DETAILED ACTION
This communication responsive to the Application No. 19/247,544 filed on 06/24/2025. Claims 1-10 pending and are directed towards NETWORK-PACKET FILTERING SYSTEM AND METHOD
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1 and 6 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter.
Independent claim
Step 1:
Claims 1 and 6 are drawn to a method, therefore falls under one of four categories of statutory subject matter (process/method, machines/products/apparatus, manufactures, and compositions of matter).
Step 2A, Prong 1:
Nonetheless, claims 1 and 6 are directed to a judicially recognized exception of an abstract idea without significantly more. Claim 1 and 6 recites a method of “obtain a host-performance vector based on system-performance information” and “determine, … whether to allow the packet to pass or to discard the packet.” enumerates a mental concept. A human can obtain and classify information based on certain criteria. As such, the steps obtaining and determining if information shall be allowed or discarded is nothing more than an abstract mental concept (MPEP 2106.04(a)(2)(III)).
Step 2A, Prong 2:
Claims 1 and 6 recites additional step of “configured to execute a second neural network model” that fails to integrate the abstract idea into a practical application. This additional step, to configure a model to make a determination, is a form of insignificant extra solution activity where a determination of system for allowing or rejecting information is necessary for all uses of the judicial exception. The additional step fails to integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea (MPEP 2106.05(g)) (MPEP 2106.05(g)).
Step 2B:
The additional step that is a form of insignificant extra-solution activity, does not amount to significantly more than an abstract idea because the courts have recognized that this additional step to be well-understood, routine, and conventional when claimed in a merely generic manner for receiving and determining data (See MPEP 2106.05(d)(II)(i)). As such claims 1 and 6 is not patent eligible.
Dependent claims
Dependent claims 2-5 and 7-10 are ineligible for being on at least one independent claim for the same reasons given with respect to claims 1 and 6.
Step 1:
Claims 2-5 and 7-10 are drawn to a method, therefore falls under one of four categories of statutory subject matter (process/method, machines/products/apparatus, manufactures, and compositions of matter).
Step 2A-2B:
Claims 2-5 and 7-10 recites a method of “receives the packet”, “preprocesses the packet” enumerates a mental concept. A human can receive, extract data and determine whether to allow or reject by mental evaluation, observation or judgement. As such, the steps of receiving and determining if data is allowable is nothing more than an abstract mental concept (MPEP 2106.04(a)(2)(III)).
Step 2B:
The additional step that is a form of insignificant extra-solution activity, does not amount to significantly more than an abstract idea because the courts have recognized that this additional step to be well-understood, routine, and conventional when claimed in a merely generic manner for receiving and determining data (See MPEP 2106.05(d)(II)(i)). As such claims 2-5 and 7-10 are not patent eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-10 are rejected under 35 U.S.C. 103 as being unpatentable over Jenkinson et al. (US-20190260785-A1), hereinafter referred to as Jenkinson, in view of Vasu et al. (US-20220014554-A1) hereinafter referred to as Vasu.
As per claim 1, Jenkinson discloses A network-packet filtering system, comprising:
one or more end hosts, (The cyber security appliance 200 receives collected pattern of life data from two or more endpoint agents 100. Each of the two or more endpoint agents 100 is on their own end-point computing-device in the network, Jenkinson, Fig 1., para [0086]. Here, the -endpoints are interpreted to the end hosts) wherein each of the one or more end hosts executes a first neural network model to obtain a host-performance vector based on system-performance information of each of the one or more end hosts; and (Probe type 1 monitors the OS for system state installed applications, software versions, pending security updates, probe type 3 records usage events such as power management and file modification, a portion of the cyber threat module resides in the agent itself and can identify conditions and trigger while offline, Jenkinson, para [0088]. Here the system performance is analogous to the OS/usage metrics and the host-performance vector is the periodic per device pattern of life metric bundle and the first NN model aligns with the agent resident model).
However, Jenkinson does not explicitly disclose:
a network-packet filtering device, communicable to the one or more end hosts and an external network, and configured to execute a second neural network model to determine, based on a packet from the external network and the host-performance vectors from the one or more end hosts, whether to allow the packet to pass or to discard the packet.
Vasu discloses:
a network-packet filtering device, communicable to the one or more end hosts and an external network, and configured to execute a second neural network model to determine, (Internal network 104 is segmented (e.g., accessible only through controlled and monitored points) from external network 102 through server computer 120, which controls traffic flow between external network hosts and internal network hosts, program 150 acts as an inline or transparent proxy through which all traffic routes, Vasu, para [0017]. Here, the filtering device is analogous to server 120 running program 150 inline) based on a packet from the external network and the host-performance vectors from the one or more end hosts, whether to allow the packet to pass or to discard the packet (A trained with rectified linear units classifies the network input images and outputs probabilities of maliciousness, authorized input 520 passes through uninterrupted while malicious input 522 is quarantined, inbound and outbound packets from a device are monitored as textual logs and system events using a host intrusion detection system, Vasu, para [0037]. Here, the second NN model is analogous to the classification model 154 (CNN + ReLU), and allowing is the passthrough 520 and discarding is quarantine 522 and the host vectors are the HIDS logs or system events)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Jenkinson and Vasu by endpoint agent and system (Jenkinson) and deep learning network intrusion detection (Vasu). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Jenkinson and Vasu in order to let the filtering decision account for real time host condition by improving detection accuracy and reducing false positives.
As per claim 2, Jenkinson and Vasu disclose the network-packet filtering system as claimed in claim 1, wherein the network-packet filtering device further:
Furthermore, Vasu discloses:
receives the packet and the host-performance vectors; (Program 150 initiates on an incoming input from external to internal network and on interception, suspends, flags, quarantines, diverts, stores or logs it, Vasu, step 202, para [0027]. Here, the intercepted network input is equivalent to a packet)
preprocesses the packet and the host-performance vectors, to generate a second internal vector; and (Extracted network input information such as Ip fields, protocol, ports, TCP flags, ICMP types, TTL, payload, plus alarms and false positive from an IDPS console is turned by a deep recurrent neural network into textual embeddings containing vectorized attributes of that information, Vasu, para [0034]. Here, preprocessing means extraction and embedding and the second internal vector is the RNN embedding).
inputs the second internal vector into the second neural network model, to determine whether to allow the packet to pass or to discard the packet (Images are synthesized from a random noise vector sampled from a normal distribution of textually embedded inputs via a trained GAN and are then classified by the trained CNN, Vasu, para [0031]. Here, the embedding feeds the classifier that drives the disposition).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Jenkinson and Vasu by endpoint agent and system (Jenkinson) and deep learning network intrusion detection (Vasu). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Jenkinson and Vasu in order to let the filtering decision account for real time host condition by improving detection accuracy and reducing false positives.
As per claim 3, Jenkinson and Vasu disclose the network-packet filtering system as claimed in claim 2, wherein the operation of the network-packet filtering device preprocessing the packet and the host- performance vectors comprises:
Furthermore, Jenkinson discloses:
merging the host-performance vectors; (FIG. 3 illustrates a block diagram of an embodiment of a cyber security appliance with various modules that reference machine learning models that are trained on the normal pattern of life of entities to detect a cyber threat. The cyber security appliance 200 cooperating with multiple instances of the endpoint agent 100 may protect against cyber security threats from maliciously harming networks as well as from maliciously harming all of the end-point computing-devices connecting to that network where the cyber security appliance 200 is installed, Jenkinson, para [0066]. Here, a coordinator module integrates network activities and activities inside each endpoint device simultaneously, models trained on the network, each monitored device and their interactions form a distributed pattern of life and merging is equivalent to the integration into the distributed pattern of life)
using a sliding window to concatenate the merged host-performance vectors within a specified time period; and (Data are bucketed into individual time slices of 1, 10 or 60 seconds and combined later to give longer range values for any multiple of the chosen interval, e.g., 120, 180 or 600 seconds, with no loss of accuracy, Jenkinson, para [0155]. Here, the sliding window is the time slice and the concatenation over period means combining consecutive slices into a multiple interval value)
merging the packet and the concatenated-and-merged host-performance vectors, so as to generate the second internal vector (The inline data may be gathered on the deployment from a data store when the traffic is observed and passed to the modules, the comparator compares data received on the network and on the endpoint agents against normal pattern of life for the entities and the wider network, Jenkinson, para [0068]. Here, the merged network and the endpoint data is the combined analysis input)
As per claim 4, Jenkinson and Vasu disclose the network-packet filtering system as claimed in claim 1, wherein
Furthermore, Vasu discloses:
the second neural network model is a recurrent neural network (RNN) (Model 152 ad 154 utilize transferrable neural network algorithms including long short-term memory (LSTM), deep stacking network, deep belief network and convolutional neural networks, Vasu, para [0021]. Here, LTSM within the classification model is the RNN)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Jenkinson and Vasu by endpoint agent and system (Jenkinson) and deep learning network intrusion detection (Vasu). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Jenkinson and Vasu in order to let the filtering decision account for real time host condition by improving detection accuracy and reducing false positives.
As per claim 5, Jenkinson and Vasu disclose the network-packet filtering system as claimed in claim 1, wherein
Furthermore, Jenkinson discloses:
the network-packet filtering device further executes the second neural network model to generate and send, based on the packet and the host-performance vectors, a performance-feedback instruction to the one or more end hosts, to control operation modes of the one or more end hosts (The agent pulls any actions to be taken from the appliance by prompting the user, quarantining a suspicious process from network and filesystem access, shutting down offending processes and the interface can program killing individual processes, revoking specific privileges or allowing only processes seen in peer devices pattern of life for a set period. This limits the threat’s consumption of unauthorized CPU cycles, memory space and power consumption, Jenkinson, para [0040]. Here, the instruction is the pushed action and the operation mode is the restricted processor revoked privilege or peer pattern of life state and performance from the CPU or memory or power)
As per claim 6, Jenkinson discloses a network-packet filtering method, applied to a computer system, wherein the computer system comprises one or more end hosts and a network-packet filtering device which is communicable to the one or more end hosts and communicable to an external network, wherein the network-packet filtering method comprises the following steps:
Furthermore, Jenkinson discloses:
executing a first neural network model by each of the one or more end hosts to obtain a host-performance vector based on system-performance information of each of the one or more end hosts; and (The cyber security appliance 200 receives collected pattern of life data from two or more endpoint agents 100. Each of the two or more endpoint agents 100 is on their own end-point computing-device in the network, Jenkinson, Fig 1., para [0086]. Here, the -endpoints are interpreted to the end hosts. Probe type 1 monitors the OS for system state installed applications, software versions, pending security updates, probe type 3 records usage events such as power management and file modification, a portion of the cyber threat module resides in the agent itself and can identify conditions and trigger while offline, Jenkinson, para [0088]. Here the system performance is analogous to the OS/usage metrics and the host-performance vector is the periodic per device pattern of life metric bundle and the first NN model aligns with the agent resident model)
executing a second neural network model by the network-packet filtering device to determine, (Internal network 104 is segmented (e.g., accessible only through controlled and monitored points) from external network 102 through server computer 120, which controls traffic flow between external network hosts and internal network hosts, program 150 acts as an inline or transparent proxy through which all traffic routes, Vasu, para [0017]. Here, the filtering device is analogous to server 120 running program 150 inline) based on a packet from the external network and the host- performance vectors from the end hosts, whether to allow the packet to pass or to discard the packet (A trained with rectified linear units classifies the network input images and outputs probabilities of maliciousness, authorized input 520 passes through uninterrupted while malicious input 522 is quarantined, inbound and outbound packets from a device are monitored as textual logs and system events using a host intrusion detection system, Vasu, para [0037]. Here, the second NN model is analogous to the classification model 154 (CNN + ReLU), and allowing is the passthrough 520 and discarding is quarantine 522 and the host vectors are the HIDS logs or system events)
As per claim 7, Jenkinson and Vasu disclose the network-packet filtering method as claimed in claim 6, further comprising:
Furthermore, Vasu discloses:
receiving the packet and the host-performance vectors by the network-packet filtering device; (Program 150 initiates on an incoming input from external to internal network and on interception, suspends, flags, quarantines, diverts, stores or logs it, Vasu, step 202, para [0027]. Here, the intercepted network input is equivalent to a packet)
preprocessing the packet and the host-performance vectors by the network- packet filtering device, to generate a second internal vector; and (Extracted network input information such as Ip fields, protocol, ports, TCP flags, ICMP types, TTL, payload, plus alarms and false positive from an IDPS console is turned by a deep recurrent neural network into textual embeddings containing vectorized attributes of that information, Vasu, para [0034]. Here, preprocessing means extraction and embedding and the second internal vector is the RNN embedding).
inputting the second internal vector into the second neural network model by the network-packet filtering device, to determine whether to allow the packet to pass or to discard the packet (Images are synthesized from a random noise vector sampled from a normal distribution of textually embedded inputs via a trained GAN and are then classified by the trained CNN, Vasu, para [0031]. Here, the embedding feeds the classifier that drives the disposition).
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Jenkinson and Vasu by endpoint agent and system (Jenkinson) and deep learning network intrusion detection (Vasu). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Jenkinson and Vasu in order to let the filtering decision account for real time host condition by improving detection accuracy and reducing false positives.
As per claim 8, Jenkinson and Vasu disclose the network-packet filtering method as claimed in claim 7, wherein the step of preprocessing the packet and the host-performance vectors comprises:
Furthermore, Jenkinson discloses:
merging the host-performance vectors; (FIG. 3 illustrates a block diagram of an embodiment of a cyber security appliance with various modules that reference machine learning models that are trained on the normal pattern of life of entities to detect a cyber threat. The cyber security appliance 200 cooperating with multiple instances of the endpoint agent 100 may protect against cyber security threats from maliciously harming networks as well as from maliciously harming all of the end-point computing-devices connecting to that network where the cyber security appliance 200 is installed, Jenkinson, para [0066]. Here, a coordinator module integrates network activities and activities inside each endpoint device simultaneously, models trained on the network, each monitored device and their interactions form a distributed pattern of life and merging is equivalent to the integration into the distributed pattern of life)
using a sliding window to concatenate the merged host-performance vectors within a specified time period; and (Data are bucketed into individual time slices of 1, 10 or 60 seconds and combined later to give longer range values for any multiple of the chosen interval, e.g., 120, 180 or 600 seconds, with no loss of accuracy, Jenkinson, para [0155]. Here, the sliding window is the time slice and the concatenation over period means combining consecutive slices into a multiple interval value)
merging the packet and the concatenated-and-merged host-performance vectors, to generate the second internal vector (The inline data may be gathered on the deployment from a data store when the traffic is observed and passed to the modules, the comparator compares data received on the network and on the endpoint agents against normal pattern of life for the entities and the wider network, Jenkinson, para [0068]. Here, the merged network and the endpoint data is the combined analysis input)
As per claim 9, Jenkinson and Vasu disclose the network-packet filtering method as claimed in claim 6, wherein
Furthermore, Vasu discloses:
the second neural network model is a recurrent neural network (RNN) (Model 152 ad 154 utilize transferrable neural network algorithms including long short-term memory (LSTM), deep stacking network, deep belief network and convolutional neural networks, Vasu, para [0021]. Here, LTSM within the classification model is the RNN)
A person of ordinary skill in the art before the effective filing date of the claimed invention would have combined Jenkinson and Vasu by endpoint agent and system (Jenkinson) and deep learning network intrusion detection (Vasu). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to combine Jenkinson and Vasu in order to let the filtering decision account for real time host condition by improving detection accuracy and reducing false positives.
As per claim 10, Jenkinson and Vasu disclose the network-packet filtering method as claimed in claim 6, further comprising:
Furthermore, Jenkinson discloses:
executing the second neural network model by the network-packet filtering device to generate and send, based on the packet and the host performance vectors, a performance-feedback instruction to each of the end hosts, so as to control operation modes of the end hosts ( The agent pulls any actions to be taken from the appliance by prompting the user, quarantining a suspicious process from network and filesystem access, shutting down offending processes and the interface can program killing individual processes, revoking specific privileges or allowing only processes seen in peer devices pattern of life for a set period. This limits the threat’s consumption of unauthorized CPU cycles, memory space and power consumption, Jenkinson, para [0040]. Here, the instruction is the pushed action and the operation mode is the restricted processor revoked privilege or peer pattern of life state and performance from the CPU or memory or power)
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RAGHAVENDER CHOLLETI whose telephone number is (703) 756-1065. The examiner can normally be reached Monday - Thursday 8AM-5PM EST & Friday variable.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, RUPAL DHARIA can be reached on (571) 272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Respectfully Submitted
/RAGHAVENDER NMN CHOLLETI/
Examiner, Art Unit 2492
/RUPAL DHARIA/ Supervisory Patent Examiner, Art Unit 2492
