Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Detailed Action
1. The office action is in response to the communication filed 09/30/2026.
Claim Status
2. Claims 1-20 have currently been amended.
Allowable Subject Matter
3. Claims 5 and 14 are objected to as being dependent upon a rejected base claim but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Response to Arguments
4. The applicant’s arguments filed 9/30/2026 have been taken into consideration but are moot in view of new grounds of rejection.
Claim Rejections – 35 USC 103
5. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office Action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
6. Claims 1-4, 6-13, and 15-20 are rejected under 35 USC 103 as being unpatentable over Luo et al (CN 111,614,627 A) in view of Manjunath et al (US 2025/0139250), further in view of Coull et al (US 2024/0007495).
Regarding claim 1, Luo et al teaches a method implemented by nodes of a network, comprising:
receiving, by a first component of a first node of the nodes of the network, event data associated with one or more security events from a second node of the nodes (Abstract, which discloses a data plane receiving a notification of a monitored detected abnormal flow caused by a DDOS attack from a control plane);
determining, by the first component, a subset of data of the event data that meets one or more criteria (pg. 3, lines 4-8, which discloses data parameters indicating the abnormal flow caused by the DDOS attack);
generating, by the first component, a first security signal associated with the subset of data (pg. 3, lines 9-10, which discloses an alarm being generated regarding the detected abnormal flow); and
receiving, by a second component of the first node and from the first component, the first security signal (pg. 3, lines 9-15, which discloses the data plane transmitting the alarm to a control plane).
Luo et al does not explicitly teach outputting, by the second component and to a fourth node of the nodes, instructions to perform the action.
However, Manjunath et al further teaches outputting, by the second component and to a second node within the network, instructions to perform the action (par [0018], lines 10-15, “initiate the remediation action”).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al in order to improve resolving detected security events among network nodes by implementing the security feature recommendation component (as disclosed in fig. 1 of Manjunath et al) because this feature would allow for faster remediation of security events when pre-stored mitigation of matching threats are issued upon a security event with a previously matching pattern being detected.
Luo et al and Manjunath et al do not explicitly teach the first security signal being indicative of a first potential threat; the second component executing a first portion of a computational graph that is federated across the nodes of the network; receiving, by the second component, a second security signal originating from a third node of the nodes, the second security signal being indicative of a second potential threat, the third node being configured to execute a second portion of the computational graph; and determining, by the second component and based in part on the first security signal and the second security signal, an action to address at least one of the first potential threat or the second potential threat.
However, Coull et al further teaches the first security signal being indicative of a first potential threat (par [0035], lines 1-3, which discloses a first alert regarding a plurality of threat scores corresponding to a potential cybersecurity threat);
the second component executing a first portion of a computational graph that is federated across the nodes of the network (fig. 2, ‘200, par [0005], and par [0010], which disclose a cyber-threat analyzer containing several components that access segments of a semantic graph used to display objects corresponding to potential cyberthreats);
receiving, by the second component, a second security signal originating from a third node of the nodes (fig. 4-5, par [0006], lines 1-2, & par [0035], lines 2-8, which discloses a second alert received from objects represented by nodes), the second security signal being indicative of a second potential threat (par [0035], lines 7-14, which discloses the second alert corresponding to one or more other cyber threats), the third node being configured to execute a second portion of the computational graph (par [0006], lines 1-3, “each object, represented by a node of the semantic graph”); and
determining, by the second component and based in part on the first security signal and the second security signal, an action to address at least one of the first potential threat or the second potential threat (fig. 2-3 & par [0010-0011], which disclose mitigating cyber-threats using the component located within the cyber-threat analyzer and the plurality of alerts).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Coull et al within the teachings of Luo et al and Manjunath et al in order to improve processing and analysis of potential threats in a network environment by increasing the data value and/or relevance for a given region of observation (i.e., a network or portion of a network that is being monitored for cyber-security by an analyst), which also improves analyst response time (as disclosed in par [0020], lines 24-29 of Coull et al).
Regarding claim 2, Luo et al does not explicitly teach wherein the node is included as part of a first level within a swarm system of the network, further comprising:
generating, by the first component and based on executing a function using the event data as input, transformed event data associated with a portion of the security events that comprise a particular identifier or classifier defined by the function; and outputting, by the first component and to one or more nodes at a second level within the network, the transformed event data.
However, Manjunath et al further teaches wherein the node is included as part of a first level within a swarm system of the network (par [0010], lines 18-19), further comprising:
generating, by the first component and based on executing a function using the event data as input, transformed event data associated with a portion of the security events that comprise a particular identifier or classifier defined by the function (par [0061-00062], “classified the container environment as being critical”); and
outputting, by the first component and to one or more nodes at a second level within the network, the transformed event data (par [0060], lines 7-9).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 1.
Regarding claim 3, Luo et al and Manjunath et al teach the limitations of claim 1.
Luo et al further teaches wherein the function comprises one of a pattern matching function, a machine learning function (Abstract, “DDOS machine learning”), heuristic function, a Bayesian function, a neural network function.
Regarding claim 4, Luo et al does not explicitly teach wherein: nodes within the first level of the swarm system comprise one or more first components configured to execute a first type of function, and one or more second nodes within the second level of the swarm system comprise one or more first components configured to execute a second type of function that is different from the first type.
However, Manjunath et al further teaches wherein:
nodes within the first level of the swarm system are configured to execute a first type of function (fig. 2 par [0003], “security feature”), and
nodes within the second level of the swarm system are configured to execute a second type of function that is different from the first type (par [0060], lines 7-9, “different levels of security alerting”).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 1.
Regarding claim 6, Luo et al and Manjunath et al teach the limitations of claim 1.
Luo et al further teaches wherein the second component comprises a control plane component (Abstract, lines 5-6) and is configured to:
receive one or more inputs via one or more pathways of the network, the one or more inputs including security events (pg. 7, lines 35-39, “feature of DDOS attack”);
perform processing, classification, or filtering of the security events to generate an output (pg. 11, lines 5-10, “classification and detection”);
determine an event type associated with the output (pg. 11, lines 25-33, “characteristics of DDOS attack flow”); and
route the output to a particular first component within the network based on the event type (pg. 6, lines 12-33, “Unloading the pre-detection function to the data plane”).
Regarding claim 7, Luo et al does not explicitly teach wherein the action comprises one or more of: informing peer nodes or other nodes of a security event associated with the first security signal; performing a remediation or enforcement action based on a configured policy determined for the security event; accumulating security signals associated with the security event, wherein subsequent security signals received in association with the security event triggering action at a subsequent time; informing upper layer nodes of the security event; or informing an upper layer controller.
However, Manjunath et al further teaches wherein the action comprises one or more of:
informing peer nodes or other nodes of a security event associated with the first security signal;
performing a remediation or enforcement action based on a configured policy determined for the security event (par [0018], lines 1-5, “remediation policy”);
accumulating security signals associated with the security event, wherein subsequent security signals received in association with the security event triggering action at a subsequent time;
informing upper layer nodes of the security event; or
informing an upper layer controller (par [0060], lines 7-9, “different levels of security alerting”).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 5.
Regarding claim 8, Luo et al does not explicitly teach wherein the second component determines the action further based on one or more of: first inputs associated with additional security events from one or more peer nodes; second inputs from one or more nodes associated with a different level within the network; or third inputs from an administrator of the network.
However, Manjunath et al further teaches wherein the second component determines the action further based one or more of:
first inputs associated with additional security events from one or more peer nodes;
second inputs from one or more nodes associated with a different level within the network (par [0060], lines 6-9, “recommend different levels of security alerting”); or
third inputs from an administrator of the network.
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 5.
Regarding claim 9, Luo et al and Manjunath et al teach the limitations of claim 1.
Luo et al further teaches wherein the second component is configured to instantiate the first component at runtime (pg. 2, lines 1-5, “cross-plane cooperative”).
Regarding claim 10, Luo et al teaches a system comprising:
receiving, by a first component of a first node of the nodes of the network, event data associated with one or more security events from a second node of the nodes (Abstract, which discloses a data plane receiving a notification of a monitored detected abnormal flow caused by a DDOS attack from a control plane);
determining, by the first component, a subset of data of the event data that meets one or more criteria (pg. 3, lines 4-8, which discloses data parameters indicating the abnormal flow caused by the DDOS attack);
generating, by the first component, a first security signal associated with the subset of data (pg. 3, lines 9-10, which discloses an alarm being generated regarding the detected abnormal flow); and
receiving, by a second component of the first node and from the first component, the first security signal (pg. 3, lines 9-15, which discloses the data plane transmitting the alarm to a control plane).
Luo et al does not explicitly teach one or more processors; and one or more non-transitory computer-readable media that, when executed by the one or more processors, cause the one or more processors to perform operations; and outputting, by the second component and to a second node within the network, instructions to perform the action.
However, Manjunath et al further teaches one or more processors (fig. 1, ‘100); and
one or more non-transitory computer-readable media (par [0089]) that, when executed by the one or more processors, cause the one or more processors to perform operations; and
outputting, by the second component and to a second node within the network, instructions to perform the action (par [0018], lines 10-15, “initiate the remediation action”).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al in order to improve resolving detected security events among network nodes by implementing the security feature recommendation component (as disclosed in fig. 1 of Manjunath et al) because this feature would allow for faster remediation of security events when pre-stored mitigation of matching threats are issued upon a security event with a previously matching pattern being detected.
Luo et al and Manjunath et al do not explicitly teach the first security signal being indicative of a first potential threat; the second component executing a first portion of a computational graph that is federated across the nodes of the network; receiving, by the second component, a second security signal originating from a third node of the nodes, the second security signal being indicative of a second potential threat, the third node being configured to execute a second portion of the computational graph; and determining, by the second component and based in part on the first security signal and the second security signal, an action to address at least one of the first potential threat or the second potential threat.
However, Coull et al further teaches the first security signal being indicative of a first potential threat (par [0035], lines 1-3, which discloses a first alert regarding a plurality of threat scores corresponding to a potential cybersecurity threat);
the second component executing a first portion of a computational graph that is federated across the nodes of the network (fig. 2, ‘200, par [0005], and par [0010], which disclose a cyber-threat analyzer containing several components that access segments of a semantic graph used to display objects corresponding to potential cyberthreats);
receiving, by the second component, a second security signal originating from a third node of the nodes (fig. 4-5, par [0006], lines 1-2, & par [0035], lines 2-8, which discloses a second alert received from objects represented by nodes), the second security signal being indicative of a second potential threat (par [0035], lines 7-14, which discloses the second alert corresponding to one or more other cyber threats), the third node being configured to execute a second portion of the computational graph (par [0006], lines 1-3, “each object, represented by a node of the semantic graph”); and
determining, by the second component and based in part on the first security signal and the second security signal, an action to address at least one of the first potential threat or the second potential threat (fig. 2-3 & par [0010-0011], which disclose mitigating cyber-threats using the component located within the cyber-threat analyzer and the plurality of alerts).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Coull et al within the teachings of Luo et al and Manjunath et al in order to improve processing and analysis of potential threats in a network environment by increasing the data value and/or relevance for a given region of observation (i.e., a network or portion of a network that is being monitored for cyber-security by an analyst), which also improves analyst response time (as disclosed in par [0020], lines 24-29 of Coull et al).
Regarding claim 11, Luo et al does not explicitly teach wherein the node is included as part of a first level within a swarm system of the network, further comprising:
generating, by the first component and based on executing a function using the event data as input, transformed event data associated with a portion of the security events that comprise a particular identifier or classifier defined by the function; and outputting, by the first component and to one or more nodes at a second level within the network, the transformed event data.
However, Manjunath et al further teaches wherein the node is included as part of a first level within a swarm system of the network (par [0010], lines 18-19), further comprising:
generating, by the first component and based on executing a function using the event data as input, transformed event data associated with a portion of the security events that comprise a particular identifier or classifier defined by the function (par [0061-00062], “classified the container environment as being critical”); and
outputting, by the first component and to one or more nodes at a second level within the network, the transformed event data (par [0060], lines 7-9).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 10.
Regarding claim 12, Luo et al and Manjunath et al teach the limitations of claim 10.
Luo et al further teaches wherein the function comprises one of a pattern matching function, a machine learning function (Abstract, “DDOS machine learning”), heuristic function, a Bayesian function, a neural network function.
Regarding claim 13, Luo et al does not explicitly teach wherein: nodes within the first level of the swarm system comprise one or more first components configured to execute a first type of function, and one or more second nodes within the second level of the swarm system comprise one or more first components configured to execute a second type of function that is different from the first type.
However, Manjunath et al further teaches wherein:
nodes within the first level of the swarm system comprise one or more first components configured to execute a first type of function (fig. 2 par [0003], “security feature”), and
one or more second nodes within the second level of the swarm system comprise one or more first components configured to execute a second type of function that is different from the first type (par [0060], lines 7-9, “different levels of security alerting”).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 11.
Regarding claim 15, Luo et al and Manjunath et al teach the limitations of claim 10.
Luo et al further teaches wherein the second component comprises a control plane component (Abstract, lines 5-6) and is configured to:
receive one or more inputs via one or more pathways of the network, the one or more inputs including security events (pg. 7, lines 35-39, “feature of DDOS attack”);
perform processing, classification, or filtering of the security events to generate an output (pg. 11, lines 5-10, “classification and detection”);
determine an event type associated with the output (pg. 11, lines 25-33, “characteristics of DDOS attack flow”); and
route the output to a particular first component within the network based on the event type (pg. 6, lines 12-33, “Unloading the pre-detection function to the data plane”).
Regarding claim 16, Luo et al does not explicitly teach wherein the action comprises one or more of: informing peer nodes or other nodes of a security event associated with the first security signal; performing a remediation or enforcement action based on a configured policy determined for the security event; accumulating security signals associated with the security event, wherein subsequent security signals received in association with the security event may trigger action at a subsequent time; informing upper layer nodes of the security event; or informing an upper layer controller.
However, Manjunath et al further teaches wherein the action comprises one or more of:
informing peer nodes or other nodes of a security event associated with the first security signal;
performing a remediation or enforcement action based on a configured policy determined for the security event (par [0018], lines 1-5, “remediation policy”);
accumulating security signals associated with the security event, wherein subsequent security signals received in association with the security event may trigger action at a subsequent time;
informing upper layer nodes of the security event; or
informing an upper layer controller (par [0060], lines 7-9, “different levels of security alerting”).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 14.
Regarding claim 17, Luo et al does not explicitly teach wherein the second component determines the action further based on one or more of: first inputs associated with additional security events from one or more peer nodes; second inputs from one or more nodes associated with a different level within the network; or third inputs from an administrator of the network.
However, Manjunath et al further teaches wherein the second component determines the action further based one or more of:
first inputs associated with additional security events from one or more peer nodes;
second inputs from one or more nodes associated with a different level within the network (par [0060], lines 6-9, “recommend different levels of security alerting”); or
third inputs from an administrator of the network.
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 14.
Regarding claim 18, Luo et al and Manjunath et al teach the limitations of claim 10.
Luo et al further teaches wherein the second component is configured to instantiate the first component at runtime (pg. 2, lines 1-5, “”cross-plane cooperative”).
Regarding claim 19, Luo et al teaches receiving, by a first component of a node, event data associated with security events from one or more other nodes in the network (Abstract, which discloses a data plane receiving a notification of a monitored detected abnormal flow caused by a DDOS attack);
determining, by the first component, a subset of data of the event data that meets one or more criteria (pg. 3, lines 4-8, which discloses data parameters indicating the abnormal flow caused by the DDOS attack);
generating, by the first component, a security signal associated with the subset of data (pg. 3, lines 9-10, which discloses an alarm being generated regarding the detected abnormal flow); and
receiving, by a second component of the node and from the first component, the security signal as input (pg. 3, lines 9-15, which discloses the data plane transmitting the alarm to a control plane).
Luo et al does not explicitly teach a non-transitory computer-readable media storing instructions executable by one or more processors of a node, wherein the instructions, when executed, cause the one or more processors to perform operations; and outputting, by the second component and to a second node within the network, instructions to perform the action.
However, Manjunath et al further teaches a non-transitory computer-readable media (par [0089]) storing instructions executable by one or more processors of a node, wherein the instructions, when executed, cause the one or more processors to perform operations; and
outputting, by the second component and to a second node within the network, instructions to perform the action (par [0018], lines 10-15, “initiate the remediation action”).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al in order to improve resolving detected security events among network nodes by implementing the security feature recommendation component (as disclosed in fig. 1 of Manjunath et al) because this feature would allow for faster remediation of security events when pre-stored mitigation of matching threats are issued upon a security event with a previously matching pattern being detected.
Luo et al and Manjunath et al do not explicitly teach the first security signal being indicative of a first potential threat; the second component executing a first portion of a computational graph that is federated across the nodes of the network; receiving, by the second component, a second security signal originating from a third node of the nodes, the second security signal being indicative of a second potential threat, the third node being configured to execute a second portion of the computational graph; and determining, by the second component and based in part on the first security signal and the second security signal, an action to address at least one of the first potential threat or the second potential threat.
However, Coull et al further teaches the first security signal being indicative of a first potential threat (par [0035], lines 1-3, which discloses a first alert regarding a plurality of threat scores corresponding to a potential cybersecurity threat);
the second component executing a first portion of a computational graph that is federated across the nodes of the network (fig. 2, ‘200, par [0005], and par [0010], which disclose a cyber-threat analyzer containing several components that access segments of a semantic graph used to display objects corresponding to potential cyberthreats);
receiving, by the second component, a second security signal originating from a third node of the nodes (fig. 4-5, par [0006], lines 1-2, & par [0035], lines 2-8, which discloses a second alert received from objects represented by nodes), the second security signal being indicative of a second potential threat (par [0035], lines 7-14, which discloses the second alert corresponding to one or more other cyber threats), the third node being configured to execute a second portion of the computational graph (par [0006], lines 1-3, “each object, represented by a node of the semantic graph”); and
determining, by the second component and based in part on the first security signal and the second security signal, an action to address at least one of the first potential threat or the second potential threat (fig. 2-3 & par [0010-0011], which disclose mitigating cyber-threats using the component located within the cyber-threat analyzer and the plurality of alerts).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Coull et al within the teachings of Luo et al and Manjunath et al in order to improve processing and analysis of potential threats in a network environment by increasing the data value and/or relevance for a given region of observation (i.e., a network or portion of a network that is being monitored for cyber-security by an analyst), which also improves analyst response time (as disclosed in par [0020], lines 24-29 of Coull et al).
Regarding claim 20, Luo et al does not explicitly teach wherein the node is included as part of a first level within a swarm system of the network, further comprising:
generating, by the first component and based on executing a function using the event data as input, transformed event data associated with a portion of the security events that comprise a particular identifier or classifier defined by the function; and outputting, by the first component and to one or more nodes at a second level within the network, the transformed event data.
However, Manjunath et al further teaches wherein the node is included as part of a first level within a swarm system of the network (par [0010], lines 18-19), further comprising:
generating, by the first component and based on executing a function using the event data as input, transformed event data associated with a portion of the security events that comprise a particular identifier or classifier defined by the function (par [0061-00062], “classified the container environment as being critical”); and
outputting, by the first component and to one or more nodes at a second level within the network, the transformed event data (par [0060], lines 7-9).
It would have been obvious to one of ordinary skill in the art, before the effective day of the invention, that one would be motivated to combine the teachings of Manjunath et al within the teachings of Luo et al according to the motivation disclosed regarding claim 19.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Randy A. Scott whose telephone number is (571) 272-3797. The examiner can normally be reached on Monday-Thursday 7:30 am-5:00 pm, second Fridays 7:30 am-4pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Luu Pham can be reached on (571) 270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RANDY A SCOTT/Primary Examiner, Art Unit 2439
20261009
