Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Election/Restrictions
2. NO restrictions warranted at initial time of filing for patent.
Information Disclosure Statement
3. The information disclosure statement (IDS) submitted on 06/24/2025, the submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Oath/Declaration
4. Applicant’s Oath was filed on 03/11/2025.
Drawings
5. Applicant’s drawings filed on 06/23/2025 has been inspected and is in compliance with MPEP 608.01.
Specification
6. Applicant’s specification filed on 03/11/2025 has been inspected and is in compliance with MPEP 608.02.
Claim Objections
7. NO objections warranted at initial time of filing for patent.
Remarks
8. Examiner request Applicant review relevant prior art under the conclusion of this office action.
Allowable Subject Matter
9. Claims 27-29, 33, 34, and 37-40 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
10. Claims 21-25, 30-32, 35 and 36 are rejected under 35 U.S.C. 103 as being unpatentable over U.S. Publication No. 20070005766 hereinafter Singhal in view of U.S. Patent No. 9985984 hereinafter Chavez.
As per claim 21, Singhal discloses:
A method (para 0015 “An object of the invention is to provide a system, method and computer program product for an operator to implement application level policies on data packets in a network for intermediation between users and service providers.”), comprising:
receiving, at a driver instantiated in kernel space of an operating system of a computing device, a network packet (Fig. 2, element 202, para 0041 “AIG 102 receives a user request from a user through a system kernel 202. The user request is in form of data packets. System kernel 202 includes a kernel hook. The kernel hook is a stream driver that inspects the data packets to determine the source and type of data.”);
parsing a network address from a header of the network packet, decapsulating an encapsulated packet from a payload of the network packet (para 0041 “Each data packet comprises a header portion and a body. The header portion has an IP header and a TCP header. The kernel hook unwraps the IP header of the data packets to determine the source and destination IP addresses and TCP header to determine the application type”);
parsing a port identifier from a header of the encapsulated packet (para 0041 “ The application type is determined by port number that is read from TCP header.”);
Singhal does not disclose:
receiving a network packet that is potentially malicious
and inputting the network address and the port identifier to a trained model to classify the network packet as potentially malicious
Chavez discloses:
receive a network packet that is potentially malicious (Col. 2 Lines 37-47 “At least one computing device (e.g., a host, a controller, a router, a switch, an endpoint, a machine, etc.) on the LAN can comprise a data analyzer component, which is configured to analyze a data packet prior to the data packet being processed (e.g., executed) on a destination device communicatively coupled to the at least one computing device. The data analyzer can also be configured to monitor host system attributes and behaviors. The data analyzer can utilize a framework comprising a plurality of machine learning algorithms which are configured to recognize an active attack pattern.”)
and inputting the network address and the port identifier to a trained model to classify the network packet as potentially malicious (Fig. 3, Col. 12 Lines 17-22 “At 310 of FIG. 3, data 305 (e.g., any of data packets 135, 139) received at the data analyzer component 165 is processed by the classification component
260, wherein, a feature extraction operation 310 can be performed to extract one or more features 315 from raw input data included in the dataset 305.” Col. 12 Lines 38-42 “For the various feature 315 extracted from the dataset 305, one or more feature vectors 316 can be generated. In an example embodiment, 14 features 315 were extracted from a dataset 305, and include source port, destination port, IP address, start time, duration of a request session, etc.” Col. 13 Lines 34-38 “It is to be appreciated that the foregoing extracted features 315 and derived features 317 are examples of features (both extracted and derived) that can be utilized by one or more the algorithms (e.g., machine learning algorithms) included in the framework 300. Col. 11 Lines 61- Col. 12 Line 9 “A notification component 270 is further included in the data analyzer component 165, wherein the notification component 270 is configured to generate the notification 190, wherein the notification 190 is generated in response to the classification component 260 determining a data packet (e.g., data packet 139) or host-based behaviors constitute an attack on the LAN 130 or devices in the LAN 130. Further, the data analyzer component 165 comprises a report component 280 configured to generate a report 285, wherein the report 285 details one or more classification results generated by the classification component 260 when analyzing a data packet (e.g., data packets 135, 139). The report 285 can include information identifying whether the data packet was determined to include expected data (e.g., a benign business request from the remote system 110) or unexpected data (e.g., attack data generated by the attack computer 138).”)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Singhal to include receiving a network packet that is potentially malicious
and inputting the network address and the port identifier to a trained model to classify the network packet as potentially malicious, as taught by Chavez.
The motivation would have been to properly analyze and classify packets to determine whether a malicious attack has commenced.
As per claim 22, Singhal in view of Chavez discloses:
The method of claim 21, wherein the inputting further includes: inputting at least one of a time associated with the network packet, a sender network address report associated with the network packet, a receiver network address report associated with the network packet,a protocol associated with the network packet, a term appearing in a payload, a rate of transmission associated with the network packet, or a rate of reception associated with the network packet to the trained model to generate an output indicating that the network packet is potentially malicious (Chavez Col. 11 Lines 61- Col. 12 Line 9 and Col. 12 Line 38- Col. 13 Line 34. Although Singhal discloses analyzing packet packets, Chavez discloses wherein the inputting further features for data analyzing. The motivation would have been to properly analyze and classify packets to determine whether a malicious attack has commenced.).
As per claim 23, Singhal in view of Chavez discloses:
The method of claim 21, wherein the trained model was trained on historic network traffic of the computing device or other computing devices associated with the computing device and the network packet is potentially malicious relative to historical usage patterns (Chavez Col. 11 Lines 21-31 “Data packets (e.g., data packets 135, 139) received at the communication component 210 can be stored, e.g., in data store(s) 220. As further described, information in a data packet can be classified as to whether the data packet is from an authorized source, or is from a malicious entity. To facilitate such classification, one or more collections of training data, datasets 230.sub.1-230.sub.n, can also be stored in the data store 220. The datasets 230.sub.1-230.sub.n can be utilized to configure (train) the classification operation, wherein the datasets 230.sub.1-230.sub.n can be previously captured data, as well as a dataset generated by a third party.” Although Singhal discloses analyzing packet packets, Chavez discloses wherein the trained model was trained on historic network traffic of the computing device or other computing devices associated with the computing device and the network packet is potentially malicious relative to historical usage patterns. The motivation would have been to properly analyze and classify packets to determine whether a malicious attack has commenced.).
As per claim 24, Singhal in view of Chavez discloses:
The method of claim 21, wherein the network packet is processed by a network stack of the computing device (Singhal Figs. 1 and 2, para 0041 and 0042).
As per claim 25, Singhal in view of Chavez discloses:
The method of claim 21, further comprising: blocking or preventing a malicious attack to the computing device based on a malicious classification of the network packet in response to classifying that the network packet is potentially malicious (Chavez Col. 26 Lines 27-37 “Returning to 1260, in response to a determination that YES the data packet contains attack code, at 1290 the data packet can be flagged as attack data and quarantined, and further prevented from being transmitted, e.g., the data packet is not forwarded to the destination device. Again at 1280, any information generated during processing of the data packet and the attack code contained therein can be reapplied to the one or more machine learning algorithms included in the framework for processing of a subsequently received data packet(s). Flow can return to 1220 for the next received data packet.” Although Singhal discloses analyzing packet packets, Chavez discloses blocking or preventing a malicious attack to the computing device based on a malicious classification of the network packet in response to classifying that the network packet is potentially malicious. The motivation would have been to properly analyze and classify packets to determine whether a malicious attack has commenced.).
As per claim 30, the implementation of the method of claim 21 will execute the processor-readable non-transitory medium (Chavez Col. 27, Lines 13-45). The claim is analyzed with respect to claim 21.
As per claim 31, Singhal in view of Chavez discloses:
The processor-readable non-transitory medium of claim 30, wherein the trained model is at least one of a recurrent neural network, a hidden Markov model, or a clustering model, the trained model trained using historical network traffic data of a computing device (Singhal Col. 16 Lines 4-14 “An ensemble of classifiers are trained on each of the feature subsets 327 and 328. Each ensemble contains one each of the Naïve Bayes, logistic regression, support vector machine (SVM), and random forest classifiers, and are termed level 1 classifiers 330 (for application with subset A 327) and 331 (for application with subset B 328). It is to be appreciated that as well as the previously mentioned classifiers, any suitable classifier can be utilized, for example, a neural network classifier, a k-nearest neighbors classifier, etc. Although Singhal discloses analyzing packet packets, Chavez discloses wherein the trained model is at least one of a recurrent neural network. The motivation would have been to properly analyze and classify packets to determine whether a malicious attack has commenced.).
As per claim 32, Singhal in view of Chavez discloses:
The processor-readable non-transitory medium of claim 30, wherein the code to cause the processor to perform a remedial action includes code to cause the processor to block the network packet or subsequent network packets before fully traversing a network stack of a computing device, the network packet processed by the network stack.
As per claim 35, the implementation of the method of claim 21 will execute the processor-readable non-transitory medium (Chavez Col. 27, Lines 13-45) to further include:
parse a port identifier from a header of the encapsulated packet, determine a transport layer protocol identifier of the encapsulated packet; and input at least one of the network address, the transport layer protocol identifier, or the port identifier to a trained model to classify the network packet as potentially malicious (Chavez discloses Col. 9 lines 6-24 “In another embodiment, the data analyzer component 165 can be located at an endpoint in the local area network 130, e.g., at any of the machines 160.sub.1-n, and is configured to monitor data packets being processed and/or generated at the endpoint, as well as operation of the endpoint device, e.g., processor utilization, memory utilization, etc. Further, in addition to determining whether a data packet includes malicious code, the data analyzer component 165 can also be configured to detect other forms of malicious activity, where such activity can include unusual amounts of traffic across the LAN 130 and/or at a particular device, any unexpected protocols being utilized (e.g., for a data packet, transmission, etc.), an unexpected process occurring at a device, an unexpected number of processes at a device, etc. The data analyzer can generate a flag indicating potential malicious activity has been detected, wherein the flag can be utilized to initiate randomization of one or more network settings, as further described.” Further see, Fig. 3, Col. 12 Lines 17-22 and Col. 11 Lines 61- Col. 12 Line 9.”).The claim is analyzed with respect to claim 21.
As per claim 36, Singhal in view of Chavez discloses:
The processor-readable non-transitory medium of claim 35, wherein the trained model is a clustering model trained using historical network traffic data of a computing device, the historical network traffic data is associated with a set of vectors, and the code further comprises code to cause the processor to: determine a plurality of clusters based on the set of vectors; generate a vector based on the network packet; and determine that the vector is part of a cluster from the plurality of clusters (Chavez Col. 11 Lines 21-31 “Data packets (e.g., data packets 135, 139) received at the communication component 210 can be stored, e.g., in data store(s) 220. As further described, information in a data packet can be classified as to whether the data packet is from an authorized source, or is from a malicious entity. To facilitate such classification, one or more collections of training data, datasets 230.sub.1-230.sub.n, can also be stored in the data store 220. The datasets 230.sub.1-230.sub.n can be utilized to configure (train) the classification operation, wherein the datasets 230.sub.1-230.sub.n can be previously captured data, as well as a dataset generated by a third party.” Although Singhal discloses analyzing packet packets, Chavez discloses wherein the trained model was trained on historic network traffic of the computing device or other computing devices associated with the computing device and the network packet is potentially malicious relative to historical usage patterns. The motivation would have been to properly analyze and classify packets to determine whether a malicious attack has commenced.).
11. Claim 26 is rejected under 35 U.S.C. 103 as being unpatentable over Singhal in view of Chavez, and further in view of U.S. Publication No. 20140181972 hereinafter Karta.
As per claim 36, Singhal in view of Chavez discloses:
The method of claim 25, wherein: the blocking or preventing (Chavez Col. 26 Lines 27-37)
Singhal in view of Chavez does not disclose:
blocking or preventing includes disconnecting an existing connection or a subsequent connection between the computing device and a network communicatively coupled with the computing device to block or prevent the malicious attack to the computing device
Karta discloses:
blocking or preventing includes disconnecting an existing connection or a subsequent connection between the computing device and a network communicatively coupled with the computing device to block or prevent the malicious attack to the computing device (para 0016 “The method includes filtering low-level network packets for each of a plurality of received network packets, offloading the received packets to an inspecting processing module and marking suspicious packets based on at least one of a header and pattern of each of said received packets. The method also includes taking preventive measures by the system to ensure protection of the device and network, taking active steps by the system to block suspicious traffic and disconnecting the current connection by the system, when it detects suspicious traffic..”)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Singhal in view of Chavez to include blocking or preventing includes disconnecting an existing connection or a subsequent connection between the computing device and a network communicatively coupled with the computing device to block or prevent the malicious attack to the computing device, as taught by Chavez.
The motivation would have been to properly analyze and classify packets to provide intrusion detection and/or prevention system.
Conclusion
12. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
U.S. Publication No. 20170364794 discloses on paragraph 0042 “The monitored reaction (i.e., monitored traffic characteristics after anomaly injection) is used to determine the traffic type of the encrypted flow. This identification is based on a training a categorization model (e.g., using machine learning such as neural networks or complex multi machine language algorithm systems) and using test traffic to train it to be able to match the encrypted traffic's characteristics to an application type. The encrypted data traffic's characteristics could be based on what is visible in packet headers and measured traffic characteristics before the anomaly injection, the injected anomaly (e.g. latency or similar anomaly) and what is visible in packet headers and the measured characteristics of the encrypted traffic after the injected anomaly.”
U.S. Publication No. 20140334304 discloses on paragraph 004 “A method 600 for classifying content and managing internet traffic in accordance with one embodiment of the present invention appears in FIG. 6. Training data may be provided to the system by any of the methods described above or using other suitable algorithm or technique to generate the initial training data set. For example, the training data may be generated by packet inspection of a data flow and/or acquired from a third party. In a first step 610, training data is stored in a computer memory and entered into the cells of a feature matrix. As described above, the feature matrix may include variables such as network source address and/or flow size that are relevant to a target processor-executable application. In a second step 620, instructions or rules (for example, yes, no, etc.) and sampling rates are assigned to each cell of the feature matrix. In a third step 630, a classifier model is constructed with the training data set The training data set may be optimized (prior to or in parallel with the construction of the model) by machine-learning or other algorithms known in the art to improve the accuracy of the model.“
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GARY S GRACIA whose telephone number is (571)270-5192. The examiner can normally be reached Monday-Friday 9am-6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip Chea can be reached at 5712723951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/GARY S GRACIA/Primary Examiner, Art Unit 2499
Prosecution Insights