DETAILED ACTION
Response to Amendment
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This is in reply to papers filed on 2026-06-16. Claims 1-20 are pending. Claims 1, 10, 19 is/are independent.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a).
Response to Arguments
Applicant's arguments have been fully considered but they are not persuasive.
Applicant’s arguments have been fully considered but are moot in view of the new ground(s) of rejection.
With respect to claim(s) 1 (see page(s) 10 of Applicant’s Remarks), Applicant argues that the prior art of record (in particular, U.S. Publication 20240291853 to Murphy et al. (hereinafter "Murphy '853")) does not disclose not use AI models to detect cyber attacks, but rather is limited to using AI models to prepare human-readable reports after other systems have detected an attack from security event data. However, Murphy '853 explicitly teaches that its use cases for its plurality of AI models include detecting cyber attacks [Murphy '853 ¶ 0654-0657, 0164]. Murphy '853 selects an AI model to use based upon the use case metadata associated with that model [Murphy '853 ¶ 0682, 0669, 0657]. Murphy '853 then tailors the prompts to that specific selected AI model using a formatting script [Murphy '853 ¶ 0439, 0458] to induce the model to provide the best response. Murphy '853 selects from models that are quite different from each other [Murphy '853 ¶ 0670-0680], such that different models / use cases would necessarily require different formatting scripts to tailor the prompts. Accordingly, Applicant's argument is unpersuasive.
With respect to claim(s) 4 (see page(s) 12-13 of Applicant’s Remarks), Applicant argues that the prior art of record (in particular, Murphy '853 in view of U.S. Publication 20250317460 to Mammadli et al. (hereinafter "Mammadli '460")) does not disclose selecting two AI models for a particular security event, each having its own pre-processing algorithm, such that the security event is processed by both models in parallel. However, Mammadli '460 discloses feeding a single security event to two or more models and combining the results [Mammadli '460 ¶ 0076-0087; Fig. 2]. As discussed above, Murphy '853 discloses selecting from a plurality of models [Murphy '853 ¶ 0682, 0669, 0657], each with its own use case (e.g., detecting a particular attack type) and pre-processing script for tailoring prompts to that model [Murphy '853 ¶ 0439, 0458]. While Murphy '853 does not explicitly disclose using two models at once on the same security event, it would have been obvious to have done so in view of Mammadli '460, as detailed in the rejections below. Accordingly, Applicant's argument is unpersuasive.
Applicant’s arguments with respect to the remaining claim(s) is/are based on Applicant’s arguments with respect to claim(s) 1 and 4 and have been considered as detailed above.
Summary of Claim Rejections under 35 U.S.C. § 102 and § 103
The following table summarizes the rejections set forth in detail below of the claims over the prior art.
Claim No.
Murphy '853
Murphy '853 in view of Mammadli '460
1
[Wingdings font/0xFC]
2
[Wingdings font/0xFC]
3
[Wingdings font/0xFC]
4
[Wingdings font/0xFC]
5
[Wingdings font/0xFC]
6
[Wingdings font/0xFC]
7
[Wingdings font/0xFC]
8
[Wingdings font/0xFC]
9
[Wingdings font/0xFC]
10
[Wingdings font/0xFC]
11
[Wingdings font/0xFC]
12
[Wingdings font/0xFC]
13
[Wingdings font/0xFC]
14
[Wingdings font/0xFC]
15
[Wingdings font/0xFC]
16
[Wingdings font/0xFC]
17
[Wingdings font/0xFC]
18
[Wingdings font/0xFC]
19
[Wingdings font/0xFC]
20
[Wingdings font/0xFC]
Claim Rejections - 35 U.S.C. § 102
The following is a quotation of the appropriate paragraphs of AIA 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim(s) 1-3, 7-12, 16-20 is/are rejected under 35 U.S.C. § 102 as being anticipated by U.S. Publication 20240291853 to Murphy et al. (hereinafter "Murphy '853"). Murphy '853 is prior art to the claims under 35 U.S.C. § 102(a)(1) and 35 U.S.C. § 102(a)(2).
Per claim 1 (independent):
Murphy '853 discloses a method (method of detecting attacks [Murphy '853 ¶ 0051, 0068, 0100, 0247])
Murphy '853 discloses pre-processing a cyber security attack statement, wherein the pre-processing is performed by a pre-processing data science algorithm associated with a first lightweight generative artificial intelligence (Al) model based on a type of cyber-attack the first lightweight generative Al model is configured to identify, and wherein the pre-processing modifies the cyber security attack statement into a format ingestible by the first lightweight generative Al model (stores plurality of AI models with "metadata about the models, such as . . . intended use cases (e.g., detecting DDOS attacks, malware)" [Murphy '853 ¶ 0657]; "Examples of such security events may include but are not limited to: DDoS events, DoS events, phishing events, spamming events, malware events, web attacks, and exploitation events." [Murphy '853 ¶ 0164]; selects AI model "from the plurality of AI models (e.g., plurality of AI models 320) defined within the model repository (e.g., model repository 318) based upon operation requirements" [Murphy '853 ¶ 0682, 0669]; tailors prompts "prompts to fit specific use cases or to elicit more accurate responses from the model" [Murphy '853 ¶ 0439, 0458]; selects AI model from wide variety of different models [Murphy '853 ¶ 0670-0680]; script cleans and structures user input queries into a prompt format AI model can understand [Murphy '853 ¶ 0436-0443, 0455-0461, 0518])
Murphy '853 discloses providing the pre-processed cyber security attack statement to the first lightweight generative AI model, wherein the first lightweight generative Al model is trained to detect a first type of cyber-attack (passes event data to AI, which determines threat level [Murphy '853 ¶ 0167-0173]; Variational Autoencoders (VAEs) is a lightweight AI model [Murphy '853 ¶ 0435; see also ¶ 0447-0455, 0247]; selects AI model for task type from among plurality of models [Murphy '853 ¶ 0654-0691]; detects particular types of security events [Murphy '853 ¶ 0140]; model trained for "a specific type of attack (e.g., DDOS events, DoS events, phishing events, spamming events, malware events, web attacks, and exploitation events)" [Murphy '853 ¶ 0230-0231]; identifies attack type, e.g. AssumedRole, AwsApiCall [Murphy '853 ¶ 0522-0523])
Murphy '853 discloses causing a first post-processing data science algorithm to post-process an output of the first lightweight generative Al model (generates conclusion in human readable form [Murphy '853 ¶ 0247, 0430-0431; ¶ 0524-0563] indicating whether event is a threat)
Murphy '853 discloses generating, based on the post-processing and based on the output of the first lightweight generative Al model, an indication of a cyber-attack (script cleans and structures user input queries into a prompt format AI model can understand [Murphy '853 ¶ 0436-0443, 0455-0461])
Per claim 2 (dependent on claim 1):
Murphy '853 discloses the elements detailed in the rejection of claim 1 above, incorporated herein by reference
Murphy '853 discloses the cyber security attack statement is a query (script cleans and structures user input queries into a prompt format AI model can understand [Murphy '853 ¶ 0436-0443, 0455-0461])
Per claim 3 (dependent on claim 2):
Murphy '853 discloses the elements detailed in the rejection of claim 2 above, incorporated herein by reference
Murphy '853 discloses causing a plurality of post-processing data science algorithms, including the first post- processing data science algorithm, to post-process the output of the first lightweight generative Al model (generates conclusion in human readable form [Murphy '853 ¶ 0247, 0430-0431])
Murphy '853 discloses the pre-processing the cyber security attack statement includes causing a plurality of pre-processing data science algorithms to convert the query to variables (conversion to variables [Murphy '853 ¶ 0091-0092; see also 0436-0443, 0455-0461])
Murphy '853 discloses causing the plurality of pre-processing data science algorithms to modify formatting of the query (script cleans and structures user input queries into a prompt format AI model can understand [Murphy '853 ¶ 0436-0443, 0455-0461])
Murphy '853 discloses causing the plurality of pre-processing data science algorithms to retrieve external resources for the query (obtains additional information from internal and/or third-party sources [Murphy '853 ¶ 0167, 0244-0246])
Per claim 7 (dependent on claim 1):
Murphy '853 discloses the elements detailed in the rejection of claim 1 above, incorporated herein by reference
Murphy '853 discloses the cyber security attack statement is a query; and causing a mitigating action to be performed, wherein the mitigating action is based on a characterization of the cyber-attack in the indication of the cyber-attack, wherein the mitigating action is selected from the group consisting of: blocking access to a database requested in the query, blocking and reporting a device from which the query is received, blocking or quarantining a user profile of the device from which the query is received, and adding the indication of the cyber-attack to a training dataset (automatically mitigates, e.g. by quarantining user, reporting, etc. [Murphy '853 ¶ 0711-0714, 0620-0622, 0643-0651])
Per claim 8 (dependent on claim 7):
Murphy '853 discloses the elements detailed in the rejection of claim 7 above, incorporated herein by reference
Murphy '853 discloses the indication of the cyber-attack and the mitigating action are not determined using large language model(s) (model repository metadata identifies type of attack model detects [Murphy '853 ¶ 0657, 0655]; selects AI model for task type from among plurality of models [Murphy '853 ¶ 0654-0691]; selects AI models, including Variational Autoencoders (VAEs) is a lightweight AI model [Murphy '853 ¶ 0435; see also ¶ 0447-0455, 0247] and generative adversarial models (GAN) [Murphy '853 ¶ 0447-0449, 0391, 0435])
Per claim 9 (dependent on claim 1):
Murphy '853 discloses the elements detailed in the rejection of claim 1 above, incorporated herein by reference
Murphy '853 discloses the cyber-attack is of a type selected from the group consisting of: an injection, an account takeover, an anomaly, a brute force attack, data tampering, and a maliciously stored procedure (detecting attacks, denial of service, anomalies [Murphy '853 ¶ 0051, 0068, 0100, 0247])
Per claim 10 (independent):
Murphy '853 discloses a computer program product comprising: one or more computer readable storage media; and program instructions stored on the one or more storage media to perform operations (processor(s), memory, computer readable media, storage, executable instructions [Murphy '853 ¶ 0789-0794])
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 1 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 11 (dependent on claim 10):
Murphy '853 discloses the elements detailed in the rejection of claim 10 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 2 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 12 (dependent on claim 11):
Murphy '853 discloses the elements detailed in the rejection of claim 11 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 3 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 16 (dependent on claim 10):
Murphy '853 discloses the elements detailed in the rejection of claim 10 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 7 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 17 (dependent on claim 16):
Murphy '853 discloses the elements detailed in the rejection of claim 16 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 8 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 18 (dependent on claim 10):
Murphy '853 discloses the elements detailed in the rejection of claim 10 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 9 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 19 (independent):
Murphy '853 discloses a computer system comprising: a processor set; one or more computer readable storage media; and program instructions stored on the one or more storage media to cause the processor set to perform operations (processor(s), memory, computer readable media, storage, executable instructions [Murphy '853 ¶ 0789-0794])
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 1 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 20 (dependent on claim 19):
Murphy '853 discloses the elements detailed in the rejection of claim 19 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 2 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Claim Rejections - 35 U.S.C. § 103
The following is a quotation of AIA 35 U.S.C. 103 that forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. § 103(a) are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim(s) 4-6, 13-15 is/are rejected under 35 U.S.C. § 103 as being unpatentable over Murphy '853 in view of U.S. Publication 20250317460 to Mammadli et al. (hereinafter "Mammadli '460"). Mammadli '460 is prior art to the claims under 35 U.S.C. § 102(a)(2).
Per claim 4 (dependent on claim 1):
Murphy '853 discloses the elements detailed in the rejection of claim 1 above, incorporated herein by reference
Murphy '853 does not disclose pre-processing, in parallel, the cyber security attack statement by a pre-processing data science algorithm associated with a second lightweight generative Al model, wherein the pre- processing data science algorithm associated with the second lightweight generative Al model is different from the pre-processing data science algorithm associated with the first lightweight generative Al model, and wherein the pre-processing modifies the cyber security attack statement into a format ingestible by the second lightweight generative Al model
However, Murphy '853 pre-processing, the cyber security attack statement by a pre-processing data science algorithm associated with a second lightweight generative Al model, wherein the pre- processing data science algorithm associated with the second lightweight generative Al model is different from the pre-processing data science algorithm associated with the first lightweight generative Al model, and wherein the pre-processing modifies the cyber security attack statement into a format ingestible by the second lightweight generative Al model (stores plurality of AI models with "metadata about the models, such as . . . intended use cases (e.g., detecting DDOS attacks, malware)" [Murphy '853 ¶ 0657]; "Examples of such security events may include but are not limited to: DDoS events, DoS events, phishing events, spamming events, malware events, web attacks, and exploitation events." [Murphy '853 ¶ 0164]; selects AI model "from the plurality of AI models (e.g., plurality of AI models 320) defined within the model repository (e.g., model repository 318) based upon operation requirements" [Murphy '853 ¶ 0682, 0669]; tailors prompts "prompts to fit specific use cases or to elicit more accurate responses from the model" [Murphy '853 ¶ 0439, 0458]; selects AI model from wide variety of different models [Murphy '853 ¶ 0670-0680]; script cleans and structures user input queries into a prompt format AI model can understand [Murphy '853 ¶ 0436-0443, 0455-0461, 0518])
Murphy '853 does not disclose providing, in parallel, the pre-processed cyber security attack statement to the second lightweight generative Al model, wherein the second lightweight generative Al model is trained to detect a second type of cyber-attack that is different than the first type of cyber-attack
However, Murphy '853 discloses providing, the pre-processed cyber security attack statement to the second lightweight generative Al model, wherein the second lightweight generative Al model is trained to detect a second type of cyber-attack that is different than the first type of cyber-attack (passes event data to AI, which determines threat level [Murphy '853 ¶ 0167-0173]; Variational Autoencoders (VAEs) is a lightweight AI model [Murphy '853 ¶ 0435; see also ¶ 0447-0455, 0247]; model repository metadata identifies type of attack model detects [Murphy '853 ¶ 0657, 0655]; selects AI model for task type from among plurality of models [Murphy '853 ¶ 0654-0691]; detects particular types of security events [Murphy '853 ¶ 0140]; model trained for "a specific type of attack (e.g., DDOS events, DoS events, phishing events, spamming events, malware events, web attacks, and exploitation events)" [Murphy '853 ¶ 0230-0231])
Murphy '853 does not disclose causing a second post-processing data science algorithm to post-process an output of the second lightweight generative Al model, wherein the indication of the cyber-attack is based on the post-processing and based on the output of the second lightweight generative AI model
However, Murphy '853 discloses causing a post-processing data science algorithm to post-process an output of a lightweight generative Al model, wherein the indication of the cyber-attack is based on the post-processing and based on the output of the lightweight generative AI model (passes event data to AI, which determines threat level [Murphy '853 ¶ 0167-0173]; Variational Autoencoders (VAEs) is a lightweight AI model [Murphy '853 ¶ 0435; see also ¶ 0447-0455, 0247]; model repository metadata identifies type of attack model detects [Murphy '853 ¶ 0657, 0655]; selects AI model for task type from among plurality of models [Murphy '853 ¶ 0654-0691]; detects particular types of security events [Murphy '853 ¶ 0140]; model trained for "a specific type of attack (e.g., DDOS events, DoS events, phishing events, spamming events, malware events, web attacks, and exploitation events)" [Murphy '853 ¶ 0230-0231])
Further:
Mammadli '460 discloses the pre-processed cyber security attack statement is provided to a second AI model , wherein the second AI model is trained to detect a second type of cyber-attack that is different than the first type of cyber-attack (processes same event data using multiple AI models to perform different detection tasks and combines results [Mammadli '460 ¶ 0076-0087; Fig. 2])
Mammadli '460 discloses causing a second post-processing data science algorithm to post-process an output of the second AI model , wherein the indication of the cyber-attack is based on the post-processing and based on the output of the second AI model (processes same event data using multiple AI models to perform different detection tasks and combines results [Mammadli '460 ¶ 0076-0087; Fig. 2])
It would have been obvious to a person having ordinary skill in the art (1) before the effective filing date of the claimed invention and (2) before the invention was made to have modified Murphy '853 with the multiple AI models of Mammadli '460 to arrive at an apparatus, method, and product including:
the pre-processed cyber security attack statement is provided to a second lightweight generative Al model, wherein the second lightweight generative Al model is trained to detect a second type of cyber-attack that is different than the first type of cyber-attack
causing a second post-processing data science algorithm to post-process an output of the second lightweight generative Al model, wherein the indication of the cyber-attack is based on the post-processing and based on the output of the second lightweight generative AI model
A person having ordinary skill in the art would have been motivated to combine them at least because training two models to detect two different scenarios allows the models to be finer tuned to detect accurately, while being smaller. A person having ordinary skill in the art would have been further motivated to combine them at least because Mammadli '460 teaches [Mammadli '460 ¶ 0076-0087; Fig. 2] modifying an AI based cyberattack detection scheme [Murphy '853 ¶ 0051, 0068, 0100, 0247] such as that of Murphy '853 to arrive at the claimed invention; because Murphy '853 and Mammadli '460 are in the same field of endeavor; because doing so constitutes use of a known technique (multiple AI models [Mammadli '460 ¶ 0076-0087; Fig. 2]) to improve similar devices and/or methods (AI based cyberattack detection scheme [Murphy '853 ¶ 0051, 0068, 0100, 0247]) in the same way; because doing so constitutes applying a known technique (multiple AI models [Mammadli '460 ¶ 0076-0087; Fig. 2]) to known devices and/or methods (AI based cyberattack detection scheme [Murphy '853 ¶ 0051, 0068, 0100, 0247]) ready for improvement to yield predictable results; and because the modification amounts to combining prior art elements according to known methods to yield predictable results. Here, (1) the prior art included each element (as detailed above); (2) one of ordinary skill in the art could have combined the elements as claimed by known methods, and in this combination, each element merely performs the same function as it does separately (AI based scheme [Murphy '853 ¶ 0051, 0068, 0100, 0247] detects cyberattacks using multiple AI models [Mammadli '460 ¶ 0076-0087; Fig. 2]); (3) one of ordinary skill in the art would have recognized that the results of the combination were predictable; and (4) other considerations do not overcome this conclusion.
Per claim 5 (dependent on claim 4):
Murphy '853 in view of Mammadli '460 discloses the elements detailed in the rejection of claim 4 above, incorporated herein by reference
Murphy '853 does not disclose the output of the first lightweight generative AI model identifies the cyber security attack statement as having a potential for causing the first type of cyber-attack, wherein the output of the second lightweight generative AI model identifies the cyber security attack statement as not having a potential for causing the second type of cyber-attack
However, Murphy '853 discloses the output of the first lightweight generative AI model identifies the cyber security attack statement as having a potential for causing the first type of cyber-attack, wherein the output of the lightweight generative AI model identifies the cyber security attack statement as not having a potential for causing the type of cyber-attack (passes event data to AI, which determines threat level [Murphy '853 ¶ 0167-0173]; Variational Autoencoders (VAEs) is a lightweight AI model [Murphy '853 ¶ 0435; see also ¶ 0447-0455, 0247]; model repository metadata identifies type of attack model detects [Murphy '853 ¶ 0657, 0655]; selects AI model for task type from among plurality of models [Murphy '853 ¶ 0654-0691]; detects particular types of security events [Murphy '853 ¶ 0140]; model trained for "a specific type of attack (e.g., DDOS events, DoS events, phishing events, spamming events, malware events, web attacks, and exploitation events)" [Murphy '853 ¶ 0230-0231]; generates conclusion in human readable form [Murphy '853 ¶ 0247, 0430-0431; ¶ 0524-0563] indicating whether event is a threat [Murphy '853 ¶ 0738-0743])
Further:
Mammadli '460 discloses the output of the first AI model identifies the cyber security attack statement as having a potential for causing the first type of cyber-attack, wherein the output of the second AI model identifies the cyber security attack statement as not having a potential for causing the second type of cyber-attack (processes same event data using multiple AI models to perform different detection tasks and combines results [Mammadli '460 ¶ 0076-0087; Fig. 2])
For the reasons detailed above with respect to claim 4, it would have been obvious to a person having ordinary skill in the art (1) before the effective filing date of the claimed invention and (2) before the invention was made to have modified Murphy '853 with the multiple AI models of Mammadli '460 to arrive at an apparatus, method, and product including:
the output of the first lightweight generative AI model identifies the cyber security attack statement as having a potential for causing the first type of cyber-attack, wherein the output of the second lightweight generative AI model identifies the cyber security attack statement as not having a potential for causing the second type of cyber-attack
Per claim 6 (dependent on claim 4):
Murphy '853 in view of Mammadli '460 discloses the elements detailed in the rejection of claim 4 above, incorporated herein by reference
Murphy '853 does not disclose the pre-processing modifies the cyber security attack statement into a format ingestible by the first lightweight generative AI model and the second lightweight generative AI model
However, Murphy '853 discloses the pre-processing modifies the cyber security attack statement into a format ingestible by the first lightweight generative AI model and [modifies a second cyber security attack statement into a format ingestible by] the second lightweight generative AI model (script cleans and structures user input queries into a prompt format AI model can understand [Murphy '853 ¶ 0436-0443, 0455-0461, 0518])
Further:
Mammadli '460 discloses the pre-processing modifies the cyber security attack statement into a format ingestible by the first lightweight generative AI model and the second AI model (processes same event data using multiple AI models to perform different detection tasks and combines results [Mammadli '460 ¶ 0076-0087; Fig. 2])
For the reasons detailed above with respect to claim 4, it would have been obvious to a person having ordinary skill in the art (1) before the effective filing date of the claimed invention and (2) before the invention was made to have modified Murphy '853 with the multiple AI models of Mammadli '460 to arrive at an apparatus, method, and product including:
the pre-processing modifies the cyber security attack statement into a format ingestible by the first lightweight generative AI model and the second lightweight generative AI model
Per claim 13 (dependent on claim 10):
Murphy '853 discloses the elements detailed in the rejection of claim 10 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 4 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 14 (dependent on claim 13):
Murphy '853 in view of Mammadli '460 discloses the elements detailed in the rejection of claim 13 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 5 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Per claim 15 (dependent on claim 13):
Murphy '853 in view of Mammadli '460 discloses the elements detailed in the rejection of claim 13 above, incorporated herein by reference
The remaining limitations of the claim(s) correspond(s) to features of claim(s) 6 and the claim(s) is/are rejected for the reasons detailed with respect to those claims.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to THEODORE C PARSONS whose telephone number is (571)270-1475. The examiner can normally be reached on MTWRF 7:30-4:30.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung Kim can be reached on (571) 272-3804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center. Status information for published applications may be obtained from Patent Center. Status information for unpublished applications is available through Patent Center for authorized users only. Should you have questions about access to Patent Center, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/apply/forms.
/THEODORE C PARSONS/Primary Examiner, Art Unit 2494
Prosecution Insights