Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendments / Arguments
Regarding the rejection(s) of claims under 35 USC 103:
Applicant’s arguments, filed 06/04/2026, in view of the amended claims, have been fully considered and are not persuasive.
Applicant argues that the combined references do not teach the amended limitation "wherein the precision metric and the recall metric are used as training optimization objectives during training of the generative adversarial network." This argument is not persuasive.
Applicant's own specification does not describe precision and recall as training optimization objectives. Rather, the specification describes precision and recall solely as post-hoc evaluation measures applied to an already-trained GAN ([0076]–[0079], describing PRD plots used to "evaluate the performance of a GAN," and [0068], describing a trained neural network used to "determine" the metrics), while identifying the Wasserstein GAN with Gradient Penalty method as the actual training objective ([0072]). Consistent with the specification, the claimed precision and recall are properly understood as the evaluation notion for distributions taught by Sajjadi, Sections 3 through 3.2. Sajjadi introduces a notion of precision and recall for comparing a generated distribution to a reference distribution, where precision reflects the quality of the generated samples and recall reflects how much of the reference distribution is covered by the generated distribution. This is the same precision/recall framework recited in the pending claim and disclosed in Applicant's specification ([0077]). Because Sajjadi teaches the precision and recall metrics used to characterize how well a generated distribution matches a reference distribution (the same metrics recited in the claim and disclosed in the specification) the combined references teach the amended limitation.
Therefore, the identified claim language is considered to be taught by the combined references, and the rejection is maintained. Further, since Applicant has not argued the dependent claims, their rejections are likewise maintained.
The amended language has further raised 112(a) and 112(b) issues that are addressed down below.
DETAILED ACTION
This is a reply to the arguments filed on 06/04/2026, in which, claims 1-14 and 16-20 are pending. Claims 1, 9, and 16 are independent. Claim 15 is cancelled
When making claim amendments, the applicant is encouraged to consider the references in their entireties, including those portions that have not been cited by the examiner and their equivalents as they may most broadly and appropriately apply to any particular anticipated claim amendments.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-14 and 16-20 rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claim 1, 9 and 16 recites "wherein the precision metric and the recall metric are used as training optimization objectives during training of the generative adversarial network." This limitation requires that precision and recall serve as objectives that drive the training of the GAN. The specification fails to provide adequate written description support for this limitation. While the specification describes precision and recall as metrics used to evaluate the performance of an already-trained GAN through PRD plots [0076]–[0079] and FIGs. 7A–7C) and describes using a trained neural network to "determine" these metrics ([0068]), it does not describe precision and recall being used as objectives that drive training. Where the specification discloses the actual training objective, it identifies the Wasserstein GAN with Gradient Penalty method ([0072]) along with a gradient penalty loss term and Adam optimizer hyperparameters ([0059]–[0066]), and describes discriminator true/false feedback with associated loss modules ([0058]). None of which employ precision or recall as the training objective.
Accordingly, claims 1, 9 and 16 lack adequate written description support for this limitation. The dependent claims are rejected under similar rationale.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 1-14 and 16-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 1, 9 and 16 recites "the precision metric" and "the recall metric" in the claim. There is insufficient antecedent basis for these limitations in the claim. The claim previously recites "a precision distribution" and "a recall distribution", but does not recite a "precision metric" or a "recall metric." It is therefore unclear whether "the precision metric" and "the recall metric" refer to the previously recited precision and recall distributions, or to separate and distinct elements.
To overcome use terminology consistent with the previous limitation e.g. replace "the precision metric and the recall metric" with "the precision distribution and the recall distribution". Alternatively, if the metrics are intended to be distinct from the distributions, introduce them with proper antecedent basis (e.g., "a precision metric and a recall metric").
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 9-10 and 16-17 are rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. (CN 110958263 A, referred to as Zhang), in view of Sajjadi et al. (“Assessing Generative Models via Precision and Recall”, referred to as Sajjadi) in further view of Huang (CN 117040871 A, referred to as Huang).
In reference to claim 1, A method for generating decoy honeypots, the steps comprising: identifying a plurality of network device configurations on a network (Zhang: [0063] and [0119]-[0120] Provides for identifying multiple network device configuration parameters (file locations, names, sizes, network configuration parameters) by extracting them from the real sample environment as a dataset.)
instantiating a generative adversarial network comprising architecture properties (Zhang: [0050]-[0058] and [0100]-[0101] Provides for instantiating ("invoking"/"constructing") a GAN with explicitly defined architecture properties.)
generating a plurality of decoy honeypots with the generative adversarial network (Zhang: [0030], [0102] and [0113] Provides for using the GAN's generative model to produce parameters that configure honeypot environments deployed across multiple devices in the enterprise network.)
wherein the plurality of decoy honeypots imitate the plurality of network device configurations to deceive malicious actors (Zhang: [0030], [0048] and [0098] Provides for honeypots that imitate real network device configurations (the GAN learns from real-environment parameters) for the explicit purpose of deceiving attackers into believing they have intruded a real environment.)
activating the plurality of decoy honeypots to the network (Zhang: [0113]-[0116] Provides for deploying ("activating") the configured honeypots across multiple networked devices.)
Zhang does not explicitly teach wherein the generative adversarial network optimizes a distribution of the plurality of decoy honeypots according to a precision distribution and a recall distribution and dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker. However, Sajjadi teaches:
wherein the generative adversarial network optimizes a distribution of the plurality of decoy honeypots according to a precision distribution and a recall distribution (Sajjadi: Section 3.2-3.3 Provides for evaluating a generative model's output distribution Q against a reference P along two separate axes, a precision distribution and a recall distribution.)
wherein the precision metric and the recall metric are used as training optimization objectives during training of the generative adversarial network (Sajjadi: Section 3 - Section 3.2 Provides for precision/recall are explicitly a post-hoc description/evaluation of a finished model and expressly do not constitute different models or training thresholds.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang, which provides a method for generating decoy honeypots using generative adversarial networks that learn from real network device configurations to deceive attackers, with the teachings of Sajjadi, which introduces optimizing generative model distributions according to separate precision and recall metrics. One of ordinary skill in the art would recognize the ability to incorporate Sajjadi's dual-metric optimization approach into Zhang's GAN-based honeypot generation system to improve the quality and effectiveness of generated decoys. One of ordinary skill in the art would be motivated to make this modification in order to create more realistic honeypots
Zhang in view of Sajjadi does not explicitly teach dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker. However, Huang teaches:
dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker (Huang: [0014], [0024] and [0048]-[0050] Provides for dynamically evolving honeypots toward attacker preferences. Determines attacker preferences from vulnerability data and behavior, then continuously optimizes/updates honeypot configuration.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi, which together provide a method for generating optimized decoy honeypots using GANs with precision and recall distribution balancing, with the teachings of Huang, which introduces dynamically evolving honeypots toward attacker preferences based on vulnerability data and observed behavior. One of ordinary skill in the art would recognize the ability to incorporate Huang's adaptive evolution capabilities into the combined honeypot generation system to create responsive deception environments. One of ordinary skill in the art would be motivated to make this modification in order to improve attacker engagement by continuously adapting honeypots to match current attacker interests and targeting patterns.
In reference to claim 2, The method for generating cybersecurity decoys of claim 1, the generative adversarial network further comprising: using a trained neural network to determine a precision metric of the plurality of network device configurations (Sajjadi: Section 4 Provides for using a trained neural network (Inception) to extract feature representations from which the precision metric is computed.)
using a trained neural network to determine a recall metric of the plurality of network device configurations (Sajjadi: Section 3.3 and 4 Provides for he same trained neural network embedding being used to compute the recall metric by measuring coverage of the true distribution's clusters.)
In reference to claim 9, A non-transitory computer-readable storage medium comprising computer readable instructions for generating decoy honeypots by using generative adversarial networks, the instructions performing operations comprising: identifying a plurality of network device configurations on a network (Zhang: [0063] and [0119]-[0120] Provides for identifying multiple network device configuration parameters (file locations, names, sizes, network configuration parameters) by extracting them from the real sample environment as a dataset.)
instantiating a generative adversarial network comprising architecture properties (Zhang: [0050]-[0058] and [0100]-[0101] Provides for instantiating ("invoking"/"constructing") a GAN with explicitly defined architecture properties.)
generating a plurality of decoy honeypots with the generative adversarial network (Zhang: [0030], [0102] and [0113] Provides for using the GAN's generative model to produce parameters that configure honeypot environments deployed across multiple devices in the enterprise network.)
wherein the plurality of decoy honeypots imitate the plurality of network device configurations to deceive malicious actors (Zhang: [0030], [0048] and [0098] Provides for honeypots that imitate real network device configurations (the GAN learns from real-environment parameters) for the explicit purpose of deceiving attackers into believing they have intruded a real environment.)
activating the plurality of decoy honeypots to the network (Zhang: [0113]-[0116] Provides for deploying ("activating") the configured honeypots across multiple networked devices.)
Zhang does not explicitly teach wherein the generative adversarial network optimizes a distribution of the plurality of decoy honeypots according to a precision distribution and a recall distribution and dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker. However, Sajjadi teaches:
wherein the generative adversarial network optimizes a distribution of the plurality of decoy honeypots according to a precision distribution and a recall distribution (Sajjadi: Section 3.2-3.3 Provides for evaluating a generative model's output distribution Q against a reference P along two separate axes, a precision distribution and a recall distribution.)
wherein the precision metric and the recall metric are used as training optimization objectives during training of the generative adversarial network (Sajjadi: Section 3 - Section 3.2 Provides for precision/recall are explicitly a post-hoc description/evaluation of a finished model and expressly do not constitute different models or training thresholds.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang, which provides a method for generating decoy honeypots using generative adversarial networks that learn from real network device configurations to deceive attackers, with the teachings of Sajjadi, which introduces optimizing generative model distributions according to separate precision and recall metrics. One of ordinary skill in the art would recognize the ability to incorporate Sajjadi's dual-metric optimization approach into Zhang's GAN-based honeypot generation system to improve the quality and effectiveness of generated decoys. One of ordinary skill in the art would be motivated to make this modification in order to create more realistic honeypots
Zhang in view of Sajjadi does not explicitly teach dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker. However, Huang teaches:
dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker (Huang: [0014], [0024] and [0048]-[0050] Provides for dynamically evolving honeypots toward attacker preferences. Determines attacker preferences from vulnerability data and behavior, then continuously optimizes/updates honeypot configuration.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi, which together provide a method for generating optimized decoy honeypots using GANs with precision and recall distribution balancing, with the teachings of Huang, which introduces dynamically evolving honeypots toward attacker preferences based on vulnerability data and observed behavior. One of ordinary skill in the art would recognize the ability to incorporate Huang's adaptive evolution capabilities into the combined honeypot generation system to create responsive deception environments. One of ordinary skill in the art would be motivated to make this modification in order to improve attacker engagement by continuously adapting honeypots to match current attacker interests and targeting patterns.
In reference to claim 10, The non-transitory computer-readable storage medium comprising computer readable instructions for generating decoy honeypots by using generative adversarial networks of claim 9, the generative adversarial network further comprising: using a trained neural network to determine a precision metric of the plurality of network device configurations (Sajjadi: Section 4 Provides for using a trained neural network (Inception) to extract feature representations from which the precision metric is computed.)
using a trained neural network to determine a recall metric of the plurality of network device configurations (Sajjadi: Section 3.3 and 4 Provides for he same trained neural network embedding being used to compute the recall metric by measuring coverage of the true distribution's clusters.)
In reference to claim 16, A network decoy server, comprising: a network interface communicatively coupled to a network; at least one processor coupled to the network interface; and at least one memory coupled to the at least one processor, the at least one memory have instructions stored there, which when executed by the at least one process, direct the network decoy server to: identifying a plurality of network device configurations on a network (Zhang: [0063] and [0119]-[0120] Provides for identifying multiple network device configuration parameters (file locations, names, sizes, network configuration parameters) by extracting them from the real sample environment as a dataset.)
instantiating a generative adversarial network comprising architecture properties (Zhang: [0050]-[0058] and [0100]-[0101] Provides for instantiating ("invoking"/"constructing") a GAN with explicitly defined architecture properties.)
generating a plurality of decoy honeypots with the generative adversarial network (Zhang: [0030], [0102] and [0113] Provides for using the GAN's generative model to produce parameters that configure honeypot environments deployed across multiple devices in the enterprise network.)
wherein the plurality of decoy honeypots imitate the plurality of network device configurations to deceive malicious actors (Zhang: [0030], [0048] and [0098] Provides for honeypots that imitate real network device configurations (the GAN learns from real-environment parameters) for the explicit purpose of deceiving attackers into believing they have intruded a real environment.)
activating the plurality of decoy honeypots to the network (Zhang: [0113]-[0116] Provides for deploying ("activating") the configured honeypots across multiple networked devices.)
Zhang does not explicitly teach wherein the generative adversarial network optimizes a distribution of the plurality of decoy honeypots according to a precision distribution and a recall distribution and dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker. However, Sajjadi teaches:
wherein the generative adversarial network optimizes a distribution of the plurality of decoy honeypots according to a precision distribution and a recall distribution (Sajjadi: Section 3.2-3.3 Provides for evaluating a generative model's output distribution Q against a reference P along two separate axes, a precision distribution and a recall distribution.)
wherein the precision metric and the recall metric are used as training optimization objectives during training of the generative adversarial network (Sajjadi: Section 3 - Section 3.2 Provides for precision/recall are explicitly a post-hoc description/evaluation of a finished model and expressly do not constitute different models or training thresholds.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang, which provides a method for generating decoy honeypots using generative adversarial networks that learn from real network device configurations to deceive attackers, with the teachings of Sajjadi, which introduces optimizing generative model distributions according to separate precision and recall metrics. One of ordinary skill in the art would recognize the ability to incorporate Sajjadi's dual-metric optimization approach into Zhang's GAN-based honeypot generation system to improve the quality and effectiveness of generated decoys. One of ordinary skill in the art would be motivated to make this modification in order to create more realistic honeypots
Zhang in view of Sajjadi does not explicitly teach dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker. However, Huang teaches:
dynamically evolving the plurality of decoy honeypots towards one or more preferences of a network attacker (Huang: [0014], [0024] and [0048]-[0050] Provides for dynamically evolving honeypots toward attacker preferences. Determines attacker preferences from vulnerability data and behavior, then continuously optimizes/updates honeypot configuration.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi, which together provide a method for generating optimized decoy honeypots using GANs with precision and recall distribution balancing, with the teachings of Huang, which introduces dynamically evolving honeypots toward attacker preferences based on vulnerability data and observed behavior. One of ordinary skill in the art would recognize the ability to incorporate Huang's adaptive evolution capabilities into the combined honeypot generation system to create responsive deception environments. One of ordinary skill in the art would be motivated to make this modification in order to improve attacker engagement by continuously adapting honeypots to match current attacker interests and targeting patterns.
In reference to claim 17, The network decoy server of claim 16, the generative adversarial network further comprising: using a trained neural network to determine a precision metric of the plurality of network device configurations (Sajjadi: Section 4 Provides for using a trained neural network (Inception) to extract feature representations from which the precision metric is computed.)
using a trained neural network to determine a recall metric of the plurality of network device configurations (Sajjadi: Section 3.3 and 4 Provides for he same trained neural network embedding being used to compute the recall metric by measuring coverage of the true distribution's clusters.)
Claims 3-6, 11-14 and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. (CN 110958263 A, referred to as Zhang), in view of Sajjadi et al. (“Assessing Generative Models via Precision and Recall”, referred to as Sajjadi) in further view of Huang (CN 117040871 A, referred to as Huang) in further view of Keras (“WGAN-GP overriding Model.train_step”, referred to as Keras).
In reference to claim 3, The method for generating cybersecurity decoys of claim 1, wherein the plurality of decoy honeypots are represented as two-dimensional data objects (Keras: Sections "Prepare the Fashion-MNIST data" and "Create the discriminator" Provides for all generated and real samples being explicitly represented as two-dimensional data objects.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized precision-recall distributions and attacker preference adaptation, with the teachings of Keras, which introduces representing data objects as two-dimensional structures for GAN processing. One of ordinary skill in the art would recognize the ability to incorporate Keras's two-dimensional data representation into the combined honeypot generation system to enable more efficient GAN processing and analysis. One of ordinary skill in the art would be motivated to make this modification in order to leverage well-established GAN architectures designed for two-dimensional data.
In reference to claim 4, The method for generating cybersecurity decoys of claim 3, wherein the generative adversarial network further comprises: at least one discriminator model using fractionally strided convolutions (Keras: "Create the discriminator" and “discriminator model summary table” Provides for the discriminator explicitly using strided convolutions (strides=(2,2)) across all four conv blocks to progressively downsample the input.)
at least one generator model comprising at least four blocks, each block further comprising an upsampling layer and a convolution layer (Keras: "Create the generator" and “generator model summary table” Provides for generator explicitly constructed with four upsample_blocks each containing a sequential UpSampling2D layer followed by a Conv2D layer.)
In reference to claim 5, The method for generating cybersecurity decoys of claim 1, wherein the architecture properties comprise batch size, number of steps, gradient penalty coefficient, and Adam Optimizer parameters (Keras: "Create the WGAN-GP model" and "Train the end-to-end model" Provides for every enumerated architecture property explicitly present in the reference.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized distributions and attacker preference adaptation, with the teachings of Keras, which introduces specific GAN architecture properties including batch size, training steps, gradient penalty coefficients, and Adam optimizer parameters. One of ordinary skill in the art would recognize the ability to incorporate Keras's detailed architectural specifications into the combined honeypot generation system to improve training stability and convergence. One of ordinary skill in the art would be motivated to make this modification in order to achieve more reliable GAN training through proven hyperparameter configurations.
In reference to claim 6, The method for generating decoys of claim 1, wherein the generative adversarial network is unconditionally trained (Keras:"Prepare the Fashion-MNIST data" and “train_step method” Provides for a GAN trained exclusively on unlabeled image data with no class conditioning, label inputs, or conditional guidance at any stage.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized distributions and attacker preference adaptation, with the teachings of Keras, which introduces unconditional GAN training using unlabeled data without class conditioning or label guidance. One of ordinary skill in the art would recognize the ability to incorporate Keras's unconditional training approach into the combined honeypot generation system to enable learning from diverse network configurations without requiring labeled categorization. One of ordinary skill in the art would be motivated to make this modification in order to simplify the training process.
In reference to claim 11, The non-transitory computer-readable storage medium comprising computer readable instructions for generating decoy honeypots by using generative adversarial networks of claim 9, wherein the plurality of decoy honeypots are represented as two-dimensional data objects (Keras: Sections "Prepare the Fashion-MNIST data" and "Create the discriminator" Provides for all generated and real samples being explicitly represented as two-dimensional data objects.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized precision-recall distributions and attacker preference adaptation, with the teachings of Keras, which introduces representing data objects as two-dimensional structures for GAN processing. One of ordinary skill in the art would recognize the ability to incorporate Keras's two-dimensional data representation into the combined honeypot generation system to enable more efficient GAN processing and analysis. One of ordinary skill in the art would be motivated to make this modification in order to leverage well-established GAN architectures designed for two-dimensional data.
In reference to claim 12, The non-transitory computer-readable storage medium comprising computer readable instructions for generating decoy honeypots by using generative adversarial networks of claim 11, wherein the generative adversarial network further comprises: at least one discriminator model using fractionally strided convolutions (Keras: "Create the discriminator" and “discriminator model summary table” Provides for the discriminator explicitly using strided convolutions (strides=(2,2)) across all four conv blocks to progressively downsample the input.)
at least one generator model comprising at least four blocks, each block further comprising an upsampling layer and a convolution layer (Keras: "Create the generator" and “generator model summary table” Provides for generator explicitly constructed with four upsample_blocks each containing a sequential UpSampling2D layer followed by a Conv2D layer.)
In reference to claim 13, The non-transitory computer-readable storage medium comprising computer readable instructions for generating decoy honeypots by using generative adversarial networks of claim 9, wherein the architecture properties comprise batch size, number of steps, gradient penalty coefficient, and Adam Optimizer parameters (Keras: "Create the WGAN-GP model" and "Train the end-to-end model" Provides for every enumerated architecture property explicitly present in the reference.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized distributions and attacker preference adaptation, with the teachings of Keras, which introduces specific GAN architecture properties including batch size, training steps, gradient penalty coefficients, and Adam optimizer parameters. One of ordinary skill in the art would recognize the ability to incorporate Keras's detailed architectural specifications into the combined honeypot generation system to improve training stability and convergence. One of ordinary skill in the art would be motivated to make this modification in order to achieve more reliable GAN training through proven hyperparameter configurations.
In reference to claim 14, The non-transitory computer-readable storage medium comprising computer readable instructions for generating decoy honeypots by using generative adversarial networks of claim 9, wherein the generative adversarial network is unconditionally trained (Keras:"Prepare the Fashion-MNIST data" and “train_step method” Provides for a GAN trained exclusively on unlabeled image data with no class conditioning, label inputs, or conditional guidance at any stage.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized distributions and attacker preference adaptation, with the teachings of Keras, which introduces unconditional GAN training using unlabeled data without class conditioning or label guidance. One of ordinary skill in the art would recognize the ability to incorporate Keras's unconditional training approach into the combined honeypot generation system to enable learning from diverse network configurations without requiring labeled categorization. One of ordinary skill in the art would be motivated to make this modification in order to simplify the training process.
In reference to claim 18, The network decoy server of claim 16, wherein the generative adversarial network further comprises: at least one discriminator model using fractionally strided convolutions (Keras: "Create the discriminator" and “discriminator model summary table” Provides for the discriminator explicitly using strided convolutions (strides=(2,2)) across all four conv blocks to progressively downsample the input.)
at least one generator model comprising at least four blocks, each block further comprising an upsampling layer and a convolution layer (Keras: "Create the generator" and “generator model summary table” Provides for generator explicitly constructed with four upsample_blocks each containing a sequential UpSampling2D layer followed by a Conv2D layer.)
In reference to claim 19, The network decoy server of claim 16, wherein the architecture properties comprise batch size, number of steps, gradient penalty coefficient, and Adam Optimizer parameters (Keras: "Create the WGAN-GP model" and "Train the end-to-end model" Provides for every enumerated architecture property explicitly present in the reference.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized distributions and attacker preference adaptation, with the teachings of Keras, which introduces specific GAN architecture properties including batch size, training steps, gradient penalty coefficients, and Adam optimizer parameters. One of ordinary skill in the art would recognize the ability to incorporate Keras's detailed architectural specifications into the combined honeypot generation system to improve training stability and convergence. One of ordinary skill in the art would be motivated to make this modification in order to achieve more reliable GAN training through proven hyperparameter configurations.
In reference to claim 20, The network decoy server of claim 16, wherein the generative adversarial network is unconditionally trained (Keras:"Prepare the Fashion-MNIST data" and “train_step method” Provides for a GAN trained exclusively on unlabeled image data with no class conditioning, label inputs, or conditional guidance at any stage.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized distributions and attacker preference adaptation, with the teachings of Keras, which introduces unconditional GAN training using unlabeled data without class conditioning or label guidance. One of ordinary skill in the art would recognize the ability to incorporate Keras's unconditional training approach into the combined honeypot generation system to enable learning from diverse network configurations without requiring labeled categorization. One of ordinary skill in the art would be motivated to make this modification in order to simplify the training process.
Claims 7 and 8 are rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. (CN 110958263 A, referred to as Zhang), in view of Sajjadi et al. (“Assessing Generative Models via Precision and Recall”, referred to as Sajjadi) in further view of Huang (CN 117040871 A, referred to as Huang) in further view of Mirza et al. (“Conditional Generative Adversarial Nets”, referred to as Mirza).
In reference to claim 7, The method for generating decoys of claim 1, wherein the generative adversarial network is conditionally trained based on operating system type (Mirza: Section 3.2 and 4.1 Provides for conditional training of a GAN on categorical auxiliary information.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized distributions and attacker preference adaptation, with the teachings of Mirza, which introduces conditional GAN training based on categorical auxiliary information such as class labels. One of ordinary skill in the art would recognize the ability to incorporate Mirza's conditional training approach into the combined honeypot generation system to enable targeted decoy generation based on operating system types. One of ordinary skill in the art would be motivated to make this modification in order to generate more authentic and contextually appropriate honeypots by conditioning the GAN on specific operating system characteristics.
In reference to claim 8, The method for generating decoys of claim 1, wherein the generative adversarial network is conditionally trained based on device type (Mirza: Section 3.2 and 4.1 Provides for conditional training of a GAN on categorical auxiliary information.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Zhang in view of Sajjadi and Huang, which together provide a method for generating and dynamically evolving decoy honeypots using GANs with optimized distributions and attacker preference adaptation, with the teachings of Mirza, which introduces conditional GAN training based on categorical auxiliary information such as class labels. One of ordinary skill in the art would recognize the ability to incorporate Mirza's conditional training approach into the combined honeypot generation system to enable targeted decoy generation based on operating system types. One of ordinary skill in the art would be motivated to make this modification in order to generate more authentic and contextually appropriate honeypots by conditioning the GAN on specific device types.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTO-892.
Applicant’s amendment necessitated the new ground(s) of rejection presented in this office action. Accordingly, THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AIDAN EDWARD SHAUGHNESSY whose telephone number is (703)756-1423. The examiner can normally be reached on Monday-Friday from 7:30am to 5pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson, can be reached at telephone number (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/usptoautomated-interview-request-air-form.
/A.E.S./Examiner, Art Unit 2432
/Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
