DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Interpretation
Claims 1-12 disclose a “non-transitory computer-readable data storage medium”. This appears to exclude any transitory embodiments; therefore, the language is compliant with 35 U.S.C. 101.
Claims 18-20 disclose a method in which the steps are all described as being executed by a processor. This appears to comply with 35 U.S.C. 112(b).
Claim Objections
Claims 4-5, 9, and 16 are objected to because of the following informalities:
In claim 4, line 2, “wherein the processor further comprising” should be -the processor further comprising- or -wherein the processor further comprises-.
In claim 9, line 9, “assign” should be -assigning-.
In claim 16, line 9, “assign” should be -assigning-.
Appropriate correction is required.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-12 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-12 of U.S. Patent No. 12,326,792 (hereafter referred to as “the ‘792 patent”). Although the claims at issue are not identical, they are not patentably distinct from each other because the claims of the ‘792 patent anticipate the current invention.
Current claims 1-12
Claims 1-12, ‘792 patent
1. A non-transitory computer-readable data storage medium storing program code executable by a processor to perform processing comprising:
1. A non-transitory computer-readable data storage medium storing program code executable by a processor to perform processing comprising:
respectively tokenizing a plurality of strings of a text file representing a configuration of a target device into a plurality of tokens for the configuration;
respectively tokenizing a plurality of strings of a text file representing a configuration of a target device into a plurality of tokens for the configuration;
sequencing the tokens for the configuration;
shingling the tokens for the configuration;
determining a target device signature representing the configuration of the target device by applying a hashing technique to the tokens as have been sequenced; and
determining a target device signature representing the configuration of the target device by applying a min-wise independent permutations locality sensitive hashing (MinHash) technique to the tokens as have been shingled; and
identifying whether the configuration of the target device is anomalous based on the target device signature.
identifying whether the configuration of the target device is anomalous based on the target device signature.
2. The non-transitory computer-readable data storage medium of claim 1, wherein the processing further comprises: in response to identifying that the configuration of the target device is anomalous, reconfiguring the target device.
2. The non-transitory computer-readable data storage medium of claim 1, wherein the processing further comprises: in response to identifying that the configuration of the target device is anomalous, reconfiguring the target device.
3. The non-transitory computer-readable data storage medium of claim 1, wherein reconfiguring the target device comprises either or both of: identifying and uninstalling a first application from the target device that resulted in the configuration of the target device having been identified as anomalous; and reconfiguring a second application from the target device having an application configuration that resulted in the configuration of the target device having been identified as anomalous.
3. The non-transitory computer-readable data storage medium of claim 1, wherein reconfiguring the target device comprises either or both of: identifying and uninstalling a first application from the target device that resulted in the configuration of the target device having been identified as anomalous; and reconfiguring a second application from the target device having an application configuration that resulted in the configuration of the target device having been identified as anomalous.
4. The non-transitory computer-readable data storage medium of claim 1, wherein the processing further comprising: comparing the target device signature representing the configuration of the target device to a reference device signature representing a reference configuration of a reference device to calculate a similarity score indicative of how similar the configuration of the target device is to the reference configuration, wherein identifying whether the configuration of the target device is anomalous is based on the similarity score.
4. The non-transitory computer-readable data storage medium of claim 1, wherein the processing further comprising: comparing the target device signature representing the configuration of the target device to a reference device signature representing a reference configuration of a reference device to calculate a similarity score indicative of how similar the configuration of the target device is to the reference configuration, wherein identifying whether the configuration of the target device is anomalous is based on the similarity score.
5. The non-transitory computer-readable data storage medium of claim 4, wherein the processing further comprises: respectively tokenizing a plurality of strings of a text file representing the reference configuration into a plurality of tokens for the reference configuration; sequencing the tokens for the reference configuration; and generating the reference device signature representing the reference configuration by applying the hashing technique to the tokens for the reference device signature as have been sequenced.
5. The non-transitory computer-readable data storage medium of claim 4, wherein the processing further comprises: respectively tokenizing a plurality of strings of a text file representing the reference configuration into a plurality of tokens for the reference configuration; shingling the tokens for the reference configuration; and generating the reference device signature representing the reference configuration by applying the MinHash technique to the tokens for the reference device signature as have been shingled.
6. The non-transitory computer-readable data storage medium of claim 1, wherein the target device is one of a plurality of devices that respectively have a plurality of device signatures, the device signature of each device represents a configuration of the device, the target device signature is the device signature of the target device that represents the configuration of the target device, and the processing further comprises: performing a different hashing technique on the device signatures to assign the device signatures within a plurality of hash buckets; and clustering the devices within a plurality of clusters based on assignment of the device signatures within the plurality of hash buckets.
6. The non-transitory computer-readable data storage medium of claim 1, wherein the target device is one of a plurality of devices that respectively have a plurality of device signatures, the device signature of each device represents a configuration of the device, the target device signature is the device signature of the target device that represents the configuration of the target device, and the processing further comprises: performing a locality-sensitive hashing (LSH) technique on the device signatures to assign the device signatures within a plurality of hash buckets; and clustering the devices within a plurality of clusters based on assignment of the device signatures within the plurality of hash buckets.
7. The non-transitory computer-readable data storage medium of claim 6, wherein identifying whether the configuration of the target device is anomalous is based on which of the clusters within which the target device has been clustered.
7. The non-transitory computer-readable data storage medium of claim 6, wherein identifying whether the configuration of the target device is anomalous is based on which of the plurality of clusters within which the target device has been clustered.
8. The non-transitory computer-readable data storage medium of claim 6, wherein the processing further comprises: for each of the plurality of hash buckets within which two or more of the device signatures have been assigned, calculating a similarity score for each of one or more unique pairs of the device signatures that have been assigned to the hash bucket, wherein the devices are clustered within the plurality of clusters based on the similarity score that has been calculated for each of the one or more unique pairs of the device signatures that have been assigned to each of the plurality of hash buckets.
8. The non-transitory computer-readable data storage medium of claim 6, wherein the processing further comprises: for each of the plurality of hash buckets within which two or more of the device signatures have been assigned, calculating a similarity score for each of one or more unique pairs of the device signatures that have been assigned to the respective hash bucket, wherein the devices are clustered within the plurality of clusters based on the similarity score that has been calculated for each of the one or more unique pairs of the device signatures that have been assigned to each of the plurality of hash buckets.
9. The non-transitory computer-readable data storage medium of claim 6, wherein performing the different technique on the device signatures comprises, for each device signature: banding the device signature into a plurality of device sub-signatures respectively corresponding to a plurality of hash bucket groups, each hash bucket group including the hash buckets; performing the different hashing technique on each device sub-signature to calculate a hash value for the device sub-signature; and for each device sub-signature, assign the device signature to one of the hash buckets of the hash bucket group to which the device sub-signature corresponds based on the hash value for the device sub-signature.
9. The non-transitory computer-readable data storage medium of claim 6, wherein performing the LSH technique on the device signatures comprises, for each device signature: banding the device signature into a plurality of device sub-signatures respectively corresponding to a plurality of hash bucket groups, each hash bucket group including the hash buckets; performing an LSH function on each device sub-signature to calculate a hash value for the device sub-signature; and for each device sub-signature, assign the device signature to one of the hash buckets of the hash bucket group to which the device sub-signature corresponds based on the hash value for the device sub-signature.
10. The non-transitory computer-readable data storage medium of claim 6, wherein the processing further comprises: for each of a plurality of unique pairs of the device signatures, identifying the devices having the device signatures of the unique pair as similar in response to both of the device signatures having been assigned to each of more than a threshold number or percentage of hash bucket groups, wherein the devices are clustered over the plurality of clusters based on which of the devices have been identified as similar.
10. The non-transitory computer-readable data storage medium of claim 6, wherein the processing further comprises: for each of a plurality of unique pairs of the device signatures, identifying the devices having the device signatures of the unique pair as similar in response to both of the device signatures having been assigned to each of more than a threshold number or percentage of hash bucket groups, wherein the devices are clustered over the plurality of clusters based on which of the devices have been identified as similar.
11. The non-transitory computer-readable data storage medium of claim 1, wherein the processing further comprises: identifying a plurality of delimiter characters within the text file; and dividing the text file into the plurality of strings based on the plurality of delimiter characters that have been identified.
11. The non-transitory computer-readable data storage medium of claim 1, wherein the processing further comprises: identifying a plurality of delimiter characters within the text file; and dividing the text file into the plurality of strings based on the plurality of delimiter characters that have been identified.
12. The non-transitory computer-readable data storage medium of claim 1, wherein the configuration is one of a plurality of different configurations of the target device respectively represented by a plurality of different text files that each have a plurality of different strings, wherein the plurality of different strings of the different text file representing each different configuration are respectively tokenized into a plurality of different tokens for the different configuration, wherein the different tokens for each different configuration are sequenced, wherein a different target device signature representing each different configuration is generated by applying the hashing technique to the different tokens for the different configuration as have been sequenced, and wherein whether each different configuration of the target device is anomalous is identified based on the target device signature representing the different configuration.
12. The non-transitory computer-readable data storage medium of claim 1, wherein the configuration is one of a plurality of different configurations of the target device respectively represented by a plurality of different text files that each have a plurality of different strings, wherein the plurality of different strings of the different text file representing each different configuration are respectively tokenized into a plurality of different tokens for the different configuration, wherein the different tokens for each different configuration are shingled, wherein a different target device signature representing each different configuration is generated by applying the MinHash technique to the different tokens for the different configuration as have been shingled, and wherein whether each different configuration of the target device is anomalous is identified based on the target device signature representing the different configuration.
Both the current claim 1 and claim 1 of the ‘792 patent disclose a non-transitory computer-readable data storage medium storing program code executable by a processor to perform processing comprising: respectively tokenizing a plurality of strings of a text file representing a configuration of a target device into a plurality of tokens for the configuration; sequencing the tokens for the configuration; determining a target device signature representing the configuration of the target device by applying a hashing technique to the tokens as have been sequenced; and identifying whether the configuration of the target device is anomalous based on the target device signature.
Claim 1 of the ‘792 patent further discloses shingling the tokens and determining the signature by applying a min-wise independent permutations locality sensitive hashing (MinHash) technique to the tokens as have been shingled.
Claim 1 of the current application does not disclose these limitations; therefore, claim 1 is rejected on the ground of nonstatutory anticipation-type double patenting.
Current claims 2-5, 7-8, and 10-12 appear to have identical disclosure to their counterparts in the ‘792 patent. Based on their dependence on independent claim 1, they are rejected on the ground of nonstatutory anticipation-type double patenting by the same reasoning accordingly.
Current claims 6 and 9 are similar to their counterparts in the ‘792 patent. While the current claim 6 discloses performing a different hashing technique, claim 6 of the ‘792 patent discloses performing a locality-sensitive hashing (LSH) technique. Based on this, claims 6 and 9 are rejected on the ground of nonstatutory anticipation-type double patenting.
Claims 13-17 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 13-17 of U.S. Patent No. 12,326,792 (hereafter referred to as “the ‘792 patent”). Although the claims at issue are not identical, they are not patentably distinct from each other because the claims of the ‘792 patent anticipate the current invention.
Claims 13-17, current application
Claims 13-17, ‘792 patent
13. A computing device comprising: a processor; and a memory storing program code executable by the processor to:
13. A computing device comprising: a processor; and a memory storing program code executable by the processor to:
for each of a plurality of devices, respectively tokenize a plurality of strings of a text file representing a configuration of the device into a plurality of tokens for the configuration;
for each of a plurality of devices, respectively tokenize a plurality of strings of a text file representing a configuration of the device into a plurality of tokens for the configuration;
for each of the plurality of devices, sequence the tokens for the configuration of the device;
for each of the plurality of devices, shingle the tokens for the configuration of the device;
for each of the plurality of devices, determine a device signature representing the configuration of the device by applying a hashing technique to the tokens for the device signature of the device as have been sequenced;
for each of the plurality of devices, determine a device signature representing the configuration of the device by applying a min-wise independent permutation locally sensitive hashing (MinHash) technique to the tokens for the device signature of the device as have been shingled;
perform a different hashing technique on the device signatures to assign the device signatures within a plurality of hash buckets;
perform a locality-sensitive hashing (LSH) technique on the device signatures to assign the device signatures within a plurality of hash buckets;
cluster the devices within a plurality of clusters based on assignment of the device signatures within the plurality of hash buckets; and
cluster the devices within a plurality of clusters based on assignment of the device signatures within the plurality of hash buckets; and
for each of the plurality of devices, identify whether the configuration of the device is anomalous based on which of the clusters within which the device has been clustered.
for each of the plurality of devices, identify whether the configuration of the device is anomalous based on which of the clusters within which the device has been clustered.
14. The computing device of claim 13, wherein the program code is executable by the processor to further: reconfigure any device that the configuration of which has been identified as anomalous.
14. The computing device of claim 13, wherein the program code is executable by the processor to further: reconfigure any device that the configuration of which has been identified as anomalous.
15. The computing device of claim 13, wherein the program code is executable by the processor to further: for each of the plurality of hash buckets within which two or more of the device signatures have been assigned, calculate a similarity score for each of one or more unique pairs of the device signatures that have been assigned to the hash bucket, wherein the devices are clustered within the plurality of clusters based on the similarity score that has been calculated for each of the one or more unique pairs of the device signatures that have been assigned to each of the plurality of hash buckets.
15. The computing device of claim 13, wherein the program code is executable by the processor to further: for each of the plurality of hash buckets within which two or more of the device signatures have been assigned, calculate a similarity score for each of one or more unique pairs of the device signatures that have been assigned to the respective hash bucket, wherein the devices are clustered within the plurality of clusters based on the similarity score that has been calculated for each of the one or more unique pairs of the device signatures that have been assigned to each of the plurality of hash buckets.
16. The computing device of claim 13, wherein the program code is executable by the processor to perform the different hashing technique on the device signatures by, for each device signature: banding the device signature into a plurality of device sub-signatures respectively corresponding to a plurality of hash bucket groups, each hash bucket group including the hash buckets; performing the hashing technique on each device sub-signature to calculate a hash value for the device sub-signature; and for each device sub-signature, assign the device signature to one of the hash buckets of the hash bucket group to which the device sub-signature corresponds based on the hash value for the device sub-signature.
16. The computing device of claim 13, wherein the program code is executable by the processor to perform the LSH technique on the device signatures by, for each device signature: banding the device signature into a plurality of device sub-signatures respectively corresponding to a plurality of hash bucket groups, each hash bucket group including the hash buckets; performing an LSH function on each device sub-signature to calculate a hash value for the device sub-signature; and for each device sub-signature, assign the device signature to one of the hash buckets of the hash bucket group to which the device sub-signature corresponds based on the hash value for the device sub-signature.
17. The computing device of claim 16, wherein the program code is executable by the processor to further: for each of a plurality of unique pairs of the device signatures, identify the devices having the device signatures of the unique pair as similar in response to both of the device signatures having been assigned to a same hash bucket in each of more than a threshold number or percentage of hash bucket groups, wherein the devices are clustered over the plurality of clusters based on which of the devices have been identified as similar.
17. The computing device of claim 16, wherein the program code is executable by the processor to further: for each of a plurality of unique pairs of the device signatures, identify the devices having the device signatures of the unique pair as similar in response to both of the device signatures having been assigned to a same hash bucket in each of more than a threshold number or percentage of hash bucket groups, wherein the devices are clustered over the plurality of clusters based on which of the devices have been identified as similar.
Both the current claim 13 and claim 13 of the ‘792 patent disclose a computing device comprising: a processor; and a memory storing program code executable by the processor to: for each of a plurality of devices, respectively tokenize a plurality of strings of a text file representing a configuration of the device into a plurality of tokens for the configuration; for each of the plurality of devices, sequence the tokens for the configuration of the device; for each of the plurality of devices, determine a device signature representing the configuration of the device by applying a hashing technique to the tokens for the device signature of the device as have been sequenced; perform a different hashing technique on the device signatures to assign the device signatures within a plurality of hash buckets; cluster the devices within a plurality of clusters based on assignment of the device signatures within the plurality of hash buckets; and for each of the plurality of devices, identify whether the configuration of the device is anomalous based on which of the clusters within which the device has been clustered.
Claim 13 of the ‘792 patent further discloses shingling the tokens and determining the signature by applying a min-wise independent permutations locality sensitive hashing (MinHash) technique to the tokens as have been shingled, as well as performing a locality-sensitive hashing (LSH) technique.
Claim 13 of the current application does not disclose these limitations; therefore, claim 13 is rejected on the ground of nonstatutory anticipation-type double patenting.
Claims 14-17 of the current application have similar disclosures to those of claims 14-17 of the ‘792 patent; therefore, they are rejected on the ground of nonstatutory anticipation-type double patenting by similar reasoning accordingly.
Claims 18-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 18-20 of U.S. Patent No. 12,326,792 (hereafter referred to as “the ‘792 patent”). Although the claims at issue are not identical, they are not patentably distinct from each other because the claims of the ‘792 patent anticipate the current invention.
Claims 18-20, current application
Claims 18-20, ‘792 patent
18. A method comprising: respectively tokenizing, by a processor, a plurality of strings of a text file representing a configuration of a target device into a plurality of tokens for the configuration;
18. A method comprising: respectively tokenizing, by a processor, a plurality of strings of a text file representing a configuration of a target device into a plurality of tokens for the configuration;
sequencing, by the processor, the tokens for the configuration;
shingling, by the processor, the tokens for the configuration;
generating, by the processor, a target device signature representing the configuration of the target device by applying a hashing technique to the tokens as have been sequenced;
generating, by the processor, a target device signature representing the configuration of the target device by applying a min-wise independent permutations locality sensitive hashing (MinHash) technique to the tokens as have been shingled;
comparing, by the processor, the target device signature representing the configuration of the target device to a reference device signature representing a reference configuration of a reference device to calculate a similarity score indicative of how similar the configuration of the target device is to the reference configuration; and
comparing, by the processor, the target device signature representing the configuration of the target device to a reference device signature representing a reference configuration of a reference device to calculate a similarity score indicative of how similar the configuration of the target device is to the reference configuration; and
identifying, by the processor, whether the configuration of the target device is anomalous based on the similarity score.
identifying, by the processor, whether the configuration of the target device is anomalous based on the similarity score.
19. The method of claim 18, further comprising: in response to identifying that the configuration of the target device is anomalous, reconfiguring, by the processor, the target device.
19. The method of claim 18, further comprising: in response to identifying that the configuration of the target device is anomalous, reconfiguring, by the processor, the target device.
20. The method of claim 18, further comprising: respectively tokenizing, by the processor, a plurality of strings of a text file representing the reference configuration into a plurality of tokens for the reference configuration; sequencing, by the processor, the tokens for the reference configuration; and generating, by the processor, the reference device signature representing the reference configuration by applying the hashing technique to the tokens for the reference device signature.
20. The method of claim 18, further comprising: respectively tokenizing, by the processor, a plurality of strings of a text file representing the reference configuration into a plurality of tokens for the reference configuration; shingling, by the processor, the tokens for the reference configuration; and generating, by the processor, the reference device signature representing the reference configuration by applying the MinHash technique to the tokens for the reference device signature.
Both claim 18 of the current application and claim 18 of the ‘792 patent disclose a method comprising: respectively tokenizing, by a processor, a plurality of strings of a text file representing a configuration of a target device into a plurality of tokens for the configuration; sequencing, by the processor, the tokens for the configuration; generating, by the processor, a target device signature representing the configuration of the target device by applying a hashing technique to the tokens as have been sequenced; comparing, by the processor, the target device signature representing the configuration of the target device to a reference device signature representing a reference configuration of a reference device to calculate a similarity score indicative of how similar the configuration of the target device is to the reference configuration; and identifying, by the processor, whether the configuration of the target device is anomalous based on the similarity score.
Claim 18 of the ‘792 patent further discloses shingling the tokens and determining the signature by applying a min-wise independent permutations locality sensitive hashing (MinHash) technique to the tokens as have been shingled, as well as performing a locality-sensitive hashing (LSH) technique.
Claim 18 of the current application does not disclose these limitations; therefore, claim 18 is rejected on the ground of nonstatutory anticipation-type double patenting.
Claims 19 and 20 of the current application have similar disclosures to those of claims 19 and 20 of the ‘792 patent; therefore, they are rejected on the ground of nonstatutory anticipation-type double patenting by similar reasoning accordingly.
Allowable Subject Matter
Claims 1-20 appear to contain allowable subject matter; however, they cannot be allowed at this time due to double patenting rejections.
The following is a statement of reasons for the indication of allowable subject matter:
Referring to independent claim 1, the prior art of record does not appear to anticipate, explicitly teach, or fairly suggest identifying whether the configuration of the target device is anomalous based on the target device signature.
Further, it would not have been obvious to combine the above limitation with the remaining limitations of the claim.
Verma et al. (US 2018/0052933) discloses wherein a signature generation module implemented at least partially in hardware of a computing device is then employed to generate signature data for the documents from the remaining meaningful word data included in the documents. However, this reference does not appear to anticipate or explicitly teach the subject matter determined to be allowable.
Referring to independent claim 13, the prior art of record does not appear to anticipate, explicitly teach, or fairly suggest a memory storing program code executable by the processor to: for each of the plurality of devices, identify whether the configuration of the device is anomalous based on which of the clusters within which the device has been clustered.
Further, it would not have been obvious to combine the above limitation with the remaining limitations of the claim.
Razin et al. (US 2017/0017537) discloses wherein a host device is configured to identify outlying data elements (e.g., data elements that fall outside of the clusters) as data anomalies which represent anomalous activity associated with the computer infrastructure. However, this reference does not appear to anticipate or explicitly teach the subject matter determined to be allowable.
Referring to independent claim 18, the prior art of record does not appear to anticipate, explicitly teach, or fairly suggest comparing, by the processor, the target device signature representing the configuration of the target device to a reference device signature representing a reference configuration of a reference device to calculate a similarity score indicative of how similar the configuration of the target device is to the reference configuration; and identifying, by the processor, whether the configuration of the target device is anomalous based on the similarity score.
Further, it would not have been obvious to combine the above limitations with the remaining limitations of the claim.
Singh (US 2024/0314566) discloses a processor configured to determine that the first RF signature comprises an anomaly in response to the first RF signature being different from the baseline RF. However, this reference does not appear to anticipate or explicitly teach the subject matter determined to be allowable.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Dema et al. (US 2024/0171609) discloses wherein de-customized text, which is defined by a plurality of characters, is parsed into tokens (a.k.a. shingles).
Panitsas et al. (US 2024/0095073) discloses wherein a cluster adjuster may adjust the configuration of the cluster of computing devices based on anomalous behavior by a particular application.
Razin et al. (US 2017/0017537) discloses wherein a host device is configured to identify outlying data elements (e.g., data elements that fall outside of the clusters) as data anomalies which represent anomalous activity associated with the computer infrastructure.
Singh (US 2024/0314566) discloses a processor configured to determine that the first RF signature comprises an anomaly in response to the first RF signature being different from the baseline RF.
Verma et al. (US 2018/0052933) discloses wherein a signature generation module implemented at least partially in hardware of a computing device is then employed to generate signature data for the documents from the remaining meaningful word data included in the documents.
However, these references do not appear to anticipate or explicitly teach the subject matter determined to be allowable.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOHN B ROCHE whose telephone number is (571)270-1721. The examiner can normally be reached Monday-Friday, 10:30 - 7.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Henry Tsai can be reached at (571)272-4176. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.B.R/Examiner, Art Unit 2184
/HENRY TSAI/Supervisory Patent Examiner, Art Unit 2184
Prosecution Insights