DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
IDS of 07/25/2025, under NPL, item # 45 does not have a date and is not considered.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 4-7, 12-18 and 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kumar et al., (US Publication No. 2016/0088000), hereinafter “Kumar”, and further in view of Brandt et al., (US Publication No. 2021/0067548), hereinafter “Brandt”.
Regarding claims 4, 16, Kumar discloses
accessing network communication session data for a session between a source and a destination [Kumar, paragraph 44, logon session data];
Kumar does not specifically disclose, however Brandt teaches
selecting a first baseline model [Brandt, figures 1, 5, paragraphs 40, 71, select a first learning statistical model];
selecting a second baseline model, wherein the second baseline model is different from the first baseline model [Brandt, figures 1, 5, paragraphs 40, 71, select a first learning statistical model, select a second learning statistical model];
applying the first baseline model to make a first determination of whether the network communication session data indicates anomalous activity [Brandt, figures 1, 5, paragraphs 40, 71-78, compare first model result to a threshold];
applying the second baseline model to make a second determination of whether the network communication session data indicates anomalous activity [Brandt, figures 1, 5, paragraphs 40, 71-78, compare second model result to a threshold]; and
when the first determination indicates anomalous activity and the second determination indicates anomalous activity: determining that the session included anomalous network activity [Brandt, figures 1, 5, paragraphs 40, 71-78, compare first and second model results to a threshold].
It would have been obvious to one having ordinary skill in the art before the effective filing date to include Brandt’s selection of multiple models to include with Kumar’s communication sessions in order to provide security for the communication sessions. It would have been obvious to combine Brandt with Kumar as each art relates to security of communications and detecting malicious activity.
Regarding claims 5, 17, Kumar-Brandt further discloses
when the first determination indicates anomalous network activity and the second determination indicates anomalous activity: performing an action comprising at least one of: generating an alert, generating an event in a log, restricting network communication of the source, or restricting network communication to the destination [Brandt, figures 1, 5, paragraphs 40, 71-78, flagged].
Regarding claim 6, Kumar-Brandt further discloses
wherein the first determination is based on determining that a first z score for the network communication session data is above a first threshold amount, and wherein the second determination is based on determining that a second z score for the network communication session data is above a second threshold amount [Kumar, paragraphs 133-135].
Regarding claim 7, Kumar-Brandt further discloses
wherein the first determination is based on determining that a first modified z score for the network communication session data is above a first threshold amount, wherein the second determination is based on determining that a second modified z score for the network communication session data is above a second threshold amount, wherein the first modified z score is determined by subtracting a first median value associated with the first baseline model from a first value associated with the network communication session data and dividing a result of the subtracting by a first median absolute deviation associated with the first baseline model, and wherein the second modified z score is determined by subtracting a second median value associated with the second baseline model from a second value associated with the network communication session data and dividing a result of the subtracting by a second median absolute deviation associated with the second baseline model [Kumar, paragraphs 133-135].
Regarding claim 12, Kumar-Brandt further discloses
wherein the first baseline model is a source-destination baseline model, and wherein the second baseline model is a destination baseline model [Brandt, figures 1, 5, paragraphs 39-40, 50, 71-78].
Regarding claim 13, Kumar-Brandt further discloses
wherein the first baseline model is a source baseline model, and wherein the second baseline model is a destination baseline model [Brandt, figures 1, 5, paragraphs 39-40, 50, 71-78].
Regarding claim 14, Kumar-Brandt further discloses
wherein selecting the first baseline model and selecting the second baseline model is based at least in part on determining an existence of a source-destination baseline model indicating baseline network activity between the source and the destination [Brandt, figures 1, 5, paragraphs 39-40, 50, 71-78].
Regarding claims 15, 20, Kumar-Brandt further discloses
when the first determination indicates anomalous network activity and the second determination indicates anomalous activity: determining a validity indication, wherein the validity indication is based on a ratio of historical anomalous sessions to total historical sessions and a total number of historical anomalous sessions [Brandt, figures 1, 5, paragraphs 39-40, 50, 71-78, trained on historical data].
Regarding claim 18, Kumar-Brandt further discloses
wherein the first determination is based on determining that a first modified z score for the network communication session data is above a first threshold amount, wherein the second determination is based on determining that a second modified z score for the network communication session data is above a second threshold amount, wherein the first modified z score is determined by subtracting a first median value associated with the first baseline model from a first value associated with the network communication session data and dividing a result of the subtracting by a first median absolute deviation associated with the first baseline model, and wherein the second modified z score is determined by subtracting a second median value associated with the second baseline model from a second value associated with the network communication session data and dividing a result of the subtracting by a second median absolute deviation associated with the second baseline model [Kumar, paragraphs 133-135].
Allowable Subject Matter
Claims 1-3 are allowed.
Claims 8-11 and 19 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WILLIAM J GOODCHILD whose telephone number is (571)270-1589. The examiner can normally be reached M-F 8am-4:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeff Pwu can be reached at 571-272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/William J. Goodchild/Primary Examiner, Art Unit 2433
Prosecution Insights