Detailed Action
The office action is in response to the communication dated on 06/06/2025.
In the communication dated on 06/06/2025, claims 1-9 have been submitted for examination.
Claims 1-9 have been examined.
Claims 1-9 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Oath/Declaration
The submitted oath/declaration, filed on 06/06/2025, for the instant application has been reviewed by the examiner and is found to conform to the requirements prescribed in 37 C.F.R. 1.63.
Priority
The present application is a Continuation of PCT/JP2023/036967, filed on 10/12/2023, and claims priority to provisional application 63432212, filed on 12/13/2022.
The present application also claims foreign priority to JP 2023-069534, filed on 04/20/2023.
Information Disclosure Statement
The information disclosure statements (IDS) submitted on 09/08/2025 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statements are being considered by the examiner.
Drawings
The drawings, filed on 06/06/2025, for the instant application are acceptable for examination purposes.
Specification
The specification, filed on 06/06/2025, for the instant application are acceptable for examination purposes.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 8 is rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. Specifically, claim 8 does not fall within at least one of the four categories of patent eligible subject matter because the claimed attack path prediction device comprises elements, such as “a first obtainer”, “a second obtainer”, and “a predictor”, which may be implemented as software program according pg. 34, lines 19-20 in the specification of the instant application that describes “… in the foregoing embodiment, each of the elements may be configured in the form of an exclusive hardware product, or may be realized by executing a software program suitable for the element. Each of the elements may be realized by means of a program executing unit, such as a CPU and a processor, reading and executing the software program recorded on a recording medium such as an HDD or a semiconductor memory”. Therefore, claim 8 is directed to subject matter that covers only implementation in software, per se, and is not statutory. Appropriate correction is needed.
Claim Rejections - 35 USC § 103
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 2, 7, 8 and 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Okano et al. (WO 2023223515, with corresponding English translation), hereinafter Okano, in view of Tanaka et al. (US Pub. 20210306361), hereinafter Tanaka.
Regarding Claims 1, 8 and 9:
As per claim 1, Okano discloses an attack path prediction method of predicting an attack path of a cyberattacker (Okano, Parag. [0020]: “The attack path estimation device 10 according to this embodiment has the hardware configuration shown in Figure 1, which enables the creation of predicted path information and the attack path estimation process …”), the attack path prediction method comprising:
obtaining incident information related to a cyberattack on a monitoring target vehicle from a monitor who is monitoring the monitoring target vehicle (Okano, Parag. [0004]: “Incidentally, when a cyberattack is detected, an analysis of the attack is conducted. One of the important purposes of cyberattack analysis is to identify the attacking device and the malware processes and programs within that device, and to clarify the attack path”. Parag. [0014]: “In the following embodiment, we will mainly describe an attack path estimation device 10 that targets a vehicle control system and can estimate the attack path even when there are gaps (data loss) in the log when some kind of attack is detected. An attack path is the route taken from the source of the attack (such as a malicious process or ECU) to the target of the attack”. Parag. [0027]: “… Attack detection logs are logs collected when an attack is detected by a vehicle control system's IDS (Intrusion Detection System) or similar device. Attack detection logs may be collected by the vehicle control system (IDS, etc.) when an attack is detected …”. Parag. [0057]: “… uses weighted predicted route information to estimate the attack path by tracing back from the CANBUS network where the CAN-IDS attack communication detection alert was generated);
obtaining one or more items of threat information [related to a past cyberattack on a vehicle], based on the incident information obtained (Okano, Parag. [0004]: “Incidentally, when a cyberattack is detected, an analysis of the attack is conducted. One of the important purposes of cyberattack analysis is to identify the attacking device and the malware processes and programs within that device, and to clarify the attack path”. Parag. [0038]: “The weighted predicted path information creation unit 121 of the attack path estimation unit 120 acquires attack detection logs and uses those attack detection logs to create observation information about the attack”. Parag. [0029]: “Observational information refers to information represented in a graph structure where processes and ECUs (including malicious processes and malicious ECUs) that appear in attack detection logs …”); and
predicting the attack path of the cyberattack on the monitoring target vehicle, based on the one or more items of threat information obtained (Okano, Parag. [0004]: “Incidentally, when a cyberattack is detected, an analysis of the attack is conducted. One of the important purposes of cyberattack analysis is to identify the attacking device and the malware processes and programs within that device, and to clarify the attack path”. Parag. [0011]: “… when an attack against the target system is detected; and a path search unit configured to estimate an attack path representing a path from the source of the attack to the target by performing a path search on the weighted predicted path information”. Parag. [0033]: “the attack path estimation unit 120 uses predicted path information corresponding to the type and category of the vehicle in which the attack was detected.”).
Okano does not expressly disclose the following limitations:
… threat information related to a past cyberattack on a vehicle;
wherein the obtaining of the one or more items of threat information includes: creating a first search query for obtaining the one or more items of threat information, based on the incident information;
creating a second search query, further based on the incident information, when a total number of the one or more items of threat information obtained is less than a predetermined number, the second search query being a search query for which a search condition is more relaxed than for the first search query; and
obtaining the one or more items of threat information, using the second search query created.
However, Tanaka discloses:
… threat information related to a past cyberattack on a vehicle (Tanaka, Parag. [0057]: “As an example, the analysis unit 12 analyzes the degree of maliciousness of a connection destination presented by information on the external connection destination in the external communication log. The degree of maliciousness may be analyzed with reference to a blacklist held in the monitoring server 10; may be analyzed by focusing on transitions of HTTP transmission to detect a connection to a malicious web site caused by a malicious redirection, by using techniques of machine learning; or may be analyzed by using any other known techniques. Also, in the case where the degree of maliciousness of the connection destination is high, the analysis unit 12 may determine the presence or absence of a cyber-attack based on whether or not the system log, application log, or the like of the information subsystem 220 as the connection source matches a predetermined pattern”. Parag. [0058]: “If it is determined that there is a likelihood of a cyber-attack (i.e., if the event that has occurred in the target vehicle 20 is classified as a cyber-attack).”);
wherein the obtaining of the one or more items of threat information includes: creating a first search query for obtaining the one or more items of threat information, based on the incident information (Tanaka, Parag. [0057]: “Whether or not there is a likelihood of a cyber-attack may be determined, for example, with reference to the external communication log among the group of logs. As an example, the analysis unit 12 analyzes the degree of maliciousness of a connection destination presented by information on the external connection destination in the external communication log. The degree of maliciousness may be analyzed with reference to a blacklist held in the monitoring server 10; may be analyzed by focusing on transitions of HTTP transmission to detect a connection to a malicious web site caused by a malicious redirection, …”. Parag. [0058]: “If it is determined that there is a likelihood of a cyber-attack (i.e., if the event that has occurred in the target vehicle 20 is classified as a cyber-attack) (YES at Step S111), the analysis unit 12 stores a determination result of the cyber-attack (hereafter, referred to as the “attack determination result”) in the attack determination DB 123 at Step S112. The attack determination result includes the vehicle ID of the target vehicle 20, a timestamp indicating the current time, the group of logs, and the like. Parag. [0059]: “Next, the analysis unit 12 searches for a group of attack determination results …”.);
creating a second search query, further based on the incident information, when a total number of the one or more items of threat information obtained is less than a predetermined number, the second search query being a search query for which a search condition is more relaxed than for the first search query (Tanaka, Fig. 5 and Parag. [0060]: “If the number of attack determination results is less than a threshold value ‘c’ (NO at Step S114), the process returns to Step S101. In this case, the cyber-attack on the target vehicle 20 is treated as an individual event”. Parag. [0061]: “If the number of attack determination results is greater than or equal to the threshold value ‘c’ (YES at S114), the analysis unit 12 compares each corresponding attack determination result with the attack determination result of the target vehicle 20 at Step S115, and among the corresponding attack determination results, determines whether or not the number of attack determination results showing a similar tendency with respect to the attack determination result of the target vehicle 20 is greater than or equal to a threshold value ‘d’ at Step S116. In other words, for the attack determination results of multiple vehicles 20, comparative analysis is performed with reference to the logs of the multiple vehicles 20. For example, various log data items included in each corresponding attack determination result may be compared with the various log data items included in the attack determination result of the target vehicle 20. Whether or not there is a similarity may be determined using a known method of calculating the degree of similarity of multiple parameters. Alternatively, similarity of the attack determination results may be determined based on whether or not an anomaly pattern that does not normally occur (e.g., a search for a file structure in the system, an execution of a shell command resulting in an upgrade of permission, etc.) is observed in both of the system log included in the attack determination result of the target vehicle 20 and the system log included in the attack determination result of a vehicle to be compared”. Parag. [0062]: “If the number of attack determination results is less than the threshold value ‘d’ (NO at Step S116), the process returns to Step S101. In this case, the attack on the target vehicle 20 is treated as an individual event.” Examiner Notes: Fig. 5 shows the second/subsequent search of steps S114 and S116 is a broader search based on whether the result is less/greater than a predetermined threshold); and
obtaining the one or more items of threat information, using the second search query created (Tanaka, Fig,5 and Parag. [0060]: “If the number of attack determination results is less than a threshold value ‘c’ (NO at Step S114), the process returns to Step S101. In this case, the cyber-attack on the target vehicle 20 is treated as an individual event”. Parag. [0062]: “If the number of attack determination results is less than the threshold value ‘d’ (NO at Step S116), the process returns to Step S101. In this case, the attack on the target vehicle 20 is treated as an individual event”. Parag. [0058]: “… The attack determination result includes the vehicle ID of the target vehicle 20, a timestamp indicating the current time, the group of logs, and the like”).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify the teaching of Okano by further incorporating Tanaka to arrive at the claimed invention. One would be motivated to incorporate the teaching of Tanaka’s in order to analyze the detection logs of cyber-attacks in details to effectively recognize detailed contents of the cyber-attacks in terms attacking methods and the like (see Tanaka, parag. [0003]).
As per claim 8, it is device claim that corresponds to the method claim 1. Therefore, claim 8 is rejected with the same rationale and motivation as applied against claim 1 above. In addition, Okano discloses an attack path prediction device that predicts an attack path of a cyberattacker (Okano, Parag. [0052]: “… the attack path estimation unit 120 estates the attack path ….”).
As per claim 9, it is a non-transitory computer-readable recording medium claim that corresponds to the method claim 1. Therefore, claim 9 is rejected with the same rationale and motivation as applied against claim 1 above. In addition, Tanaka discloses a non-transitory computer-readable recording medium having recorded thereon a program for causing a computer (Tanaka, Claim 8, “A non-transitory computer-readable recording medium having computer-readable instructions stored thereon, which when executed, causes a computer …”) to execute the attack path prediction method.
Regarding Claim 2:
As per claim 2, Okano and Tanaka disclose the attack path prediction method according to claim 1. Okano further discloses wherein the obtaining of the one or more items of threat information includes: extracting one or more named entities included in the incident information (Okano, Parag. [0004]: “Incidentally, when a cyberattack is detected, an analysis of the attack is conducted. One of the important purposes of cyberattack analysis is to identify the attacking device and the malware processes and programs within that device, and to clarify the attack path”. Parag. [0038]: “The weighted predicted path information creation unit 121 of the attack path estimation unit 120 acquires attack detection logs and uses those attack detection logs to create observation information about the attack”. Parag. [0029]: “Observational information refers to information represented in a graph structure where processes and ECUs (including malicious processes and malicious ECUs) that appear in attack detection logs …”).
Tanaka further discloses creating the first search query, based on the one or more named entities extracted (Tanaka, Parag. [0035]: “[0035] For example, the communication log is constituted with information on requests and responses that includes a vehicle ID; a timestamp (date and time information); information on a connection source (a subsystem constituting the vehicle 20); information on an external connection destination (an external server such as the car company's official server 30a or the service providing server 30b, a device to be connected by short-distance wireless communication, or a device physically connected through the USB or the like) …”. Parag.[0057]: “… Also, in the case where the degree of maliciousness of the connection destination is high, the analysis unit 12 may determine the presence or absence of a cyber-attack based on whether or not the system log, application log, or the like of the information subsystem 220 as the connection source matches a predetermined pattern”. Parag. [0058]: “… The attack determination result includes the vehicle ID of the target vehicle 20, a timestamp indicating the current time, the group of logs, and the like”. Parag. [0059]: “Next, the analysis unit 12 searches for a group of attack determination results ….”).
Regarding Claim 7:
As per claim 7, Okano and Tanaka disclose the attack path prediction method according to claim 1, comprising:
obtaining, for each of the one or more items of threat information obtained, trend information indicating a degree of trend of the cyberattack (Tanaka, Parag. Tanaka, Parag. [0057]: “The degree of maliciousness may be analyzed with reference to a blacklist held in the monitoring server 10; may be analyzed by focusing on transitions of HTTP transmission to detect a connection to a malicious web site caused by a malicious redirection, by using techniques of machine learning; or may be analyzed by using any other known techniques”. Parag. [0058]: “If it is determined that there is a likelihood of a cyber-attack (i.e., if the event that has occurred in the target vehicle 20 is classified as a cyber-attack) …”. Parag. [0061]: “… among the corresponding attack determination results, determines whether or not the number of attack determination results showing a similar tendency with respect to the attack determination result of the target vehicle 20 ….”), wherein the predicting of the attack path of the cyberattack includes predicting the attack path of the cyberattack on the monitoring target vehicle (Okano, Parag. [0021]: “As shown in Figure 2, the attack path estimation device 10 according to this embodiment has a predicted path configuration unit 110 and an attack path estimation unit 120”. Parag. [0022]: “The predicted path configuration unit 110 uses information obtained in advance to create predicted path information representing the predicted path of the attack.”), further based on the trend information (Tanaka, Parag. [0058]: “If it is determined that there is a likelihood of a cyber-attack (i.e., if the event that has occurred in the target vehicle 20 is classified as a cyber-attack) …”. Parag. [0061]: “… among the corresponding attack determination results, determines whether or not the number of attack determination results showing a similar tendency with respect to the attack determination result of the target vehicle 20 ….”).
Claim(s) 3-6 is/are rejected under 35 U.S.C. 103 as being unpatentable over Okano et al. (WO 2023223515, with corresponding English translation), hereinafter Okano and Tanaka et al. (US Pub. 20210306361), hereinafter Tanaka, and further in view of Chiba (US Patent 12363144).
Regarding Claim 3:
As per claim 3, Okano and Tanaka disclose the attack path prediction method according to claim 2. Tanaka further teaches wherein the incident information includes two or more classification items (Tanaka, Parag. [0043]: “Specifically, based on the log data transmitted from each vehicle 20, the analysis unit 12 determines which one of multiple types of events (in the present embodiment, failure, cyber-attack, erroneous detection of anomaly, or the other) corresponds to the event occurring in the vehicle 20 (classifies the event into one of these types). … A determination result indicating a cyber-attack is stored in the attack determination DB 123”. Parag. [0058]: “… The attack determination result includes the vehicle ID of the target vehicle 20, a timestamp indicating the current time, the group of logs, and the like”.), and
creating the second search query, based on …. the two or more classification items (Tanaka, Fig. 5 and Parag. [0059]: “Next, the analysis unit 12 searches for a group of attack determination results related to the other vehicles 20 of the same model and model year as the target vehicle 20 that are traveling near the current position of the target vehicle 20 (e.g., within a radius of N km) in the attack determination DB 123 at Step S113. The method of identifying the group of attack determination results may be substantially the same as in Step S106”. Parag. [0060]: “If the number of attack determination results is less than a threshold value ‘c’ (NO at Step S114), the process returns to Step S101. In this case, the cyber-attack on the target vehicle 20 is treated as an individual event”. Parag. [0061]: “If the number of attack determination results is greater than or equal to the threshold value ‘c’ (YES at S114), the analysis unit 12 compares each corresponding attack determination result with the attack determination result of the target vehicle 20 at Step S115, and among the corresponding attack determination results, determines whether or not the number of attack determination results showing a similar tendency with respect to the attack determination result of the target vehicle 20 is greater than or equal to a threshold value ‘d’ at Step S116. In other words, for the attack determination results of multiple vehicles 20, comparative analysis is performed with reference to the logs of the multiple vehicles 20. …. Alternatively, similarity of the attack determination results may be determined based on whether or not an anomaly pattern that does not normally occur (e.g., a search for a file structure in the system, an execution of a shell command resulting in an upgrade of permission, etc.) is observed in both of the system log included in the attack determination result of the target vehicle 20 and the system log included in the attack determination result of a vehicle to be compared; or whether or not anomaly patterns of control communication that do not normally occur (e.g., incoming, etc.) are observed in both of the external communication log included in the attack determination result of the target vehicle 20 and the external communication log included in the attack determination result of the vehicle to be compared.”).
The combination of Okano and Tanaka does not expressly teach the remaining limitations of the claim.
However, Chiba teaches wherein the incident information includes two or more classification items and character string information (Chiba, Fig. 11 and Col. 13, line 39 to Col. 14, line 9: “Fig. 11 is a diagram illustrating an example of log data according to one embodiment. In the example of FIG. 11, the log data 31 includes, as items (i.e., two or more classification items), information of a detection date and time, a vehicle identification information, a sensor name, an ECU name, an input interface name, an output interface name, a source MAC address, a destination MAC address, an application identifier, a CAN ID, and a detection event, or the like (i.e., character string information). ….. The sensor name is information indicating a name, a function, or the like of a security sensor that detected the detection event. The ECU name is information indicating a name, identification information, or the like of the ECU that detected the detection event. … The application identifier is information indicating an application identifier included in the data in which the detection event is detected. The CAN ID is information indicating a CAN ID included in the data in which the detection event is detected. The detection event is information indicating a name, identification information, or the like of the detected detection event”. Co. 14, lines 36-52: “In step S1203, the configuration information acquisition part 501 of the estimator 402 acquires the network configuration information corresponding to the vehicle identification number of the attacked vehicle 20, included in the attack detection notification (i.e., character string information), from each of the DBs 411 through 415 included in the network configuration information 410. In step S1204, the related log extractor 502 of the estimator 402 performs a related log extraction process that extracts the log data related to the attack, from the log data 31 acquired by the acquisition part 401. In step S1205, the constituent element identifier 503 of the estimator 402 uses the log data extracted by the related log extractor 502 and the network configuration information acquired by the configuration information acquisition part 501, to perform the constituent element identification process that identifies the constituent elements related to the attack”), and
the obtaining of the one or more items of threat information includes:
extracting the one or more named entities included in the character string information in the incident information (Chiba, Col. 13, lines 4-16: “Preferably, the related log extractor 502 relates the plurality of log data that are extracted, using the network configuration information acquired by the configuration information acquisition part 501. For example, the related log extractor 502 extracts the log data related to the detected attack, by directly or indirectly comparing items, defined in advance as being comparable, from among the plurality of log data that are extracted. The constituent element identifier 503 performs a constituent element identification process that identifies a constituent element (ECU or the like) related to the detected attack, from the log data extracted by the related log extractor 502”. Fig. 11 and Co. 14, lines 36-52: “In step S1203, the configuration information acquisition part 501 of the estimator 402 acquires the network configuration information corresponding to the vehicle identification number of the attacked vehicle 20, included in the attack detection notification, from each of the DBs 411 through 415 included in the network configuration information 410. In step S1204, the related log extractor 502 of the estimator 402 performs a related log extraction process that extracts the log data related to the attack, from the log data 31 acquired by the acquisition part 401. In step S1205, the constituent element identifier 503 of the estimator 402 uses the log data extracted by the related log extractor 502 and the network configuration information acquired by the configuration information acquisition part 501, to perform the constituent element identification process that identifies the constituent elements related to the attack.”);
weighting each of the two or more classification items, based on the one or more named entities (Chiba, Col. 16, Col. 16, lines 13-24: “For example, the related log extractor 502 compares a value of an item (i.e., weight of each of the classification items) predefined as “directly comparable” in the acquired one log data, with a value of an item having the same meaning as the predefined item in each of the other log data, and determines whether or not the compared values match. When the compared values match, the related log extractor 502 extracts the other log data including the matching value. As an example, among the items included in the log data 31 illustrated in FIG. 11, it is assumed that the source MAC address, the destination MAC address, the application identifier, the CAN ID, or the like are predefined as “directly comparable”, for example.”), and
[creating the second search] query, based on a weighting value of two or more classification items (Chiba, Col. 6, lines 8-13: “The constituent elements included in the in-vehicle network 100, such as the gateway 200, the external communication device 260, the ECU 250, or the like, have functions of continuously acquiring log data indicating an operation log thereof or the like, and transmitting the acquired log data to the log server 30 or the like”. Col. 8, lines 46-50: “The estimator 402 performs an estimation process that estimates one or more attack vectors including the information of the constituent elements related to the attack vectors, by relating log data of a predetermined time period, among the log data 31 acquired by the acquisition part 401”. Col. 13. Lines 4-10: “Preferably, the related log extractor 502 relates the plurality of log data that are extracted, using the network configuration information acquired by the configuration information acquisition part 501. For example, the related log extractor 502 extracts the log data related to the detected attack, by directly or indirectly comparing items, defined in advance as being comparable ….“. Col. 16, lines 13-24: “For example, the related log extractor 502 compares a value of an item (i.e., weight of each of the classification items) predefined as “directly comparable” in the acquired one log data, with a value of an item having the same meaning as the predefined item in each of the other log data, and determines whether or not the compared values match. When the compared values match, the related log extractor 502 extracts the other log data including the matching value. As an example, among the items included in the log data 31 illustrated in FIG. 11, it is assumed that the source MAC address, the destination MAC address, the application identifier, the CAN ID, or the like are predefined as “directly comparable”, for example.”).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify the combination of Okano and Tanaka by further incorporating Chiba to arrive at the claimed invention. One would be motivated to incorporate the teaching of Chiba’s comparable values as weight for the various items in the log record with the system of Okano and Tanaka in order to facilitate estimation of constituent elements which participated in or were involved in an attack, when the attack is detected in a system including a network and a plurality of constituent elements which performs communication via the network (see Chiba, Col. 3, lines 26-29).
Regarding Claim 4:
As per claim 4, Okano, Tanaka, and Chiba disclose the attack path prediction method according to claim 3. Chiba further teaches extracting one or more classification items excluding a classification item whose weighting value is smallest, among the two or more classification items (Chiba, Col. 15, lines 36-48: “When the process proceeds to step S1303, the related log extractor 502 extracts the log data within a predetermined time period, from the log data acquired in step S1301. For example, as illustrated in FIG. 14B, the log data 1401, 1402, and 1404 through 1406 acquired in step S1301 include information on the detection date and time. The related log extractor 502 selectively acquires the log data 1401, 1402, 1404, and 1405 within the predetermined time period, …. Accordingly, the related log extractor 502 can exclude old data having a low relation to the detected attack.”); and
Tanaka further teaches wherein the obtaining of the one or more items of threat information includes: creating the second search query, based on the one or more classification items extracted (Tanaka, Fig. 5 and Parag. [0059]: “Next, the analysis unit 12 searches for a group of attack determination results related to the other vehicles 20 of the same model and model year as the target vehicle 20 that are traveling near the current position of the target vehicle 20 (e.g., within a radius of N km) in the attack determination DB 123 at Step S113. The method of identifying the group of attack determination results may be substantially the same as in Step S106”. Parag. [0060]: “If the number of attack determination results is less than a threshold value ‘c’ (NO at Step S114), the process returns to Step S101. In this case, the cyber-attack on the target vehicle 20 is treated as an individual event”. Parag. [0061]: “If the number of attack determination results is greater than or equal to the threshold value ‘c’ (YES at S114), the analysis unit 12 compares each corresponding attack determination result with the attack determination result of the target vehicle 20 at Step S115, and among the corresponding attack determination results, determines whether or not the number of attack determination results showing a similar tendency with respect to the attack determination result of the target vehicle 20 is greater than or equal to a threshold value ‘d’ at Step S116. In other words, for the attack determination results of multiple vehicles 20, comparative analysis is performed with reference to the logs of the multiple vehicles 20. …. Alternatively, similarity of the attack determination results may be determined based on whether or not an anomaly pattern that does not normally occur (e.g., a search for a file structure in the system, an execution of a shell command resulting in an upgrade of permission, etc.) is observed in both of the system log included in the attack determination result of the target vehicle 20 and the system log included in the attack determination result of a vehicle to be compared; or whether or not anomaly patterns of control communication that do not normally occur (e.g., incoming, etc.) are observed in both of the external communication log included in the attack determination result of the target vehicle 20 and the external communication log included in the attack determination result of the vehicle to be compared.”).
Regarding Claim 5:
As per claim 5, Okano, Tanaka, and Chiba disclose the attack path prediction method according to claim 3. Tanaka further discloses wherein the obtaining of the one or more items of threat information includes creating the first search query (Tanaka, Parag. [0057]: “Whether or not there is a likelihood of a cyber-attack may be determined, for example, with reference to the external communication log among the group of logs. As an example, the analysis unit 12 analyzes the degree of maliciousness of a connection destination presented by information on the external connection destination in the external communication log. The degree of maliciousness may be analyzed with reference to a blacklist held in the monitoring server 10; may be analyzed by focusing on transitions of HTTP transmission to detect a connection to a malicious web site caused by a malicious redirection, …”. Parag. [0058]: “If it is determined that there is a likelihood of a cyber-attack (i.e., if the event that has occurred in the target vehicle 20 is classified as a cyber-attack) (YES at Step S111), the analysis unit 12 stores a determination result of the cyber-attack (hereafter, referred to as the “attack determination result”) in the attack determination DB 123 at Step S112. The attack determination result includes the vehicle ID of the target vehicle 20, a timestamp indicating the current time, the group of logs, and the like. Parag. [0059] Next, the analysis unit 12 searches for a group of attack determination results related to the other vehicles 20 of the same model and model year as the target vehicle), and Chiba further discloses based on a weighting value that is preliminarily set, when the character string information includes no named entity (Col. 16, lines 13-24: “For example, the related log extractor 502 compares a value of an item (i.e., weight of each of the classification items) predefined as “directly comparable” in the acquired one log data, with a value of an item having the same meaning as the predefined item in each of the other log data, and determines whether or not the compared values match. When the compared values match, the related log extractor 502 extracts the other log data including the matching value. As an example, among the items included in the log data 31 illustrated in FIG. 11, it is assumed that the source MAC address, the destination MAC address, the application identifier, the CAN ID, or the like are predefined as “directly comparable”, for example”. Examiner Notes: Fig. 11 illustrates that entries with certain items may be initially set with “N/A” when including no entry/named entity.).
Regarding Claim 6:
As per claim 6, Okano, Tanaka, and Chiba disclose the attack path prediction method according to claim 3, wherein the two or more classification items include at least two of:
a vehicle type of the monitoring target vehicle (Tanaka, Parag. [0037]: “Note that the system log and the application log include, for example, information on the vehicle ID vehicle ID”. Parag. [0050]: “… the model and model year of the vehicle ID of the target vehicle 20”);
an attack path of the cyberattack on the monitoring target vehicle at a present point in time (Okano, Parag. [0026]: “during the attack, nodes not present in the graph represented by the vehicle configuration information (malicious processes, malicious communications, malicious files, and other malicious objects) appear, and the path becomes one that passes through such malicious nodes.”);
an interface serving as an entry point of the cyberattack; or a device targeted by the cyberattack ((Okano, Parag. [0045]: “Figure 6 shows an example of an attack on the vehicle control system in this embodiment. The attack example shown in Figure 6 is a Drive-by-Download attack in which malicious commands are executed. First, malicious information exploiting the TCUctrl vulnerability is embedded in the OEM site. If TCUctr accesses the malicious information (URLOEM) on the TCU, the vulnerability allows a malicious process, the mal1 process, to be created and started on the TCU. The mal1 process accesses the attacker's site (URLmal), downloads the attack program to the TCU, and uses that program to create and launch the malicious process, mal2. The mal2 process sends a malicious CAN message CAN6AA' to CANBUS (CAN message insertion attack), causing ECU1 to execute a malicious command) or (Chiba, Col. 15, lines 1-9: “In step S1208, the output part 403 of the SOC server 10 outputs information of the one or more attack vectors estimated by the estimator 402. For example, the output part 403 outputs, to the SIRT server 40 or the like, a report listing one or more attack vectors represented by a directed graph of the progressing attack, wherein the constituent elements related to the detected attack are represented as nodes, and communication paths utilized by the progressing attack are represented as links”. Col. 18,lines 29-41: “Similarly, the constituent element identifier 503 retrieves the network configuration information acquired by the configuration information acquisition part 501, using the ECU name “CGW”, the output interface name “can0”, and the CAN ID “0x28” in the log data 1402, for example, as the keys. Hence, network information 1802 and communication pattern information 1803 illustrated in FIG. 18, for example, are retrieved. In this case, because the network information 1802 and the communication pattern information 1803 have a common item, namely, the CAN bus “CAN-0”, the constituent element identifier 503 relates the two information, and acquires the reception ECU “IVI” as the ECU related to the attack vectors.”)).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Naito et al. (US Patent 11893110) teaches an attack estimation device including a storage unit configured to hold an attack tree, an abstract attack tree, and log check management information, and a prediction unit configured to predict, when a detection alert is received, a range of compromise from the attack by referring to the information in the storage unit. The prediction unit is configured to: determine that an attack of an unknown pattern has occurred as the attack when indicators of compromise that correspond to the attack are not successfully identified; identify an abstract attack name by referring to the abstract attack tree; and predict a range of compromise from the attack of an unknown pattern by identifying a device in which indicators of the attack of an unknown pattern are likely to be left, and by identifying a specific place in the log of the identified device, by referring to the log check management information.
Ueno et al. (US Patent 12401667) teaches a vehicle security monitoring apparatus capable of communicating with an in-vehicle network having a function of transmitting log data related to an operation state of an in-vehicle apparatus, and the vehicle security monitoring apparatus is configured to acquire the log data, and to detect an abnormal state in the in-vehicle network based on the acquired log data. The vehicle security monitoring apparatus is configured to estimate an influence range affected by the detected abnormal state, and to manage information indicating the estimated influence range.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to YIN CHEN SHAW whose telephone number is (571)272-8878. The examiner can normally be reached Monday - Friday, 10:00AM - 6:00PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amy C. Johnson can be reached at (571)272-2238. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/YIN CHEN SHAW/Supervisory Patent Examiner, Art Unit 2498
Prosecution Insights