CTNF 19/065,468 CTNF 82680 Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Claim Rejections - 35 USC § 102 07-07-aia AIA 07-07 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – 07-12-aia AIA (a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention. 07-15-03-aia AIA Claim(s) 1, 7, 8, 14-15 is/are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Jones (US 2025/0150474) Regarding Claim 1, Jones (US 2025/0150474) teaches a method for utilizing a language model to detect and remedy a security incident in a network, the method comprising: deploying the language model that is configured to respond to prompts from network operators associated with the network (Fig. 1B, 142, “Generative AI Model (LLM)” and paragraph [0031] teaches a client can communicate a request having prompt data and the LLM processes the request); receiving a prompt from network operator indicating one or more actions to take based on predetermined trigger events occurring; determining that a predetermined trigger event occurred indicating a potential security incident; receiving, by the language model, a description of the potential security incident (Paragraph [0034] teaches determining intent associated with prompt data, and analyzing whether prompt data is associated with an attack); determining, by the language model, indicators of compromise identified in the description; determining, by the language model, one or more second models to call to analyze the indicators of compromise (Paragraph [0040-0041] teaches comparing prompt data to prompt data database and determining if there is match for “indicators of compromise”) receiving, by the language model and from the one or more second models, information indicating that the potential security incident is a real security incident (Paragraph [0045] teaches “false positive reduction includes implementing a…security engine model…to determine whether prompt data is a true positive”); and in response to receiving the information, outputting, by the language model, a prompt to the network operator to approve confirmation of the real security incident (Fig. 1C, teaches “did model identify as true positive?” and “send response to user” 116C, 130C) Regarding Claim 7, Jones teaches the method of claim 1, wherein the language model is a large language model (LLM) (Fig. 1B, 142, “Generative AI Model (LLM)”) Regarding Claims 8, 14, Claims 8, 14 are similar in scope to Claims 1, 7 and are rejected for a similar rationale. Regarding Claim 15, Claim 15 is similar in scope to Claim 1 and is rejected for a similar rationale . Claim Rejections - 35 USC § 103 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-21-aia AIA Claim (s) 2-6, 9-13, 16-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Jones in view of Lal (US 2024/0414190) Regarding Claim 2, Jones teaches the method of claim 1 but does not explicitly teach further comprising: based at least in part on receiving approval from the network operator, calling a third model to update a status of the real security incident to a true positive. Lal (US 2024/0414190) teaches based at least in part on receiving approval from the network operator, calling a third model to update a status of the real security incident to a true positive (Paragraph [0189] teaches AI models trained on cyber threats to now be identified as malicious or benign…if later confirmed as malicious…AI models can update their training) It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify Jones with the method of updating the status of a real security incident to a true positive and the results would be predictable (i.e. the AI model would be updated with the newest information) Regarding Claim 3, Jones and Lal teaches the method of claim 2. Lal teaches wherein the approval from the network operator is automated and does not require user input (Paragraph [0224] teaches decision to determine whether threat is malicious is automated) Regarding Claim 4, Jones and Lal teaches the method of claim 2. Lal teaches wherein the information received from the one or more second models include network devices that are affected by the real security incident, and further comprising: calling, by the language model, one or more fourth models to call to determine how to contain the real security incident; receiving, by the language model from the one or more fourth models, information on actions to execute to contain the real security incident including actions to execute to (i) isolate the affected network devices, (ii) disable affected user accounts, or (iii) prevent further damage from the real security incident (Paragraph [0091] teaches autonomously responding to threat and mitigating and remediating actions to minimize further damage)(Also see Fig. 1, Cyber Threat Autonomous Response Engine); outputting, by the language model, a prompt to the network operator for approval to execute the actions; and in response to receiving approval, calling one or more fifth models to execute the actions (Paragraph [0067] teaches outputting a prompt for approval to use another security service) . It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify Jones with the remediation method of Lal The motivation is to minimize further damage to the system (Paragraph [0091] of Lal) Regarding Claim 5, Jones and Lal teaches the method of claim 4. Lal teaches further comprising: determining, by the language model, one or more sixth models to call to determine how to eradicate the real security incident; receiving, by the language model from the one or more sixth models, information on actions to execute to eradicate the real security incident including actions to execute to (i) remove malicious software, (ii) patch vulnerable systems, or (iii) restore affected data; outputting, by the language model, a prompt to the network operator for approval to execute the actions; and in response to receiving approval, calling one or more seventh models to execute the actions (Paragraph [0113] teaches the cyber attack restoration engine restores affected data) Regarding Claim 6, Jones and Lal teaches the method of claim 5, further comprising: determining, by the language model, one or more eighth models to call to determine how to recover from the real security incident; receiving, by the language model from the one or more eighth models, information on actions to execute to recover from the real security incident including actions to execute to (i) restoring systems to a known good state, and (ii) validating that the real security incident has been resolved; outputting, by the language model, a prompt to the network operator for approval to execute the actions; and in response to receiving approval, calling one or more ninth models to execute the actions (Paragraph [0113] teaches returning the components back to their trusted operational state) Regarding Claims 9-13 Claims 9-13 are similar in scope to Claims 2-6 and are rejected for a similar rationale. Regarding Claims 16-20, Claims 9-13 are similar in scope to Claims 2-6 and are rejected for a similar rationale. Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to HARRIS C WANG whose telephone number is (571)270-1462. The examiner can normally be reached M-F 9:00-5:30. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, LUU PHAM can be reached at 571-270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /HARRIS C WANG/Primary Examiner, Art Unit 2439 Application/Control Number: 19/065,468 Page 2 Art Unit: 2439 Application/Control Number: 19/065,468 Page 3 Art Unit: 2439 Application/Control Number: 19/065,468 Page 4 Art Unit: 2439 Application/Control Number: 19/065,468 Page 5 Art Unit: 2439 Application/Control Number: 19/065,468 Page 6 Art Unit: 2439 Application/Control Number: 19/065,468 Page 7 Art Unit: 2439 Application/Control Number: 19/065,468 Page 8 Art Unit: 2439
