Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This office action is in response to the communication filed on 5/6/2026.
Response to Arguments
Applicant's arguments filed 5/6/2026 have been fully considered but are moot in view of the new grounds of rejection presented below.
All objections and rejections not set forth below have been withdrawn.
Claims 1-3, 5-13, 15-23, and 25-30 have been examined.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 5-13, 15-23, and 25-30 are rejected under 35 U.S.C. 103 as being unpatentable over Apger et al. (US Patent Application Publication Number 2022/0141188) hereinafter referred to as Apger, and further in view of Dirac et al. (US Patent Application Publication Number 2015/0379072) hereinafter referred to as Dirac, and further in view of Saklikar et al. (US Patent Number 8,904,531) hereinafter referred to as Saklikar.
Regarding claims 1, 11, and 21, Apger disclosed a computing system including a processor and memory configured to perform operations (Apger Fig. 2 and Paragraphs 0091-0106 for example) comprising:
receiving a message concerning an event within a computer platform, wherein the message concerns a technology type and includes raw data (Apger Fig. 2 and Paragraphs 0091-0093 for example);
defining a cipher for the technology type, thus defining an associated cipher (Apger Fig. 2 and Paragraphs 0094-0106 for example);
processing the raw data included within the message using the associated cipher to define supplemental data for the technology type (Apger Fig. 2 and Paragraphs 0094-0106 for example); and
forming enriched data for the technology type based, at least in part, upon the raw data and the supplemental data (Apger Fig. 2 and Paragraphs 0094-0106 for example).
While Apger did teach interpreting sequences of the message, classifying the messages by threat level, and correlating the messages with one or more known patterns of network behavior and past incidents, Apger did not explicitly teach integrating the cipher into an AI-driven analytics engine or applying, by the AI-driven analytics engine, learned models to perform the interpreting, classifying, or correlating by the AI-driven analytics engine through applying learned models.
Dirac, in a similar art, taught integrating the cipher (e.g. datasource definitions) into an AI-driven analytics engine and applying, by the AI-driven analytics engine, learned models to perform one or more of: interpreting sequences of the message, classifying the messages by threat level, and correlating the messages with one or more known patterns of network behavior and past incidents (Dirac Fig. 1 and Paragraphs 0002, 0053, 0074, and 0097 for example).
It would have been obvious to the person having ordinary skill in the art before the effective filing date of the invention to have employed the teachings of Dirac in the network security system of Apger by utilizing AI and ML to analyze the raw data and determine threat levels of the data. This would have been obvious because the person having ordinary skill in the art would have been motivated to improve the quality of predictions made by the system.
While Apger and Dirac disclosed effectuating a query on at least a portion of the enriched data, including defining a query to generate a result set, and executing an initial search to generate an initial result set (Apger Paragraph 0104 for example), they did not explicitly teach comparing a size of the initial result set to a target result set size, and when the size of the initial result set is not compatible with the target result set size, revising the initial search to generate a revised result set.
However, Saklikar taught comparing a size of the initial result set to a target result set size, and when the size of the initial result set is not compatible with the target result set size, revising the initial search to generate a revised result set (Saklikar Fig. 3 and Col. 4 Lines 56-60 and Col. 5 Line 50 – Col. 6 Line 12 for example).
It would have been obvious to the person having ordinary skill in the art to have employed the teachings of Saklikar in the anomaly detection system of Apger and Dirac by incorporating maximum and minimum result limits to the queries and adjusting the query accordingly if the number of results falls outside those limits. This would have been obvious because the person having ordinary skill in the art would have been motivated to ensure that the number of query results are manageable.
Regarding claims 2, 12, and 22, Apger, Dirac, and Saklikar taught that defining a cipher for the technology type includes:
defining a cipher for the technology type based, at least in part, upon a source of the message concerning the event within the computer platform (Apger Fig. 2 and Paragraphs 0094-0106 for example).
Regarding claims 3, 13, and 23, Apger, Dirac, and Saklikar taught that defining a cipher for the technology type includes:
defining a cipher for the technology type based, at least in part, upon an originator of the message concerning the event within the computer platform (Apger Fig. 2 and Paragraphs 0091-0106 for example).
Regarding claims 5, 15, and 25, Apger, Dirac, and Saklikar taught forming additional enriched data for additional technology types based, at least in part, upon additional raw data and additional supplemental data, thus defining a plurality of enriched data sets that span a plurality of technology types (Apger Fig. 2 and Paragraphs 0091-0106 for example).
Regarding claims 6, 16, and 26, Apger, Dirac, and Saklikar taught combining the plurality of enriched data sets to form an enriched data repository that spans a plurality of technology types (Apger Fig. 2 and Paragraphs 0091-0106 for example).
Regarding claims 7, 17, and 27, Apger, Dirac, and Saklikar taught effectuating a query on at least a portion of the enriched data repository that spans the plurality of technology types (Apger Paragraph 0104 for example).
Regarding claims 8, 18, and 28, Apger, Dirac, and Saklikar taught that the cipher includes an analysis tree (Apger Paragraphs 0093-0094 for example).
Regarding claims 9, 19, and 29, Apger, Dirac, and Saklikar taught that processing the raw data included within the message using the associated cipher to define supplemental data for the technology type includes:
processing the raw data included within the message using the analysis tree to define supplemental data for the technology type (Apger Paragraphs 0093-0094 for example).
Regarding claims 10, 20, and 30, Apger, Dirac, and Saklikar taught that forming enriched data for the technology type based, at least in part, upon the raw data and the supplemental data includes:
combining at least a portion of the raw data and at least a portion of the supplemental data to form the enriched data for the technology type (Apger Fig. 2 and Paragraphs 0094-0106 for example).
Conclusion
Claims 1-3, 5-13, 15-23, and 25-30 have been rejected.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MATTHEW T HENNING whose telephone number is (571)272-3790. The examiner can normally be reached Monday-Friday 9AM-3PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, William Korzuch can be reached at (571)272-7589. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MATTHEW T HENNING/ Primary Examiner, Art Unit 2491
Prosecution Insights