Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
Claims 1-8 are pending in this office action.
Priority
Foreign priority claimed to CN202510756931.2, filed 06/06/2025.
Claim Interpretation under 35 U.S.C. 112(f)
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
Use of the word “means” (or “step for”) in a claim with functional language creates a rebuttable presumption that the claim element is to be treated in accordance with 35 U.S.C. 112(f) (pre-AIA 35 U.S.C. 112, sixth paragraph). The presumption that 35 U.S.C. 112(f) (pre-AIA 35 U.S.C. 112, sixth paragraph) is invoked is rebutted when the function is recited with sufficient structure, material, or acts within the claim itself to entirely perform the recited function.
As to claims 1-8, claim limitations that claim different modules, submodules and units, viz. “data monitoring module, threat analysis module, risk processing module, log generation module, data obtaining submodule, data identification submodule, first feature extraction submodule, algorithm matching submodule, secondary identification submodule, information generation module, second feature extraction submodule, strategy-method matching submodule, security management submodule, factor obtaining unit, information matching unit, historical strategy-method matching unit, strategy design unit, threat preprocessing unit, abnormal data log submodule, threat analysis log submodule, risk processing log submodule, standardization submodule, abnormal activity analysis submodule, daily management submodule, security management submodule, threat management log generation submodule, feature data set generating unit, data set to be tested generating unit, height determination unit, anomaly analysis unit, threat level determining unit”, have been interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because they use generic placeholders “module”, “submodule” or “unit” coupled with functional language without reciting sufficient structure to achieve the function. Furthermore, for each of the above, the generic placeholder is not preceded by a structural modifier. Since the claim limitations invoke 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claims 1-8 have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof. A review of the specification shows that structures for all the above modules, submodules and units are not specified.
If applicant wishes to provide further explanation or dispute the examiner’s interpretation of the corresponding structure, applicant must identify the corresponding structure with reference to the specification by page and line number, and to the drawing, if any, by reference characters in response to this Office action.
If applicant does not intend to have the claim limitation(s) treated under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112 , sixth paragraph, applicant may amend the claim(s) so that it/they will clearly not invoke 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, or present a sufficient showing that the claim recites/recite sufficient structure, material, or acts for performing the claimed function to preclude application of 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
For more information, see MPEP § 2173 et seq. and Supplementary Examination Guidelines for Determining Compliance With 35 U.S.C. 112 and for Treatment of Related Issues in Patent Applications, 76 FR 7162, 7167 (Feb. 9, 2011).
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112(a):
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-8 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ) first paragraph, as failing to comply with the written description requirement. The claims contain subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor(s), at the time the application was filed, had possession of the claimed invention.
For claims 1-8, the terms “data monitoring module, threat analysis module, risk processing module, log generation module, data obtaining submodule, data identification submodule, first feature extraction submodule, algorithm matching submodule, secondary identification submodule, information generation module, second feature extraction submodule, strategy-method matching submodule, security management submodule, factor obtaining unit, information matching unit, historical strategy-method matching unit, strategy design unit, threat preprocessing unit, abnormal data log submodule, threat analysis log submodule, risk processing log submodule, standardization submodule, abnormal activity analysis submodule, daily management submodule, security management submodule, threat management log generation submodule, feature data set generating unit, data set to be tested generating unit, height determination unit, anomaly analysis unit, threat level determining unit” in the instant claims do not have structural support with regards to what each comprises, in specification. The Examiner is unable to find any section in specification that discusses what these modules/units are (e.g. hardware, software or having any specific structures). The instant claims thus fail to comply with the written description requirement and fail to be supported by the original disclosure. See: MPEP §2163.01.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-8 are rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which applicant regards as the invention.
For claims 1-8, the specification does not disclose the structure for achieving the recited limitations around “data monitoring module, threat analysis module, risk processing module, log generation module, data obtaining submodule, data identification submodule, first feature extraction submodule, algorithm matching submodule, secondary identification submodule, information generation module, second feature extraction submodule, strategy-method matching submodule, security management submodule, factor obtaining unit, information matching unit, historical strategy-method matching unit, strategy design unit, threat preprocessing unit, abnormal data log submodule, threat analysis log submodule, risk processing log submodule, standardization submodule, abnormal activity analysis submodule, daily management submodule, security management submodule, threat management log generation submodule, feature data set generating unit, data set to be tested generating unit, height determination unit, anomaly analysis unit, threat level determining unit”, which have been interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because each limitation uses a generic placeholder “means” (module, submodule or unit) coupled with functional language, or the means-plus-function structure allowed under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, wherein the pertinent limitations of instant claims utilize “means” for performing certain “function”. However under 35 U.S.C. 112(f), the means described in the claims must have adequate structural description in the specification. Through consulting the specification, a sufficient structure for the means to achieve respective function is lacking. Furthermore, the generic placeholder “means” is not preceded by a structural modifier. Therefore, the claims lack corresponding structure in the specification, as there is no description of the structure which performs the claimed invention. As such, the claims are indefinite.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-5 are rejected under 35 U.S.C. 103 as being unpatentable over Adivi et al. (US 2025/0365298 A1, hereinafter Adivi), in view of Olszak et al. (US 2026/0006043 A1, Olszak hereinafter).
For claim 1, Adivi teaches network security operation workbench (Fig. 1A-1C), comprising:
a data monitoring module, configured for performing security monitoring on network events in systems, identifying abnormal data and outputting to obtain abnormal information (Fig. 1A-1C; para 0041, 0046, 0050 – monitoring network traffic data for abnormal patterns in the data);
a threat analysis module, configured for performing secondary identification on the abnormal information by using preset identification algorithms, obtaining threat types and levels corresponding to abnormal events in the abnormal information, and generating threat identification information (para 0040-0041, 0043, 0045-0047, 0072, 0073 – anomaly or abnormality detection followed by further analysis, and analyzing anomaly to identify using algorithms such as graph or statistical analysis, determine its type, vulnerability levels);
a risk processing module, configured for analyzing the threat identification information, matching to obtain corresponding coping strategies and methods, and performing security management operations on the abnormal events based on the coping strategies and methods (para 0038, 0042, 0046-0047 – analysis of anomaly and matching for selection of resolution steps or strategies of remediation, and performing remediation for anomaly resolution).
Adivi does not explicitly teach, whereas Olszak teaches a log generation module, configured for recording an identification and analysis process and a security management operation process of each of abnormal events in the systems and generating a threat management log (Fig. 1-2; para 0004, 0043, 0062 - threats, events and actions associated with management are logged). Based on Adivi in view of Olszak, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention, to utilize teachings of Olszak in the system of Adivi, in order to incorporate widely known feature of logging of events and actions in the system, for further remediation, analysis and improvement of the threat management security system.
For claim 2, Adivi in view of Olszak teaches the claimed subject matter as discussed above. Adivi further teaches wherein the data monitoring module comprises: a data obtaining submodule, configured for obtaining data of all the network events in the systems and preprocessing the data to obtain initial data (para 0041, 0046, 0050 – monitoring network traffic data for abnormal patterns in the traffic as initial collected data); and a data identification submodule, configured for identifying and analyzing abnormal data in the initial data and outputting to obtain the abnormal information (para 0040-0041, 0043, 0045-0047, 0072, 0073 – anomaly or abnormality detection followed by further analysis of the initially collected traffic data for vulnerability analysis, and analyzing anomaly to identify types and other details).
Adivi does not explicitly teach, whereas Olszak teaches wherein the data monitoring module comprises: a data obtaining submodule, configured for obtaining log data of all the network events in the systems and preprocessing the log data (Fig. 1-2; para 0004, 0040-0043, 0062 - threats, events and actions associated with management are logged and processed). Based on Adivi in view of Olszak, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention, to utilize teachings of Olszak in the system of Adivi, in order to incorporate widely known feature of logging of events and actions in the system, to further process for remediation, analysis and improvement of the threat management security system.
For claim 3, Adivi in view of Olszak teaches the claimed subject matter as discussed above. Adivi further teaches wherein the threat analysis module comprises: a first feature extraction submodule, configured for performing feature extraction on the abnormal information to obtain abnormal data features (para 0044-0046, 0072-0073); and an algorithm matching submodule, configured for selecting and obtaining corresponding preset identification algorithms in an algorithm database based on the abnormal data features (para 0040-0041, 0043, 0045-0047, 0072, 0073, 0075 – anomaly or abnormality detection followed by further analysis, and analyzing anomaly to identify using preset algorithms such as graph or statistical analysis, determine its type, vulnerability levels).
For claim 4, Adivi in view of Olszak teaches the claimed subject matter as discussed above according to claim 3. Adivi further teaches wherein the threat analysis module further comprises: a secondary identification submodule, configured for performing secondary identification on abnormal information by using the preset identification algorithms to obtain threat type information and corresponding level information of each of the abnormal events (para 0040-0041, 0043, 0045-0047, 0072, 0073 – anomaly or abnormality detection followed by further secondary analysis, and analyzing anomaly to identify using algorithms such as preset graph or statistical analysis, determine its type, vulnerability levels);
an information generation module, configured for counting the threat type information and corresponding level information of all the abnormal events to generate threat identification information (para 0040-0041, 0043, 0045-0047, 0072, 0073 – anomaly or abnormality detection followed by further analysis, and analyzing anomaly to identify using algorithms such as graph or statistical analysis, determine its type, vulnerability levels and threat or vulnerability event counts).
For claim 5, Adivi in view of Olszak teaches the claimed subject matter as discussed above. Adivi further teaches wherein the risk processing module comprises: a second feature extraction submodule, configured for performing feature extraction on features from the threat identification information to obtain threat data features (para 0044-0046, 0072-0073); a strategy-method matching submodule, configured for matching in a preset strategy and method database based on the threat data features to obtain corresponding threat processing strategies and threat processing methods; a security management submodule, configured for performing security management operations on corresponding abnormal events in the systems based on the threat processing strategies and the threat processing methods (para 0038, 0042, 0046-0047, 0073 – analysis of anomaly and matching for selection of resolution steps or strategies of remediation from prestored locations such as databases, and performing remediation for anomaly resolution).
Allowable Subject Matter
Claims 6-8 are objected to as being dependent upon a rejected base claim but would be allowable if incorporated in base claim 1 including all the limitations of base claim 1 and any intervening claims, in addition to overcoming the above-mentioned 112 rejections associated with them and rejections associated their parent claims.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. (1) Schiappa - US 20260180999 A1 (AI threat detection and mitigation); (2) Haletky - US 20260067318 A1 (container-based forensics and incident response); (3) Herz - US 9438614 B2 (distributed multi-agent system for real-time collection and monitoring of events, analysis and mitigation of abnormal activities) - are cited to show methods, computer program products and systems pertinent to abnormal network event detection, analysis and remediation.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAYESH JHAVERI whose telephone number is (571)270-7584. The examiner can normally be reached on Mon-Fri 9 AM to 5 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached on (571)272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JAYESH M JHAVERI/Primary Examiner, Art Unit 2433
