Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
The present office action is responsive to communications received on 02/11/2025.
Information Disclosure Statement
The information disclosure statements (IDS) submitted on 03/06/2025 and 06/23/2025 are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Status of Claims
Claims 1-20 are pending.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1, 7-8 and 11-20 is/are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Anderson et al. (US 20210160268 A1) hereinafter referred to as Anderson.
With respect to claim 16, Anderson discloses: A network device, comprising: a processor; a network interface controller configured to provide access to a network; and a memory communicatively coupled to the processor, wherein the memory comprises an anomaly detection logic configured to: (Anderson Fig. 2 teaches device comprising processor 220, Network interface 210 and memory 240 used for anomaly detection per, for example, Anderson ¶3).
collect legitimate network traffic comprising a plurality of packets; (Anderson ¶65 “the device may receive traffic data [legitimate traffic] regarding a plurality of observed traffic flows.”).
classify the collected legitimate network traffic into a plurality of categories based on one or more criteria, wherein based on the classification, each category of the plurality of categories comprises a corresponding subset of packets of the plurality of packets; (Anderson ¶65 “the received traffic data may include traffic flows from a sandbox [subset of packets of the plurality of packets] in which malware is executed and/or from a live networking environment. In other words, the received traffic data may be labeled [classified] according to the desired set of output labels for the classifier being trained (e.g., to distinguish malware-associated traffic flows, to identify an application associated with a traffic flow, etc.).” Classification is also explicitly disclosed in Anderson ¶66).
for each category of the plurality of categories: learn a first set of features based on the corresponding subset of packets; (Anderson ¶65 “Generally, the received traffic data may include any number of traffic characteristics of the observed [learn from] traffic flows (e.g., header field values, TLS parameters, etc.).”)
generate synthetic network traffic based on the learned first set of features; (Anderson ¶67 “At step 520, the device may generate synthetic traffic data based on the mapped characteristics from step 515 [learned first set of features]”).
and train a machine learning model based on the learned first set of features and the generated synthetic network traffic, (Anderson ¶68 “the device may use the synthetic traffic data to train a machine learning-based traffic classifier.” Wherein it is understood that the synthetic traffic data is based on the first set of features upon which the synthetic traffic data is generated).
wherein based on the training, the machine learning model learns a second set of features that differentiates the generated synthetic network traffic from the corresponding subset of packets. (Anderson ¶68 “the classifier may be configured to identify malicious/malware-related traffic flows, distinguish between different source applications for the flows, or perform other traffic classifications. For example, if the observed traffic data from step 510 is labeled “benign” or “malware,” [differentiate by recognizing malware or benign packet data from synthetic traffic training data] the corresponding synthetic traffic data from 525 can be used with these labels to train a classifier that is better suited for the environment to which the classifier will be deployed.”)
Claims 1 and 20 recite a device and method respectively. While the claims might have a slight difference in language, they recite same matter as claim 16 combined with 2 (as mapped below); therefore, the claims are rejected based upon the same rationale.
With respect to claim 7, Anderson discloses: The network device of claim 1, wherein the first set of features comprises one or more of: header characteristics, payload characteristics, temporal characteristics, or state transition characteristics associated with the legitimate network traffic. (Anderson ¶65 “Generally, the received traffic data may include any number of traffic characteristics of the observed traffic flows (e.g., header field values [header characteristics], TLS parameters, etc.).”)
With respect to claim 8, Anderson discloses: The network device of claim 1, wherein the learning of the first set of features is based on another machine learning model different from the machine learning model. (Anderson ¶33 teaches using different types of machines learning models for learning and detecting when reciting “classifier process 244 may employ one or more supervised, unsupervised, or semi-supervised machine learning models. Generally, supervised learning entails the use of a training set of data, as noted above, that is used to train the model to apply labels to the input data. For example, the training data may include sample traffic data that is “normal,” or “malware-generated.” On the other end of the spectrum are unsupervised techniques that do not require a training set of labels. Notably, while a supervised learning model may look for previously seen attack patterns that have been labeled as such, an unsupervised model may instead look to whether there are sudden changes in the behavior of the network traffic. Semi-supervised learning models take a middle ground approach that uses a greatly reduced set of labeled training data.”).
With respect to claim 11, Anderson discloses: The network device of claim 1, wherein the generation of the synthetic network traffic comprises generating a plurality of valid packets that mimics the legitimate network traffic. (Anderson ¶49-51 teach synthetic data could be based on traffic which comprises normal traffic and “malware-related traffic”).
With respect to claim 12, Anderson discloses: The network device of claim 1, wherein the generation of the synthetic network traffic comprises generating a plurality of invalid packets including one or more corrupted packets and one or more anomalous packets. (Anderson ¶49-51 teach synthetic data could be based on traffic which comprises normal traffic and “malware-related traffic”).
With respect to claim 13, Anderson discloses: The network device of claim 12, wherein each packet of the plurality of invalid packets is different from the legitimate network traffic in terms of at least one of: a packet structure, one or more protocol specifications, header characteristics, payload characteristics, temporal characteristics, or state transition characteristics. (Anderson ¶51 teaches the at least header characteristics).
With respect to claim 14, Anderson discloses: The network device of claim 1, wherein the network device corresponds to an edge-based network device. (Anderson ¶14 teaches the device is an edge-device or router, etc.).
With respect to claim 15, Anderson discloses: The network device of claim 1, wherein the network device corresponds to one of an access point, a switch, or a router. (Anderson ¶14 teaches the device is an edge-device or router, etc.).
With respect to claim 17, Anderson discloses: The network device of claim 16, wherein the one or more criteria comprises at least one of a packet type or a connection state. (Anderson ¶39 teaches part of the analyzing comprises packet types, alternative limitation excluded from mapping).
With respect to claim 18, Anderson discloses: The network device of claim 17, wherein the packet type comprises at least one of: a management frame, a control frame, or a data frame, (Anderson ¶53 teaches are data frames, alternative limitations are excluded from mapping).
and the connection state comprises at least one of: scanning, pre-authentication, authentication, association, or data exchange. (Anderson ¶53 teaches connection state of “malware-related vs. benign, one application type vs. another, etc.”. alternative limitations are excluded from mapping).
With respect to claim 19, Anderson discloses: The network device of claim 16, wherein the anomaly detection logic is further configured to: receive at least one new packet; identify, from among the plurality of categories, a category associated with the received at least one new packet; (It is understood from Anderson ¶68 and 70 that data used to train a model in one environment can be used in another environment which means new packets and classify them).
and classify the at least one new packet as one of: legitimate, corrupted, or anomalous based on the trained machine learning model corresponding to the identified category. (Anderson ¶53 and 68 teach classify the data, based on the training, as “benign” or “malware” or “malware-related”).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 2-6 is/are rejected under 35 U.S.C. 103 as being unpatentable over Anderson as applied to claims 1, 7-8 and 11-20 above, and further in view of Sun (US 20240265273 A1) hereinafter referred to as Sun.
With respect to claim 2, Anderson discloses: The network device of claim 1,
Anderson does not explicitly disclose: “generate, based on the trained machine learning model, a time series of scores”
However, Sun in an analogous art discloses: wherein the anomaly detection logic is further configured to: receive, within a time window, new network traffic comprising a sequence of packets; (Sun ¶43 “collect data packets or copies of data packets transmitted between nodes (e.g., two nodes) of a communication session.”)
and generate, based on the trained machine learning model, a time series of scores for the sequence of packets, wherein each score in the time series of scores corresponds to a packet of the sequence of packets and indicates a likelihood of the packet deviating from being legitimate. (Sun ¶45 “The data processing system may separate the time series data into two different portions. A first portion may include test data to be used as input for evaluating various machine learning models. A second portion may include known data to be used to calculate a variance [deviating] score to evaluate how similar the output of each machine learning model is to the known [legitimate] data.”).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Anderson with generate, based on the trained machine learning model, a time series of scores as disclosed by Sun to generate score of packets over time to improve machine learning and detection (see Sun Abstract and ¶47).
With respect to claim 3, Anderson in view of Sun disclose: The network device of claim 2, wherein the anomaly detection logic is further configured to classify the packet as one of legitimate, corrupted, or anomalous based on a corresponding score in the time series of scores. (Sun ¶47 teaches classify packets over “time series” whether they are satisfactory based on a score in a “cluster” of time series scores. See also Anderson ¶35).
With respect to claim 4, Anderson in view of Sun disclose: The network device of claim 3, wherein the anomaly detection logic is further configured to: aggregate the time series of scores to obtain an aggregate score; compare the aggregate score with a threshold value; and detect an intrusion event within the time window based on a result of the comparison. (Sun ¶47 “The clustering algorithm may group [aggregate] the time series data sets into a quantity of clusters equal to the quantity of clusters parameter and compute a silhouette score [aggregate score] that is based on a distance between each time series within a cluster and each time series of another cluster” and based on the comparison determine if score is satisfactory or not, which mean a security issue, similar to an intrusion).
With respect to claim 5, Anderson in view of Sun disclose: The network device of claim 4, wherein the intrusion event is detected within the time window based on the result indicating that the aggregate score is greater than the threshold value. (Sun ¶47 “the silhouette score is satisfactory (e.g., equal to or greater than a quantity or threshold)”).
With respect to claim 6, Anderson in view of Sun disclose: The network device of claim 4, wherein the intrusion event is detected within the time window based on the result indicating that the aggregate score is less than the threshold value. (Sun ¶47 “silhouette score is not satisfactory and the quantity of clusters is less than or equal to a cluster threshold”).
Claim(s) 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Anderson as applied to claims 1, 7-8 and 11-20 above, and further in view of Villasante et al. (US 20250126497 A1) hereinafter referred to as Villasante.
With respect to claim 9, Anderson discloses: The network device of claim 1,
Anderson does not explicitly disclose: wherein the generation of the synthetic network traffic is based on another machine learning model, and the machine learning model and the another machine learning model correspond to a generative adversarial network.
However, Villasante in an analogous art discloses: wherein the generation of the synthetic network traffic is based on another machine learning model, and the machine learning model and the another machine learning model correspond to a generative adversarial network. (Villasante Abstract “A Generative Adversarial Network (GAN) is used to generate synthetic network traffic data, such as for use in training Machine Learning (ML) models.” Villasante ¶82 “the consumer applies the synthetic network data to its actions, such as using the data to train one or more ML models.”).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Anderson wherein the generation of the synthetic network traffic is based on another machine learning model, and the machine learning model and the another machine learning model correspond to a generative adversarial network as disclosed by Villasante to efficiently train models (see Villasante Abstract and ¶82 and 105).
Claim(s) 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Anderson as applied to claims 1, 7-8 and 11-20 above, and further in view of Bartos et al. (US 20190260775 A1) hereinafter referred to as Bartos.
With respect to claim 10, Anderson discloses: The network device of claim 1,
Anderson does not explicitly disclose: wherein during the training of the machine learning model, the anomaly detection logic is further configured to: receive feedback from the machine learning model;
However, Bartos in an analogous art discloses: wherein during the training of the machine learning model, the anomaly detection logic is further configured to: receive feedback from the machine learning model; (Bartos ¶27 teaches Self Learning Network model (SLN) “dynamically adapts according to potential user feedback.”)
and re-generate the synthetic network traffic based on the feedback, wherein the machine learning model is further trained based on the re-generated synthetic network traffic. (Bartos ¶27 teaches Self Learning Network model (SLN) “dynamically adapts according to potential user feedback.” And Bartos ¶143 “The techniques described herein, therefore, provide for refining [re-generate] synthetic malicious samples with unlabeled data. In particular, the techniques herein automatically adapt [such as using user feedback] the system to new and previously unseen variations of threats, and also create new labeled data that are critical for training more sophisticated detectors and classifiers.”
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Anderson wherein during the training of the machine learning model, the anomaly detection logic is further configured to: receive feedback from the machine learning model as disclosed by Bartos to allow for adaptive learning based on user feedback (see Bartos ¶27 and 143).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Xu et al. (US 20230368069 A1) ¶101 teaches “monitoring machine learning model features for an online system, including automatically predicting a score for a time series feature health variable using a deep learning model, where the deep learning model is trained using supervised learning, the automatically predicting a score for a time series feature health variable using a deep learning model including receiving a set of historical values and a current feature value of the time series feature health variable, the time series feature health variable representing one or more user interactions with the online system, and the predicting uses the set of historical values and the current feature value; and applying a filtering operation in response to the predicted score being greater than a threshold score”.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HANY S GADALLA whose telephone number is (571)272-2322. The examiner can normally be reached Mon to Fri 8:00AM - 4:00PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at (571) 272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HANY S. GADALLA/Primary Examiner, Art Unit 2493
Prosecution Insights