DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Receipt is acknowledged of certified copies of papers required by 37 CFR 1.55.
.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitations are: “a determination section configured to…”, “an estimation section configured to…”, and “an inspection section configured to…” in claims 1-10 and 13-15.
Because these claim limitation(s) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, they are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. See [0035]-[0040] of the originally filed specifications.
If applicant does not intend to have these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-10 and 13-15 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 3, 4, and 7 recite the terms “high likelihood/possibility” and “highly likely”. These are relative terms and the scope of the claims cannot be ascertained. It is unclear what is considered “high” or “highly” from a point of reference and/or degree.
Claim 3 recites “an electronic control unit that is a communication source of the communication is an electronic control unit whose communication destination is unable to be designated by anyone other than a vendor.” This limitation appears to be describing an electronic control unit (ECU) as the source of the communication and also as the destination that is only designated by the vendor. The context and scope of this limitation is confusing as how the ECU is both the source and destination of a communication. It is unclear what claim 3 is attempting to claim.
Claim 5 recites “a type of the attack” matched by the determination section. Parent claim 1 recites the determination section to match “a preset type of the [same] attack”. It is unclear if the “type” is the same as the “preset type”, or directed to different types. If the later, it is suggested that both terms be distinctively identified (e.g., adding the phrases “first”, “second”, etc., using the exact same terminologies for consistency, etc.). Claims 6-10 are dependent on claim 5 and similarly rejected.
Claim 5 recites: “a combination of abnormalities predicted” and “a combination of predicted abnormalities”. It is unclear if these combinations are the same or referring to two different combinations. Claims 6-10 are dependent on claim 5 and similarly rejected.
Claim 10 recites “a type of the attack” and is dependent on claim 5, which also recites “a type of the attack”. It is unclear if these are the same types or different types.
Claims 13 and 14 recites “a preset type of attack” and are dependent on claim 1, which also recites “a preset type of the attack”. It is unclear if these are the same preset types or different preset types.
Claims 13 and 14 recites “a system log” and are dependent on claim 1, which also recites “a system log”. It is unclear if these are the same system logs or different system logs.
Claims 13 and 14 recites “a communication log” and are dependent on claim 1, which also recites “a communication log”. It is unclear if these are the same communication logs or different communication logs.
Claim limitations “a determination section”, “an estimation section”, and “an inspection section” invoke 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. The specifications are devoid of any hardware and/or software disclosure linked to performing the claimed functions. It is unclear if the “section[s]” are hardware, software, a combination thereof, or some other material. Therefore, the claim is indefinite and is rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-9 and 11-15 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
For step 1, a claim is determined whether it falls within one of the four statutory categories. Claims 1-9 and 13-15 are directed to a device, claim 11 is directed to a method, and claim 12 is directed to a non-transitory computer readable storage medium. Therefore, the claims fall within at least one of the statutory categories of invention and passes step 1.
For step 2A (Prong One), a claim is determined whether it recites an abstract idea, law of nature, or natural phenomenon. Independent claims 1, 11, and 12 recite limitations for:
“determin[ing] whether correspondence information matches a preset type of the attack”
“determin[ing] whether a target element…has been violated”
However, there are no elements recited in limitations [A] & [B] that would preclude them from being practically performed in the mind, or with pen/paper, under broadest reasonable interpretation (BRI). For example, both limitations can be interpreted as human judgement actions under (BRI) as they are recited with a high degree of generality. The act of determining if something “matches” is simply comparing objects, an act that can be performed mentally. Furthermore, determining if an object has violated a rule is also an act of comparison (e.g., comparing attributes to predefined conditions), or an act of human judgement. Therefore, these steps can be performed without the direct aid of processing from a computer. Thus, the independent claims present at least one limitation that falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the independent claims recite an abstract idea.
For step 2A (Prong Two), a claim is determined whether it recites additional elements that integrate the judicial exception into a practical application. These additional elements are:
“correspondence information obtained by associating…log[s]” data
Various computer components (e.g., “an attack analysis device”, various “section[s]”, “an electronic control system”, “a non-transitory computer readable storage medium”, etc.) for performing the claimed limitations
However, these elements fail to add something more meaningful to the judicial exception as generic computer components are used to apply the exception. See MPEP 2106.05(f). MPEP 2106.05(f) provides the following considerations for determining whether a claim simply recites a judicial exception with the words “apply it” (or an equivalent), such as mere instructions to implement an abstract idea on a computer: (1) whether the claim recites only the idea of a solution or outcome i.e., the claim fails to recite details of how a solution to a problem is accomplished; (2) whether the claim invokes computers or other machinery merely as a tool to perform an existing process; and (3) the particularity or generality of the application of the judicial exception. For example, a “target element” is determined to be violated is merely a desired result. This limitation is silent to how the determination is accomplished in an inventive manner that precludes any mental activities.
Furthermore, the limitations as a whole fail to integrate the idea into a practical application. In MPEP 2106.04(d), the considerations of integration of the judicial exception into a practical application include, but is not limited to, “[a]n improvement in the functioning of a computer, or an improvement to other technology or technical field” and “[a]pplying or using the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular technological environment, such that the claim as a whole is more than a drafting effort designed to monopolize the exception.” In the current claims, the high-level recitations of determining if a “target element” has been “violated” is not reasonably considered an improvement. There are no active limitations that improve the functioning or security of the system. Such limitation is analogous to the act of merely displaying the result(s) of a process. See MPEP 2106.05(a)(II): “Gathering and analyzing information using conventional techniques and displaying the result, TLI Communications, 823 F.3d at 612-13, 118 USPQ2d at 1747-48”.
Thus, the independent claims, as a whole, fail to present enough elements to integrate the abstract idea into a practical application. Accordingly, the independent claims are directed to an abstract idea.
For step 2B, a claim is determined whether any elements, or combination of elements, are enough to ensure that the claims amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements to perform the steps amounts to no more than mere instructions to apply the exception using a generic computer component. Since these elements are recited at a high level of generality, such that they can be represented as ordinary computer systems. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. Having a hardware and software/logic agents to perform such elements does not instantly preclude it from mental activities if the act itself is presented in a generic/abstract manner – it would be mere instructions to apply an exception (see MPEP 2106.05(f)). Hence, the independent claims are not patent eligible. Furthermore, generally linking the use of the judicial exception to a particular technological environment does not integrate the exception into a practical application (see MPEP 2106.04(d) and MPEP 2106.05(h))
Dependent Claims: The dependent claims recite further limitations for mental activities without significantly more. Like the limitations of the independent claims, the limitations of the dependent claims merely recite the desired outcomes/results based upon human mental activities (e.g., determining, analyzing, etc.), rather than providing significant step-by-step features that leads to said result (e.g., claims 3-7, 13-15; claim 5 recites the determining as a “similarity”, which is human judgement/comparison; claim 6 recites analyzing the communication log, which is an act of human review, comparison, and/or judgement; claims 7, 13, and 14 performs determining based on “match[ing]”, which is human judgement/comparison). Furthermore, the dependent claims recite nominal features that do not add significantly more to the abstract idea (e.g., claims 2, 8, 9, and 15 further describe characteristics of the logs, which does not add meaningful features as they remain being used in the high-level determination processes to produce a desired outcome). Thus, none of the elements in those limitations would preclude them from being performed mentally nor do they present additional meaningful elements that are more than an abstract idea.
Claim 10 is not rejected under 35 U.S.C. 101 as being abstract without significantly more. Claim 10 is directed to a particular layered structure of the electronic control system and how a type of attack is matched based on this particular structure of electronic control units (ECUs) are within the layers. Such features are not abstract and/or are integrated to a practical application of how ECUs within the electronic control system are staged for violation detection.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1, 2, 5-7, 11-13, and 15 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by US 2018/0351980 to Galula et al. (hereinafter, “GALULA”).
As per claim 1: GALULA discloses: An attack analysis device configured to analyze an attack against an electronic control system constructed in a vehicle, the attack being against the electronic control system via a network (a server 210 can be a security operations center (SOC) that manages various aspects related to the cyber-security of a fleet of vehicles that include an in-vehicle network of one or more electronic control units (ECUs) control components [GALULA, ¶0033]; cyber-security refers to processes and practices to protect computerized systems from attacks [GALULA, ¶0035]), the attack analysis device comprising: a determination section configured to determine whether correspondence information matches a preset type of the attack (the server 210 includes one or more computing devices 100 that includes components necessary to perform the disclosed functions [GALULA, ¶0019-0020; 0031]; matching for known attack patterns [GALULA, ¶0064-0066]), the correspondence information being obtained by associating a system log that is a log of the electronic control system with a communication log that is a log of communication between the electronic control system and an outside of the vehicle (reports include any data received from collection units in vehicles, for example reports may be data corresponding to the status or state of a vehicle [GALULA, ¶0024, 0066, 0104-0106]; server logs include information related to a communication of data collection units (DCUs) in vehicles with the server 210 (i.e., external, or “outside”, communications of the vehicle) [GALULA, ¶0114]), and determine whether a target element representing at least one of the electronic control system or a component of the electronic control system has been violated (correlating reports and server logs to identify patterns of an attack or threat [GALULA, ¶0114]).
As per claim 2: GALULA discloses all limitations of claim 1. Furthermore, GALULA discloses: wherein the system log includes a history of mediating, in the electronic control system, communication between with an outside of the electronic control system, and the determination section specifies a source of communication of the communication log from the history, and determines whether the target element is violated (server 210 may identify attacks that occurred in the past. Identifying historical attacks may be desirable, e.g., some attacks may leave malware in attacked vehicles thus, by detecting or identifying that an attack occurred in the past, malware left in vehicles can be detected and removed, another example is identifying sources of historical attacks, e.g., identifying a dealership or service facility wherefrom an attack was launched can help in securing a dealership or service facility such that additional attacks therefrom are prevented [GALULA, ¶0121]).
As per claim 5: GALULA discloses all limitations of claim 1. Furthermore, GALULA discloses: wherein the system log includes an abnormality log indicating an abnormality detected by the electronic control system, the attack analysis device further comprises an estimation section configured to estimate a category of the attack by determining a similarity between: measured abnormality information generated on a basis of the abnormality log and indicating a combination of the abnormality actually detected; and predicted abnormality information indicating a combination of abnormalities predicted to occur in the electronic control system when the attack is received, for each category of the attack (correlation may include identifying an anomalous behavior of a vehicle to detect that a hacker is trying to gain access to in-vehicle components – for example, if logs indicate a specific vehicle is being turned on and off many times without moving then server 210 may determine someone might be trying to hack the vehicle [GALULA, ¶0052]; correlation is classifying similar/identical attacks by their sequence of anomalies to help identify the attacker [GALULA, ¶0063]; classifying an attack may include determining the type of the attack [GALULA, ¶0119]), and in the predicted abnormality information, a combination of predicted abnormalities can be changed by using the correspondence information determined by the determination section to match a type of the attack (server 210 may run or execute logic to detect security related events based on aggregated, correlated, grouped and/or fused data – for example, based on weather conditions received from a website and reports of suspected anomalies in some of vehicles 220, server 210 may determine whether or not the suspected anomalies are indeed indicative of an attack or they are a result of severe weather conditions [GALULA, ¶0070]; anomalies as false positives can be ignored due to extreme environmental conditions [GALULA, ¶0071]).
As per claim 6: GALULA discloses all limitations of claim 5. Furthermore, GALULA discloses: further comprising: an inspection section configured to analyze the communication log, and specify at least one of a malicious communication destination or a malicious communication content, wherein the communication log of the correspondence information includes at least one of a malicious communication destination or a malicious communication content (correlation may include inspecting and correlating data with maintenance records. For example, if server 210 identifies that a large number of vehicles attacked visited the same service shop then server 210 may determine the service shop is the source of the attack; any service and/or dealership logs may be correlated with any data, e.g., to determine if affected vehicles were serviced in the same dealership thus a source of an attack may be identified as described; full or complete records or logs as described may be downloaded from a vehicle in a service facility and sent to server 210 for inspection [GALULA, ¶0056-0057]).
As per claim 7: GALULA discloses all limitations of claim 5. Furthermore, GALULA discloses: wherein the determination section specifies a position where an abnormality has occurred in the electronic control system on a basis of whether the correspondence information matches any of a plurality of types of the attack, and is capable of classifying whether the position where the abnormality has occurred is a position violated by the attack or a position highly likely to have been violated by the attack (correlation may be according to location - for example, server 210 may correlate reports from a plurality of DCUs in a respective plurality of vehicles that are in the same geographic location, or an attack launched over Wi-Fi may be localized, by correlating or comparing logs or reports from vehicles received when the vehicles are, or were, in a specific area (although at different times), server 210 may detect that, when vehicles are in a specific area, no information from an ECU that controls the air conditioning system is included in reports from the vehicles, in such case, based on correlating reports according to a location, server 210 may identify or determine where an attacker is located [GALULA, ¶0068]).
As per claim 11: Claim 11 is different in overall scope from claim 1. However, claim 11 is directed to substantially subject matter as claim 1. Claim 11 recites an attack analysis method performed by the attack analysis device recited in claim 1. GALULA also discloses method embodiments (of the server) [GALULA, ¶0017]. Thus, the responses provided herein and in claim 1 are equally applicable to claim 11.
As per claim 12: Claim 12 is different in overall scope from claim 1. However, claim 12 is directed to substantially subject matter as claim 1. Claim 12 recites a non-transitory computer readable storage medium storing an attack analysis program executing instructions corresponding to the functions of the attack analysis device recited in claim 1. GALULA also discloses executing software code to carry out the method embodiments (of the server) [GALULA, ¶0018]. Thus, the responses provided herein and in claim 1 are equally applicable to claim 12.
As per claim 13: GALULA discloses all limitations of claim 1. Furthermore, GALULA discloses: wherein the determination section is configured to determine whether correspondence information matches a preset type of the attack (the server 210 includes one or more computing devices 100 that includes components necessary to perform the disclosed functions [GALULA, ¶0019-0020; 0031]; matching for known attack patterns [GALULA, ¶0064-0066]), the correspondence information being obtained by associating a system log that is a log of the electronic control system with a communication log that is a log of communication between the electronic control system and a communication destination outside the vehicle, the communication log being generated by an external vehicle device that is placed an outside of the vehicle and relays and monitors the communication (reports include any data received from collection units in vehicles, for example reports may be data corresponding to the status or state of a vehicle [GALULA, ¶0024, 0066, 0104-0106]; server logs include information related to a communication of data collection units (DCUs) in vehicles with the server 210 (i.e., external, or “outside”, communications of the vehicle) [GALULA, ¶0114]; controllers in each vehicle collects and sends data to the server 210, which is processed into aggregated data comprising of logs [GALULA, ¶0019, 0034]), and determine whether a target element representing at least one of the electronic control system or a component of the electronic control system has been violated (correlating reports and server logs to identify patterns of an attack or threat [GALULA, ¶0114]).
As per claim 15: GALULA discloses all limitations of claim 1. Furthermore, GALULA discloses: wherein the system log includes an abnormality log indicating an abnormality detected by the electronic control system, and the attack analysis device further comprises an estimation section configured to estimate a category of the attack by determining a similarity between: measured abnormality information generated on a basis of the abnormality log and indicating a combination of the abnormality actually detected; and predicted abnormality information indicating a combination of abnormalities predicted to occur in the electronic control system when the attack is received, for each category of the attack (correlation may include identifying an anomalous behavior of a vehicle to detect that a hacker is trying to gain access to in-vehicle components – for example, if logs indicate a specific vehicle is being turned on and off many times without moving then server 210 may determine someone might be trying to hack the vehicle [GALULA, ¶0052]; correlation may also include classifying similar/identical attacks by their sequence of anomalies to help identify the attacker [GALULA, ¶0063]; classifying an attack may include determining the type of the attack [GALULA, ¶0119]).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over GALULA in view of US 2021/0377289 to Okano et al. (hereinafter, “OKANO”).
As per claim 4: GALULA discloses all limitations of claim 1. GALULA does not explicitly disclose, but OKANO discloses: wherein the determination section determines that there is a high possibility that the target element has been subjected to no violation in a case where a communication source of the communication is an external vehicle equipment (a tracking unit may determine a possibility of an external attack (to a vehicle) when an external source point is found…however, when the anomaly is detected due to an access of a particular external communication device, such as by a car dealer, there is not a possibility of an external attack [OKANO, ¶0068]).
Thus, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention to implement means for distinguishing normal and malicious (attacks) network traffic based on the source of the communications. One would have been motivated to implement those means to improve the accuracy of determining network attacks by properly identifying its origins/source, such as described in [OKANO, ¶0068], which would have reduced the number of false positives.
Comments on Prior Arts
Claims 3, 8-10, and 14 are not rejected under any prior arts. See the following section for relevant prior arts to the claimed invention.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US 2022/0103583: Vehicle monitoring log information with respect to a series of attacks is transmitted to a monitoring system. See ¶0040.
US 2022/0019661: A server device analyzes a log received from a vehicle-mounted device to detect a possibility of a cyberattack. See ¶0021.
US 2022/0019662: A log analyzer performs attack detection by comparing a blacklist and a whitelist with a log of logs received from a vehicle-mounted equipment. See ¶0084.
US 2022/0006821: A suspect event and context received by a log receiving unit is compared with one or more known events and context to determine a degree of similarity. See ¶0077-0078.
US 2020/0053112: A vehicle anomaly detection server is connected to multiple vehicles to handle anomalies occurring in frames transmitted over in-vehicle networks of the vehicles. See ¶0089.
US 2019/0182275: A log collection system analyzes logs received from an in-vehicle apparatus to detect a possibility of an attack. Detection of possible attacks causes a log priority change command to the in-vehicle apparatus to update log priority information. See ¶0006.
US 2018/0295147: Different phase information is stored to define stages of a sign (possibility) of an attack and the attack itself. See ¶0092.
M. Henzl, P. Hanacek and M. Kacic, "Preventing real-world relay attacks on contactless devices," 2014 International Carnahan Conference on Security Technology (ICCST), Rome, Italy, 2014, pp. 1-6, doi: 10.1109/CCST.2014.6987031. (A system monitors different vehicle interfaces to extract relevant information used to train a generative model for detecting deviations from normal behavior. See Abstract.)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ROBERT B LEUNG whose telephone number is (571)270-1453. The examiner can normally be reached Mon - Thurs: 10am-7pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, JUNG KIM can be reached at 571-272-3804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ROBERT B LEUNG/Primary Examiner, Art Unit 2494
Prosecution Insights