Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
2. This Office Action is issued in response to the claims filed on 03/17/2025.
Claims 22-41 are pending in this Office Action.
Claims 1-21 and 42-161 have been cancelled.
Priority
3. Acknowledgement is made of Applicant’s priority claim of U.S. provisional application number 63/563,363, filed March 9, 2024.
Information Disclosure Statement
4. The information disclosure statement (IDS) filed on 03/17/2025 has been considered by the Examiner except lined through reference on page 5 because its copy has not been provided on file.
Objections
5. The specification is objected to as failing to provide proper antecedent basis for the claimed subject matter. See 37 CFR 1.75(d)(1) and MPEP § 608.01(o). Correction of the following is required: limitation “the preprocessing module includes a noise reduction feature designed to eliminate irrelevant data and enhance the signal-to-noise ratio of the traffic data before entropy calculation and feature extraction” (claim 28) and “said comprehensive feature set includes the examination of packet payloads for known encryption signatures using heuristic analysis” (claim 39).
35 U.S.C. § 112(f)
6. The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
7. The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
8. This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitations are: “…data capture unit configured to…(claim 22); entropy calculation unit designed to…(claim 22 and claim 23); feature extraction unit that…(claim 22); neural network analysis unit to…(claim 22 and 29); feedback loop mechanism…to…(claim 22); preprocessing module for…(claim 24 and claim 35); alert generation module configured to…(claim 27 and claim 32); data anonymization unit to…(claim 30); scalability module that…(claim 31); continuous learning mechanism that…(claim 33); and network traffic simulation unit for…(claim 34).
Because these claim limitations are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, they are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
A review of the specification shows that the following appears to be the corresponding structure described in the specification for the 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph limitations: data capture unit-includes hardware and software as disclosed in paragraphs [0023] and [0110]; entropy calculation unit-includes hardware and software as disclosed in paragraph [0031]; feature extraction unit- includes hardware and software as disclosed in paragraphs [0037]-[0038]; neural network analysis unit- includes hardware and software as disclosed in paragraphs [0043], [0045], and [0129]; feedback loop mechanism- includes hardware and software as disclosed in paragraphs [0051], [0083], and [0095]; preprocessing module is software as disclosed in paragraph [0024].
If applicant does not intend to have these limitations interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitations to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitations recite sufficient structure to perform the claimed function so as to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 112
9. The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
10. Claims 27- 34 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claims contain subject matters which were not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention. The specification is devoid of any structure that performs the functions in the claims that are interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph for the limitations “alert generation module” (claim 27 and claim 32); “data anonymization unit” (claim 30); “scalability module” (claim 31); “continuous learning mechanism” (claim 33); and “network traffic simulation unit” (claim 34). Therefore, claim 27 and claims 30-34 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph. Claims 28 -29 depend on claim 27; therefore, they are also rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph.
11. The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
12. Claims 27-34 are rejected under35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Claim limitations alert generation module configured to…(claim 27 and claim 32); data anonymization unit to…(claim 30); scalability module that…(claim 31); continuous learning mechanism that…(claim 33); and network traffic simulation unit for…(claim 34) invoke 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed functions and to clearly link the structure, material, or acts to the functions. The disclosure is devoid of any structure that performs the functions for the limitations “alert generation module”, “data anonymization unit”, “scalability module”, “continuous learning mechanism”, and “network traffic simulation unit” in the claims. Therefore, claims 27 and 30-34 are indefinite and are rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. Claims 28 -29 depend on claim 27; therefore, they are also rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
13. Claims 22-41 are rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
a. Regarding claim 22, it recites: “a data capture unit configured to collect network traffic data; an entropy calculation unit designed to apply entropy estimation on collected data for initial traffic classification.” The claim is ambiguous because it is unclear if there is relation between “collect network traffic data” and “collected data.” Therefore, claim 22 and its dependent claims 23-41 are rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
For purpose of examination, the Examiner assumes entropy estimation is applied on the collected network traffic data for initial traffic classification.
b. Regarding claim 23, limitation “the randomness of network traffic data” lacks proper antecedent basis and makes the claim ambiguous. Therefore, claim 23 is rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. For purpose of examination, the Examiner assumes the limitation as “randomness of network traffic data.”
c. Regarding claim 26, limitation “the latest detected anomalies and emerging threat patterns” lacks proper antecedent basis and makes the claim ambiguous. Therefore, claim 26 is rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. For purpose of examination, the Examiner assumes the limitation as “latest detected anomalies and emerging threat patterns.
d. Regarding claim 28, limitation “the signal-to-noise ratio of the traffic data before entropy calculation and feature extraction.” lacks proper antecedent basis and makes the claim ambiguous. Therefore, claim 28 is rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. For purpose of examination, the Examiner assumes the limitation as “signal-to-noise ratio of the traffic data before entropy calculation and feature extraction.”
e. Regarding claim 32, it recites: “the alert generation module is configured to prioritize alerts based on the severity of the detected anomalies, employing machine learning models to assess threat levels.” Limitation “the severity of the detected anomalies” lacks proper antecedent basis and makes the claim ambiguous. It is also unclear connection of limitation “employing machine learning models to assess threat levels” with the previous part in the claim. Therefore, claim 32 is rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. For purpose of examination, the Examiner assumes the limitation as “the alert generation module is configured to prioritize alerts based on severity of detected anomaly.”
f. Regarding claim 35, it recites: “wherein the preprocessing module applies advanced encryption detection algorithms to differentiate between various encryption methods before feature extraction, enhancing the accuracy of subsequent analysis.” Limitation “the accuracy of subsequent analysis” lacks proper antecedent basis and it is unclear connection of limitation “enhancing the accuracy of subsequent analysis” with the previous part in the claim. Therefore, claim 35 is rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. For purpose of examination, the Examiner assumes the claim as “wherein the preprocessing module applies advanced encryption detection algorithms to differentiate between various encryption methods before feature extraction to enhance accuracy of subsequent analysis.”
g. Regarding claim 37, limitation “the analysis of the entropy variation over time within a traffic flow” lacks proper antecedent basis and makes the claim ambiguous. Therefore, claim 37 is rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. For purpose of examination, the Examiner assumes the limitation as “analysis of the entropy variation over time within a traffic flow.”
h. Regarding claim 38, limitation “the ratio of incoming to outgoing packets as a measure of network interaction” lacks proper antecedent basis and makes the claim ambiguous. Therefore, claim 38 is rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. For purpose of examination, the Examiner assumes the limitation as “ratio of incoming to outgoing packets as a measure of network interaction.”
i. Regarding claim 39, limitation “the examination of packet payloads for known encryption signatures using heuristic analysis” lacks proper antecedent basis and makes the claim ambiguous. Therefore, claim 39 is rejected 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. For purpose of examination, the Examiner assumes the limitation as “examination of packet payloads for known encryption signatures using heuristic analysis.”
Allowable Subject Matter
14. Claims 22-41 are allowable over prior art if rewritten to overcome the rejections under 35 USC § 112(a) and 35 USC § 112(b) set forth in this Office action.
The following is an examiner’s statement of reasons for allowance:
Regarding independent claim 22:
a. Smolik et al. (US 20250159009 A1) discloses a method for monitoring network traffic. The method includes: receiving network traffic packets from at least one network probe; pre-processing network traffic packets to generate pre-processed network traffic data containing at least one statistical value for at least one parameter for a plurality of packets; each network traffic data item of the time series being representative of network traffic packets from a selected time window; providing a plurality of machine learning models configured to predict network traffic data for upcoming traffic based on the pre-processed network traffic data of traffic received so far; training the machine learning models with the pre-processed network traffic data and deriving an evaluation score for each machine learning model; and based on the evaluation score, selecting at least one model of the trained machine learning models for monitoring of upcoming network traffic; monitoring the upcoming network traffic to detect anomalous events; and generating a warning (Figs. 2 and 7 with associated text and paragraphs [0016], [0043]).
b. Zhou et al. (Applicant’s IDS-Practical evaluation of encrypted traffic classification based on a combined method of entropy estimation and neural networks) discloses network traffic is classified as encrypted or plaintext with entropy estimation. Encrypted traffic is then further classified using neural networks (section 3, pages 313-316).
The prior arts of record fail to either disclose or sufficiently suggest the combination features as claimed and arranged by applicant. Although the above references teach similar aspects of the independent claim 22, none of these references individually or in reasonable combination discloses all the limitations as claimed in the independent claim and the independent claim as a whole is not obvious over these prior arts. Therefore, independent claim 22 is allowable over the prior arts of record and dependent claims are allowable by virtue of their dependence on the independent claims.
Prior Art of Record
15. The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure: see attached PTO-892 Notice of References Cited.
Conclusion
16. Any inquiry concerning this communication or earlier communications from the examiner should be directed to THANH T. LE whose telephone number is (571)270-0279. The examiner can normally be reached on Monday-Friday 8:00 am - 4:30 pm EST.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached on 571-272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/THANH T LE/Primary Examiner, Art Unit 2495
Prosecution Insights