Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
1. The following is a non-Final Office Action in response to applicant’s arguments/filing filed on July 3, 2025
Claims 1-23 are cancelled Claims 24-49 are pending
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 8/18/2026 was filed prior to the mailing date of the first office action. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
The information disclosure statement (IDS) submitted on 7/3/2025 was filed prior to the mailing date of the first office action. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Drawings
Acknowledgment is made of applicant’s drawings submitted on 7/3/2025.
Oath/Declaration
Acknowledgment is made of applicant’s oath submitted on 7/3/2025
Application Data Sheet
Acknowledgment is made of applicant’s application data sheet submitted on 7/3/2025.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
1..) Claims 24-28, 31, 32, 37-43, 46 and 47 are rejected under 35 U.S.C. 103 as unpatentable over IDS supplied reference WO 2022260564, Reijonen in view of US 20150365309, Kaminski
In regards to claim 24, Reijonen teaches a method performed by a security controller for a communication network in which defense agents in a set are distributed for anomaly detection in the communication network, the method comprising: obtaining one or more accuracy metrics characterizing how accurately the defense agents in the set detect anomalies in the communication network(WO 2022260564, Reijonen, pg. 13, lines 12-17, The target metric scores 204 comprise one or more scores such as FI score, henceforth referred to as FI, precision and recall. The target metric scores 204 depict the fitness of the system performance. More specifically, precision is the ratio of correctly predicted threat events to all predicted threat events.); obtaining one or more resource consumption metrics characterizing how extensively the defense agents in the set consume resources in the communication network(WO 2022260564, Reijonen, pg. 5, lines 13-14, the new DMT is selected based on at least one of risk, cost and time available for current metric score computation.pg. 11, line 26-pg.12, line 2, To better illustrate how the quantifier 202 estimates the extent of security threat that may be tolerated, consider, as an example, a DoS attack threat event type in an environment. Let us assume that we have the following CVID 201 values: Cost of false negative (CFN) = 200000, Cost of false positive (CFP) = 2000, total number of False detections = (number of FPs + number of FNs). The total number of False detection can, for instance, be estimated based on the average number of false detections in a year or in some case, provided by a security analyst. In this example, the total number of false detections is considered as 1000.); and controlling the defense agents in the set based on the one or more accuracy metrics and the one or more resource consumption metrics(WO 2022260564, Reijonen, pg. 5, lines 11-12, In an embodiment according to the first and the second aspect, the new DMT is selected based on at least one of risk, cost and time available for current metric score computation.), wherein controlling the defense agents in the set comprises, for each of one or more anomaly detection tasks, controlling which one or more of the defense agents in the set are to perform the anomaly detection task and which one or more of the defense agents in the set, if any, are not to perform the anomaly detection task, based on the one or more accuracy metrics and the one or more resource consumption metrics(WO 2022260564, Reijonen, pg. 4, line 24-pg. 5, line, In an embodiment according to the first and the second aspect, comprises updating the DMT and repeatedly computing one or more current metric scores for the environment threat data using the updated DMT until the computed one or more current metric scores is within a range of said target metric scores 204, … pg. 5, lines 5-6, In an embodiment according to the first and the second aspect, the new DMT is selected based on a criterion of achieving the highest recall and/or precision.), Reijonen does not teach wherein said controlling comprises, for at least one of the one or more anomaly detection tasks: making a decision to switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the anomaly detection task to a resource-saving mode in which at least one of the defense agents in the set does not perform the anomaly detection task, based on comparison of a set-wide resource consumption metric to a set-wide resource consumption threshold for the anomaly detection task; and based on the decision, determining which one or more of the defense agents in the set are still to perform the anomaly detection task in the resource-saving mode and which one or more of the defense agents in the set are not to perform the anomaly detection task in the resource-saving mode, based on agent-specific accuracy metrics for the respective defense agents However, Kaminski teaches wherein said controlling comprises, for at least one of the one or more anomaly detection tasks: making a decision to switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the anomaly detection task to a resource-saving mode in which at least one of the defense agents in the set does not perform the anomaly detection task, based on comparison of a set-wide resource consumption metric to a set-wide resource consumption threshold for the anomaly detection task(US 20150365309, Kaminski, para. 0039 and 0041: [0039]- The system includes a plurality of client agents 202a-n (referred to generally as a client agent 202),[0041]- In one embodiment, the client agent 202 collects data about computer resource consumption for each running process of the computing resource 220a, including, without limitation, usage of CPUs, memory, disk space, I/O, and network resources. In another embodiment, the client agent 202 is dynamically selective about what data it gathers based on resource optimization algorithms[i.e. note: resource saving mode] for detecting anomalies and performance bottlenecks. The client agent 202 may be dynamically selective about both what and when it collects data.); and based on the decision, determining which one or more of the defense agents in the set are still to perform the anomaly detection task in the resource-saving mode and which one or more of the defense agents in the set are not to perform the anomaly detection task in the resource-saving mode, based on agent-specific accuracy metrics for the respective defense agents(US 20150365309, Kaminski, para. 0065, the client agent 202 collects (and populates into a database) a subset (for example, and without limitation, less than 5%) of available sampling metrics (both subject and time-related data), minimizing redundancies and recording information that is known (e.g., from prior expert experience) to either (a) impact perceived user response time or (b) is needed for process workload classification (e.g., to improve a classification process)[i.e. note: to enable a specific agent of the plurality of agents in the client agent to selectively process a subset of received data metrics to respond to an anomaly]. These data are selected dynamically and recorded because they, for example, point to potential problems or are needed to correctly model the system via queuing theory. This selectivity results in a constrained dataset that nevertheless is able to drive highly accurate analytical results far more comprehensively and faster than conventional approaches,). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of Reijonen with the teaching of Kaminski because a user would have been motivated to add a step of generating mitigating recommendations, taught by Kaminski, since Reijonen does not instruct an operator what corrective action to take(Kaminski, para. 0102)
In regards to claim 25, the combination of Reijonen and Kaminski teach the method of claim 24, wherein the one or more accuracy metrics include: a set-wide false positive rate comprising a rate at which the defense agents in the set incorrectly detect anomalies, a set-wide false negative rate comprising a rate at which the defense agents in the set fail to detect anomalies(WO 2022260564, Reijonen, pg. 11, lines 28-29 , Cost of false negative (CFN) = 200000, Cost of false positive (CFP) = 2000,), and/or a set-wide false rate comprising a combination of the set-wide false positive rate and the set-wide false negative rate(WO 2022260564, Reijonen, pg. 11, lines 29-30, total number of False detections = (number of FPs + number of FNs).); and/or for each of the defense agents in the set, an agent-specific false positive rate comprising a rate at which the defense agent incorrectly detects anomalies, an agent-specific false negative rate comprising a rate at which the defense agent fails to detect anomalies, and/or an agent-specific false rate comprising a combination of the agent-specific false positive rate and the agent-specific false negative rate(WO 2022260564, Reijonen, pg. 11, line 29-page 12, line 2, Cost of false negative (CFN) = 200000, Cost of false positive (CFP) = 2000, total number of False detections = (number of FPs + number of FNs). The total number of False detection can, for instance, be estimated based on the average number of false detections in a year or in some case, provided by a security analyst. In this example, the total number of false detections is considered as 1000.).
In regards to claim 26, the combination of Reijonen and Kaminski teach the method of claim 24, wherein controlling the defense agents in the set comprises, based on the one or more accuracy metrics and the one or more resource consumption metrics, controlling whether and/or how each defense agent in the set performs each of one or more anomaly detection tasks(WO 2022260564, Reijonen, pg. 13, lines 12-24, The target metric scores 204 to be achieved are, thus, obtained based on the information provided by the CVID 201, the quantifier 202 and the importance analyzer 203. The target metric scores 204 comprise one or more scores such as FI score, henceforth referred to as FI, precision and recall. The target metric scores 204 depict the fitness of the system performance. More specifically, precision is the ratio of correctly predicted threat events to all predicted threat events. Precision indicates the percentage of real threat events out of all predicted threat events. Recall is the ratio of correctly predicted threat events to all threat events. Recall indicates the percentage of predicted threat events out of all threat events. FI is the inverse of the average of inverses of Precision and Recall.
Target Precision, target recall and target FI metric scores are calculated as below:
Target Precision = (number of TPs) / (number of TPs + tolerance limit of number of FPs)
Target Recall = (number of TPs) / (number of TPs + tolerance limit of number of FNs)
Target FI = 2 * (precision * recall) / (precision + recall)).
In regards to claim 27, the combination of Reijonen and Kaminski teach the method of claim 24, wherein said controlling comprises, for at least one of the one or more anomaly detection tasks, making a decision to switch the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the anomaly detection task to an accuracy-enhancing mode in which all of the defense agents in the set perform the anomaly detection task, based on: comparison of a set-wide accuracy metric to a set-wide accuracy threshold for the anomaly detection task(WO 2022260564, Reijonen, pg. 18, lines 18-20, Additionally, or alternatively, the number of iterations may be pre-defined. In yet another embodiment, the new DMT 305 is selected based on risk, cost and/or time available for computation.); or comparison of a set-wide resource consumption metric to a set-wide resource consumption threshold for the anomaly detection task.
In regards to claim 28, the combination of Reijonen and Kaminski teach the method of claim 24, wherein said controlling comprises: obtaining a defense agent utility metric for the set of defense agents as a function of the one or more accuracy metrics and the one or more resource consumption metrics(US 20150365309, Kaminski, para. 0065, the client agent 202 collects (and populates into a database) a subset (for example, and without limitation, less than 5%) of available sampling metrics (both subject and time-related data), minimizing redundancies and recording information that is known (e.g., from prior expert experience) to either (a) impact perceived user response time or (b) is needed for process workload classification (e.g., to improve a classification process). These data are selected dynamically and recorded because they, for example, point to potential problems or are needed to correctly model the system via queuing theory. This selectivity results in a constrained dataset that nevertheless is able to drive highly accurate analytical results far more comprehensively and faster than conventional approaches,); obtaining an attack utility metric as a function of the defense agent utility metric and an attack resource consumption metric reflecting an extent of resources required for attackers to execute a cooperative attack on the communication network(US 20150365309, Kaminski, para. 0004, a metric associated with a process. The method includes analyzing, by the workload engine, the retrieved metric and the process. The method includes associating, by the workload engine, at least one workload with the process, responsive to the analysis. The method includes analyzing, by an exception engine executing on the first computing resource, the retrieved metric, the process, and the at least one workload; analyzing includes applying at least one workload rule to the at least one workload. The method includes identifying, by the exception engine, an operational anomaly within the process, responsive to the analysis by the exception engine.); and controlling whether the defense agents in the set are to perform one or more anomaly detection tasks, based on comparison of the defense agent utility metric to the attack utility metric(US 20150365309, Kaminski, para. 0084, the exception engine 206 uses an extensible rules engine to compare workload information to historical norms and absolute references, using decision-based rules (e.g., rules defined by administrators, users, experts, or others) and historical data. The exception engine 206 may then apply at least one workload rule to the at least one workload.). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of Reijonen with the teaching of Kaminski because a user would have been motivated to add a step of generating mitigating recommendations, taught by Kaminski, since Reijonen does not instruct an operator what corrective action to take(Kaminski, para. 0102)
In regards to claim 31, the combination of Reijonen and Kaminski teach the method of claim 26, wherein the one or more anomaly detection tasks include: a feature monitoring task involving determining respective features of anomalies to be detected; and/or a feature detection task involving detecting the determined features; and/or a decision-making task involving making decisions on whether or not anomalies are present based upon detected features(WO 2022260564, Reijonen, pg. 14, lines 6-14, In some embodiments, the precision is further multiplied by an importance weight of FP. The importance weight of FP may be obtained according to one or more procedures described above in relation to the importance analyzer 203. Additionally, the recall is further multiplied by an importance weight of FN. The importance weight of FN may be obtained according to one or more procedures described above in relation to the importance analyzer 203. Additionally, the FI score is calculated based on the importance weight-adjusted precision and recall target metric scores. This embodiment has an advantage that it enables estimating the optimal decision-making threshold (DMT) by using an organization's threat event detection requirements, i.e. importance of FP vs FN.).
In regards to claim 32, the combination of Reijonen and Kaminski teach the method of claim 24, wherein controlling the defense agents in the set comprises, based on the one or more accuracy metrics and the one or more resource consumption metrics, controlling whether or which defense agents in the set operate in a collaborative mode for performing anomaly detection collaboratively with one another and controlling whether or which defense agents in the set operate in a standalone mode for performing anomaly detection without collaborating with one another(WO 2022260564, Reijonen, pg. 16, lines 23-24, In an embodiment, two or more DMTs, e.g. initial DMTs, may be used per ADM. Further, a DMT may be used per threat event type, e.g. DoS, IA.; and pg. 17, lines 16-19, If they fall within the range, the initial DMT 302 is selected as the threshold to be used for anomaly detection. If the current metric scores 303 do not fall within a range of values of the target metric scores 204, then a new DMT 305 is selected and updated for computing the current metric scores 303.).
In regards to claim 37, the combination of Reijonen and Kaminski teach the method of claim 24, wherein the multiple defense agents include multiple first layer defense agents distributed in the communication network and a second layer defense agent, wherein each of the first layer defense agents is configured to determine respective features of anomalies in the communication network, detect the determined features of the anomalies, and make decisions on whether or not anomalies are present based upon features detected, and wherein the second layer defense agent is configured to collaborate with the multiple first layer defense agents to assist the first layer defense agents to collaboratively decide whether or not anomalies are present in the communication network(WO 2022260564, Reijonen, pg. 13, lines 12-24, The target metric scores 204 to be achieved are, thus, obtained based on the information provided by the CVID 201, the quantifier 202 and the importance analyzer 203. The target metric scores 204 comprise one or more scores such as FI score, henceforth referred to as FI, precision and recall. The target metric scores 204 depict the fitness of the system performance. More specifically, precision is the ratio of correctly predicted threat events to all predicted threat events. Precision indicates the percentage of real threat events out of all predicted threat events. Recall is the ratio of correctly predicted threat events to all threat events. Recall indicates the percentage of predicted threat events out of all threat events. FI is the inverse of the average of inverses of Precision and Recall.
Target Precision, target recall and target FI metric scores are calculated as below:
Target Precision = (number of TPs) / (number of TPs + tolerance limit of number of FPs)
Target Recall = (number of TPs) / (number of TPs + tolerance limit of number of FNs)
Target FI = 2 * (precision * recall) / (precision + recall)).
In regards to claim 38, the combination of Reijonen and Kaminski teach the method of claim 24, wherein said controlling comprises: based on the one or more accuracy metrics and the one or more resource consumption metrics, identifying a defense agent in the set as being malicious; and controlling the identified defense agent to stop performing anomaly detection(WO 2022260564, Reijonen, pg. 17, lines 16-19, If they fall within the range, the initial DMT 302 is selected as the threshold to be used for anomaly detection. If the current metric scores 303 do not fall within a range of values of the target metric scores 204, then a new DMT 305 is selected and updated for computing the current metric scores 303.).
In regards to claim 39, Reijonen teaches a security controller for a communication network in which defense agents in a set are distributed for anomaly detection in the communication network, the security controller comprising processing circuitry configured to: obtain one or more accuracy metrics characterizing how accurately the defense agents in the set detect anomalies in the communication network(WO 2022260564, Reijonen, pg. 13, lines 12-17, The target metric scores 204 comprise one or more scores such as FI score, henceforth referred to as FI, precision and recall. The target metric scores 204 depict the fitness of the system performance. More specifically, precision is the ratio of correctly predicted threat events to all predicted threat events.); obtain one or more resource consumption metrics characterizing how extensively the defense agents in the set consume resources in the communication network(WO 2022260564, Reijonen, pg. 5, lines 13-14, the new DMT is selected based on at least one of risk, cost and time available for current metric score computation.pg. 11, line 26-pg.12, line 2, To better illustrate how the quantifier 202 estimates the extent of security threat that may be tolerated, consider, as an example, a DoS attack threat event type in an environment. Let us assume that we have the following CVID 201 values: Cost of false negative (CFN) = 200000, Cost of false positive (CFP) = 2000, total number of False detections = (number of FPs + number of FNs). The total number of False detection can, for instance, be estimated based on the average number of false detections in a year or in some case, provided by a security analyst. In this example, the total number of false detections is considered as 1000.); and control the defense agents in the set based on the one or more accuracy metrics and the one or more resource consumption metrics(WO 2022260564, Reijonen, pg. 5, lines 11-12, In an embodiment according to the first and the second aspect, the new DMT is selected based on at least one of risk, cost and time available for current metric score computation.), wherein the processing circuitry is configured to control the defense agents in the set by, for each of one or more anomaly detection tasks, controlling which one or more of the defense agents in the set are to perform the anomaly detection task and which one or more of the defense agents in the set, if any, are not to perform the anomaly detection task, based on the one or more accuracy metrics and the one or more resource consumption metrics(WO 2022260564, Reijonen, pg. 4, line 24-pg. 5, line, In an embodiment according to the first and the second aspect, comprises updating the DMT and repeatedly computing one or more current metric scores for the environment threat data using the updated DMT until the computed one or more current metric scores is within a range of said target metric scores 204, … pg. 5, lines 5-6, In an embodiment according to the first and the second aspect, the new DMT is selected based on a criterion of achieving the highest recall and/or precision.), Reijonen does not teach wherein the processing circuitry is configured to, for at least one of the one or more anomaly detection tasks: make a decision to switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the anomaly detection task to a resource-saving mode in which at least one of the defense agents in the set does not perform the anomaly detection task, based on comparison of a set-wide resource consumption metric to a set-wide resource consumption threshold for the anomaly detection task; and based on the decision, determine which one or more of the defense agents in the set are still to perform the anomaly detection task in the resource-saving mode and which one or more of the defense agents in the set are not to perform the anomaly detection task in the resource-saving mode, based on agent-specific accuracy metrics for the respective defense agents However, Kaminski teaches wherein the processing circuitry is configured to, for at least one of the one or more anomaly detection tasks: make a decision to switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the anomaly detection task to a resource-saving mode in which at least one of the defense agents in the set does not perform the anomaly detection task, based on comparison of a set-wide resource consumption metric to a set-wide resource consumption threshold for the anomaly detection task(US 20150365309, Kaminski, para. 0039 and 0041: [0039]- The system includes a plurality of client agents 202a-n (referred to generally as a client agent 202),[0041]- In one embodiment, the client agent 202 collects data about computer resource consumption for each running process of the computing resource 220a, including, without limitation, usage of CPUs, memory, disk space, I/O, and network resources. In another embodiment, the client agent 202 is dynamically selective about what data it gathers based on resource optimization algorithms[i.e. note: resource saving mode] for detecting anomalies and performance bottlenecks. The client agent 202 may be dynamically selective about both what and when it collects data.); and based on the decision, determine which one or more of the defense agents in the set are still to perform the anomaly detection task in the resource-saving mode and which one or more of the defense agents in the set are not to perform the anomaly detection task in the resource-saving mode, based on agent-specific accuracy metrics for the respective defense agents(US 20150365309, Kaminski, para. 0065, the client agent 202 collects (and populates into a database) a subset (for example, and without limitation, less than 5%) of available sampling metrics (both subject and time-related data), minimizing redundancies and recording information that is known (e.g., from prior expert experience) to either (a) impact perceived user response time or (b) is needed for process workload classification (e.g., to improve a classification process)[i.e. note: to enable a specific agent of the plurality of agents in the client agent to selectively process a subset of received data metrics to respond to an anomaly]. These data are selected dynamically and recorded because they, for example, point to potential problems or are needed to correctly model the system via queuing theory. This selectivity results in a constrained dataset that nevertheless is able to drive highly accurate analytical results far more comprehensively and faster than conventional approaches,). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of Reijonen with the teaching of Kaminski because a user would have been motivated to add a step of generating mitigating recommendations, taught by Kaminski, since Reijonen does not instruct an operator what corrective action to take(Kaminski, para. 0102)
In regards to claim 40, the combination of Reijonen and Kaminski teach the security controller of claim 39, wherein the one or more accuracy metrics include: a set-wide false positive rate comprising a rate at which the defense agents in the set incorrectly detect anomalies, a set-wide false negative rate comprising a rate at which the defense agents in the set fail to detect anomalies(WO 2022260564, Reijonen, pg. 11, lines 28-29 , Cost of false negative (CFN) = 200000, Cost of false positive (CFP) = 2000,), and/or a set-wide false rate comprising a combination of the set-wide false positive rate and the set-wide false negative rate(WO 2022260564, Reijonen, pg. 11, lines 29-30, total number of False detections = (number of FPs + number of FNs).); and/or for each of the defense agents in the set, an agent-specific false positive rate comprising a rate at which the defense agent incorrectly detects anomalies, an agent-specific false negative rate comprising a rate at which the defense agent fails to detect anomalies, and/or an agent-specific false rate comprising a combination of the agent-specific false positive rate and the agent-specific false negative rate(WO 2022260564, Reijonen, pg. 11, line 29-page 12, line 2, Cost of false negative (CFN) = 200000, Cost of false positive (CFP) = 2000, total number of False detections = (number of FPs + number of FNs). The total number of False detection can, for instance, be estimated based on the average number of false detections in a year or in some case, provided by a security analyst. In this example, the total number of false detections is considered as 1000.).
In regards to claim 41, the combination of Reijonen and Kaminski teach the security controller of claim 39, wherein the processing circuitry is configured to control the defense agents in the set by, based on the one or more accuracy metrics and the one or more resource consumption metrics, controlling whether and/or how each defense agent in the set performs each of one or more anomaly detection tasks(WO 2022260564, Reijonen, pg. 13, lines 12-24, The target metric scores 204 to be achieved are, thus, obtained based on the information provided by the CVID 201, the quantifier 202 and the importance analyzer 203. The target metric scores 204 comprise one or more scores such as FI score, henceforth referred to as FI, precision and recall. The target metric scores 204 depict the fitness of the system performance. More specifically, precision is the ratio of correctly predicted threat events to all predicted threat events. Precision indicates the percentage of real threat events out of all predicted threat events. Recall is the ratio of correctly predicted threat events to all threat events. Recall indicates the percentage of predicted threat events out of all threat events. FI is the inverse of the average of inverses of Precision and Recall.
Target Precision, target recall and target FI metric scores are calculated as below:
Target Precision = (number of TPs) / (number of TPs + tolerance limit of number of FPs)
Target Recall = (number of TPs) / (number of TPs + tolerance limit of number of FNs)
Target FI = 2 * (precision * recall) / (precision + recall)).
In regards to claim 42, the combination of Reijonen and Kaminski teach the security controller of claim 39, wherein the processing circuitry is configured to, for at least one of the one or more anomaly detection tasks, make a decision to switch the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the anomaly detection task to an accuracy-enhancing mode in which all of the defense agents in the set perform the anomaly detection task, based on: comparison of a set-wide accuracy metric to a set-wide accuracy threshold for the anomaly detection task(WO 2022260564, Reijonen, pg. 18, lines 18-20, Additionally, or alternatively, the number of iterations may be pre-defined. In yet another embodiment, the new DMT 305 is selected based on risk, cost and/or time available for computation.); or comparison of a set-wide resource consumption metric to a set-wide resource consumption threshold for the anomaly detection task.
In regards to claim 43, the combination of Reijonen and Kaminski teach the security controller of claim 39, wherein the processing circuitry is configured to: obtain a defense agent utility metric for the set of defense agents as a function of the one or more accuracy metrics and the one or more resource consumption metrics(US 20150365309, Kaminski, para. 0065, the client agent 202 collects (and populates into a database) a subset (for example, and without limitation, less than 5%) of available sampling metrics (both subject and time-related data), minimizing redundancies and recording information that is known (e.g., from prior expert experience) to either (a) impact perceived user response time or (b) is needed for process workload classification (e.g., to improve a classification process). These data are selected dynamically and recorded because they, for example, point to potential problems or are needed to correctly model the system via queuing theory. This selectivity results in a constrained dataset that nevertheless is able to drive highly accurate analytical results far more comprehensively and faster than conventional approaches,); obtain an attack utility metric as a function of the defense agent utility metric and an attack resource consumption metric reflecting an extent of resources required for attackers to execute a cooperative attack on the communication network(US 20150365309, Kaminski, para. 0004, a metric associated with a process. The method includes analyzing, by the workload engine, the retrieved metric and the process. The method includes associating, by the workload engine, at least one workload with the process, responsive to the analysis. The method includes analyzing, by an exception engine executing on the first computing resource, the retrieved metric, the process, and the at least one workload; analyzing includes applying at least one workload rule to the at least one workload. The method includes identifying, by the exception engine, an operational anomaly within the process, responsive to the analysis by the exception engine.); and control whether the defense agents in the set are to perform one or more anomaly detection tasks, based on comparison of the defense agent utility metric to the attack utility metric(US 20150365309, Kaminski, para. 0084, the exception engine 206 uses an extensible rules engine to compare workload information to historical norms and absolute references, using decision-based rules (e.g., rules defined by administrators, users, experts, or others) and historical data. The exception engine 206 may then apply at least one workload rule to the at least one workload.). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of Reijonen with the teaching of Kaminski because a user would have been motivated to add a step of generating mitigating recommendations, taught by Kaminski, since Reijonen does not instruct an operator what corrective action to take(Kaminski, para. 0102)
In regards to claim 46, the combination of Reijonen and Kaminski teach the security controller of claim 41, wherein the one or more anomaly detection tasks include: a feature monitoring task involving determining respective features of anomalies to be detected; and/or a feature detection task involving detecting the determined features; and/or a decision-making task involving making decisions on whether or not anomalies are present based upon detected features(WO 2022260564, Reijonen, pg. 14, lines 6-14, In some embodiments, the precision is further multiplied by an importance weight of FP. The importance weight of FP may be obtained according to one or more procedures described above in relation to the importance analyzer 203. Additionally, the recall is further multiplied by an importance weight of FN. The importance weight of FN may be obtained according to one or more procedures described above in relation to the importance analyzer 203. Additionally, the FI score is calculated based on the importance weight-adjusted precision and recall target metric scores. This embodiment has an advantage that it enables estimating the optimal decision-making threshold (DMT) by using an organization's threat event detection requirements, i.e. importance of FP vs FN.).
In regards to claim 47, the combination of Reijonen and Kaminski teach the security controller of claim 39, wherein the processing circuitry is configured to, based on the one or more accuracy metrics and the one or more resource consumption metrics, control whether or which defense agents in the set operate in a collaborative mode for performing anomaly detection collaboratively with one another and controlling whether or which defense agents in the set operate in a standalone mode for performing anomaly detection without collaborating with one another(WO 2022260564, Reijonen, pg. 16, lines 23-24, In an embodiment, two or more DMTs, e.g. initial DMTs, may be used per ADM. Further, a DMT may be used per threat event type, e.g. DoS, IA.; and pg. 17, lines 16-19, If they fall within the range, the initial DMT 302 is selected as the threshold to be used for anomaly detection. If the current metric scores 303 do not fall within a range of values of the target metric scores 204, then a new DMT 305 is selected and updated for computing the current metric scores 303.).
2.) Claims 29 and 44 are rejected under 35 U.S.C. 103 as unpatentable over IDS supplied reference WO 2022260564, Reijonen in view of US 20150365309, Kaminski and further in view of US 20090271504, Ginter In regards to claim 29, the combination of Reijonen and Kaminski teach the method of claim 28. The combination of Reijonen and Kaminski do not teach wherein: the defense agent utility metric is determined as U.sub.D=α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D−−α.sub.3.Math.C.sub.D, where M.sub.D is a rate at which the defense agents in the set determine respective features of anomalies, D.sub.D is a rate at which the defense agents in the set detect anomalies, P.sub.D is a set-wide false positive rate comprising a rate at which the defense agents in the set incorrectly detect anomalies, N.sub.D is a set-wide false negative rate comprising a rate at which the defense agents in the set fail to detect anomalies, C.sub.D is a set-wide resource consumption metric, M.sub.D, D.sub.D, P.sub.D, N.sub.D and C.sub.D∈[0, 1], and α.sub.1, α.sub.2, α.sub.3∈[0,1] are weight parameters; the attack utility metric is determined as U.sub.A=−, where C.sub.A is the attack resource consumption metric, β is a weight parameter, and β∈[0,1] However, Ginter teaches wherein: the defense agent utility metric is determined as U.sub.D=α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D−−α.sub.3.Math.C.sub.D, where M.sub.D is a rate at which the defense agents in the set determine respective features of anomalies, D.sub.D is a rate at which the defense agents in the set detect anomalies, P.sub.D is a set-wide false positive rate comprising a rate at which the defense agents in the set incorrectly detect anomalies, N.sub.D is a set-wide false negative rate comprising a rate at which the defense agents in the set fail to detect anomalies, C.sub.D is a set-wide resource consumption metric, M.sub.D, D.sub.D, P.sub.D, N.sub.D and C.sub.D∈[0, 1], and α.sub.1, α.sub.2, α.sub.3∈[0,1] are weight parameters; the attack utility metric is determined as U.sub.A=−, where C.sub.A is the attack resource consumption metric, β is a weight parameter, and β∈[0,1] (US 20090271504, Ginter, para. 0273, an approach may be taken with respect to combining inputs with respect to the different metrics as may be reported by the different agents. A resulting combination may be expressed as a derived parameter used, for example, in connection with generating an alarm or alert condition, as an input to the threat thermostat 218, and the like. A derived value or signal indicating an attack may be produced by examining one of more of the following: one or more metrics from the NIDS agent, the ARPWatch agent, IPS, the number of bad logins and root user count exceeding some predetermined normal threshold tuned for that particular system.). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of the combination of Reijonen and Kaminski with the teaching of Ginter because a user would have been motivated to use a configuration agent, taught by Ginter, to configure the plurality of agents, taught by the combination of Reijonen and Kaminski, in order to configure other system agents to report system monitoring information(Ginter, para. 0007)
In regards to claim 44, the combination of Reijonen and Kaminski teach the security controller of claim 43. The combination of Reijonen and Kaminski do not teach wherein: the defense agent utility metric is determined as U.sub.D=α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D−−α.sub.3.Math.C.sub.D, where M.sub.D is a rate at which the defense agents in the set determine respective features of anomalies, D.sub.D is a rate at which the defense agents in the set detect anomalies, P.sub.D is a set-wide false positive rate comprising a rate at which the defense agents in the set incorrectly detect anomalies, N.sub.D is a set-wide false negative rate comprising a rate at which the defense agents in the set fail to detect anomalies, C.sub.D is a set-wide resource consumption metric, M.sub.D, D.sub.D, P.sub.D, N.sub.D and C.sub.D∈[0, 1], and α.sub.1, α.sub.2, α.sub.3∈[0,1] are weight parameters; the attack utility metric is determined as U.sub.A=−, where C.sub.A is the attack resource consumption metric, β is a weight parameter, and β∈[0,1] ] However, Ginter teaches wherein: the defense agent utility metric is determined as U.sub.D=α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D−−α.sub.3.Math.C.sub.D, where M.sub.D is a rate at which the defense agents in the set determine respective features of anomalies, D.sub.D is a rate at which the defense agents in the set detect anomalies, P.sub.D is a set-wide false positive rate comprising a rate at which the defense agents in the set incorrectly detect anomalies, N.sub.D is a set-wide false negative rate comprising a rate at which the defense agents in the set fail to detect anomalies, C.sub.D is a set-wide resource consumption metric, M.sub.D, D.sub.D, P.sub.D, N.sub.D and C.sub.D∈[0, 1], and α.sub.1, α.sub.2, α.sub.3∈[0,1] are weight parameters; the attack utility metric is determined as U.sub.A=−, where C.sub.A is the attack resource consumption metric, β is a weight parameter, and β∈[0,1] ] (US 20090271504, Ginter, para. 0273, an approach may be taken with respect to combining inputs with respect to the different metrics as may be reported by the different agents. A resulting combination may be expressed as a derived parameter used, for example, in connection with generating an alarm or alert condition, as an input to the threat thermostat 218, and the like. A derived value or signal indicating an attack may be produced by examining one of more of the following: one or more metrics from the NIDS agent, the ARPWatch agent, IPS, the number of bad logins and root user count exceeding some predetermined normal threshold tuned for that particular system.). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of the combination of Reijonen and Kaminski with the teaching of Ginter because a user would have been motivated to use a configuration agent, taught by Ginter, to configure the plurality of agents, taught by the combination of Reijonen and Kaminski, in order to configure other system agents to report system monitoring information(Ginter, para. 0007)
3.) Claim 30 is rejected under 35 U.S.C. 103 as unpatentable over IDS supplied reference WO 2022260564, Reijonen in view of US 20150365309, Kaminski and further in view of US 20090271504, Ginter and further in view of US 20230121158, Meinhart
In regards to claim 30, the combination of Reijonen, Kaminski and Ginter teach the method of claim 29. The combination of Reijonen, Kaminski and Ginter do not teach wherein said controlling comprises: for a feature monitoring task involving determining respective features of anomalies to be detected: if α.sub.3.Math.C.sub.D>α.sub.1.Math.M.sub.D, switching the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the feature monitoring task to a resource-saving mode in which at least one of the defense agents in the set does not perform the feature monitoring task; or if >α.sub.1.Math.M.sub.D, switching the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the feature monitoring task to an accuracy-enhancing mode in which all of the defense agents in the set perform the feature monitoring task; for a feature detection task involving detecting the determined features: if α.sub.3.Math.C.sub.D>α.sub.2.Math.D.sub.D, switching the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the feature detection task to a resource-saving mode in which at least one of the defense agents in the set does not perform the feature detection task; or if >α.sub.2.Math.D.sub.D, switching the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the feature detection task to an accuracy-enhancing mode in which all of the defense agents in the set perform the feature detection task; for a decision-making task involving making decisions on whether or not anomalies are present based upon detected features: if ≤α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D, switching the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the decision-making task to a resource-saving mode in which at least one of the defense agents in the set does not perform the decision-making task; or if >α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D, switching the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the decision-making task to an accuracy-enhancing mode in which all of the defense agents in the set perform the decision-making task However, Meinhart teaches wherein said controlling comprises: for a feature monitoring task involving determining respective features of anomalies to be detected: if α.sub.3.Math.C.sub.D>α.sub.1.Math.M.sub.D, switching the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the feature monitoring task to a resource-saving mode in which at least one of the defense agents in the set does not perform the feature monitoring task; or if >α.sub.1.Math.M.sub.D, switching the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the feature monitoring task to an accuracy-enhancing mode in which all of the defense agents in the set perform the feature monitoring task; for a feature detection task involving detecting the determined features: if α.sub.3.Math.C.sub.D>α.sub.2.Math.D.sub.D, switching the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the feature detection task to a resource-saving mode in which at least one of the defense agents in the set does not perform the feature detection task; or if >α.sub.2.Math.D.sub.D, switching the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the feature detection task to an accuracy-enhancing mode in which all of the defense agents in the set perform the feature detection task; for a decision-making task involving making decisions on whether or not anomalies are present based upon detected features: if ≤α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D, switching the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the decision-making task to a resource-saving mode in which at least one of the defense agents in the set does not perform the decision-making task; or if >α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D, switching the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the decision-making task to an accuracy-enhancing mode in which all of the defense agents in the set perform the decision-making task (US 20230121158, Meinhart, para. 0026-0029, Referring to FIG. 2, data will be collected by retrieving information from a client system that is connected to VADS. A new client system (i.e., the new device(s) to be protected) will be scanned and the baseline software of the client system will be catalogued into a database. As shown at block 202, baseline data on the client or external system is collected and a determination is made whether the client system is new at block 204. If the system is new, this baseline data is added to a database as shown at 206 and flow proceeds to block 208 where the client system is scanned for available ports and protocols. Alternatively, if the system is not new as determined at decision block 204, flow proceeds directly to block 208.
[0027] Next, method 200 proceeds to decision block 210 where a determination is made whether open ports and protocols have been added to a database. Is not, flow proceeds to block 212 where the open ports and protocols are added to the database, as further shown at block 214, and then flow proceeds to decision block 216. In the alternative at block 210, if the open ports and protocols have been added to the database already, then flow proceeds directly from block 210 to block 216.
[0028] At decision block 216, a determination is made whether a current security patch has been applied. If so, method 200 ends. If not, flow proceeds to block 218 where necessary patches are applied to the client system based on a patch repository or database 220.
[0029] The processes of method 200, in part, ensure that the VADS will be able to identify any changes to the baseline throughout the life cycle of the protected client systems and take appropriate actions when necessary. In addition, ports, protocols and network traffic baselines are established thereby and catalogued into a database once the new client system is connected. This database will be used to determine any malicious activity occurring from internal or external sources (e.g., hacks).). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of the combination of Reijonen, Kaminski and Ginter with the teaching of Meinhart because a user would have been motivated to use an AGI system, taught by Meinhart, in order to provide an autonomous system for defending the system taught by the combination of Reijonen, Kaminski and Ginter from malicious attacks(Meinhart, para. 0006)
4.) Claim 45 is rejected under 35 U.S.C. 103 as unpatentable over IDS supplied reference WO 2022260564, Reijonen in view of US 20150365309, Kaminski and further in view of US 20230121158, Meinhart
In regards to claim 45, the combination of Reijonen and Kaminski teach the security controller of claim 39. The combination of Reijonen and Kaminski do not teach wherein the processing circuitry is configured to: for a feature monitoring task involving determining respective features of anomalies to be detected: if α.sub.3.Math.C.sub.D>α.sub.1.Math.M.sub.D, switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the feature monitoring task to a resource-saving mode in which at least one of the defense agents in the set does not perform the feature monitoring task; or if >α.sub.1.Math.M.sub.D, switch the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the feature monitoring task to an accuracy-enhancing mode in which all of the defense agents in the set perform the feature monitoring task; for a feature detection task involving detecting the determined features: if α.sub.3.Math.C.sub.D>α.sub.2.Math.D.sub.D, switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the feature detection task to a resource-saving mode in which at least one of the defense agents in the set does not perform the feature detection task; or if >α.sub.2.Math.D.sub.D, switch the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the feature detection task to an accuracy-enhancing mode in which all of the defense agents in the set perform the feature detection task; for a decision-making task involving making decisions on whether or not anomalies are present based upon detected features: if ≤α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D, switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the decision-making task to a resource-saving mode in which at least one of the defense agents in the set does not perform the decision-making task; or if >α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D, switch the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the decision-making task to an accuracy-enhancing mode in which all of the defense agents in the set perform the decision-making task However, Meinhart teaches wherein the processing circuitry is configured to: for a feature monitoring task involving determining respective features of anomalies to be detected: if α.sub.3.Math.C.sub.D>α.sub.1.Math.M.sub.D, switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the feature monitoring task to a resource-saving mode in which at least one of the defense agents in the set does not perform the feature monitoring task; or if >α.sub.1.Math.M.sub.D, switch the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the feature monitoring task to an accuracy-enhancing mode in which all of the defense agents in the set perform the feature monitoring task; for a feature detection task involving detecting the determined features: if α.sub.3.Math.C.sub.D>α.sub.2.Math.D.sub.D, switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the feature detection task to a resource-saving mode in which at least one of the defense agents in the set does not perform the feature detection task; or if >α.sub.2.Math.D.sub.D, switch the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the feature detection task to an accuracy-enhancing mode in which all of the defense agents in the set perform the feature detection task; for a decision-making task involving making decisions on whether or not anomalies are present based upon detected features: if ≤α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D, switch the set from an accuracy-enhancing mode in which all of the defense agents in the set perform the decision-making task to a resource-saving mode in which at least one of the defense agents in the set does not perform the decision-making task; or if >α.sub.1.Math.M.sub.D+α.sub.2.Math.D.sub.D, switch the set from a resource-saving mode in which at least one of the defense agents in the set does not perform the decision-making task to an accuracy-enhancing mode in which all of the defense agents in the set perform the decision-making task (US 20230121158, Meinhart, para. 0026-0029, Referring to FIG. 2, data will be collected by retrieving information from a client system that is connected to VADS. A new client system (i.e., the new device(s) to be protected) will be scanned and the baseline software of the client system will be catalogued into a database. As shown at block 202, baseline data on the client or external system is collected and a determination is made whether the client system is new at block 204. If the system is new, this baseline data is added to a database as shown at 206 and flow proceeds to block 208 where the client system is scanned for available ports and protocols. Alternatively, if the system is not new as determined at decision block 204, flow proceeds directly to block 208.
[0027] Next, method 200 proceeds to decision block 210 where a determination is made whether open ports and protocols have been added to a database. Is not, flow proceeds to block 212 where the open ports and protocols are added to the database, as further shown at block 214, and then flow proceeds to decision block 216. In the alternative at block 210, if the open ports and protocols have been added to the database already, then flow proceeds directly from block 210 to block 216.
[0028] At decision block 216, a determination is made whether a current security patch has been applied. If so, method 200 ends. If not, flow proceeds to block 218 where necessary patches are applied to the client system based on a patch repository or database 220.
[0029] The processes of method 200, in part, ensure that the VADS will be able to identify any changes to the baseline throughout the life cycle of the protected client systems and take appropriate actions when necessary. In addition, ports, protocols and network traffic baselines are established thereby and catalogued into a database once the new client system is connected. This database will be used to determine any malicious activity occurring from internal or external sources (e.g., hacks).). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of the combination of Reijonen and Kaminski with the teaching of Meinhart because a user would have been motivated to use an AGI system, taught by Meinhart, in order to provide an autonomous system for defending the system taught by the combination of Reijonen and Kaminski from malicious attacks(Meinhart, para. 0006)
5.) Claims 33, 34, 48 and 49 are rejected under 35 U.S.C. 103 as unpatentable over IDS supplied reference WO 2022260564, Reijonen in view of US 20150365309, Kaminski and further in view of US 20190034254, Nataraj
In regards to claim 33, the combination of Reijonen and Kaminski teach the method of claim 32, wherein the one or more accuracy metrics are obtained for each of the collaborative mode and the standalone mode, wherein said controlling comprises: controlling defense agents in the set to operate in the standalone mode if each of one or more standalone mode triggering criteria is met, wherein the one or more standalone mode triggering criteria include a set-wide accuracy metric for the collaborative mode falling below an accuracy threshold for the collaborative mode, wherein the set-wide accuracy metric is a set-wide false rate metric(WO 2022260564, Reijonen, pg. 8, lines 3-7, The purpose of inducing one or more threat events into the environment data 101 is to enable evaluating anomaly detection by calculating precision, recall and/or FI scores using a particular threshold which requires knowledge about the true malicious events, as will be further disclosed below and through-out the present application.); and the combination of Reijonen and Kaminski do not teach controlling defense agents in the set to operate in the collaborative mode if each of one or more collaborative mode triggering criteria is met, wherein the one or more collaborative mode triggering criteria include a set-wide accuracy metric for the standalone mode exceeding an accuracy threshold for the standalone mode, wherein the set-wide accuracy metric is a set-wide false rate metric However, Nataraj teaches controlling defense agents in the set to operate in the collaborative mode if each of one or more collaborative mode triggering criteria is met, wherein the one or more collaborative mode triggering criteria include a set-wide accuracy metric for the standalone mode exceeding an accuracy threshold for the standalone mode, wherein the set-wide accuracy metric is a set-wide false rate metric(US 20190034254, Nataraj, para. 0113, an example procedure for providing application-based network anomaly management in accordance with one or more embodiments described herein… in particular, individual business transactions occurring within the one or more applications may be identified, such as through collaboration between applications agents injecting GUIDs and the server/controller detecting the GUIDs (e.g., in traffic monitored by network visibility agents). As further mentioned above, in step 920 network traffic metrics within the computer network may also be determined); It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of the combination of Reijonen and Kaminski with the teaching of Nataraj because a user would have been motivated to apply an application intelligence platform, taught by Nataraj, to monitor the network environment, taught by the combination of Reijonen and Kaminski, to collect environmental metrics for subsequent analysis and remediation(Nataraj, para. 0029 and 0054)
In regards to claim 34, the combination of Reijonen, Kaminski, and Natarj teach the method of claim 33, wherein the accuracy threshold for the standalone mode is a function of a set-wide anomaly detection rate of the defense agents in the set while operating in the standalone mode, and/or wherein the accuracy threshold for the collaborative mode is a function of a set-wide anomaly detection rate of the defense agents in the set while operating in the collaborative mode(WO 2022260564, Reijonen, pg. 8, lines 3-7, The purpose of inducing one or more threat events into the environment data 101 is to enable evaluating anomaly detection by calculating precision, recall and/or FI scores using a particular threshold which requires knowledge about the true malicious events, as will be further disclosed below and through-out the present application.). In regards to claim 48, the combination of Reijonen and Kaminski teach the security controller of claim 47, wherein the one or more accuracy metrics are obtained for each of the collaborative mode and the standalone mode, wherein the processing circuitry is configured to: control defense agents in the set to operate in the standalone mode if each of one or more standalone mode triggering criteria is met, wherein the one or more standalone mode triggering criteria include a set-wide accuracy metric for the collaborative mode falling below an accuracy threshold for the collaborative mode, wherein the set-wide accuracy metric is a set-wide false rate metric(WO 2022260564, Reijonen, pg. 8, lines 3-7, The purpose of inducing one or more threat events into the environment data 101 is to enable evaluating anomaly detection by calculating precision, recall and/or FI scores using a particular threshold which requires knowledge about the true malicious events, as will be further disclosed below and through-out the present application.); and the combination of Reijonen and Kaminski do not teach control defense agents in the set to operate in the collaborative mode if each of one or more collaborative mode triggering criteria is met, wherein the one or more collaborative mode triggering criteria include a set-wide accuracy metric for the standalone mode exceeding an accuracy threshold for the standalone mode, wherein the set-wide accuracy metric is a set-wide false rate metric However, Nataraj teaches control defense agents in the set to operate in the collaborative mode if each of one or more collaborative mode triggering criteria is met, wherein the one or more collaborative mode triggering criteria include a set-wide accuracy metric for the standalone mode exceeding an accuracy threshold for the standalone mode, wherein the set-wide accuracy metric is a set-wide false rate metric (US 20190034254, Nataraj, para. 0113, an example procedure for providing application-based network anomaly management in accordance with one or more embodiments described herein… in particular, individual business transactions occurring within the one or more applications may be identified, such as through collaboration between applications agents injecting GUIDs and the server/controller detecting the GUIDs (e.g., in traffic monitored by network visibility agents). As further mentioned above, in step 920 network traffic metrics within the computer network may also be determined); It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of the combination of Reijonen and Kaminski with the teaching of Nataraj because a user would have been motivated to apply an application intelligence platform, taught by Nataraj, to monitor the network environment, taught by the combination of Reijonen and Kaminski, to collect environmental metrics for subsequent analysis and remediation(Nataraj, para. 0029 and 0054).
In regards to claim 49, the combination of Reijonen, Kaminski and Nataraj teach the security controller of claim 48, wherein the accuracy threshold for the standalone mode is a function of a set-wide anomaly detection rate of the defense agents in the set while operating in the standalone mode, and/or wherein the accuracy threshold for the collaborative mode is a function of a set-wide anomaly detection rate of the defense agents in the set while operating in the collaborative mode(WO 2022260564, Reijonen, pg. 8, lines 3-7, The purpose of inducing one or more threat events into the environment data 101 is to enable evaluating anomaly detection by calculating precision, recall and/or FI scores using a particular threshold which requires knowledge about the true malicious events, as will be further disclosed below and through-out the present application.).
6.) Claim 35 is rejected under 35 U.S.C. 103 as unpatentable over IDS supplied reference WO 2022260564, Reijonen in view of US 20150365309, Kaminski and further in view of US 20190034254, Nataraj and further in view of US 20170374098, Kish
In regards to claim 35, the combination of Reijonen, Kaminski, and Nataraj teach the method of claim 33. The combination of Reijonen, Kaminski, and Nataraj do not teach wherein the one or more resource consumption metrics are obtained for each of the collaborative mode and the standalone mode, and wherein the one or more standalone mode triggering criteria further include a set-wide resource consumption metric obtained for the collaborative mode exceeding a resource consumption threshold for the collaborative mode However, Kish teaches wherein the one or more resource consumption metrics are obtained for each of the collaborative mode and the standalone mode, and wherein the one or more standalone mode triggering criteria further include a set-wide resource consumption metric obtained for the collaborative mode exceeding a resource consumption threshold for the collaborative mode (US 20170374098, Kish, para. 0093, The resource consumption based comparison module 558 can be configured to, during a period of time in which the number of connections exceeds a connection count threshold or when an static condition is met and the mitigation mode is triggered, compare, for each client device, the amount of resources being consumed with the resource consumption threshold. Module 558 can be configured to compare resource utilization for different resources against one or more thresholds set for such resources for each of the client device.). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of the combination of Reijonen, Kaminski and Nataraj with the teaching of Kish because a user would have been motivated to establish a network threshold characteristic, taught by Kish, in order to mitigate systems from Denial-of-Service attacks(Kish, para. 0007)
7.) Claim 36 is rejected under 35 U.S.C. 103 as unpatentable over IDS supplied reference WO 2022260564, Reijonen in view of US 20150365309, Kaminski and further in view of US 20190034254, Nataraj and further in view of US 20130138428, Chandramouli
In regards to claim 36, the combination of Reijonen, Kaminski, and Nataraj teach The method of claim 33, wherein: the set-wide false rate metric for the standalone mode is equal to, where γ.sub.2 is a weight parameter, P.sub.L is a set-wide false positive rate for the standalone mode, and N.sub.L is a set-wide false negative rate for the standalone mode(WO 2022260564, Reijonen, pg. 4, lines 1-6, In an embodiment according to the first and the second aspect, the target metric score is calculated using one or more cost values, wherein the cost value comprises at least one of number of FPs relating to the event of the environment threat data, number of FNs relating to the event, cost of FPs relating to the event, cost of FNs relating to the event, cost of the threat event, probability of occurrence of the threat event, frequency of occurrence of the threat event, importance weight associated with the FPs and importance weight associated with FNs.); the false rate threshold for the standalone mode is equal to γ.sub.1.Math.D.sub.L, where γ.sub.1 is a weight parameter, and D.sub.L is a set-wide anomaly detection rate while operating in the standalone mode(WO 2022260564, Reijonen, pg. 12, lines 13-22, Alternatively, the quantifier 202 outputs the FP and FN tolerance limit by minimizing the Cost Function (CF) such as below. CF indicates the total cost that is distributed among the FP and FN detections and is estimated as follows:
CF = ( FNDOS* CFN + CFP * FPDOS)
Where CF is the cost function to be minimized, FND.sub.OS is the number of False Negative associated with the e.g. DoS threat event, FPD.sub.OS is the number of False Positive associated with the DoS threat event, CFN is the cost of false negative associated with the DoS threat event and CFP is the cost of false positive associated with the DoS threat event . The FP and FN tolerance limit may vary depending on different threat event types and the CVID 201 values associated with the threat events.); the set-wide false rate metric for the collaborative mode is equal to, where δ.sub.2 is a weight parameter, P.sub.I is a set-wide false positive rate for the collaborative mode, and N.sub.I is a set-wide false negative rate for the collaborative mode(WO 2022260564, Reijonen, pg. 12, lines 13-22, Alternatively, the quantifier 202 outputs the FP and FN tolerance limit by minimizing the Cost Function (CF) such as below. CF indicates the total cost that is distributed among the FP and FN detections and is estimated as follows:
CF = ( FNDOS* CFN + CFP * FPDOS)
Where CF is the cost function to be minimized, FND.sub.OS is the number of False Negative associated with the e.g. DoS threat event, FPD.sub.OS is the number of False Positive associated with the DoS threat event, CFN is the cost of false negative associated with the DoS threat event and CFP is the cost of false positive associated with the DoS threat event . The FP and FN tolerance limit may vary depending on different threat event types and the CVID 201 values associated with the threat events.); and the combination of Reijonen, Kaminski, and Nataraj do not teach the false rate threshold for the collaborative mode is equal to δ.sub.1.Math.D.sub.I, where δ.sub.1 is a weight parameter, and D.sub.I is a set-wide anomaly detection rate while operating in the collaborative mode However, Chandramouli teaches the false rate threshold for the collaborative mode is equal to δ.sub.1.Math.D.sub.I, where δ.sub.1 is a weight parameter, and D.sub.I is a set-wide anomaly detection rate while operating in the collaborative mode (US 20130138428, Chandramouli, para. 0126, [0126] The simulated annealing algorithm used is as follows:
Step 1: Initialization: total iteration number N, weight.sub.1=1.5rand(1, n) (vector of n random weights), j=1. Step 2: Compute detection rate and false positive using weight.sub.1 on deceptive and truthful training data. Choose detection threshold tmax=is that maximizes the cost function E.sub.max=E.sub.i=detection rate-false positive. Step 3: Set SA temperature T.sub.j=0.1/log (j+1); newweight.sub.j=weight.sub.j+T.sub.j*rand(1,n), j=j+1. Step 4: Compute the detection rate and false positive using newweight.sub.j on deceptive and truthful training emails. Chosen detection threshold t.sub.max=t.sub.j that maximizes the cost function Ej=detection rate-false positive.). It would have been obvious to one of ordinary skill in the art before the effective filing date is made to modify the teaching of the combination of Reijonen, Kaminski and Nataraj with the teaching of Chandramouli because a user would have been motivated to apply statistical analysis methods, taught by Chandramouli, in order to detect deceptive messages in the system maintained by the combination of Reijonen, Kaminski and Nataraj(Chandramouli, para. 0008)
CONCLUSION
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GREGORY LANE whose telephone number is (571)270-7469. The examiner can normally be reached on 571 270 7469 from 8:00 AM to 6:00 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Taghi Arani, can be reached on 571 272 3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/GREGORY A LANE/Examiner, Art Unit 2438
/TAGHI T ARANI/Supervisory Patent Examiner, Art Unit 2438
Prosecution Insights