DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Office Action is in response to the communication filed on 12/27/2024.
Claims 1-32 are pending.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) ELEMENT IN CLAIM FOR A COMBINATION.—An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term "means" or "step" or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term "means" or "step" or the generic placeholder is modified by functional language, typically, but not always linked by the transition word "for" (e.g., "means for") or another linking word or phrase, such as "configured to" or "so that"; and
(C) the term "means" or "step" or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word "means" (or "step") in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word "means" (or "step") in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word "means" (or "step") are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word "means" (or "step") are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word "means," but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitations use a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitations are: “enforcer” recited in claims 1 and 22, “evaluator” recited in claims 1-2, and 22, “scoring model” recited in claim 1.
Because these claim limitations are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, they are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. A review of the specification shows that the following appears to be the corresponding structure described in the specification for the 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph limitations: figs. 2-4, [0104]-[0120] of the specification.
If applicant does not intend to have these limitations interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitations to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitations recite sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Objections
Claims 7-8 are objected to because of the following informalities:
“the group” in claim 7 should read “a group”.
“the training” in claim 8 should read “training”.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-32 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim 1 recites “the transaction”, however it is unclear whether this limitation refers to one of “layer 7 transactions” as recited in line 1 of claim 1, “a layer 7 transaction” recited in line 4 of claim 1, or some other transaction. Note that dependent claims 8-9, 13-14, 16, 18-19, 22 also recites “the transaction” limitation. Claims 23, 25, 28, and 30-31 also have similar issue.
Claim 1 recites “…receives a layer 7 transaction destined for a protected application prior to the transaction possibly being supplied to the protected entity” which renders the claim indefinite because it utilizes speculative language that fails to clearly set forth the metes and bounds of the claim. The intended scope of the limitation is unclear. The claims and specification do not provide any clarification for determining the intended scope of the limitation. Specifically, it’s unclear whether the act of the transaction being supplied to the protected entity is a mandatory operational requirement of the apparatus, a conditional limitation triggered by a specific event, or an entirely optional feature that may be omitted entirely. Thus, the limitation is unclear and renders the claim indefinite. Claim 23 also has this issue.
There is insufficient antecedent basis for the limitation “the parameter value” recited in claim 7, it’s unclear if it refers to “the parameter values” in claim 5 or some other parameter value.
Dependent claims are also rejected for inheriting the deficiencies of the claims from which they depend on.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-6, 8-13, 15-21, and 23-32 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Subbarayan et al. (US 2019/0114417).
Claim 1, Subbarayan teaches:
Apparatus for filtering layer 7 transactions, each transaction being transmitted from a source to a protected entity, comprising:
computing circuitry implementing a transaction filter enforcer which at least receives a layer 7 transaction destined for a protected application prior to the transaction possibly being supplied to the protected entity; and (e.g., figs. 1-2, [0042], “The router 250 can be a hardware device or a software unit configured to route data communications between compute devices and destination servers. The router 250 can be configured to receive requests from a client application at a compute device, for example API based web applications, distributed applications and client server applications configured to use one or more security gateways…interposed between clients and destination servers for security at the API layer. The router 250 can receive data packets associated with a specific API and addressed to a target service at a destination server. The router 250 can transmit the data packets to the appropriate destination server based on predefined policies and techniques (e.g. security policies and techniques), via the communicator 226…the router 250 can be configured to parse the incoming data. The router 250 can be configured to route a copy of the received data to other components in the processor 222 such as the data logger 251, the context analyzer 252, and the security enforcer 255 for storage and analysis…the router 250 can selectively discard or reject transmission of communications/messages/traffic events that have been determined to be representative of a potentially malicious action/indicator of compromise, and only to allow transmission of communications/messages/traffic events that are found to be consistent with (or within established traffic parameter baselines for) normal traffic patterns associated with an API or application, based on inputs from the other components”)
computing circuitry implementing an evaluator, the evaluator receiving the transaction from the enforcer; (e.g., fig. 2, [0044], “The context analyzer 252 can be configured to receive a copy of the data received by the router 250…and analyze the data including API traffic for context of one or more data API calls. For example the context analyzer 252 can be configured to parse real-time API traffic” [0045], “the context analyzer 252 can extract context based information from API traffic based on the protocol used for data transmission. For example, context information can be extracted from API traffic data associated with REST API, WebSocket, MQTT, AMQP, CoAP and any other application layer (layer 7) protocols” [0046], “The context analyzer 252 can analyze the extracted data to identify a sequence of API transactions...The context analyzer 252 can define a set of symbols, the symbol being units of the data associated with the sequence of API transactions” [0048], “the context analyzer 252 can be configured to generate a set of vector representations of the symbols based on the various context defined as described above…the context analyzer 252 can use the sequence of symbols to generate a n-gram representation of the sequence of symbols…that can be provided as an input vector to a machine learning model (ML model) such as the ML model 253”)
wherein the enforcer routes the transaction to the protected entity when the transaction does not receive a malicious determination from the evaluator for the transaction; and (e.g., figs. 1-2, [0042], “the router 250 can…allow transmission of communications/messages/traffic events that are found to be consistent with (or within established traffic parameter baselines for) normal traffic patterns associated with an API or application, based on inputs from the other components”)
wherein the evaluator includes at least a scoring model that determines a score indicative of whether the transaction is malicious or non-malicious based on input from at least one trained model, the transaction being supplied to each of the at least one trained model, each of the at least one trained model being a model from a set of available model types, the available model types including at least an anomaly model and an attack model; (e.g., figs. 2-4, [0049], “the context analyzer 252 can be configured to generate an input vector based on the vector representation of the sequence of symbols to be provided to the ML model 253 such that the ML model 253 can identify based on the input vector, a potential malicious activity associated with a client application at a compute device from which the sequence of symbols are known to have originated. In other words, the ML model 253 can be trained on API transactions associated with largely normal user access patterns to applications that can be stored in a dictionary of API transactions (e.g., a dictionary of known associations between symbols). A potentially malicious pattern of activity can generate either a new sequence of symbols or a combination of new sequences of symbols of API transactions that can be identified as an outlier and be flagged as being indicative of malicious activity. For example, the context analyzer 252 can generate a representation of an indication associated with at least one API call from a sequence or set of API calls (defined based on a context for example) to provide as input to the ML model 253 to identify potentially malicious activity associated with a client device, as described herein” [0050]-[0053], “The ML model 253 can be any statistical model built and trained using machine learning tools. In some embodiments the ML model 253 can be a supervised model. In some other embodiments, the ML model 253 can be built and used in an unsupervised manner” [0064], “the ML model can be configured to receive as input a vector representation of a sequence of symbols, the symbols being API calls. The ML model can be configured to calculate and output the co-occurrence scores for every possible pair of API calls in the sequence of API calls according to various contexts. The co-occurrence scores associated with a single symbol or a single API call can then be combined, for example by the outlier detector, to generate consistency scores associated with single API calls that can be compared against baseline values of consistency scores for API calls occurring in sequences of normal activity (e.g. good sequences). For example, if the consistency scores associated with one or more API calls in an analyzed sequence (received from a client device) are found to be below a predetermined threshold, the threshold being determined based on baseline data collected during training, the outlier detector can report or return an outlier indicating anomalous activity. This report can be acted upon, for example by the security enforcer, by sending a signal for remedial action, such as restricting traffic to/from the suspected client device or collecting and analyzing data associated with the potential malicious activity” [0065], “the proxy server can be configured such that the ML model is trained to directly output an identification and a classification of type of maliciousness of activity associated with a sequence of symbols” [0085], “various features associated with the anomalous API traffic detection can be extracted at suitable time intervals…the ML models can be built to output results for API visibility, API anomalies, API attacks, backend errors and blocked connections…The aggregate summary and details of all flagged and/or blocked connections can be reported on a per-API basis”)
wherein the enforcer operates in real-time and the evaluator operates in at least near real-time. (e.g., [0044], “the proxy server 220 may be configured to monitor a set of API calls associated with a set of APIs, and the context analyzer 252 can extract discrete sets of data parameters that may be selected corresponding to each API call from the set of API calls being monitored by the proxy server 220 based on the APIs with which they may be associated. In other words, data parameters can be selected for data extraction from raw data logs and/or from data packets corresponding to real-time API traffic that is being received”)
Claim 2, Subbarayan teaches:
wherein the evaluator is further adapted to receive and evaluate at least one transaction from at least one source other than the enforcer. (e.g., fig. 2, [0042], [0048]-[0049], [0051])
Claim 3, Subbarayan teaches:
wherein the at least one transaction from the at least one source other than the enforcer are used as part of a determination as to whether a source of the at least one transaction from the at least one source other than the enforcer is malicious. (e.g., fig. 2, [0042], [0046], [0048]-[0049])
Claim 4, Subbarayan teaches:
wherein the anomaly model is trained using normal behavior of the application during peacetime. (e.g., [0053], [0064])
Claim 5, Subbarayan teaches:
wherein the normal behavior of the application is based on learned characteristics of parameter values. (e.g., [0053], [0064], [0069])
Claim 6, Subbarayan teaches:
wherein triggering a suspect indicator upon at least one of the parameter values exceeding its learned characteristics. (e.g., [0063]-[0064], [0075])
Claim 8, Subbarayan teaches:
wherein the anomaly model detects anomalous structure within the transaction based on the training of the anomaly model. (e.g., figs. 2-4, [0063]-[0065], [0085])
Claim 9, Subbarayan teaches:
wherein the anomaly model employs vector embedding to evaluate a scenario comprised of a sequence of transactions that includes the transaction to determine if the source of the transaction is malicious and wherein subsequent transactions from the source of the transaction will be designated as malicious. (e.g., fig. 4, [0060]-[0062], [0064]-[0065])
Claim 10, Subbarayan teaches:
wherein the anomaly model is trained using suspect indicators that are based on at least one of counters or rates with tuned threshold values. (e.g., [0053], [0055], [0063], [0072])
Claim 11, Subbarayan teaches:
wherein the attack model is trained to recognize general characteristics of attacker behaviors. (e.g., [0043], [0051], [0053], [0073], [0085])
Claim 12, Subbarayan teaches:
12. The apparatus of claim 1, wherein the attack model is trained based on supervised learning from historic transactions. (e.g., [0050]-[0051], [0053], [0066])
Claim 13, Subbarayan teaches:
wherein the attack model is trained to identify malicious values in fields of the transaction. (e.g., figs. 3-4, [0051], [0063]-[0066])
Claim 15, Subbarayan teaches:
wherein the attack model is trained to detect probing behavior. (e.g., figs. 3-4, [0053], [0055], [0063]-[0064])
Claim 16, Subbarayan teaches:
wherein the score is for at least the source of the transaction. (e.g., figs. 3-4, [0063]-[0066])
Claim 17, Subbarayan teaches:
wherein the score for the source is based on a scenario comprised of sequence of transactions from the source. (e.g., fig. 4, [0060]-[0062], [0064]-[0065])
Claim 18, Subbarayan teaches:
wherein the score is at least based on the transaction itself. (e.g., figs. 3-4, [0063]-[0066])
Claim 19, Subbarayan teaches:
wherein the score of the transaction is based on a scenario comprised of a sequence of transactions of which the transaction is a part. (e.g., fig. 4, [0060]-[0062], [0064]-[0065])
Claim 20, Subbarayan teaches:
wherein the scoring model is a trained scoring model. (e.g., [0063]-[0066])
Claim 21, Subbarayan teaches:
wherein the available model types further includes an attack pattern mining model. (e.g., [0049], [0066], [0084]-[0085])
Claim 23, this claim is directed to a method containing similar limitations as recited in claim 1 and is rejected for similar rationale.
Claim 24, this claim is directed to a method containing similar limitations as recited in claim 4 and is rejected for similar rationale.
Claim 25, this claim is directed to a method containing similar limitations as recited in claim 9 and is rejected for similar rationale.
Claim 26, this claim is directed to a method containing similar limitations as recited in claim 12 and is rejected for similar rationale.
Claim 27, this claim is directed to a method containing similar limitations as recited in claim 15 and is rejected for similar rationale.
Claim 28, this claim is directed to a method containing similar limitations as recited in claim 16 and is rejected for similar rationale.
Claim 29, this claim is directed to a method containing similar limitations as recited in claim 17 and is rejected for similar rationale.
Claim 30, this claim is directed to a method containing similar limitations as recited in claim 18 and is rejected for similar rationale.
Claim 31, this claim is directed to a method containing similar limitations as recited in claim 19 and is rejected for similar rationale.
Claim 32, this claim is directed to a method containing similar limitations as recited in claim 21 and is rejected for similar rationale.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 7, and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Subbarayan et al. (US 2019/0114417) in view of Bar Noy et al. (US 2019/0334940).
Claim 7, Subbarayan teaches the parameter value (see above) and does not appear to explicitly teach but Bar Noy teaches:
at least one of the group consisting of query arguments, query headers, and query body parameters. (e.g., [0062], [0115], [0141])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teachings described by Bar Noy into the invention of Subbarayan, and the motivation for such an implementation would be for the purpose of detecting attack patterns and making it difficult for attackers to find system weaknesses without being detected, reducing false-positive identifications of request messages as suspicious/malicious requests without adversely affecting the true-positive detection rate, and reducing the amount of interaction required by system administrators (Bar Noy [0005]).
Claim 14, Subbarayan teaches the malicious values in fields of the transaction (see above) and does not appear to explicitly teach but Bar Noy teaches:
strings that constitute at least one of a structured query language (SQL) injection and a code injection. (e.g., [0064], [0068], [0082])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teachings described by Bar Noy into the invention of Subbarayan, and the motivation for such an implementation would be for the purpose of detecting attack patterns and making it difficult for attackers to find system weaknesses without being detected, reducing false-positive identifications of request messages as suspicious/malicious requests without adversely affecting the true-positive detection rate, and reducing the amount of interaction required by system administrators (Bar Noy [0005]).
Claim 22 is rejected under 35 U.S.C. 103 as being unpatentable over Subbarayan et al. (US 2019/0114417) in view of Waters, JR. et al. (US 2014/0373140).
Claim 22, Subbarayan teaches wherein, when the evaluator receives for the transaction a malicious determination from the evaluator, the enforcer routes the cleaned transaction to the protected entity (see above) and does not appear to explicitly teach but Waters teaches:
causes an attempt to clean a transaction to take place and when cleaning of the transaction is successful, routes the cleaned transaction. (e.g., [0026], [0031]-[0032])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teachings described by Waters into the invention of Subbarayan, and the motivation for such an implementation would be for the purpose of reducing the negative effects of malicious packets (Waters [0026]).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: 2017/0180418 teaches a system and method for detecting malicious hijack events in real-time by classifying an event as a malicious event or a benign event using a hijack detection model.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AMIE C LIN whose telephone number is (571)272-7752. The examiner can normally be reached M-F 9:00AM -5:00PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, GELAGAY SHEWAYE can be reached at (571)272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/AMIE C. LIN/Primary Examiner, Art Unit 2436
Prosecution Insights