Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
2. EXAMINER’S NOTE: The claims have been reviewed and considered under the new guidance pursuant to the 2019 Revised Patent Subject Matter Eligibility Guidance (PEG 2019) issued January 7, 2019.
3. This communication is in response to Applicant’s Preliminary Amendment filed on 25 February 2025. Claims 13-15 have been canceled. Claims 1-12 have been amended. Claims 1-12 remain pending.
Information Disclosure Statement
4. The Information Disclosure Statements respectfully submitted on 25 February 2025 and 27 March 2025 have been considered by the Examiner.
Claim Rejections - 35 USC § 102
5. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
6. Claims 1-2, 4-9, and 11-12 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Li et al. (Pub No. 2019/0102564).
Referring to the rejection of claim 1, Li et al. discloses a method for monitoring a control program of a functional unit of a machine installation using an electronic computing device, the method comprising: (See Li et al., para. 10, i.e., the present invention provides a machine learning-based software tool for electric utilities that can automatically recommend a remediation action for any security vulnerability, such as Patch Immediately and Use Mitigate Actions, based on the properties of the vulnerability and the properties of the asset that has the vulnerability)
detecting a vulnerability within the control program; categorizing the detected vulnerability on the basis of vulnerabilities already analyzed in the past; (See Li et al., para. 36-39 and 48, i.e., detecting a vulnerability is disclosed as after obtaining vulnerability information, operators analyze the vulnerability and asset characteristics to determine a remediation plan. Categorizing is disclosed as each vulnerability is identified by a unique Common Vulnerability Enumeration (CVE) ID, and vulnerability characteristics are defined in CVSS metrics. They can be obtained in three ways: software or vulnerability inventory tools, which scan the cyber assets and report applicable vulnerabilities via these tools, CVE and CVSS can be obtained, obtain the CVE and CVSS directly from vendors through some reporting mechanism on authorized patches. For example, Microsoft has a mechanism to release CVE and CVSS for their vulnerabilities and use third-party services or public vulnerability databases such as Foxguard Solutions to obtain the CVSS of applicable vulnerabilities)
and proposing a corrective action for the vulnerability depending on the categorization. (See Li et al., para. 48, i.e., the present invention uses machine learning technologies to automate remediation action analysis. A prediction model is trained first over historical operation data. Then for a new vulnerability, the model takes the vulnerability's asset characteristics and vulnerability characteristics as inputs and outputs a predicted remediation action)
Referring to the rejection of claim 2, Li et al. discloses wherein the vulnerability is categorized into at least two categories. (See Li et al., para. 66 and Table 2, i.e., for each vulnerability, the present invention outputs three parts after analyzing input data: predicted decision, confidence, and reason code, as shown in Table 2. Table 2 shows examples of the predictions for three different vulnerabilities. Sample prediction results Predicted action Confidence Reason code Patch Later 1 Unproven Exploitability, CVSS Score is less than 4.2 and Medium Confidentiality Impact Mitigate 0.91 Proof-of-Concept Exploitability, Network Attack, High External Accessibility and High Confidentiality Impact Patch Immediately 1 not Unproven Exploitability and this Workstation allows users' login)
Referring to the rejection of claim 4, Li et al. discloses wherein the categorization is carried out on the basis of a characteristic of the vulnerability. (See Li et al., para. 44 and Table 1, i.e., each vulnerability is identified by a unique Common Vulnerability Enumeration (CVE) ID, such as CVE-2016-8882. It provides which products are affected by the vulnerability by specifying the products CPE names under the vulnerability. Each vulnerability also comes with Common Vulnerability Scoring System (CVSS) metrics which describe the vulnerability features. Table 1 discloses the vulnerability characteristics - CVSS Score Exploitability Attack Vector Value in 0-10 High Functional Proof-of- Unproven Network Adjacent Local Concept Attack Complexity User Interaction Privilege High Low High Medium Low Multiple Single None Confidentiality Impact Integrity Impact Availability Impact Complete Partial None Complete Partial None Complete Partial None)
Referring to the rejection of claim 5, Li et al. discloses wherein the characteristic corresponds to a type and/or a manufacturer of the relevant functional unit and/or a location of the relevant functional unit. (See Li et al., para. 41-42, i.e., Each specification specifies the value for one attribute, such as attribute vendor=“Microsoft”, which implies the value of the “product's vendor” attribute is Microsoft. The present invention may use the latest CPE version 2.3 name format: cpe:2.3:part:vendor:product:version:update:*:*:*:*. The part attribute describes the product's type: an application (“a”), operating systems (“o”), or hardware (“h”). Values for vendor attribute identify the manufacturer of the products. Products and version attributes describe the product name and release version)
Referring to the rejection of claim 6, Li et al. discloses wherein the proposed corrective action includes an update of the control program. (See Li et al., para. 32 and 34, i.e., The model may be updated periodically or as needed based on recent manual decisions. Predicted decisions can be seen as manual decisions after being verified by human operators and be used for model update. Based on the database and past operation records and expert inputs, a machine learning engine automatically obtains applicable vulnerabilities, analyzes vulnerabilities, recommends remediation decisions (i.e., patch quickly or defer patching) for vulnerabilities. For recommended remediation decisions, the engine can also output a simple, easy-to-verify reason code for each recommended decision, so that human operators can understand and validate the machine learning)
Referring to the rejection of claim 7, Li et al. discloses wherein the vulnerability includes comparing with closed vulnerabilities and, if the vulnerability is similar to at least one other closed vulnerability, the corrective action of the closed vulnerability is proposed for the vulnerability. (See Li et al., para. 67-68, i.e., note that predicted decisions could be different for different utilities depending on their ways to address vulnerabilities. Predicted confidence shows how confident the tool makes the prediction. Reason code helps human operators to understand and verify the prediction. Table 2 shows examples of the predictions for three different vulnerabilities. The first one shows the predicted action is ‘Patch Later’ with 100% confidence. The reason why the tool makes such prediction is that the vulnerability is not exploitable, the CVSS score is less than 4.2 which means it has a low impact on assets, and it has medium confidentiality impact. The other two can be interpreted in a similar way. In one analysis, the dataset was randomly split into two parts, 70% for training and 30% for testing. Prediction accuracy is defined as the fraction of predicted decisions that are the same as a manual decision. The false negative rate is defined as the fraction of cases where the prediction is Patch Later, but the manual decision is Patch Immediately or Mitigate. False negatives may cause severe results if the vulnerabilities that should be remediated immediately are not remediated in time, and thus it should be minimized. The prediction accuracy of an embodiment of the present invention are shown in FIG. 5. The prediction accuracy can be up to 97.22%. False negative is 1.44%. If vulnerabilities with a prediction confidence under 0.9 receive operators' manual check, prediction accuracy can be improved to 99.42%)
Referring to the rejection of claim 8, Li et al. discloses wherein detection of the vulnerability and/or the categorization of the vulnerability and/or the proposal of the corrective action is/are carried out by means of a machine learning algorithm of the electronic computing device. (See Li et al., para. 10, i.e., the present invention provides a machine learning-based software tool for electric utilities that can automatically recommend a remediation action for any security vulnerability, such as Patch Immediately and Use Mitigate Actions, based on the properties of the vulnerability and the properties of the asset that has the vulnerability)
Referring to the rejection of claim 9, Li et al. discloses further comprising analyzing the categorized vulnerability and using the result of the analysis for the detection and/or categorization and/or correction of a future vulnerability. (See Li et al., para. 93-94, i.e., the module “Model Update” can update some decision tree paths specifically to correct the wrongly predicted decisions. For example, two vulnerabilities go through the same path and are made with the same decisions, but one's decision is wrongly made. When it is verified by experts, it is found that one vulnerability has high confidentiality impact which should result in a different decision, but this feature is not checked by the decision tree path. Then “Model Update” will add an offspring node to the path and make the added node check the confidentiality impact. Overall, when decisions are found wrongly predicted, experts can provide decision rules especially for this type of vulnerabilities. Through comparing the decision tree paths, the vulnerabilities go through, and the provided rules, “Model Update” module can automatically update the decision tree model by making offspring paths. For example, the remediation action is always “patch immediately” when a type of vulnerability presents in asset A. However if this vulnerability cannot be patched anymore and have to be mitigated because of some configuration changes, the trained decision tree cannot be used to predict this vulnerability. Then the decision tree model should be updated by changing the decision tree path that the vulnerability goes though)
Referring to the rejection of claim 11, Li et al. discloses wherein the electronic computing device comprises a central electronic computing device external to the machine. (See Li et al., para. 34 and Fig. 2, i.e., a central database which includes asset data obtained from baseline configuration management systems and vulnerability data, especially CVSS attributes obtained from vendors, third-party services and/or public databases (i.e., NVD). Based on the database and past operation records and expert inputs, a machine learning engine automatically obtains applicable vulnerabilities, analyzes vulnerabilities, recommends remediation decisions (i.e., patch quickly or defer patching) for vulnerabilities)
Referring to the rejection of claim 12, Li et al. discloses wherein the implementation of the corrective action is carried out automatically using the electronic computing device. (See Li et al., para. 6, i.e., Patch Manager Plus by ManageEngine discovers vulnerabilities and patches, and then automates the deployment of patches for Windows, Mac, Linux, and third-party applications for control system devices such as Programmable Logic Controller (PLC), which are very important and common in electric systems. Solutions mostly deploy all available patches automatically regardless of asset or system differences, which is infeasible in electric systems since it may interrupt the system service)
Claim Rejections - 35 USC § 103
7. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
8. Claim 3 is rejected under 35 U.S.C. 103 as being unpatentable over Li et al. (Pub No. 2019/0102564) in view of Gerrick (Pub No. 2019/0166149). Li et al. discloses the invention as described above however, Li et al. does not explicitly disclose wherein a first category identifies the vulnerability as open; a second category identifies the vulnerability as closed; and a third category identifies the vulnerability as if relevant to the functional unit.
Gerrick discloses a method for contextualizing vulnerabilities.
Referring to the rejection of claim 3, (Li et al. modified by Gerrick) discloses wherein a first category identifies the vulnerability as open; a second category identifies the vulnerability as closed; and a third category identifies the vulnerability as if relevant to the functional unit. (See Gerrick, para. 34-35, i.e., At step 304, the vulnerability analytics servers import control exceptions and system management automation tools from database to perform further comparison. The system management automation tools provide further information on vulnerabilities, for example, vulnerabilities that are currently being worked on, vulnerabilities that have already been patched, vulnerabilities for which a patch has already been scheduled, and so on. The vulnerability analytics servers update the contextual vulnerability data with information on control exceptions and system management automation, after the comparison. Assets may then be ranked by order of importance based on the contextual vulnerability data including asset values, application, owner, control exceptions, system management automation. At step 306, the vulnerability analytics servers may analyze vulnerabilities using the contextual vulnerability data. During analysis, the vulnerability analytics servers categorize the vulnerabilities into different groupings, for example, groupings based on duplicates, exceptions, being superseded, unfixed, patch in progress, application dependent)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date the claimed invention was made to combine Li et al.’s system and method for implementing a machine learning-based software for electric utilities that can automatically recommend a remediation action for a security vulnerability modified with Gerrick’s method for contextualizing vulnerabilities. Motivation for such an implementation would enable categorizing contextual vulnerability data in an exception category or in a fixed category. (See Gerrick, para. 6)
9. Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Li et al. (Pub No. 2019/0102564) in view of Iyer et al. (Pub No. 2020/0162497). Li et al. discloses the invention as described above however, Li et al. does not explicitly disclose further comprising investigating an effect of the correction for the vulnerability on another detected vulnerability.
Iyer et al. discloses a method for prioritized remediation of information security vulnerabilities based on service model aware multi-dimensional security risk scoring.
Referring to the rejection of claim 10, (Li et al. modified by Iyer et al.) discloses further comprising investigating an effect of the correction for the vulnerability on another detected vulnerability. (See Iyer et al., para. 66, i.e., Prioritization simulator module in application may be configured to recommend prioritization schedules for remediation of network asset vulnerabilities in computer network to secure IT service. In example implementations, module prioritization simulator may be configured to simulate the effect of different remediation schedules on the service risk score (normalized or modified service risk scores) of IT service. The simulations may take into account vulnerability interdependencies by considering the effects of each remediation action on multiple network asset vulnerabilities. Prioritization simulator module may prioritize and recommend a schedule of remediation actions according to the simulated effect of the remediation actions on lowering the service risk score. The effect of known remediation actions may be considered on a per network asset basis. In the simulations, the service risk score may be computed for each remediation action and the one that results in the largest reduction in service risk may be recommended as the first remediation action to be implemented)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date the claimed invention was made to combine Li et al.’s system and method for implementing a machine learning-based software for electric utilities that can automatically recommend a remediation action for a security vulnerability modified with Iyer et al.’s method for prioritized remediation of information security vulnerabilities based on service model aware multi-dimensional security risk scoring. Motivation for such an implementation would enable one or more vulnerability remediation actions on the computer network to secure the service. For this purpose, the prioritization simulator simulates effects of different vulnerability remediation actions on the service risk score and prioritizes implementation of a vulnerability remediation action that has a larger simulated reduction in the service risk score over implementation of other vulnerability remediation actions that have smaller simulated reductions in the service risk score. (See Iyer et al., para. 11)
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to COURTNEY D FIELDS whose telephone number is (571)272-3871. The examiner can normally be reached IFP M-F 8am-4:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, SHEWAYE GELAGAY can be reached at (571)272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/COURTNEY D FIELDS/Examiner, Art Unit 2436 September 22, 2026
/SHEWAYE GELAGAY/Supervisory Patent Examiner, Art Unit 2436
Prosecution Insights