Vertically Integrated Automatic Threat Level Determination For Containers And Hosts In A Containerization Environment

§103 §112 §DOUBLEPATENT

DETAILED ACTION This action is made in response to the communication filed on August 07, 2025. This action is made non-final. Claims 1-20 are pending. Claims 1, 8 and 15 are independent claims. Notice of Pre-AIA or AIA Status 3. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Priority This application is a continuation of U.S. Patent Application No. 18/515,895, filed on November 21, 2023, now U.S. Patent No. 12,411,939, issued on September 09, 2025, which is a continuation of U.S. Patent Application No. 17/458,966, filed on August 27, 2021, now U.S. Patent No. 11,886,573, issued on January 30, 2024, which is a continuation of U.S. Patent Application No. 16/155,742, filed on October 9, 2018, now U.S. Patent No. 11,106,784, issued on August 31, 2021. The effective filing date of the claimed subject matter is October 9, 2018. Information Disclosure Statement The information disclosure statement (IDS) submitted on October 19, 2025, is in compliance with the provisions of 37 CFR 1.97 and has been fully considered by the examiner. Claim Objections 6. Claims 2, 3, 8-12, 16 and 17 are objected to because of the following informalities: In claims 2, 9 and 16, “a list of identified threats” is inconsistent with “a threat” as recited in claims 1, 8 and 15, respectively. In claims 3, 10 and 17, “connections between instances” lacks antecedent basis for plural “instances.” In claim 8, “instructions that, when executed by the processor, configures the processor” should read “configure the processor”. In claims 9-12, “ the processor is further configured: [verb]” should read “the processor is further configured to: [verb]”. In claims 6, 13 and 20, “determining that the threat level assessment score exceeds a threshold value” should read “the threat level assessment score for the instance” for consistency with the responding limitation. Appropriate correction is required. Claim Rejections - 35 USC § 112 7. The following is a quotation of 35 U.S.C. 112(b): (b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention. The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph: The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention. 8. Claims 4, 5, 11, 12, 18 and 19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Claims 4, 5, 11, 12, 18 and 19 recite that “a software resource of a software source” matches a signature but conditions the score increase on “the software source” matching the signature. It is unclear which element performs the matching. Claims 5, 12 and 19 recite entries indicating “a benchmark setting using a Common Vulnerabilities and Exposure (CVE) identifier.” The specification describes threat-database entries indicating vulnerabilities using CVE identifiers ([0039]) and separately describes benchmark-setting entries having their own identifiers, exemplified by the CIS Benchmarks ([0040]). It does not describe a benchmark setting indicated by a CVE identifier. In light of the specification, it is unclear whether the limitation refers to a benchmark-setting entry, a vulnerability entry, or otherwise. Therefore, the metes and bounds of the claims cannot be ascertained. 9. The following is a quotation of 35 U.S.C. 112(d): (d) REFERENCE IN DEPENDENT FORMS.—Subject to subsection (e), a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers. The following is a quotation of pre-AIA 35 U.S.C. 112, fourth paragraph: Subject to the following paragraph [i.e., the fifth paragraph of pre-AIA 35 U.S.C. 112], a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers. 10. Claims 7 and 14 are rejected under 35 U.S.C. 112(d) or pre-AIA 35 U.S.C. 112, 4th paragraph, as being of improper dependent form for failing to further limit the subject matter of the claim upon which it depends, or for failing to include all the limitations of the claim upon which it depends. Each recites that “the container system is a virtualized system.” Per the specification, a container system is an operating-system-level virtualization environment ([0018]). The limitation is inherent in the container system of claims 1 and 8 and fails to further limit the claims from which it depends. Applicant may cancel the claim(s), amend the claim(s) to place the claim(s) in proper dependent form, rewrite the claim(s) in independent form, or present a sufficient showing that the dependent claim(s) complies with the statutory requirements. Double Patenting 11. The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969). A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b). The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13. The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer. 12. Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 12,411,939 B2, which claim common subject matter, as charted below. Although the claims at issue are not identical, they are not patentably distinct from each other. Every limitation of instant claims 1-3, 8-10 and 15-17 is present in 12,411,939 B2 claims 3, 10 and 17, respectively, each of which incorporates the claims from which it depends. The sole exception, recitation of a “container system” in place of a ”virtualized system,” is the species claimed by 12,411,939 B2 claims 7 and 14, and its selection would been obvious. Instance claims 4-7, 11-14, and 18-20 combine the subject matter of 12,411,939 B2 claims 3, 10 and 17 with that of the correspondingly charted 12,411,939 B2 claims. For example, instant claim 4 combines 12,411,939 B2 claims 3 and 4. The 12,411,939 B2 patent claims these features as separate dependent claims of the same independent claim, presenting them as compatible additions to a single common base claim. Their combination would have been obvious. The claims are therefore not patentably distinct. In the charts, wording common to both claims appears in boldface, and the difference appear in plain type. Instant Application 19/293,018, claim 1 Reference U.S. Patent No. 12,411,939 B2, claims 1, 2, 3 A computer-implemented method, comprising: identifying a threat in one or more of an instance or a host of a container system; generating a threat level assessment score based on the threat; determining that the instance generates requests to access a Wide Area Network (WAN); increasing the threat level assessment score for the instance by a fixed value in response to determining that the instance generates requests to access the WAN; identifying abnormal network behavior of the one or more of the instance or the host; and increasing the threat level assessment score for the one or more of the instance or the host by a fixed value in response to the abnormal network behavior. [Claim 1] A computer-implemented method, comprising: identifying a threat in one or more of an instance or a host of a virtualized system; generating a threat level assessment score based on the threat; generating a report comprising the threat level assessment score and a list of identified threats; and transmitting the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. [Claim 2] The method of claim 1, wherein the generating the threat level assessment score further comprises: determine that the instance generates requests to access a Wide Area Network (WAN); and increasing the threat level assessment score for the instance by a fixed value in response to it being determined that the instance generates requests to access the WAN. [Claim 3] The method of claim 2, wherein the generating the threat level assessment score further comprises: identifying abnormal network behavior of the one or more of the instance or the host; and increasing the threat level assessment score for the one or more of the instance or the host by a fixed value in response to the abnormal network behavior. Instant Application 19/293,018, claim 2 Reference U.S. Patent No. 12,411,939 B2, claim 1 The computer-implemented method of claim 1, wherein the generating the threat level assessment score further comprises: generating a report comprising the threat level assessment score and a list of identified threats. [Claim 1] A computer-implemented method, comprising: identifying a threat in one or more of an instance or a host of a virtualized system; generating a threat level assessment score based on the threat; generating a report comprising the threat level assessment score and a list of identified threats; and transmitting the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. Instant Application 19/293,018, claim 3 Reference U.S. Patent No. 12,411,939 B2, claim 1 The computer-implemented method of claim 2, wherein the generating the threat level assessment score further comprises: transmitting the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. [Claim 1] A computer-implemented method, comprising: identifying a threat in one or more of an instance or a host of a virtualized system; generating a threat level assessment score based on the threat; generating a report comprising the threat level assessment score and a list of identified threats; and transmitting the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. Instant Application 19/293,018, claim 4 Reference U.S. Patent No. 12,411,939 B2, claim 4 The computer-implemented method of claim 1, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the vulnerability; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the CVE identifier of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the entry. [Claim 4] The method of claim 1, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the vulnerability; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the CVE identifier of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the entry. Instant Application 19/293,018, claim 5 Reference U.S. Patent No. 12,411,939 B2, claim 5 The computer-implemented method of claim 1, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a benchmark setting using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the benchmark setting; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the benchmark setting of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the benchmark setting corresponding to the entry. [Claim 5] The method of claim 1, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a benchmark setting using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the benchmark setting; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the benchmark setting of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the benchmark setting corresponding to the entry. Instant Application 19/293,018, claim 6 Reference U.S. Patent No. 12,411,939 B2, claim 6 The computer-implemented method of claim 1, further comprising: determining that the threat level assessment score exceeds a threshold value; and suspending execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. [Claim 6] The method of claim 1, further comprising: determining that the threat level assessment score exceeds a threshold value; and suspending execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. Instant Application 19/293,018, claim 7 Reference U.S. Patent No. 12,411,939 B2, claim 7 The computer-implemented method of claim 1, wherein the container system is a virtualized system. [Claim 7] The method of claim 1, wherein the system is a container system. Instant Application 19/293,018, claim 8 Reference U.S. Patent No. 12,411,939 B2, claims 8, 9, 10 A container system comprising: a processor; and memory storing instructions that, when executed by the processor, configures the processor to: identify a threat in one or more of an instance or a host of the container system; generate a threat level assessment score based on the threat; determine that the instance generates requests to access a Wide Area Network (WAN); increase the threat level assessment score for the instance by a fixed value in response to the determination that the instance generates requests to access the WAN; identify abnormal network behavior of the one or more of the instance or the host; and increase the threat level assessment score for the one or more of the instance or the host by a fixed value in response to the abnormal network behavior. [Claim 8] A system comprising: a processor; and memory storing instructions that, when executed by the processor, configures the processor to: identify a threat in one or more of an instance or a host of the virtualized system; generate a threat level assessment score based on the threat; generate a report comprising the threat level assessment score and a list of identified threats; and transmit the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. [Claim 9] The system of claim 8, wherein when the processor generates the threat level assessment score, the processor is further configured: determine that the instance generates requests to access a Wide Area Network (WAN); and increase the threat level assessment score for the instance by a fixed value in response to it being determined that the instance generates requests to access the WAN. [Claim 10] The system of claim 9, wherein when the processor generates the threat level assessment score, the processor is further configured: identify abnormal network behavior of the one or more of the instance or the host; and increase the threat level assessment score for the one or more of the instance or the host by a fixed value in response to the abnormal network behavior. Instant Application 19/293,018, claim 9 Reference U.S. Patent No. 12,411,939 B2, claim 8 The container system of claim 8, wherein when the processor generates the threat level assessment score, the processor is further configured: generate a report comprising the threat level assessment score and a list of identified threats. [Claim 8] A system comprising: a processor; and memory storing instructions that, when executed by the processor, configures the processor to: identify a threat in one or more of an instance or a host of the virtualized system; generate a threat level assessment score based on the threat; generate a report comprising the threat level assessment score and a list of identified threats; and transmit the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. Instant Application 19/293,018, claim 10 Reference U.S. Patent No. 12,411,939 B2, claim 8 The container system of claim 9, wherein when the processor generates the threat level assessment score, the processor is further configured: transmit the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. [Claim 8] A system comprising: a processor; and memory storing instructions that, when executed by the processor, configures the processor to: identify a threat in one or more of an instance or a host of the virtualized system; generate a threat level assessment score based on the threat; generate a report comprising the threat level assessment score and a list of identified threats; and transmit the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. Instant Application 19/293,018, claim 11 Reference U.S. Patent No. 12,411,939 B2, claim 11 The container system of claim 8, wherein when the processor identifies the threat, the processor is further configured: retrieve entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the vulnerability; identify that a software resource of a software source of the one or more of the instance or the host matches a signature that corresponds to the CVE identifier of an entry of the entries from the threat database; and wherein the generation of the threat level assessment score further comprises: increase the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature that corresponds to the entry. [Claim 11] The system of claim 8, wherein when the processor identifies the threat, the processor is further configured: retrieve entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature used to identify the vulnerability; identify that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the CVE identifier of an entry of the entries from the threat database; and increase the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the entry. Instant Application 19/293,018, claim 12 Reference U.S. Patent No. 12,411,939 B2, claim 12 The container system of claim 8, wherein when the processor identifies the threat, the processor is further configured: retrieve entries from a threat database, wherein each entry indicates a benchmark setting using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the benchmark setting; identify that a software resource of a software source of the one or more of the instance or the host matches a signature that corresponds to the benchmark setting of an entry of the entries from the threat database; and wherein the generation of the threat level assessment score further comprises: increase the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature that corresponds to the benchmark setting that corresponds to the entry. [Claim 12] The system of claim 8, wherein when the processor identifies the threat, the processor is further configured: retrieve entries from a threat database, wherein each entry indicates a benchmark setting using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the benchmark setting; identify that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the benchmark setting of an entry of the entries from the threat database; and increase the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the benchmark setting corresponding to the entry. Instant Application 19/293,018, claim 13 Reference U.S. Patent No. 12,411,939 B2, claim 13 The container system of claim 8, wherein the processor is configured to: determine that the threat level assessment score exceeds a threshold value; and suspend execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. [Claim 13] The system of claim 8, wherein the processor is configured to: determine that the threat level assessment score for the instance exceeds a threshold value; and suspend execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. Instant Application 19/293,018, claim 14 Reference U.S. Patent No. 12,411,939 B2, claim 14 The container system of claim 8, wherein the container system is a virtualized system. [Claim 13] The system of claim 8, wherein the system is a container system. Instant Application 19/293,018, claim 15 Reference U.S. Patent No. 12,411,939 B2, claims 15, 16, 17 A non-transitory computer-readable medium comprising instructions that, when executed by a processor, configure the processor to perform: identifying a threat in one or more of an instance or a host of a container system; generating a threat level assessment score based on the threat; determining that the instance generates requests to access a Wide Area Network (WAN); increasing the threat level assessment score for the instance by a fixed value in response to determining that the instance generates requests to access the WAN; identifying abnormal network behavior of the one or more of the instance or the host; and increasing the threat level assessment score for the one or more of the instance or the host by a fixed value in response to the abnormal network behavior. [Claim 15] A non-transitory computer-readable medium comprising instructions that, when executed by a processor, configure the processor to: identify a threat in one or more of an instance or a host of the virtualized system; generate a threat level assessment score based on the threat; generate a report comprising the threat level assessment score and a list of identified threats; and transmit the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. [Claim 16] The non-transitory computer-readable medium of claim 15, wherein when the processor generates the threat level assessment score, the processor is further configured to: determine that the instance generates requests to access a Wide Area Network (WAN); and increase the threat level assessment score for the instance by a fixed value in response to it being determined that the instance generates requests to access the WAN. [Claim 17] The non-transitory computer-readable medium of claim 16, wherein when the processor generates the threat level assessment score, the processor is further configured to: identify abnormal network behavior of the one or more of the instance or the host; and increase the threat level assessment score for the one or more of the instance or the host by a fixed value in response to the abnormal network behavior. Instant Application 19/293,018, claim 16 Reference U.S. Patent No. 12,411,939 B2, claim 15 The non-transitory computer-readable medium of claim 15, wherein the generating the threat level assessment score further comprises: generating a report comprising the threat level assessment score and a list of identified threats. [Claim 15] A non-transitory computer-readable medium comprising instructions that, when executed by a processor, configure the processor to: identify a threat in one or more of an instance or a host of the virtualized system; generate a threat level assessment score based on the threat; generate a report comprising the threat level assessment score and a list of identified threats; and transmit the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. Instant Application 19/293,018, claim 17 Reference U.S. Patent No. 12,411,939 B2, claim 15 The non-transitory computer-readable medium of claim 16, wherein the generating the threat level assessment score further comprises: transmitting the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. [Claim 15] A non-transitory computer-readable medium comprising instructions that, when executed by a processor, configure the processor to: identify a threat in one or more of an instance or a host of the virtualized system; generate a threat level assessment score based on the threat; generate a report comprising the threat level assessment score and a list of identified threats; and transmit the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. Instant Application 19/293,018, claim 18 Reference U.S. Patent No. 12,411,939 B2, claim 18 The non-transitory computer-readable medium of claim 15, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the vulnerability; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the CVE identifier of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the entry. [Claim 18] The non-transitory computer-readable medium of claim 15, wherein when the processor identifies the threat, the processor is further configured to: retrieve entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the vulnerability; identify that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the CVE identifier of an entry of the entries from the threat database; and increase the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the entry. Instant Application 19/293,018, claim 19 Reference U.S. Patent No. 12,411,939 B2, claim 19 The non-transitory computer-readable medium of claim 15, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a benchmark setting using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the benchmark setting; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the benchmark setting of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the benchmark setting corresponding to the entry. [Claim 19] The non-transitory computer-readable medium of claim 15, wherein when the processor identifies the threat, the processor is further configured to: retrieve entries from a threat database, wherein each entry indicates a benchmark setting using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature used to identify the benchmark setting; identify that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the benchmark setting of an entry of the entries from the threat database; and increase the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the benchmark setting corresponding to the entry. Instant Application 19/293,018, claim 20 Reference U.S. Patent No. 12,411,939 B2, claim 20 The non-transitory computer-readable medium of claim 15, wherein the instructions further configure the processor to perform: determining that the threat level assessment score exceeds a threshold value; and suspending execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. [Claim 20] The non-transitory computer-readable medium of claim 15, wherein the instructions further configure the processor to: determine that the threat level assessment score exceeds a threshold value; and suspend execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. 13. Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-18 of U.S. Patent No. 11,106,784 B2, under the legal standard set forth above. The 11,106,784 B2 claims recites an “application container,” the claimed instance, and “probing” for threats, the claimed identifying. Every limitation of instant claims 1-3, 8-10 and 15-17 is presented in 11,106,784 B2 claims 3, 9 and 15, respectively, each of which incorporates the claims from which it depends. The 11,106,784 B2 claims expressly recites a container system. These claims are not patentably distinct. Instance claims 4-6, 11-13, and 18-20 combine the subject matter of 11,106,784 B2 claims 3, 9 and 15 with that of 11,106,784 B2 claims 4-6, 10-12 and 16-18, respectively. For example, instant claim 4 combines 11,106,784 B2 claims 3 and 4. Because the 11,106,784 B2 patent likewise claims these features as dependent claims of the same independent claim, their combination would have been obvious. The “CVE identifier” recited in instant claim 5, 12 and 19 in place of the 11,106,784 B2 claims’ “CIS benchmark” is an obvious substitution. Instant claims 7 and 14 add only an inherent characteristic of the claimed container system and are not patentably distinct for the reasons given for claims 1 and 8. The chart below set forth the method-chain correspondence claim by claim. Instant claims 8-14 and 15-20 correspond to 11,106,784 B2 claims 7-12 and 13-18 in the same manner. Wording common to both claims appears in boldface, and the difference appear in plain type. The additional limitations of the narrower 11,106,784 B2 claims do not distinguish the broader instant claims. Instant Application 19/293,018, claim 1 Reference U.S. Patent No. 11,106,784 B2, claims 1, 2, 3 A computer-implemented method, comprising: identifying a threat in one or more of an instance or a host of a container system; generating a threat level assessment score based on the threat; determining that the instance generates requests to access a Wide Area Network (WAN); increasing the threat level assessment score for the instance by a fixed value in response to determining that the instance generates requests to access the WAN; identifying abnormal network behavior of the one or more of the instance or the host; and increasing the threat level assessment score for the one or more of the instance or the host by a fixed value in response to the abnormal network behavior. [Claim 1] A method in a container system, comprising: probing, by an threat level analyzer, for one or more threats within an application container in a container system, each threat being at least one of a vulnerability and a non-conformance with a benchmark setting, the application container including computer-readable instructions, and the application container initiated via a container service and isolated using operating system-level virtualization; probing for one or more threats within a host of the container service; generating a threat level assessment score based on results from the probing of the one or more threats of the application container and the one or more threats of the host; generating a report for presentation in a user interface including the threat level assessment score and a list of threats discovered from the probing of the one or more threats of the application container and the host; and transmitting the report to a client device of a user for presentation in the user interface, wherein the user interface is a graph view, wherein the application container is represented in the user interface by a container graphical indicator, wherein the threat level assessment score for the application container is indicated by a threat score graphical indicator adjacent to the container graphical indicator, and wherein connections between application containers are indicated by arrow connection indicators. [Claim 2] The method of claim 1, wherein generating a threat level assessment score further comprises: probing the application container to determine whether the application container generates requests to access a Wide Area Network (WAN); and increasing, in response to determining that the application container does generate requests to access the WAN, the threat level assessment score for the application container by a fixed value. [Claim 3] The method of claim 2, wherein generating a threat level assessment score further comprises: probing a network activity of the application container; determining whether the network activity of the application container indicates abnormal network behavior; and increasing, in response to determining that the application container does generate requests to access the WAN, the threat level assessment score for the application container by a fixed value. Instant Application 19/293,018, claim 2 Reference U.S. Patent No. 11,106,784 B2, claim 1 (report limitation) The computer-implemented method of claim 1, wherein the generating the threat level assessment score further comprises: generating a report comprising the threat level assessment score and a list of identified threats. [Claim 1] generating a report for presentation in a user interface including the threat level assessment score and a list of threats discovered from the probing of the one or more threats of the application container and the host; and Instant Application 19/293,018, claim 3 Reference U.S. Patent No. 11,106,784 B2, claim 1 (transmitting limitation) The computer-implemented method of claim 2, wherein the generating the threat level assessment score further comprises: transmitting the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. [Claim 1] transmitting the report to a client device of a user for presentation in the user interface, wherein the user interface is a graph view, wherein the application container is represented in the user interface by a container graphical indicator, wherein the threat level assessment score for the application container is indicated by a threat score graphical indicator adjacent to the container graphical indicator, and wherein connections between application containers are indicated by arrow connection indicators. Instant Application 19/293,018, claim 4 Reference U.S. Patent No. 11,106,784 B2, claim 4 The computer-implemented method of claim 1, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the vulnerability; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the CVE identifier of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the entry. [Claim 4] The method of claim 1, wherein probing, for the one or more threats within the application container further comprises: retrieving entries from a threat database, each entry indicating a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry indicating a signature used to identify the vulnerability; probing one or more software sources of the application container; determining whether one of the one or more software sources of the application container matches to the signature corresponding to the CVE identifier of one of the entries of the threat database; and wherein generating the threat level assessment score further comprises: increasing, in response to determining that one of the one or more software sources of the application container matches the signature corresponding to the one of the entries of the threat database, the threat level assessment score for the application container. Instant Application 19/293,018, claim 5 Reference U.S. Patent No. 11, 106,784 B2, claim 5 The computer-implemented method of claim 1, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a benchmark setting using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the benchmark setting; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the benchmark setting of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the benchmark setting corresponding to the entry. [Claim 5] The method of claim 1, wherein probing, for the one or more threats within the application container further comprises: retrieving entries from a threat database, each entry indicating a benchmark setting using a Center for Internet Security (CIS) benchmark, and each entry indicating a signature used to identify a non-conformance with the benchmark setting; probing one or more software sources of the application container; determining whether one of the one or more software sources of the application container matches to the signature corresponding to the benchmark setting in one of the entries of the threat database; and wherein generating the threat level assessment score further comprises: increasing, in response to determining that one of the one or more software sources of the application container matches the signature corresponding to the benchmark setting in the one of the entries of the threat database, the threat level assessment score for the application container. Instant Application 19/293,018, claim 6 Reference U.S. Patent No. 11,106,784 B2, claim 6 The computer-implemented method of claim 1, further comprising: determining that the threat level assessment score exceeds a threshold value; and suspending execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. [Claim 6] The method of claim 1, further comprising: determining whether the threat level assessment score for the application container exceeds a threshold value; and suspending, in response to determining that the threat level assessment score for the application container exceeds the threshold value, the application container from execution. Instant Application 19/293,018, claim 7 Reference U.S. Patent No. 11,106,784 B2, claim 1 (virtualization limitation) The computer-implemented method of claim 1, wherein the container system is a virtualized system. [Claim 1] the application container initiated via a container service and isolated using operating system-level virtualization 14. Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-18 of U.S. Patent No. 11,886,573 B2, under the legal standard set forth above. The 11,886,573 B2 claims recites an “instance in a virtualized system” and “probing” for threats, the claimed identifying. Every limitation of instant claims 1-3, 8-10 and 15-17 is presented in 11,886,573 B2 claims 3, 10 and 17, respectively, each of which incorporates the claims from which it depends. The recitation of a “container system” in place of a “virtualized system” is the species expressly claimed by 11,996,573 B2 claims 7 and 14, and its selection would have been obvious. These claims are not patentably distinct. Instance claims 4-6, 11-13, and 18-20 combine the subject matter of 11,886,573 B2 claims 3, 10 and 17 with that of 11,886,573 B2 claims 4-6, 10-13 and 18-20, respectively. For example, instant claim 4 combines 11,886,573 B2 claims 3 and 4. Because the 11,886,573 B2 patent likewise claims these features as dependent claims of the same independent claim, their combination would have been obvious. The “CVE identifier” recited in instant claim 5, 12 and 19 in place of the 11,886,573 B2 claims’ “CIS benchmark” is an obvious substitution. Instant claims 7 and 14 recites the inverse of 11,886,573 B2 claims 7 and 14 and are not patentably distinct for the reasons given for claims 1 and 8. The chart below set forth the method-chain correspondence claim by claim. Instant claims 8-14 and 15-20 correspond to 11,886,573 B2 claims 8-14 and 15-20 in the same manner. Wording common to both claims appears in boldface, and the difference appear in plain type. The additional limitations of the narrower 11,886,573 B2 claims do not distinguish the broader instant claims. Instant Application 19/293,018, claim 1 Reference U.S. Patent No. 11,886,573 B2, claims 1, 2, 3 A computer-implemented method, comprising: identifying a threat in one or more of an instance or a host of a container system; generating a threat level assessment score based on the threat; determining that the instance generates requests to access a Wide Area Network (WAN); increasing the threat level assessment score for the instance by a fixed value in response to determining that the instance generates requests to access the WAN; identifying abnormal network behavior of the one or more of the instance or the host; and increasing the threat level assessment score for the one or more of the instance or the host by a fixed value in response to the abnormal network behavior. [Claim 1] A computer-implemented method, comprising: probing for one or more threats within an instance in a virtualized system, each threat being at least one of a vulnerability and a non-conformance with a benchmark setting, the instance in the virtualized system including computer-readable instructions; probing for one or more threats within a host of the virtualized system; generating a threat level assessment score based on results from the probing of the one or more threats of the instance and the one or more threats of the host; generating a report for presentation in a user interface including the threat level assessment score and a list of threats discovered from the probing of the one or more threats of the instance and the host; and transmitting the report to a client device of a user for presentation in the user interface, wherein the user interface includes a graph view, wherein the instance is represented in the user interface by a graphical indicator, wherein the threat level assessment score for the instance is indicated by a threat score graphical indicator adjacent to the graphical indicator, and wherein connections between instances are indicated by arrow connection indicators. [Claim 2] The method of claim 1, wherein generating a threat level assessment score further comprises: probing the instance to determine whether the instance generates requests to access a Wide Area Network (WAN); and increasing, in response to determining that the instance does generate requests to access the WAN, the threat level assessment score for the instance by a fixed value. [Claim 3] The method of claim 2, wherein generating a threat level assessment score further comprises: probing a network activity of the instance; determining whether the network activity of the instance indicates abnormal network behavior; and increasing, in response to determining that the instance does generate requests to access the WAN, the threat level assessment score for the instance by a fixed value. Instant Application 19/293,018, claim 2 Reference U.S. Patent No. 11,886,573 B2, claim 1 (report limitation) The computer-implemented method of claim 1, wherein the generating the threat level assessment score further comprises: generating a report comprising the threat level assessment score and a list of identified threats. [Claim 1] generating a report for presentation in a user interface including the threat level assessment score and a list of threats discovered from the probing of the one or more threats of the instance and the host; and Instant Application 19/293,018, claim 3 Reference U.S. Patent No. 11,106,784 B2, claim 1 (transmitting limitation) The computer-implemented method of claim 2, wherein the generating the threat level assessment score further comprises: transmitting the report to a user interface of a client device for display in a graphical view that shows the instance as a graphical indicator, the threat level assessment score with an adjacent threat score indicator, and arrow indicators that depict connections between instances. [Claim 1] transmitting the report to a client device of a user for presentation in the user interface, wherein the user interface includes a graph view, wherein the instance is represented in the user interface by a graphical indicator, wherein the threat level assessment score for the instance is indicated by a threat score graphical indicator adjacent to the graphical indicator, and wherein connections between instances are indicated by arrow connection indicators. Instant Application 19/293,018, claim 4 Reference U.S. Patent No. 11,886,573 B2, claim 4 The computer-implemented method of claim 1, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the vulnerability; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the CVE identifier of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the entry. [Claim 4] The method of claim 1, wherein probing for the one or more threats within the instance further comprises: retrieving entries from a threat database, each entry indicating a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry indicating a signature used to identify the vulnerability; probing one or more software sources of the instance; determining whether one of the one or more software sources of the instance matches to the signature corresponding to the CVE identifier of one of the entries of the threat database; and wherein generating the threat level assessment score further comprises: increasing, in response to determining that one of the one or more software sources of the instance matches the signature corresponding to the one of the entries of the threat database, the threat level assessment score for the instance. Instant Application 19/293,018, claim 5 Reference U.S. Patent No. 11, 886,573 B2, claim 5 The computer-implemented method of claim 1, wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a benchmark setting using a Common Vulnerabilities and Exposures (CVE) identifier, and each entry uses a signature to identify the benchmark setting; identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the benchmark setting of an entry of the entries from the threat database; and wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to an identification that the software source matches the signature corresponding to the benchmark setting corresponding to the entry. [Claim 5] The method of claim 1, wherein probing, for the one or more threats within the instance further comprises: retrieving entries from a threat database, each entry indicating a benchmark setting using a Center for Internet Security (CIS) benchmark, and each entry indicating a signature used to identify a non-conformance with the benchmark setting; probing one or more software sources of the instance; determining whether one of the one or more software sources of the instance matches to the signature corresponding to the benchmark setting in one of the entries of the threat database; and wherein generating the threat level assessment score further comprises: increasing, in response to determining that one of the one or more software sources of the instance matches the signature corresponding to the benchmark setting in the one of the entries of the threat database, the threat level assessment score for the instance. Instant Application 19/293,018, claim 6 Reference U.S. Patent No. 11,886,573 B2, claim 6 The computer-implemented method of claim 1, further comprising: determining that the threat level assessment score exceeds a threshold value; and suspending execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. [Claim 6] The method of claim 1, further comprising: determining whether the threat level assessment score for the instance exceeds a threshold value; and suspending, in response to determining that the threat level assessment score for the instance exceeds the threshold value, the instance from execution. Instant Application 19/293,018, claim 7 Reference U.S. Patent No. 11,886,573 B2, claim 7 The computer-implemented method of claim 1, wherein the container system is a virtualized system. [Claim 7] The method of claim 1, wherein the virtualized system is a container system. Claim Rejections - 35 USC § 103 15. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 16. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 17. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows: 1. Determining the scope and contents of the prior art. 2. Ascertaining the differences between the prior art and the claims at issue. 3. Resolving the level of ordinary skill in the pertinent art. 4. Considering objective evidence present in the application indicating obviousness or nonobviousness. 18. Claims 1, 2, 6-9, 13-16 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Hufsmith et al. (US 2020/0097662 A1), and in view of Jeffries et al. (US 2018/0336351 A1), hereafter Jeffries. Regarding claim 1, Hufsmith teaches a computer-implemented method, comprising: (Abstract: Provided is a process”; [0038]: these techniques are implemented “by executing processes… upon computing devices.”) identifying a threat in one or more of an instance or a host of a container system; Hufsmith teaches submitting files, packages, and other resources of each layer of a container “to various vulnerability scanning engines” ([0031]). The identified vulnerabilities are the claimed threats, consistent with the specifications, which states that each threat is “a vulnerabilities or a non-conformance with a benchmark setting” (Spec. [0015]). Hufsmith examines the scanner results “in view of a context of a given execution environment for the container image” ([0032]0. The execution environment corresponds to the claimed host. generating a threat level assessment score based on the threat; Hufsmith teaches that scanner results are from the vulnerability scanning engines are “normalized to determine component threat scores” ([0032]). Hufsmith determines “a combined threat score for the container image as a whole,” which “takes into account the threat levels determined for the packages, binaries, and other resources within the container image” ([0034]). The scores are thus based on the identified vulnerabilities, the claimed threats. Hufsmith further weights the scores based on network accessibility. Hufsmith teaches exploitability metrics including “an attack vector indicating whether an attacker requires (N) network access (e.g., OSI layer 3),” which Hufsmith differentiates from “(A) adjacent network access (e.g., shared physical or local IP subnet)” and "(L) local network access” ([0117]). The CVE evaluator evaluates this information “to determine one or more CVE weights” contributing to the score ([0116], [0119]). Hufsmith does not teach determining that the instance generates requests to access a Wide Area Network (WAN), or identifying abnormal network behavior of the one or more of the instance or the host. Hufsmith also does not teach increasing the threat level assessment score for the one or more of the instance or the host by a fixed value in response to either. Jefferies cures these deficiencies. Jefferies teaches monitoring “both activity in the container 122 as well as activity in the host operating system 102” ([0078]). Jefferies teaches that the computing device implementing the host operating system “accesses network resources 120(1),…, 120(m) via network 108” and the “Network 108 represents functionality of a data network, such as the Internet” ([0027]). The internet is a WAN, consistent with the specification, which describes WAN access as including access to “any WAN, the internet, an external LAN” (Spec. [0024]). Jefferies further describes threat level thresholds “for various activities that occur from accessing individual network resources 120(1),…, 120(m) in a container 122(1),…, 122(n)” ([0030]). Monitoring these network resource accesses in the container determines that the instance generates requests to access the WAN. Jefferies teach that a security event “describes activity performed by an application, performed by an operating system, performed over a network” ([0021]). Jefferies teaches generating a security event upon identifying “anomalous behavior that would otherwise not occur during normal container activity,” including “abnormal network activity” ([0079]). The abnormal network activity is the claimed abnormal network behavior. Jefferies teaches that additional security events are “events are aggregated with logged security events to determine a current threat level for a container” ([0022]). Aggregating an additional security event to determine a current threat level increases the threat level in response to the identified behavior. This increase corresponds to the claimed step of increasing the threat level assessment score in response to the abnormal network behavior. Jefferies is analogous art. Jefferies is directed to monitoring containers for malicious activity and determining container threat levels, the same field of endeavor as Hufsmith and the claimed invention. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hufsmith with the runtime monitoring of Jefferies. In the combination, the system determines that the instance generates requests to access the WAN and identifies abnormal network behavior of the instance or the host, as taught by Jefferies. Hufsmith’s scores is increased in response to each determination. One of ordinary skill would have been motivated to add Jefferies’s runtime monitoring so that the score reflects live container activity in addition to scanned content. Jefferies confirms this benefit. The security events provide “a real-time overview of container activity to an external entity” (Jefferies, [0077]). Increasing the score by a fixed value is a selection between known scoring schemes, namely fixed increments and weighted increments. The result of either selection is predictable. A fixed increment raises the score by the same predetermined amount upon each detection, so the resulting score reflects the number and type of conditions detected. Hufsmith already applies per metric weights ([0119]; see also [0208], weights modified based on context properties). Choosing a fixed increment for each determination would have been an obvious design choice. One of ordinary skill would have had a reasonable expectation of success. Hufsmith already aggregates component threat scores and CVE weights into “a combined threat score” ([0034], [0109]). Jefferies already determines a threat level from aggregated security events ([0022]). The modification feeds Jefferies’ security events as additional inputs to Hufsmith’s scoring. Claim 2: Regarding claim 2, Hufsmith in view of Jefferies teaches the limitations of claim 1 as set forth above. Hufsmith further teaches wherein the generating the threat level assessment score further comprises: generating a report comprising the threat level assessment score and a list of identified threats. Hufsmith teaches that the result engine outputs “the results of one or more calculation or determinations about the container images” and causes “the result to be presented to a user, for instance, in a user interface, like a dashboard, a report” ([0096]). The reported combined threat score “is a report including additional information such as a last scan date and a threat level based on the combined threat score” ([0209]). The report therefore comprises the claimed threat level assessment score. Hufsmith further teaches that the resulting metrics “may be presented with user selectable links through to descriptions of the potential vulnerabilities upon which those metrics are based” ([0096]). The presented potential vulnerabilities are the claimed list of identified threats, consistent with the specification, which states that each threat is “a vulnerabilities or a non-conformance with a benchmark setting” (Spec. [0015]). Claim 6: Regarding claim 6, Hufsmith in view of Jefferies teaches the limitations of claim 1 as set forth above. Hufsmith further teaches determining that the threat level assessment score exceeds a threshold value. Hufsmith teaches that the score evaluator “may provide an indication of whether a distributed application or container image is safe to use, such as by comparing a combined threat score to a threshold, where the threshold may be set based on administrator or company policy” ([0146]). Comparing the combined threat score to the threshold determines that the score exceeds the claimed threshold value. Hufsmith does not teach suspending execution of the one or more of the instance or the host in response to a determination that the threat level assessment score for the instance exceeds the threshold value. Jefferies cures this deficiency. Jefferies teaches that ”in response to receiving an indication from the security subsystem 112 that a threat level of malicious activity within the container 122 satisfies a threat level threshold, container manager 118 is configured to quarantine the container 122 and prevent the container 122 from further accessing resources” ([0073]). Jefferies further teaches taking corrective action in response to such a determination “by terminating the container 122 and rebuilding a new container “ ([0073]). Quarantining or terminating the container suspends execution of the claimed instance. A threat level that exceeds the threshold satisfies it. Jefferies therefore takes corrective action in response to a determination that the threat level exceeds a threshold value. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hufsmith to suspend execution of the instance in response to a determination that the threat level assessment score exceeds the threshold value, as taught by Jefferies. One of ordinary skill would have been motivated to act automatically on the threshold determination rather than merely report it. Blocking a container in which the threat level of malicious activity satisfies the threshold “prevents malicious activity occurring in the container from gaining file system access, access to shared resources hosted by the device implementing system architecture 200, and shared network resources” (Jefferies, [0073]). Triggering a container quarantine from a threshold determination is a known technique, as shown by Jefferies ([0073]). Applying it to Hufsmith’s comparison yields the predicable result that the container manager quarantines a high scoring container and prevents it from further accessing resources. One of ordinary skill would have had a reasonable expectation of success. Hufsmith already compares the combined threat score to a policy threshold ([0146]). Jefferies already takes corrective actions in response to a threshold determination ([0023], [0073)]. The modification uses the outcome of Hufsmith’s comparison as the trigger for Jefferies’s quarantine. Claim 7: Regarding claim 7, Hufsmith in view of Jefferies teaches the limitations of claim 1 as set forth above. Hufsmith further teaches wherein the container system is a virtualized system. Hufsmith teaches that the operating system “may provide operating-system-level virtualization to form multiple isolated user-space instances” in which the containers execute ([0054]). “[E]ach of the user-space instances may be referred to as a container” ([0055]). The container system operating with operating-system-level virtualization is the claimed virtualized system. Claims 8, 9, 13 and 14: Claims 8 recites the operations of claim 1 performed by a processor, and further recites the container system comprising the processor and memory storing instructions executed by the processor. Hufsmith teaches a computing system that “may include one or more processors (e.g., processors 1010a-1010n) coupled to system memory 1020” ([0214]), wherein the described functionality is implemented “by executing processes” upon such computing devices ([0039]). Claim 9 recites the limitations of claim 2, claim 13 recites the limitations of claim 6, and claim 14 recites the limitations of claim 7, as functions the processor is configured to perform. Hufsmith in view of Jefferies teaches the recited functions and limitations as set forth in the rejections of claims 1, 2, 6 and 7 above. Claims 8, 9, 13 and 14 are therefore rejected under the same rationale as claims 1, 2, 6 and 7, respectively. Claims 15, 16 and 20: Claim 15 recites the operations of claim 1 as instructions of a non-transitory computer-readable medium that configures a processor to perform the operations. Hufsmith teaches that the described functionality “may be implemented with machine-readable instructions stored on a tangible, non-transitory, machine-readable medium, such that when the instructions are executed, the described functionality may be implemented” ([0151]). Claim 16 recites the limitations of claim 2, and claim 20 recites the limitations of claim 6 above. Hufsmith in view of Jefferies teaches the recited functions and limitations as set forth in the rejections of claims 1, 2 and 6 above. Claims 15, 16 and 20 are therefore rejected under the same rationale as claims 1, 2 and 6, respectively. 19. Claims 4, 11 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Hufsmith in view of Jefferies as applied to claim 1, 8, and 15 above, and further in view of Golan et al. (US 10,944,778 B1), hereafter Golan. Regarding claim 4, Hufsmith in view of Jefferies teaches the limitations of claim 1 as set forth above. Hufsmith further teaches wherein the identifying the threat further comprises: retrieving entries from a threat database, wherein each entry indicates a vulnerability using a Common Vulnerabilities and Exposures (CVE) identifier. Hufsmith teaches that the CVE evaluator “may retrieve information about the CVE based on the identifier” and “may query a repository, database, or other entity with the CVE identifier to retrieve current information about the CVE” ([0113]). The queried repository is the claimed threat database, and the retrieved CVE information is the claimed entries indicating vulnerabilities using CVE identifier. Hufsmith also teaches wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to identified vulnerabilities. The CVE evaluator evaluates “the information associated with potential identified CVEs within the container image to determine one or more CVE weights” ([0116]). The CVE evaluator “determine a weight for each metric of an identified CVE” and “assigns the calculated value as the weight for the metric” ([0119]). The result engine calculates the combined score “based on a weighted sum of context adjusted weights associated with the detected potential vulnerabilities” ([0097], see also [0034]). Each CVE identified in the container therefore raises the container’s combined threat scores. Hufsmith does not teach that each entry uses a signature to identify the vulnerability. Hufsmith also does not teach identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the CVE identifier of an entry of the entries from the threat database. Golan cures these deficiencies. Golan teaches a vulnerability monitoring service (VMS) that processes gathered vulnerability data “to obtain intelligent vulnerabilities information (e.g., identifiers, signatures, description, type, status, and other metadata)” (col. 3, ll. 38-67). The VMS includes “the Common Vulnerabilities and Exposures (CVE) service” supported by NIST and the MITRE Corporation (col. 3, ll. 63-67). Golan teaches compiling an environment properties list identifying the “software components installed on the PCS physical machine” (col. 13, l. 56 – col. 14, l. 4). Golan requests and receives vulnerability information specifying the vulnerabilities that the identified components “is/are known to exhibit” (col. 14, ll. 8-35). Golan updates a threat signature library with extracted “signatures (i.e., pieces of information such as a recurring bit string, a data pattern, etc.) that uniquely identifies the one or more cyber security threats/attacks known to exploit/target the cyber security vulnerabilities” (Step 408; col. 14, ll. 46-57). The per vulnerability item of the intelligent vulnerabilities information is the claimed entry. Each entry therefore indicates a vulnerability by its identifier and uses a signature to identify the vulnerability. Golan monitors the executing application image to identify potential threat signature signatures and matches them against the library (FIG. 4B, Step 428, col. 16, ll. 37-50; FIG. 4C, Step 440, col. 16, ll. 51-60). A potential threat signature of the executing software matching a library signature is the claimed identification that the software resource matches a signature corresponding to the vulnerability entry. Golan is analogous art. Golan is directed to signature-based identification of software vulnerabilities and to computing vulnerability risk metrics, the same filed of endeavor as Hufsmith, Jefferies and the claimed invention. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hufsmith and Jefferies with the signature matching of Golan. In the combination, each threat database entry uses a signature to identify the vulnerability, as taught by Golan. Software resources of the instance or the host are identified by matching against the signatures. The threat level assessment score is increased in response to each such identification, as set forth above. One of ordinary skill would have been motivated to use signatures because they identify precisely which known threats target the installed software. Golan states this benefit: the extracted signatures are pieces of information that “uniquely identifies the one or more cyber security threats/attacks known to exploit/target the cyber security vulnerabilities” (col. 14, ll. 46-57). Signature matching against a vulnerability database is a known technique. Applying it to the threat database of Hufsmith yields the predictable result that a library signature match reveals which installed software components exhibit a known vulnerability. One of ordinary skill would have had a reasonable expectation of success. Hufsmith already queries a repository with CVE identifiers ([0113]). Golan already matches potential threat signatures against its threat signature library (FIG. 4, Step 440). The modification adds Golan’s signature to the entries of Hufsmith’s threat database and matches the software of the container against them. Claims 11 and 18: Claim 11 recites the limitations of claim 4, as functions the processor of the container system of claim 8 is configured to perform. Claim 18 recites the limitations of claim 4 as operations the instructions of the non-transitory computer-readable medium of claim 15 configure the processor to perform. Hufsmith in view of Jefferies and Golan teaches the recited functions and limitations as set forth in the rejections of claim 4 above. Claims 11 and 18 are therefore rejected under the same rationale as claim 4. 20. Claims 5, 12 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Hufsmith in view of Jefferies as applied to claim 1, 8, and 15 above, and further in view of Sweet et al. (US 2018/0309747 A1), hereafter Sweet. Claims 5, 12 and 19 are examined as best understood in view of the rejection under 35 U.S.C 112(b) above. For purpose of examination, the limitation reciting a benchmark setting “using a Common Vulnerabilities and Exposures (CVE) identifier” is interpreted as requiring that each entry indicate a benchmark setting and include an identifier for that benchmark setting, consistent with the specification’s description of benchmark setting entries (Spec. [0040]). Regarding claim 5, Hufsmith in view of Jefferies teaches the limitations of claim 1 as set forth above. Hufsmith further teaches wherein the identifying the threat further comprises: retrieving entries from a threat database having identifiers, as set forth above in the rejection for claim 4 ([0113]). Hufsmith also teaches wherein the generating the threat level assessment score further comprises: increasing the threat level assessment score for one or more of the instance or the host in response to evaluated properties. Hufsmith’s results engine includes “a configuration evaluator 105” and “a container scorer 130 for determining a score, such as a combined threat score, for a container image based on the evaluations of the properties in a container score record” ([0109]). The container scorer modifies weights associated with properties “reported by the scanner evaluators 105, 110, 115, 120” ([0143]). The configuration evaluator “determines a weight for each metric or value of a metric based on whether the configuration properties implicate that the container is more, less, or neutrally susceptible” to that metric ([0112]). The configuration-based weights raise the combined threat score. This increase corresponds to the claimed step of increasing the threat level assessment score. Hufsmith does not teach that each entry indicates a benchmark setting or that each entry uses a signature to identify the benchmark setting. Hufsmith also does not teach identifying that a software resource of a software source of the one or more of the instance or the host matches a signature corresponding to the benchmark setting of an entry of the entries from the threat database. Sweet cures these deficiencies. Sweet teaches that a command “runs a Center for Internet Security (CIS) benchmark audit on a respective container image” ([0052]; see also [0218]). The CIS Benchmark are the claimed benchmark settings, consistent with the specification, which gives the CIS Benchmarks as the example of the benchmark settings (Spec. [0040]). The specification further describes a benchmark setting signature as instructions that determine whether a configuration setting is correctly set (Spec. [0040]). Sweet further teaches a command that “verifies a container image configuration hardening” of the container image, comprising “a user access control of the container” “a network configuration of the container,” and “a process profile of the container” ([0045]). The audit thus check whether configuration settings of the container image are correctly set and uses the claimed signature to identify the benchmark setting. Auditing the container image checks the software resource of the claimed instance, and a non-conformant setting found by the audit is the claimed identification that the software resource matches the signature corresponding to the benchmark setting. Sweet is analogous art. Sweet is directed to container security including benchmark audits of container images, the same field of endeavor as Hufsmith, Jefferies and the claimed invention. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hufsmith and Jefferies with the benchmark audit of Sweet. In the combination, each threat database entry indicates a benchmark setting and uses a signature to identify the benchmark setting, as taught by Sweet. Software resources of the instance or the host are identified by matching against the signatures corresponding to the benchmark settings. The threat level assessment score is increased in response to each identified non-conformance through the configuration evaluator (Hufsmith, [0109]). One of ordinary skill would have been motivated to audit configuration setting in addition to scanning vulnerabilities because “server-level security such as hardening, secure application configuration, and patch management are important” (Sweet, [0011]). Running a benchmark audit on a container image is a known technique, as shown by Sweet ([0052]). Applying it to the container image that Hufsmith scans yields the predictable result that non-conformant setting contribute to the combined threat score. One of ordinary skill would have had a reasonable expectation of success. Hufsmith already evaluates configurations through the configuration evaluator ([0109]). Sweet already audits container images against the CIS Benchmarks ([0052]). The modification feeds Sweet’s audit results to Hufsmith’s configuration evaluator. Claims 12 and 19: Claim 12 recites the limitations of claim 5 as functions the processor of the container system of claim 8 is configured to perform. Claim 19 recites the limitations of claim 5 as operations the instructions of the non-transitory computer-readable medium of claim 15 configure the processor to perform. Hufsmith in view of Jefferies and Sweet teaches the recited functions and operations as set forth in the rejections of claim 5 above. Claims 12 and 19 are therefore rejected under the same rationale as claim 5. 21. Claims 3, 10 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Hufsmith in view of Jefferies as applied to claim 1, 2, 8, 9, 15 and 16 above, and further in view of Strobel et al. (US 2018/0287876 A1), hereafter Strobel. Regarding claim 3, Hufsmith in view of Jefferies teaches the limitations of claim 2 as set forth above. Hufsmith further teaches wherein the generating the threat level assessment score further comprises: transmitting the report to a user interface of a client device for display of the threat level assessment score. Hufsmith teaches that the result engine outputs “the results of one or more calculation or determinations about the container images” and causes “the result to be presented to a user, for instance, in a user interface, like a dashboard, a report” ([0096]). Hufsmith teaches an “an example interface 600 displaying combined threat scores” for each of the requested containers on a developers computing device ([0201]). The developer computing device corresponds to the claimed client device. Hufsmith does not teach display in a graphical view that shows the instance as a graphical indicator with an adjacent threat score indicator, and arrow indicators that depict connections between instances. Strobel cures these deficiencies. Strobel teaches inferring a topology of a distributed application and “causing, with one or more processors, a visual representation of the topology to be presented in a graphical user interface” ([0006]). The view generator presents “visual representation of these topologies ([0070]). The topology is a directed graph “in which nodes of the graph correspond to hosts of the one or more distributed applications, edges correspond to packets sent between the hosts, and directions of edges correspond to the direction in which the packets are sent” ([0006]; see also [0058]). The hosts on which the application components execute include containers: the components “execute on different hosts, for instance, on different computing devices, in different virtual machines, in different containers” ([0036]). FIG. 4, “an example of a visual presentation of a distributed-application topology” ([0013]), shows the hosts 82 as arranged in the display as “icons depicting hosts,” “with edges showing which hosts communicate with which other hosts and the direction of communication” ([0078]). The visual representation depicts the hosts “with lines in the display indicating edges” ([0100]). The host icon of a container is the claimed instance shown as a graphical indicator. The displayed edges showing the direction of communication are the claimed arrow indicators that depict the connections between instances. Strobel is analogous art. Strobel is directed to discovering and visually presenting the topology of distributed application whose components execute in containers, the same field of endeavor as Hufsmith, Jefferies and the claimed invention. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hufsmith and Jefferies with the graphical topology view of Strobel. In the combination, the report is displayed in the topology view, with each container shown as a graphical indicator and connections shown as arrow indicators, as taught by Strobel. The combined threat score that Hufsmith displays for each container ([0210], FIG. 6) is displayed at that container’s graphical indicator and is therefore adjacent to it. This corresponds to the claimed threat level assessment score with an adjacent threat score indicator. One of ordinary skill would have been motivated to present the scores at the host icons because Strobel’s icons “may be user selectable to reveal metrics or alarms reported by the infrastructure monitor 16 or the application monitor 18” ([0078]). Strobel thus already makes per host metrics and alarms available at the host icons of the topology view. Presenting a per entity metric on a per entity display is a known technique. Applying it to Hufsmith’s per container score yields the predictable result that each container’s score appears at its node in Strobel’s topology view. One of ordinary skill would have had a reasonable expectation of success. Hufsmith already displays combined threat scores for each container ([0210]). Strobel already renders each container as a node in a graphical user interface ([0036], [0078]). The modification changes only where Hufsmith’s score is displayed. Claims 10 and 17: Claim 10 recites the limitations of claim 3 as functions the processor of the container system of claim 8 is configured to perform. Claim 17 recites the limitations of claim 3 as operations the instructions of the non-transitory computer-readable medium of claim 15 configure the processor to perform. Hufsmith in view of Jefferies and Strobel teaches the recited functions and operations as set forth in the rejections of claim 3 above. Claims 10 and 17 are therefore rejected under the same rationale as claim 3. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Chitalia et al. (US 10,728,121 B1) discloses a dashboard presenting a graphical display of computer network topology with device symbols interconnected by graphic lines, health and risk indicators for virtual machines and other resources, and alarms triggered when monitored metrics exceed thresholds. 23. Any inquiry concerning this communication or earlier communications from the examiner should be directed to BIN QING ZHENG whose telephone number is (703)756-1535. The examiner can normally be reached on M-F 10:00 am -6:00 pm. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip J. Chea can be reached on 571-272-3951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /BIN QING ZHENG/ Examiner, Art Unit 2499 /PHILIP J CHEA/Supervisory Patent Examiner, Art Unit 2499