DETAILED ACTION
This action is responsive to application filed on June 16th, 2025.
Claims 1~20 are examined.
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 06/16/25 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1~20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter.
Step 2A Prong One: Claims 1 and 11 recite:
Claims 1 and 11 recite: “collecting deception data from one or more deception technologies; collecting EASM data from one or more EASM tools, wherein the EASM tools scan an organization's external-facing infrastructure to identify vulnerabilities associated with Common Vulnerabilities and Exposures (CVE) identifiers, and mapping identified CVEs to corresponding Common Weakness Enumeration (CWE) categories; initiating a matching procedure to correlate the deception-based attack data with EASM- based vulnerability findings; and providing an alert based on results of the matching procedure.”
The limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting, “medium”, nothing in the claim elements preclude the steps from practically being performed in the mind. For example, but for the reciting “medium”, language, “mapping…”, “initiating…” and “providing…” in the context of these claims encompasses concepts relating to organizing or analyzing information in a way that can be performed mentally. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claims recite an abstract idea.
Step 2A Prong Two: This judicial exception is not integrated into a practical application because:
1. The claims recite additional elements reciting, “medium”, which are recited at a high-level of generality such that it amounts no more than mere instructions to apply the exception using a generic computer component. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea.
2. The claims do not recite additional elements which taken individually amounts to adding insignificant extra solution activity to the judicial exception. Accordingly, this additional element does not integrate the abstract idea into a practical application because claims 1 and 11 as a whole is silent regarding specific limitations directed to improving a computer system, processor, memory, network, database, or the Internet, nor do Applicants direct any attention to such specific limitations.
Accordingly, claims 1 and 11 are directed to an abstract idea.
Step 2B: Claims 1 and 11 do not include additional elements that are sufficient to amount to significantly more than the judicial exception.
As discussed above with respect to integration of the abstract idea into a practical application, the additional elements of “medium”, amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept.
Collecting EASM data and providing an alert limitations are insignificant extra solution activity which simply appends well-understood, routine and conventional activities previously known to the industry, specified at a high level of generality, to the judicial exception. The courts recognize receiving/transmitting data over a network, electronic recordkeeping, and storing and retrieving information in memory (see MPEP 2106.05(d)(II)).
Thus, taken alone, the additional elements do not amount to significantly more than a judicial exception. Looking at the limitations as an ordered combination adds nothing that is not already present when looking at the elements taken individually. There is no indication that the combination of elements improves the functioning of a computer or improves any other technology. The claims when read as an ordered combination is not significantly more than a judicial exception. For these reasons, claims 1 and 11 are not patent eligible.
Regarding dependent claims 2~10 and 12~20
Claims 2~10 and 12~20 recite elements/limitations that also fall within the “Mental Processes” grouping of abstract ideas and/or elements/limitations that are insignificant extra solution activity which simply appends well-understood, routine and conventional activities previously known to the industry, specified at a high level of generality, to the judicial exception.
Looking at the limitations as an ordered combination adds nothing that is not already present when looking at the elements taken individually. There is no indication that the combination of elements improves the functioning of a computer or improves any other technology. The claims when read as an ordered combination is not significantly more than a judicial exception. For these reasons, claims 2~10 and 12~20 are not patent eligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 3~7, and 11~17 are rejected under 35 U.S.C. 103 as being unpatentable over Geller et al. hereinafter Geller (EP-4024252) in view of Albanese et al. hereinafter Albanese (U.S 2024/0396930).
Regarding Claim 1,
Geller taught a method for integrating deception-based attack intelligence with External Attack Surface Management (EASM) data to identify and mitigate cybersecurity threats, the method comprising steps of:
collecting deception data from one or more deception technologies [¶38, honeypot consists of data that appears to be a legitimate part of the site, but is actually isolated and monitored, and that seems to contain information or a resource of value to attackers. The invention uses data recorded by web-based honeypots that pretend to be web servers. The honeypots are low-interaction web applications, capable of emulating thousands of vulnerabilities to gather data from attacks that target web applications].
initiating a matching procedure to correlate the deception-based attack data with EASM-based vulnerability findings [¶40, locating all the honeypot records that belong to this specific CVE's properties for a given CVE, using anomaly detection methods (to locate trends in the honeypot records and relevant for each CVE)]; and
providing an alert based on results of the matching procedure [¶41, scores all the anomalies that are related to the CVE and alerts on exploited ones].
Geller did not specifically teach collecting EASM data from one or more EASM tools, wherein the EASM tools scan an organization's external-facing infrastructure to identify vulnerabilities associated with Common Vulnerabilities and Exposures (CVE) identifiers and mapping identified CVEs to corresponding Common Weakness Enumeration (CWE) categories.
Albanese taught collecting EASM data from one or more EASM tools [¶37, vulnerability scanning data ingestion device 216 is communicatively coupled to various open-source and commercial vulnerability scanners (e.g., without limitation, Nessus®, OpenWAS) 320 via APIs (Application Programming Interfaces) 217 and structured to obtain vulnerability scanning data 308],
wherein the EASM tools scan an organization's external-facing infrastructure to identify vulnerabilities associated with Common Vulnerabilities and Exposures (CVE) identifiers [¶36, determining security weaknesses of the distributed system 100 and performing prioritized remediation of a target security weakness], and
mapping identified CVEs to corresponding Common Weakness Enumeration (CWE) categories [¶43, each CVE can be mapped to one or more CWE entries and each CWE entry may encompass numerous different vulnerabilities. The purpose of classifying CVEs into CWE is to provide an easy way to identify specific types of weaknesses and also understand the nature of vulnerabilities];
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention was made, to combine, Albanese’s teaching of limitations with the teachings of Geller, because the combination would lead to improvement in cyber security solutions against constant and rapidly evolving cyber-attack landscape [¶8].
Regarding Claim 3,
Geller taught wherein the deception data includes at least one attack vector, attack source, affected decoy systems, and associated attack descriptions [¶33~¶37].
Regarding Claim 4,
Geller taught wherein collecting deception data further includes analyzing the deception data to extract CVE identifiers [¶26, b) extracting the relevant properties from the stored CVE's text; e) locating the CVE's properties in the honeypot data records]. or, if no CVE is present, using an artificial intelligence-based model to identify and classify attack techniques into CWE categories.
Regarding Claim 5,
Geller taught wherein an alert is provided based on a direct CVE match signaling an actively exploited vulnerability requiring immediate attention [¶26, g) scoring each CVE's exploitability by its anomalies status, and alerting CVEs with a high score (higher than a predetermined value), using a rule-based scoring system].
Regarding Claim 6,
Geller-Albanese taught wherein mapping of CVE identifiers to CWE categories uses data from National Vulnerability Database (NVD) [¶37, NVD data ingestion device 214 is communicatively coupled to the NVD and structured to receive NVD data]. The rationale to combine as discussed in claim 1, applies here as well.
Regarding Claim 7,
Geller-Albanese taught the matching procedure includes generating a priority risk score based on correlation results to help security teams prioritize remediation efforts [¶34, risk scoring framework that allows for determining and remediating a target vulnerability of a distributed system based on prioritization of discovered security risks in accordance with specific needs of the distributed system being protected]. The rationale to combine as discussed in claim 1, applies here as well.
Regarding Claims 11~17, the claims are similar in scope to claim(s) 1 and 3~7 and therefore, rejected under the same rationale.
Claims 2 are rejected under 35 U.S.C. 103 as being unpatentable over Geller and Albanese in view of Semel et al. hereinafter Semel (U.S 2022/0103592).
Regarding Claim 2,
Geller-Albanese-Semel taught wherein detecting one or more cybersecurity risk factors comprises: determining one or more Internet Protocol (IP) addresses of one or more employees of the organization, the one or more IP addresses being associated with one or more CPE devices [¶35, an entity includes devices (i.e., laptops, desktops, servers, mobile devices, IoT devices, OT devices, etc.), network devices or infrastructure (e.g., firewall, switch, access point, router, enforcement point, etc.)] and may have an IP address (e.g., a device)]; and scanning the one or more CPE devices to detect one or more cybersecurity risk factors of the one or more CPE devices [¶18, entity at risk may have one or more potential risk factors which are associated with potential risks; ¶61, perform an active scan of a device of network 200 by sending a request to any entity of network 200. The information from passive and active scans of entities of network 200 can be used to determine a risk for each entity of network 200].
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention was made, to combine, Semel’s teaching of limitations with the teachings of Geller, because the combination would allow for determining a risk (e.g., score or value) for an entity based on a plurality of factors thereby allowing prioritization of risks. [¶13].
Claims 8~10 and 18~20 are rejected under 35 U.S.C. 103 as being unpatentable over Geller and Albanese in view of Kannan et al. hereinafter Kannan (U.S 12,107,869).
Regarding Claim 8,
Geller-Albanese-Kannan taught wherein the alert includes detailed information about correlated vulnerabilities, attack techniques, and recommendations for mitigating detected risks (C8:10~22, receive detections, alerts and associated metadata 315 concerning suspicious and/or malicious events from the enterprise level security system 303. Based on this information the assessment, recommendation and mitigation manager 101 can automatically identify specific threats, types of threats, and/or threat groups to which the enterprise type and the specific hardware and software deployed in the enterprise level network 107 are especially vulnerable, as well as specific tactics, techniques, and/or procedures used by the identified threats, types of threats, and/or threat groups).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention was made, to combine, Kannan’s teaching of limitations with the teachings of Geller and Albanese, because the combination would find most effective ways to triage and respond to alerts triggered to mitigate detected threats (C2:28~44).
Regarding Claim 9,
Geller-Albanese-Kannan taught wherein the steps include integrating real-time updates from a deception environment and EASM tools to refine the matching procedure and provide updated alerts in response to ongoing threats (C8:10~22, table 1, analysis may be repeated/updated at regular or specific intervals as desired, to maintain a current threat prioritization against the dynamic threat landscape, as well as to account for any changes made at an enterprise level). The rationale to combine as discussed in claim 8, applies here as well.
Regarding Claim 10,
Geller-Albanese-Kannan taught wherein the alert includes recommendations for applying software patches, updating configurations, or implementing broader security measures to address identified vulnerabilities (C5:12~16, the assessment, recommendation and mitigation manager 101 can produce detailed recommendations 309 to improve the operation of the enterprise level security system 303). The rationale to combine as discussed in claim 8, applies here as well.
Regarding Claims 18~20, the claims are similar in scope to claims 8~10 and therefore, rejected under the same rationale.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HEE SOO KIM whose telephone number is (571)270-3229. The examiner can normally be reached M-F 9AM-5PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Nicholas Taylor can be reached on (571) 272-3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HEE SOO KIM/Primary Examiner, Art Unit 2443
