DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 05/15/2025 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 5-9, & 11-12 are rejected under 35 U.S.C 103 as being unpatentable over Peng et al. (US 2022/0224706), hereon referred to as Peng, in view of Anderson et al. (US 2021/0357815), and hereon referred to as Anderson.
In regards to claims 1 & 7, Peng discloses a characteristic extraction unit extracting a pre-designated packet and a plurality of fingerprint characteristic values from network traffic incoming into the computing device ( Extract, from the plurality of data packets included in each session, a data feature in at least one of the following dimensions: a protocol version of an SSL applied in a process of transmitting the data packet; a handshake version applied in the process of transmitting the data packet; a packet length of the SSL applied in the process of transmitting the data packet; a cipher suite length of the data packet; a cipher suite of the data packet; a group length of the data packet; group content of the data packet; an extension length of the data packet; and a supported extension quantity of the data packet; Paragraphs 0061-0069); and a determination unit determining whether the network traffic includes a malicious packet by inputting the plurality of fingerprint characteristic values and the meta- characteristic to a pre-trained artificial neural network (a convolutional neural network model is continuously iteratively trained by using bypass data including normal traffic data and abnormal traffic data, so that the model has a capability of automatically determining normal traffic and abnormal traffic. After the model is trained and mature, the model is deployed in a network security protection system of an existing network for protection; Paragraphs 0071; 0090).
However, Peng does not disclose a meta-characteristic generation unit generating a meta-characteristic for the network traffic by using a packet and a plurality of fingerprint characteristic values extracted from the characteristic extraction unit to track a change over time of at least one parameter included in the extracted packet. In an analogous art Anderson discloses a meta-characteristic generation unit generating a meta-characteristic for the network traffic by using a packet and a plurality of fingerprint characteristic values extracted from the characteristic extraction unit to track a change over time of at least one parameter included in the extracted packet (Example data features that were collected included sequence of packet length and packet inter-arrival time (SPLT) information, byte distribution information, unencrypted TLS header information (e.g., offered ciphersuites, TLS extensions, etc.), and the like; Paragraphs 0045; 0064).
At the time before the effective filing date of the invention, it would have been obvious to the one with ordinary skill in the art to combine the teachings disclosed by Peng, with the teachings disclosed by Anderson regarding a meta-characteristic generation unit generating a meta-characteristic for the network traffic by using a packet and a plurality of fingerprint characteristic values extracted from the characteristic extraction unit to track a change over time of at least one parameter included in the extracted packet. The suggestion/motivation of the combination would have been to provide additional security to the training network traffic flow classifiers using a prototype training dataset (Anderson; Paragraph 0002).
In regards to claims 2 & 8, Peng discloses wherein the characteristic extraction unit extracts at least a part of an encryption channel protocol, an encryption channel certificate, a source address, a destination address, port information, and header information extracted from a non-encrypted area of the network traffic or extracted in an encrypted state as the plurality of fingerprint characteristic values (the following basic data features of each packet are extracted from captured packet files: an SSL protocol version, a handshake version, an SSL packet length, a cipher suite length, a cipher suite, a group length, group content, an extension length, and a supported extension quantity; Paragraphs 0060-0070).
In regards to claims 3 & 9, Peng and Anderson disclose wherein the meta-characteristic generation unit groups a plurality of packets executing one session among pre-stored session lists as one group, and generates a change of a parameter associated with a packet accumulated in each group over time as the meta-characteristic (each session includes a plurality of data packets. The session is a set of data packets with the same source IP, destination IP, source port, destination port, and protocol; Example data features that were collected included sequence of packet length and packet inter-arrival time (SPLT) information, byte distribution information, unencrypted TLS header information (e.g., offered ciphersuites, TLS extensions, etc.), and the like; Paragraphs 0060-0065).
In regards claims 5 & 11, Anderson disclose wherein the meta-characteristic generation unit uses, as a parameter associated with the packet, at least one of a total network arrival time of a packet, a network latency, a transmission/reception pattern of network traffic including a packet, BPS (Bit per second), PPS (Packet per second), a connection time between packets, the number of sessions per unit time, the number of users per unit time, and an estimated destination hit of a packet ( Example data features that were collected included sequence of packet length and packet inter-arrival time (SPLT) information, byte distribution information, unencrypted TLS header information (e.g., offered ciphersuites, TLS extensions, etc.), and the like.; Paragraphs 0045; 0060-0065).
In regards claims 6 &12, Peng disclose wherein the determination unit, when it is determined that a first network traffic includes a malicious packet, asynchronously updates a packet or a plurality of fingerprint characteristic values associated with the first network traffic to a packet classification filter for a malicious packet, and when a packet and a plurality of fingerprint characteristic values for a second network traffic are delivered from the characteristic extraction unit, determines whether to block the second network traffic through the packet classification filter (filtering out the attack access traffic in the access traffic that needs to be verified, and transmitting filtered normal access traffic to the router for forwarding by the router; and transmitting the source address to the router, so that the router identifies new access traffic from the source address as new attack access traffic, and screens the new attack access traffic; Paragraphs 0075-0070).
Claims 4 & 10 are rejected under 35 U.S.C 103 as being unpatentable over the combination of Peng and Anderson, in view Neupane et al. (US 2023/0231857), hereon referred to as Neupane.
In regards to claims 4 & 10, the combination of Peng and Anderson does wherein the meta-characteristic generation unit, when a packet and a plurality of fingerprint characteristic values for a new network traffic are delivered from the characteristic extraction unit, allocates the packet to at [east one of pre-designated groups according to whether there is a same packet or a same session for a packet included in the new network traffic from a pre-designated memory area. In an analogous art Neupane discloses wherein the meta-characteristic generation unit, when a packet and a plurality of fingerprint characteristic values for a new network traffic are delivered from the characteristic extraction unit, allocates the packet to at least one of pre-designated groups according to whether there is a same packet or a same session for a packet included in the new network traffic from a pre-designated memory area (Whenever flow module 238 identifies packets as being part of a new session, it creates a new session flow. Subsequent packets will be identified as belonging to the session based on a flow lookup. If applicable, SSL decryption is applied by SSL decryption engine 240. Otherwise, processing by SSL decryption engine; Paragraphs 00040-0050).
At the time before the effective filing date of the invention, it would have been obvious to the one with ordinary skill in the art to combine the teachings disclosed by the combination of Peng and Anderson, with the teachings of Neupane regarding wherein the meta-characteristic generation unit, when a packet and a plurality of fingerprint characteristic values for a new network traffic are delivered from the characteristic extraction unit, allocates the packet to at least one of pre-designated groups according to whether there is a same packet or a same session for a packet included in the new network traffic from a pre-designated memory area. The suggestion/motivation of the combination would have been to provide additional security to the training network traffic flow classifiers using a prototype training dataset (Anderson; Paragraph 0002).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHARIF E ULLAH whose telephone number is (571)272-5453. The examiner can normally be reached Mon-Fri 7:00-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached at 571-272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHARIF E ULLAH/Primary Examiner, Art Unit 2495
Prosecution Insights