocked the management system. Each summary is associated with a control tool to invoke generation of a report for review and further analysis. Each of these summaries, reports, and/or the information used to generate the summaries/reports can be populated using natural language phrases via the NL interface 550 by a user input of a natural language request at the editable text space 572.)
Regarding Claim 3;
Lee discloses the method according to claim 1.
Lee further discloses further comprising: receiving one or more of an input for the threat detection system and an input for a component of a thread detections system in natural lanague as structure in numbers, or categories, or their combination ([0046] - In some instances, the NL analysis device 201 can implement an NL interface to receive natural language instructions and transform the natural language instructions into system commands compatible with the management system to perform one or more system tasks via the management system and [0056]-[0058] and [0060] - For example, in the example shown in FIG. 6, the natural language phrase provided is “show http network connections from windows 10 machines, ordered by bandwidth”. This phrase is provided to one or more ML models 212 to parse and parameterize into parameters 682, 684, 686, 688. The parameters can include one or more subject parameters, one or more object parameters, one or more action parameters, one or more descriptor parameters, one or more execution initiation parameters, one or more Boolean parameters, and/or the like. In the example in FIG. 6, the template query generated is “HTTP+Windows 10+Order by bandwidth+Search” which can be corrected by a user by either typing into the editable text sections 681 or by selecting an option from a list of options provided in drop down menu lists activated by control items 683); and [sic] and the converting, by the threat detection controller, received information by the at least one large language model to the format required by the threat detection component or the threat detection system ([0046] - In some instances, the NL analysis device 201 can implement an NL interface to receive natural language instructions and transform the natural language instructions into system commands compatible with the management system to perform one or more system tasks via the management system and [0056]-[0058] - Each of these summaries, reports, and/or the information used to generate the summaries/reports can be populated using natural language phrases via the NL interface 550 by a user input of a natural language request at the editable text space 572 and [0060])
Regarding Claim 4;
Lee discloses the method according to claim 1.
Lee further discloses wherein the at least two threat detection components comprise at least one of the following: a service component, including one or more of a parser, an antivirus engine, an Endpoint Detection and Response (EDR) and a Managed Detection and Response (MDR) engine ([0029] – antivirus and [0044] - The NL analysis device 101 can be configured to perform actions based on analysis of data. For example, the task to be performed via the management system can include generating summary of analytical data related to states of security associated with one or more endpoints under the management of the management system. Based on the summary, the NL analysis device 101 can receive instructions from a user and perform one or more actions such as send message to endpoints, block or permit communications between endpoints or servers, quarantine an endpoint, generate, and send an alert to a user regarding a status of one or more endpoints, and/or the like and [0060] - Example action parameters can include blocking a communication or a host, allowing a communication, filtering a set of data, sorting a set of data, displaying a set of data, applying a patch, rebooting an endpoint, executing a rule and/or the like and ) As noted instructions/performing actions to an endpoint is an EDR and MDR engine, and external data source, and an internal data source.
Regarding Claim 5;
Lee discloses the method according to claim 1.
Lee further discloses wherein the one or more of threat detection component and the task given for the threat detection component relates to one or more of machine translation, sentiment analysis, grammar checking and identifying synonyms and semantically similar statements ([0032] - The template query can be finalized with user input, and then translated into a complex SQL query. For example, the ML model can be trained, using training data, to generate complex queries based on the natural language request or phrase provided by predicting the user's intent to perform the task and [0057] - The NL interface manager 211 can be configured to generate the NL interface 550 in FIG. 5, for example, to provide control tools to receive natural language phrases or queries from a user indicating an intent to perform a task via a management system threat... category... blocked... and [0070] - The ML models 212 can include a fourth ML model configured to receive a natural language phrase as a reference and generate a set of similar natural language phrases (e.g., semantically similar, functionally similar, etc.). The fourth ML model can be configured to receive the reference NL phrase and generate synonyms of the words in the reference NL phrase, and then use a combinatorial approach in using the synonyms to generate semantically, syntactically, functionally and/or contextually similar phrases as output)
Regarding Claim 6;
Lee discloses the method according to claim 1.
Lee further discloses wherein decision making logic related information is received as input to the threat detection controller (FIG. 5 and [0046] - In some instances, the NL analysis device 201 can implement an NL interface to receive natural language instructions and transform the natural language instructions into system commands compatible with the management system to perform one or more system tasks via the management system and [0056]-[0058] - The NL interface manager 211 can be configured to generate the NL interface 550 in FIG. 5, for example, to provide control tools to receive natural language phrases or queries from a user indicating an intent to perform a task via a management system... threat... category... blocked... For example, the NL interface 550 can be used to display summary information that can be obtained as results from executing system commands by providing natural language requests.)
Regarding Claim 7;
Lee discloses the method according to claim 1.
Lee further discloses the method further comprises summarizing the output from the one or more of the threat detection system and the threat detection controller, including one or more of the decision and reasons for the decision, by the at least one large language model (FIG. 5 and [0056]-[0058] - The NL interface manager 211 can be configured to generate the NL interface 550 in FIG. 5, for example, to provide control tools to receive natural language phrases or queries from a user indicating an intent to perform a task via a management system... threat... category... blocked... For example, the NL interface 550 can be used to display summary information that can be obtained as results from executing system commands by providing natural language requests.)
Regarding Claim 8;
Lee discloses the method according to claim 1.
Lee further discloses wherein the at least one large language model is one or more of a generative model and a model for natural language processing (NLP) tasks ([0056] - The NL interface manager 211 can be configured to generate a user interface that can be used to receive natural language queries or phrases from a human user based on which the processor 210 can implement auto-completion, auto-correction, and/or intent inference, as described herein, to generate system commands compatible with a management system and [0057] - Each of these summaries, reports, and/or the information used to generate the summaries/reports can be populated using natural language phrases via the NL interface 550 by a user input of a natural language request at the editable text space 572.)
Regarding Claim 9;
Lee discloses the method according to claim 1.
Lee further discloses further comprising: collecting, by the at least one endpoint, thread detection-related data by a security agent module installed at the at least one endpoint ([0029] - ([0029] - For example, management systems can be configured to run regularly scheduled scans on compute devices, and/or receive predetermined, regularly scheduled check-in communications from one or more compute devices. In some instances, management systems can be configured to send data, information, signals, or messages to the devices (e.g., compute devices), sources, servers, etc. In some instances, for example, management systems can manage usage policies in a set of compute devices, and manage installation, in the set of compute devices, of security software such as firewalls or antivirus software. A management system can receive, for example, via firewalls installed in the compute devices, messages or data associated with the state of the compute devices related to activity, any deviations in activity profiles detected, security levels maintained or not maintained, threats detected, web threats blocked, any changes or breaches in policies, etc., and/or generate alerts or summary reports for further analysis. Management systems can be configured to set policies, for example, operational policies associated with permissions for specific users to access specified portions of a compute device, communication device, and/or a data storage. Management systems can be configured to set security policies associated with data transfer, communication of information, or day-to-day activity of one or more compute devices under the management of the management system. Management systems can be configured to send messages or data to the compute devices to permit or block activity at a compute device, for example, communications to or from the device. Management systems can be configured to permit or block activity of one or more users, entities, communications involving one or more hosts, and/or the like), sending the collected threat detection-related data to the threat detection system, and controlling ([0029] - For example, management systems can be configured to run regularly scheduled scans on compute devices, and/or receive predetermined, regularly scheduled check-in communications from one or more compute devices. In some instances, management systems can be configured to send data, information, signals, or messages to the devices (e.g., compute devices), sources, servers, etc. In some instances, for example, management systems can manage usage policies in a set of compute devices, and manage installation, in the set of compute devices, of security software such as firewalls or antivirus software. A management system can receive, for example, via firewalls installed in the compute devices, messages or data associated with the state of the compute devices related to activity, any deviations in activity profiles detected, security levels maintained or not maintained, threats detected, web threats blocked, any changes or breaches in policies, etc., and/or generate alerts or summary reports for further analysis. Management systems can be configured to set policies, for example, operational policies associated with permissions for specific users to access specified portions of a compute device, communication device, and/or a data storage. Management systems can be configured to set security policies associated with data transfer, communication of information, or day-to-day activity of one or more compute devices under the management of the management system. Management systems can be configured to send messages or data to the compute devices to permit or block activity at a compute device, for example, communications to or from the device. Management systems can be configured to permit or block activity of one or more users, entities, communications involving one or more hosts, and/or the like), by the thread detection controller, analysis of the received thread detection-related data ([0057] - Each summary is associated with a control tool to invoke generation of a report for review and further analysis. Each of these summaries, reports, and/or the information used to generate the summaries/reports can be populated using natural language phrases via the NL interface 550 by a user input of a natural language request at the editable text space 572.)
Regarding Claim 10;
Lee discloses the method according to claim 1.
Lee further discloses further comprising; carrying out actions by the at least one thread detection component relating to prioritizing potential treatments for one or more of an identified thread and security posture improvement ([0029] - Management systems can be configured to set policies, for example, operational policies associated with permissions for specific users to access specified portions of a compute device, communication device, and/or a data storage. Management systems can be configured to set security policies associated with data transfer, communication of information, or day-to-day activity of one or more compute devices under the management of the management system. Management systems can be configured to send messages or data to the compute devices to permit or block activity at a compute device, for example, communications to or from the device. Management systems can be configured to permit or block activity of one or more users, entities, communications involving one or more hosts, and/or the like and [0057] - The NL interface manager 211 can be configured to generate the NL interface 550 in FIG. 5, for example, to provide control tools to receive natural language phrases or queries from a user indicating an intent to perform a task via a management system.), and/or wherein an output of the threat detection component relates to at least one of the following: identified vulnerability, identified critical asset, priority of identified vulnerability, priority of critical asses, risk values for business of the identified asset and/or vulnerability, attack path mapping, visualization and reporting artifact (FIG. 5 and [0057] - Each summary is associated with a control tool to invoke generation of a report for review and further analysis. Each of these summaries, reports, and/or the information used to generate the summaries/reports can be populated using natural language phrases via the NL interface 550 by a user input of a natural language request at the editable text space 572).
Regarding Claim(s) 11; claim(s) 11 is/are directed to a/an server associated with the method claimed in claim(s) 1. Claim(s) 11 is/are similar in scope to claim(s) 1, and is/are therefore rejected under similar rationale.
Regarding Claim 12;
Lee further discloses a threat detection system comprising: at least one ([0029] and [0057]), and/or at least one server, wherein the server is a server according to claim 11 ([0029] - Management systems, for example, cybersecurity management systems, can often be configured to monitor, evaluate, manage, and/or maintain activity or security associated with communications, artifacts, compute devices, data storage devices, servers, and/or hosts of that are of interest. In some instances, management systems can be configured to be in communication with compute devices, servers, data sources, data storage devices, hosts, and can maintain a schedule of scanning the various devices or sources and reporting the results for maintenance of security and [0057]).
Regarding Claim 13;
Lee further discloses one or more processors configured to carry out the method according to claim 1 ([0029] - Management systems, for example, cybersecurity management systems, can often be configured to monitor, evaluate, manage, and/or maintain activity or security associated with communications, artifacts, compute devices, data storage devices, servers, and/or hosts of that are of interest. In some instances, management systems can be configured to be in communication with compute devices, servers, data sources, data storage devices, hosts, and can maintain a schedule of scanning the various devices or sources and reporting the results for maintenance of security and [0057]).
Regarding Claim 14;
Lee further discloses a computer program comprising instructions which, when executed by a computer, cause the computer to carry out the method according to claim 1 ([0029] and [0057] and [0126] - Some embodiments described herein relate to a computer storage product with a non-transitory computer-readable medium (also can be referred to as a non-transitory processor-readable medium) having instructions or computer code thereon for performing various computer-implemented operations).
Regarding Claim 15;
Lee further discloses a computer-readable medium comprising the computer program according to claim 14 ([0029] and [0057] and [0126] - Some embodiments described herein relate to a computer storage product with a non-transitory computer-readable medium (also can be referred to as a non-transitory processor-readable medium) having instructions or computer code thereon for performing various computer-implemented operations).
Regarding Claim 16;
Lee discloses the method according to claim 3.
Lee further discloses further wherein the input includes one or more of decision-making logic, analysis of executables, updates and decision on incidents, assessed reputations and risk scores (FIG. 5 and [0029] and- [0056]-[0058] - The NL interface manager 211 can be configured to generate a user interface that can be used to receive natural language queries or phrases from a human user based on which the processor 210 can implement auto-completion, auto-correction, and/or intent inference, as described herein, to generate system commands compatible with a management system... The NL interface manager 211 can be configured to generate the NL interface 550 in FIG. 5, for example, to provide control tools to receive natural language phrases or queries from a user indicating an intent to perform a task via a management system. For example, the NL interface 550 can be used to display summary information that can be obtained as results from executing system commands by providing natural language requests category... count...).
Regarding Claim 18;
Lee discloses the method according to claim 6.
Lee further discloses further wherein the decision-making logic related information includes one or more of deep analysis of executables, updates on incidents and decision on incidents, assessed reputations and risk scores (FIG. 5 and [0046] - In some instances, the NL analysis device 201 can implement an NL interface to receive natural language instructions and transform the natural language instructions into system commands compatible with the management system to perform one or more system tasks via the management system and [0056]-[0058] - The NL interface manager 211 can be configured to generate the NL interface 550 in FIG. 5, for example, to provide control tools to receive natural language phrases or queries from a user indicating an intent to perform a task via a management system... threat... category... blocked... For example, the NL interface 550 can be used to display summary information that can be obtained as results from executing system commands by providing natural language requests.)
Regarding Claim 19;
Lee discloses the method according to claim 8.
Lee further discloses wherein the natural language processing (NLP) tasks include one or more of text generation, language translation, sentiment analysis, text summarization, and question-answering ([0057] – ...summary..).
Regarding Claim 20;
Lee discloses the method according to claim 1.
Lee further disclose further comprising: outputting, by the threat detection component, at least one of the following: an identified vulnerability, an identified critical asset, a priority of identified vulnerability, a priority of critical asses, risk values for business of one or more of the identified asset and vulnerability, attack path mapping, visualization and reporting artifact (FIG. 5 and [0029] - A management system can receive, for example, via firewalls installed in the compute devices, messages or data associated with the state of the compute devices related to activity, any deviations in activity profiles detected, security levels maintained or not maintained, threats detected, web threats blocked, any changes or breaches in policies, etc., and/or generate alerts or summary reports for further analysis and [0057] - Each summary is associated with a control tool to invoke generation of a report for review and further analysis. Each of these summaries, reports, and/or the information used to generate the summaries/reports can be populated using natural language phrases via the NL interface 550 by a user input of a natural language request at the editable text space 572).
Regarding Claim 21;
Lee discloses the method according to claim 10.
Lee further disclose further comprising: outputting, by the threat detection component, at least one of the following: an identified vulnerability, an identified critical asset, a priority of identified vulnerability, a priority of critical asses, risk values for business of one or more of the identified asset and vulnerability, attack path mapping, visualization and reporting artifact (FIG. 5 and [0029] - A management system can receive, for example, via firewalls installed in the compute devices, messages or data associated with the state of the compute devices related to activity, any deviations in activity profiles detected, security levels maintained or not maintained, threats detected, web threats blocked, any changes or breaches in policies, etc., and/or generate alerts or summary reports for further analysis and [0057] - Each summary is associated with a control tool to invoke generation of a report for review and further analysis. Each of these summaries, reports, and/or the information used to generate the summaries/reports can be populated using natural language phrases via the NL interface 550 by a user input of a natural language request at the editable text space 572).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lee et al. (US 2023/0315856 A1) in view of Satish et al. (US 2016/0164891 A1).
Regarding Claim 17;
Lee discloses the method according to claim 4.
Lee fails to explicitly disclose wherein the EDR and MDR engine is one or more of an EDR and/or a MDR rule based engine and an EDR and/or a MDR AI-based engine ([0029] – antivirus and [0044] - The NL analysis device 101 can be configured to perform actions based on analysis of data. For example, the task to be performed via the management system can include generating summary of analytical data related to states of security associated with one or more endpoints under the management of the management system. Based on the summary, the NL analysis device 101 can receive instructions from a user and perform one or more actions such as send message to endpoints, block or permit communications between endpoints or servers, quarantine an endpoint, generate, and send an alert to a user regarding a status of one or more endpoints, and/or the like and [0060] - Example action parameters can include blocking a communication or a host, allowing a communication, filtering a set of data, sorting a set of data, displaying a set of data, applying a patch, rebooting an endpoint, executing a rule and/or the like and ) As noted instructions/performing actions to an endpoint is an EDR and MDR engine
Lee fails to explicitly disclose the external data source includes one of a domain search database, a virus database, and information source, and the internal data source is one of a threat intelligence information database, an incident information database, and an asset information database.
However, in an analogous art, Satish teaches [an] external data source includes one of a domain search database, a virus database, and information source ([0034] - Before, during, or after determining the state of the threat within the environment, advisement system 320 may obtain enrichment information from sources 325. Sources 325 may correspond to internal or external databases or websites that store information about the various possible threats to asset environment 305), and [an] internal data source is one of a threat intelligence information database, an incident information database, and an asset information database ([0017] - For example, if an unknown process is identified as executing on an asset, one or more internal and external sources may be used to identify the type of threat that the process presents to the environment, such as a Trojan, virus, or some other threat and [0034] - Before, during, or after determining the state of the threat within the environment, advisement system 320 may obtain enrichment information from sources 325. Sources 325 may correspond to internal or external databases or websites that store information about the various possible threats to asset environment 305).
Therefore, it would have been obvious to one of ordinarily skill in the art before the effective filing date of the claimed invention to combine the teachings of Satish to the method of Lee to include [an] external data source includes one of a domain search database, a virus database, and information source, and [an] internal data source is one of a threat intelligence information database, an incident information database, and an asset information database.
One would have been motivated to combine the teachings of Satish to Lee to do so as it provides / allows defining kill-chains for security incidents to assist in identifying security actions for a computing environment (Satish, [0002]).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KARI L SCHMIDT whose telephone number is (571)270-1385. The examiner can normally be reached Monday-Friday 10am - 6pm (MDT).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached at (571)270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KARI L SCHMIDT/ Primary Examiner, Art Unit 2439
Prosecution Insights