Office Action 1: Non-Final Rejection (2024-04-04)
Rejection types: 102 - Lack of Novelty

CLAIMS:
CLAIMS

1\. A computer-implemented method for detection of a malicious activity by analyzing object behavior in a non-isolated environment, the method being executable by a processor communicatively coupled to a plurality of hosts of the non-isolated environment, the method comprising:
receiving, by the processor, from a given host of the plurality of hosts, an event flow including data representative of events occurred at the given host;
analyzing, by the processor, a given event sequence of the event flow having been generated for a predetermined period, to generate, for a given event of the given event sequence, a respective internal event, the respective internal event being format- invariant to other events in the event flow;
applying, by the processor, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event sequence, respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not;
feeding, by the processor, the respective internal state markers to a trained machine- learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity, the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity based on the respective internal state markers of the given host associated therewith; and
in response to the prediction outcome exceeding a predetermined threshold value, determining, by the processor, the given event sequence having been occurred at the given host as being associated with the malicious activity;
generating, by the processor, a report including the prediction outcome for presentation thereof to a user.

2\. The method of claim 1, prior to applying the plurality of signature-based rules, further comprising storing the respective internal event in a pipeline of internal events.
3\. The method of claim 1, wherein the determining the at least one internal state marker comprises detecting one of malicious activity and object in one of the given host of the plurality of hosts and a network thereof.

4\. The method of claim 3, wherein the at least one internal state marker is valid for a predetermined period.

5\. The method of claim 3, wherein the at least one internal state marker has been pre-assigned with a respective weight value.

6\. The method of claim 1, wherein at least one internal state indicated by the at least one internal state marker comprises at least one of: a set of flags indicative of a current state of the given host, file paths, a registry, processes, signatures, mutexes, synchronization objects, and
counters.

7\. The method of claim 6, wherein the at least one internal state is valid for a predetermined period.

8\. The method of claim 1, wherein the trained MLA comprises at least one of: a linear model, a classifier, and a neural network.

9\. The method of claim 1, wherein the report further comprises at least one of: signature markers, information of the given host, contents of environment variables of processes running during occurrences of the given event sequence, information about connected devices, a screenshot, a screen video at a moment of the determining the given event sequence as being associated with the malicious activity, a sequence of user actions executed prior to the given event sequence, an incident graph.

10\. A system for detecting a malicious activity by analyzing objects behavior in a non-isolated environment, the system comprising: a processor communicatively coupled to a plurality of hosts of the non-isolated environment and a non-transitory computer-readable memory storing instructions; and the processor, upon executing the instructions, being configured to:
receive, from a given host of the plurality of hosts, an event flow including data representative of events occurred at the given host;
analyze a given event sequence of the event flow having been generated for a predetermined period, to generate, for a given event of the given event sequence, a respective internal event, the respective internal event being format-invariant to other events in the event flow;
apply, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event sequence, respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not;
feed the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity, the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity based on the respective internal state markers of the given host associated therewith; and
in response to the prediction outcome exceeding a predetermined threshold value, determine the given event sequence having been occurred at the given host as being associated with the malicious activity;
generate a report including the prediction outcome for presentation thereof to a user. 14 15 16 18387524.1

OFFICE ACTION:
DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-10 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Neumann (US Pat. 9,654,485 B1).
Neumann discloses the following subject matter:
1. A computer-implemented method for detection of a malicious activity by analyzing object behavior in a non-isolated environment, the method being executable by a processor communicatively coupled to a plurality of hosts of the non-isolated environment (Figs. 1 & 2), the method comprising:
receiving, by the processor, from a given host of the plurality of hosts, an event flow including data representative of events occurred at the given host (col. 8, line 65-col. 9, line19- The term “event log” (e.g., a log file) generally refers to data with respect to dynamic (e.g., run-time) behaviors that are gathered by one or more computer nodes 112, e.g., end points, intermediate nodes or other network devices coupled with network 114 in the computing environment 110. The data of event logs may be collected using one or more collection agents deployed by the system 100 and installed in the computer nodes 112. The agents are designated by the letter-“A” in the figures. In some embodiments, the event logs may store data collected by collection agent functionality embedded within or constituting applications running within the computer nodes 112. The event logs may contain data generated by anti-virus applications on the computer nodes 112. The event logs may contain alerts and related data generated by intrusion protection systems, intrusion detection systems and/or malware detection systems running in the computing environment 110. Each such system is encompassed by the terms “computer node” and “network device”. Each of the event logs contains data from (and, often, about) at least one of the computer nodes 112 in the computing environment 110, such as run-time activities, network activity, or other behavior.);
analyzing, by the processor, a given event sequence of the event flow having been generated for a predetermined period (col. 22, lines 49-53- the security monitoring framework 104 may be provided with an event log cache 130 (FIG. 1) to store event log data for a period of time or up to a quantity (data storage size) for later use in analysis), to generate, for a given event of the given event sequence, a respective internal event, the respective internal event being format-invariant to other events in the event flow (col. 24, lines 52-61- In step 506, the security monitoring framework 104 detects behavioral characteristics from the received event logs. In one embodiment, the security monitoring framework 104 detects the behavioral characteristics using independently deployable modules that are each configured for detecting a separate behavioral characteristic. For example, one module may be configured for detecting a spidering event, a second module may be configured to detect a hopping event, while a third module may be configured to detect an account probing event.);
applying, by the processor, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event sequence, respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not (col. 15, lines 21-57-A behavioral characteristic correlation module 218 correlates multiple behavioral characteristics 116 with one another using at least one of multiple correlation profiles 122 stored in the data source 106. The behavioral characteristic correlation module 218 may use one or more functions, such as a higher order function, a heuristic function, a schedule, a profile, and/or a probability distribution function, either singularly or in combination to determine correlations among multiple behavioral characteristics. Each correlation profile 120 generally includes information associated with a set of behavioral characteristics that form a behavior pattern. When associated behavioral characteristics in the normalized data are observed (e.g., detected) with a relatively high degree of relevance to each other as indicated by the behavioral characteristic pattern, they may provide evidence of an attack or at least a portion of an attack. The behavioral pattern of each correlation profile 120 may include any combination of behavioral characteristics that may be related to one another, such as those behavioral characteristics that occur during or close to the same time frame, behavioral characteristics that originate from the same computing node, behavioral characteristics that originate from multiple computing nodes that are owned by the same user or accessed using the same user credentials, behavioral characteristics that access or manipulate the same element of data, and the like.
An attack identification module 219 receives the determined behavioral fragments from the behavioral fragment detection module 218 and correlates those fragments with a plurality of attack patterns of known attacks previously detected and analyzed, as stored in the attack profiles repository 122. The attack identification module 219 may use, depending on the embodiment, one or more functions, such as a higher order function, a heuristic function, a schedule, a profile, blacklists, whitelists, and/or a probability distribution function, either singularly or in combination in identifying and verifying an attack.; col. 25, lines 8-12);
feeding, by the processor, the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity, the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity based on the respective internal state markers of the given host associated therewith (col. 15, lines 21-57, col. 25, lines 8-12); and
in response to the prediction outcome exceeding a predetermined threshold value, determining, by the processor, the given event sequence having been occurred at the given host as being associated with the malicious activity (col. 16, lines 44-64-  In one embodiment, each behavioral characteristic may be associated with one or more weighting factors that represent a confidence level regarding the relevance of that characteristic to other detected behavioral characteristics within a behavioral fragment. That is, a behavioral characteristic having a relatively high weighting factor may have a relatively higher degree of relevance to others within a behavioral fragment as represented by the correlation profile, than another behavioral characteristic having a relatively lower weighting factor. Additionally, each behavioral characteristic may include multiple weighting factors that are associated with multiple aspects of one or more behavioral fragments. Moreover, each behavioral fragment may be associated with one or more weighting factors that may represent a confidence level regarding the relevance of that fragment to other detected behavioral fragment, in a manner just described for behavioral characteristics. An attack score may be generated based on weighting factors of the behavioral fragments and based on the attack profiles so as to indicate the likelihood that the detected behavioral fragments constitute attack fragments of an attack., col. 25, lines 22-28);
generating, by the processor, a report including the prediction outcome for presentation thereof to a user (col. 20, lines 12-26- An attack report generation module 228 may generate an alert or other report of an attack, and may include information regarding the behavioral characteristics and fragments associated with the attack, and, in some embodiments, the score(s) associated therewith. Moreover, a remedial action generation module 230 may be optionally deployed in some embodiments (and, for example, enabled by an administrator) to generate one or more remedial actions to mitigate the adverse effects of any identified attacks. For example, the security monitoring framework 104 may issue an alert message transmitted to administrators of the computing environment indicating that an attack has been identified, and the alert may be generated by the attack report generation module 228 or the remedial action generation module 230.).
2. The method of claim 1, prior to applying the plurality of signature-based rules, further comprising storing the respective internal event in a pipeline of internal events. (col. 25, lines 8-12- In step 508, the security monitoring framework 104 correlates the detected behavioral characteristics with a correlation profile 120 stored in the data source 106 to identify a set of related behavioral characteristics called behavioral fragments.)
3. The method of claim 1, wherein the determining the at least one internal state marker comprises detecting one of malicious activity and object in one of the given host of the plurality of hosts and a network thereof. (col. 17, lines 63-col. 18, line 8- the behavioral correlation module 218 receiving these two behavioral characteristics may correlate the unusual port activity and the unusual beaconing activity into a behavioral fragment based on their “relatedness” as indicated by a behavioral correlation profile. The behavioral correlation module 218, which may have sufficient evidence to associate the unusual port activity with a score of 0.80 (e.g., reflecting an assessment of a combination of its severity and confidence) and the unusual beaconing activity with a score of 0.75 (again, reflecting a combination of its severity and confidence), and an overall score (combining the component scores) of 0.40 confidence of a suspicious callback.)
4. The method of claim 3, wherein the at least one internal state marker is valid for a predetermined period. (col. 9, line 62 – col. 10, line 8- the criteria used to delineate what is considered normal behavioral characteristics as opposed to what is considered abnormal behavioral characteristics that may provide evidence or an indication of an attack. For example, multiple authentication attempts generated by the computing node 112 at a rate of less than a specified number of attempts per hour may be an indication of normal behavior, while any rate above that may be an indication of abnormal behavior. As another example, a spidering technique (e.g., blind searches or even mere communication for content on each of multiple computing nodes) during a first specified time of day (e.g., during business hours) may be considered normal behavior, while another spidering technique conducted during late night hours may be considered to be abnormal behavior.)
5. The method of claim 3, wherein the at least one internal state marker has been pre-assigned with a respective weight value. (col. 16, lines 44-60-  In one embodiment, each behavioral characteristic may be associated with one or more weighting factors that represent a confidence level regarding the relevance of that characteristic to other detected behavioral characteristics within a behavioral fragment. That is, a behavioral characteristic having a relatively high weighting factor may have a relatively higher degree of relevance to others within a behavioral fragment as represented by the correlation profile, than another behavioral characteristic having a relatively lower weighting factor. Additionally, each behavioral characteristic may include multiple weighting factors that are associated with multiple aspects of one or more behavioral fragments. Moreover, each behavioral fragment may be associated with one or more weighting factors that may represent a confidence level regarding the relevance of that fragment to other detected behavioral fragment, in a manner just described for behavioral characteristics.)
6. The method of claim 1, wherein at least one internal state indicated by the at least one internal state marker comprises at least one of: a set of flags indicative of a current state of the given host, file paths, a registry, processes, signatures, mutexes, synchronization objects, and counters. (col. 9, lines 31-39- For example, a behavior may be a request to open a communication port in a network device. Examples of behavioral characteristics may include certain criteria, such as a callback (e.g., outbound communication or communication attempts, sometimes referred to as beaconing) initiated by a segment of code and directed to a potential target computing node, the quantity and/or type of authentication (e.g., user login) attempts, data transmission techniques, network searching techniques, and the like.; col. 17, lines 63-col. 18, line 8- the behavioral correlation module 218 receiving these two behavioral characteristics may correlate the unusual port activity and the unusual beaconing activity into a behavioral fragment based on their “relatedness” as indicated by a behavioral correlation profile. The behavioral correlation module 218, which may have sufficient evidence to associate the unusual port activity with a score of 0.80 (e.g., reflecting an assessment of a combination of its severity and confidence) and the unusual beaconing activity with a score of 0.75 (again, reflecting a combination of its severity and confidence), and an overall score (combining the component scores) of 0.40 confidence of a suspicious callback.)
7. The method of claim 6, wherein the at least one internal state is valid for a predetermined period. (col. 9, line 62 – col. 10, line 8- the criteria used to delineate what is considered normal behavioral characteristics as opposed to what is considered abnormal behavioral characteristics that may provide evidence or an indication of an attack. For example, multiple authentication attempts generated by the computing node 112 at a rate of less than a specified number of attempts per hour may be an indication of normal behavior, while any rate above that may be an indication of abnormal behavior. As another example, a spidering technique (e.g., blind searches or even mere communication for content on each of multiple computing nodes) during a first specified time of day (e.g., during business hours) may be considered normal behavior, while another spidering technique conducted during late night hours may be considered to be abnormal behavior.)
8. The method of claim 1, wherein the trained MLA comprises at least one of: a linear model, a classifier, and a neural network. (col. 15, lines 52-57, col. 18, lines 16-22)
9. The method of claim 1, wherein the report further comprises at least one of: signature markers, information of the given host, contents of environment variables of processes running during occurrences of the given event sequence, information about connected devices, a screenshot, a screen video at a moment of the determining the given event sequence as being associated with the malicious activity, a sequence of user actions executed prior to the given event sequence, an incident graph. (col. 20, lines 12-35-  An attack report generation module 228 may generate an alert or other report of an attack, and may include information regarding the behavioral characteristics and fragments associated with the attack, and, in some embodiments, the score(s) associated therewith. Moreover, a remedial action generation module 230 may be optionally deployed in some embodiments (and, for example, enabled by an administrator) to generate one or more remedial actions to mitigate the adverse effects of any identified attacks. For example, the security monitoring framework 104 may issue an alert message transmitted to administrators of the computing environment indicating that an attack has been identified, and the alert may be generated by the attack report generation module 228 or the remedial action generation module 230. As another example, the security monitoring framework 104 may trace the origin of any computing nodes associated with the attack and halt operation of those computing nodes and/or any connections formed with these computing nodes to other nodes in the computing environment until the attack has been resolved. Although only several example remedial actions have been described, it should be understood that the security monitoring framework 104 may perform any number and type of remedial actions according to the identified attack.)
Regarding claim 10, it is rejected as applied to claim 1 because a corresponding system would have been necessitated to carry forth the method steps of claim 1.  The applied prior art also discloses the corresponding architecture. (Figs. 1 and 2)
Conclusion

APPLICANT REBUTTAL: REMARKS
By the present amendments, claims 1, 6, and 10 have been amended. No claims have been cancelled; and no new claims have been added.
The claims have additionally been amended for clarity.
No new subject matter has been introduced via the present amendments. Support therefor can be found at least on paragraphs [044] to [046] of the present application as filed.
After the entry of the present amendments, claims 1 to 10 will remain pending in the application.
With Re
g
ard to the Claim Rejections under 35 U.S.C.
In the present Office Action, the Examiner has rejected claims 1 to 10 under 35 U.S. C. 102 as being anticipated by U.S. Patent No.: 9,654,485-B1 to Neumann (hereinafter "Neumann").
The Applicant respectfully disagrees; however, in order to expedite the prosecution, the Applicant has amended the independent claims.
It is submitted that claims 1 and 10 as amended are novel and non-obvious over the cited reference, as it does not teach, disclose, or even remotely suggest at least the following features:
applying, by the processor, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the
given event of the given event sequence,
the respective internal state marker being indicative of a then current state of the given host during an occurrence of the given event of the given event sequence;
and
respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with
the malicious activity or not;
feeding, by the processor, the respective internal state markers to a trained machine- learning algorithm (MLA) to determine a prediction outcome thereof of whether the given
event sequence is associated with the malicious activity,
the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity using a training set of data comprising: (i) arrays of training internal state markers associated with training event sequences; and (ii) a respective label assigned to each of the training event sequences, the respective label for a given training event sequence being indicative of whether the given training event sequence is associated with the
malicious activity or not; and
The Applicant notes that with respect to the claimed features of "analyzing, by the processor, a given event sequence of the event flow having been generated for a predetermined period to generate, for a given event of the given event sequence, a respective internal event, the respective internal event being format-invariant to other events in the event flow" and "applying, by the processor, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event sequence, respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not," the Examiner refers to col. 24, lines 52-61 and col. 15, lines 21 to 57 of Neumann. Also, with respect to the claimed feature of 'feeding, by the processor, the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity, the trained MLA having been trained to determine whether the given event sequence is associated with the malicious
activity based on the respective internal state markers of the given host associated therewith," the Examiner refers to col. 15, lines 21-57 and col. 25, lines 8-12 of Neumann.
The identified passages of Neumann, as well as, others, providing more context to the teachings thereof, are reproduced below for the ease of reference.
Neumann discloses (emphasis added):
[Abstarct] An analytics-based security monitoring system includes instructions that may be executed by a computing system to receive
data in the form of event lo
g
s from one or more network devices transferred through a computing environment, detect a plurality of behavioral characteristics from the received event lo
g
s, identify behavioral fragments composed of related behavioral characteristics, and identify an attack by correlating the behavioral fragments against patterns of known malicious attacks.
The analytics-based security monitoring system may then perform a learning process to enhance further detection of
attacks and perform one or more remedial actions when an attack is identified.
[...]
[Col. 9, lines 20 to 61] In this description, the term "behavior" generally refers to any low level activity in the computing environment 110, which may be captured as an event during processing within or in communications from a network device.
"Behavioral characteristic" generally refers to any activity in the computing environment 110 that may be categorized according to a specified criteria associated with expected or unexpected use of the computing
environment 110.
[...]
Each behavioral characteristic may represent an action conducted in the computing environment having a plurality of network devices, such as within a proprietary or private network of an enterprise or other organization, which action is associated with expected or unexpected use of the computing environment 110. The event data may be collected and stored in event lo
g
s
by a background process running "behind the scenes" on each of the one or more computer nodes 112 or by a foregoing process on one or more of the computing nodes 112 (e.g., a device that sniffs or otherwise monitors network traffic). The background process may run
without interfering with routine, "foreground" operations and, in some embodiments, without being apparent to the end users or requiring end user interaction during operation. In some embodiments, the background process may be deployed to run during a forensic investigation of a previously detected attack, and in other embodiments the background process may be deployed to run during
normal run-time to continuously monitor runtime behavior for an attack.
[...]
[Col. 15, lines 21 to 57]
A behavioral characteristic correlation module 218 correlates multiple behavioral characteristics 116 with one another using at least one of multiple correlation profiles 122 stored in the data source 106. The behavioral characteristic correlation module 218 may use one or more functions, such as a hi
g
her order function, a heuristic function, a schedule, a profile, and/or a probability distribution function, either singularly or in combination to determine correlations among multiple behavioral characteristics.
Each correlation profile 120 generally includes information associated with a set of behavioral characteristics that form a behavior pattern. When associated behavioral characteristics in the normalized data are observed (e.g., detected) with a relatively high degree of relevance to each other as indicated by the behavioral characteristic pattern, they may provide evidence of an attack or at least a portion of an attack. The behavioral pattern of each correlation profile 120 may include any combination of behavioral characteristics that may be related to one another, such as those behavioral characteristics that occur during or close to the same time frame, behavioral characteristics that originate from the same computing node, behavioral characteristics that originate from multiple computing nodes that are owned by the same user or accessed using the same user credentials, behavioral characteristics that access or manipulate the same element of data,
and the like.
An attack identification module 219 receives the determined behavioral fragments from the behavioral fragment detection module 218 and correlates those fragments with a plurality of attack patterns of known attacks previously detected and analyzed,
as stored in the attack profiles repository 122.
The attack identification module 219 may use, depending on the embodiment, one or more functions, Such as a hi
g
her order function, a heuristic function, a schedule, a profile, blacklists, whitelists, and/or a probability distribution function,
either
singularly or in combination in identifying and verifying an attack.
[Col. 24, lines 52 to 61] In step 506, the security monitoring framework 104 detects behavioral characteristics from the received event logs. In one embodiment, the security monitoring framework 104 detects the behavioral characteristics using independently deployable modules that are each configured for detecting a separate behavioral characteristic. For example,
one module may be configured for detecting a spiderin
g
event, a second module may be configured to detect a hopping event, while a third module may be configured to detect an account probing
event.
[ ... ]
[Col. 25, lines 8 to 12] In step 508,
the security monitoring framework 104 correlates the detected behavioral characteristics with a correlation profile 120 stored in the data source
106 to identify a set of related behavioral characteristics called behavioral fragments.
Overall, the method of Neumann is directed to identifying a malicious attack in a given computer environment by (i) analyzing preliminarily generated event logs from the given computer environment to identify behavioral patterns of events therein; and (ii) determining a
correlation of the so identified behavioral
p
atterns with behavioral
p
atterns of known malicious attacks.
To do so, the method ofNeumann includes using at least one of
a hi
g
her order function, a heuristic function, a schedule, a
p
rofile, and/or a
p
robabilit
y
distribution function,
In sharp contrast, the presently claimed subject-matter is directed to analyzing certain internal states markers of the given
host, each of which has been caused by the occurrence of a res
p
ective event of a given event se
q
uence.
To do so, the presently claimed subject-matter is directed to generating, for each event in the given event sequence, a respective internal event which is format-invariant to the events in the given event sequence.
It is respectfully submitted that the person of ordinary skill in the art would understand that the term "internal event" refers to an event as defined in the field of Unified Model Language state machine, that is,
the event which is re
p
resentative of a state change of the given host in
res
p
onse to the res
p
ective event of the given event se
q
uence
,
which Neumann also fails to disclose.
Further, using these internal events, the respective internal state markers of the given host can be identified that are indictive of certain internal states of the given host during the occurrence of the respective event. Finally, these internal state markers are used for determining the presence of the malicious activity.
To do so,
unlike in the method of Neumann
,
the
p
resentl
y
claimed subject-matter uses an MLA that has been s
p
ecifically trained to determine whether a given array of internal state markers is indicative of the malicious activity based on (1) arrays of training internal states markers of training hosts and (2) labels
representative of whether a given array of training internal states markers is associated with the malicious activity.
Thus, it is respectfully submitted that the claims as amended are novel and non-obvious in view of Neumann, as Neumann fails to teach, disclose, or suggest at least the following feature of the independent claims 1 and 10, and, as such, do not render obvious the subject-matter thereof:
applying, by the processor, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the
given event of the given event sequence,
the respective internal state marker being indicative of a then current state of the given host during an occurrence of the given event of the given event sequence;
and
respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with
the malicious activity or not;
feeding, by the processor, the respective internal state markers to a trained machine- learning algorithm (MLA) to determine a prediction outcome thereof of whether the given
event sequence is associated with the malicious activity,
the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity using a training set of data comprising: (i) arrays of training internal state markers associated with training event sequences; and (ii) a respective label assigned to each of the training event sequences, the respective label for a given training event sequence being indicative of whether the given training event sequence is associated with the
malicious activity or not; and
Pending claims 2 to 9 recite additional features of the currently claimed subject-matter and are therefore believed to be novel and patentable over Neumann at least for the reasons discussed above with respect to claim 1 and for the additional features recited therein.
In view of the foregoing, the Applicant respectfully requests that the rejections under 35 U.S.C. 102 be withdrawn.
Conclusions

NEXT OFFICE ACTION: DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
EXAMINER'S AMENDMENT
An examiner’s amendment to the record appears below. Should the changes and/or additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the payment of the issue fee.
Authorization for this examiner’s amendment was given in an interview with Amber Beckley on 6/24/24.
The application has been amended as follows:
4. (currently amended) The method of claim 3, wherein the at least one internal state marker is valid for the
7. (currently amended) The method of claim 6, wherein the at least one internal state is valid for the
Reasons for Allowance
Claims 1-10 are allowed.
The following is an examiner’s statement of reasons for allowance: The primary reason for allowance is that the prior art of record fails to teach or render obvious the following subject matter in combination with other elements of the independent claims as well as Applicant’s arguments of record as to the distinguishing claim features over the applied prior art: “applying, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event of the given event sequence, the respective internal state marker being indicative of a then current state of the given host during an occurrence of the given event of the given event sequence; and respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not; feeding, the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity, the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity using a training set of data comprising: (i) arrays of training internal state markers associated with training event sequences; and (ii) a respective label assigned to each of the training event sequences, the respective label for a given training event sequence being indicative of whether the given training event sequence is associated with the malicious activity or not.”
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion

CITED REFERENCE SUMMARIES: Ref US9654485B1: Claims:
An analytics-based security monitoring system comprising: at least one memory to store instructions; and a hardware processor communicatively coupled to the at least one memory, the hardware processor, when executing the instructions, to: receive information collected from at least one computing node in a computing environment, detect a first plurality of behavioral characteristics from behavioral data in the received information, each of the first plurality of behavioral characteristics representing an action conducted in the computing environment, determine one or more behavioral fragments, each of the one or more behavioral fragments comprises a second plurality of behavioral characteristics having a level of relevance to each other that is computed based, at least in part, on one or more of (i) whether the second plurality of behavioral characteristics occur within a prescribed window of time or (ii) whether the second plurality of behavioral characteristics are detected on a single computing node or different computing nodes of the at least one computing node, correlate the one or more determined behavioral fragments against an attack profile comprising a plurality of sets of behavioral fragments where each set of behavioral fragments forms a malicious behavior pattern of a known attack, identify an attack based on the correlated one or more determined behavioral fragments, and perform one or more remedial actions when the attack is identified.
at least one memory to store instructions; and
a hardware processor communicatively coupled to the at least one memory, the hardware processor, when executing the instructions, to: receive information collected from at least one computing node in a computing environment, detect a first plurality of behavioral characteristics from behavioral data in the received information, each of the first plurality of behavioral characteristics representing an action conducted in the computing environment, determine one or more behavioral fragments, each of the one or more behavioral fragments comprises a second plurality of behavioral characteristics having a level of relevance to each other that is computed based, at least in part, on one or more of (i) whether the second plurality of behavioral characteristics occur within a prescribed window of time or (ii) whether the second plurality of behavioral characteristics are detected on a single computing node or different computing nodes of the at least one computing node, correlate the one or more determined behavioral fragments against an attack profile comprising a plurality of sets of behavioral fragments where each set of behavioral fragments forms a malicious behavior pattern of a known attack, identify an attack based on the correlated one or more determined behavioral fragments, and perform one or more remedial actions when the attack is identified.
receive information collected from at least one computing node in a computing environment,
detect a first plurality of behavioral characteristics from behavioral data in the received information, each of the first plurality of behavioral characteristics representing an action conducted in the computing environment,
determine one or more behavioral fragments, each of the one or more behavioral fragments comprises a second plurality of behavioral characteristics having a level of relevance to each other that is computed based, at least in part, on one or more of (i) whether the second plurality of behavioral characteristics occur within a prescribed window of time or (ii) whether the second plurality of behavioral characteristics are detected on a single computing node or different computing nodes of the at least one computing node,
correlate the one or more determined behavioral fragments against an attack profile comprising a plurality of sets of behavioral fragments where each set of behavioral fragments forms a malicious behavior pattern of a known attack,
identify an attack based on the correlated one or more determined behavioral fragments, and
perform one or more remedial actions when the attack is identified.
The analytics-based security monitoring system of claim 1 , wherein the instructions are further executed by the hardware processor to: identify the attack by generating a score based on the correlated one or more determined behavioral fragments.
identify the attack by generating a score based on the correlated one or more determined behavioral fragments.
The analytics-based security monitoring system of claim 1 , wherein the instructions are further executed to: correlate a first behavioral characteristic against one or more other behavioral characteristics; generate a behavioral score indicative of a level of relevance of the first behavioral characteristic to the one or more other behavioral characteristics using at least one correlation weighting factor applied to the first behavioral characteristic and the one or more other behavioral characteristics; and identify the attack by generating a score based on the correlated one or more determined behavioral fragments.
correlate a first behavioral characteristic against one or more other behavioral characteristics;
generate a behavioral score indicative of a level of relevance of the first behavioral characteristic to the one or more other behavioral characteristics using at least one correlation weighting factor applied to the first behavioral characteristic and the one or more other behavioral characteristics; and
The analytics-based security monitoring system of claim 3 , wherein the instructions are further executed by the hardware processor to perform a learning process that includes analyzing a previously identified attack, and modifying the at least one correlation weighting factor according to the analyzed attack.
The analytics-based security monitoring system of claim 1 , wherein the instructions are further executed by the hardware processor to detect the plurality of behavioral characteristics using one or more detection weighting factors that are applied to the behavioral data of received information.
The analytics-based security monitoring system of claim 1 , wherein the instructions are further executed by the hardware processor to identify an inter-computing environment-based attack by comparing the one or more determined behavioral fragments against a profile including information associated with one or more other attacks identified in other computing environments.
The analytics-based security monitoring system of claim 6 , wherein the instructions are further executed by the hardware processor to perform a learning process that includes analyzing the one or more other attacks, and modifying a similarity weighting factor of the profile according to the one or more other attacks.
The analytics-based security monitoring system of claim 1 , wherein the level of relevance is further based on at least whether the second plurality of behavioral characteristics arose during processing of a particular object or a particular type of object.
The analytics-based security monitoring system of claim 1 , wherein the instructions are further executed by the hardware processor to normalize data associated with the received information into a common format prior to detecting the plurality of behavioral characteristics.
The analytics-based security monitoring system of claim 9 , wherein the normalized data has a reduced size relative to the data associated with the received information.
The analytics-based security monitoring system of claim 1 , wherein each of the behavioral characteristics is associated with criteria comprising at least one of a known illicit behavior, a quantity of failed authentication attempts, a quantity of successful authentication attempts, a type of authentication attempt, a data transmission technique, an elapsed time between first and second behavioral characteristics, a reordering of third and fourth behavioral characteristics, and a network searching technique.
The analytics-based security monitoring system of claim 1 , wherein the remedial action comprises at least one of generating an alert message, tracing an origin of one or more computing nodes associated with the attack, and halting operation of the one or more computing nodes associated with the attack.
An analytics-based security monitoring method comprising: receiving, using an operations management application with instructions stored on a non-transitory medium and executed on at least one processor, information collected from at least one computing node in a computing environment; detecting, using the instructions, a plurality of behavioral characteristics from the received information, each of the plurality of behavioral characteristics representing an action conducted in the computing environment; identifying, using the instructions, at least one behavioral fragment comprising one or more of the detected behavioral characteristics that are related by correlating the behavioral characteristics against a correlation profile including information associated with a set of behavioral characteristic that form a behavior pattern, the related behavioral characteristics are determined based, at least in part, on (i) whether the behavioral characteristics occur within a prescribed window of time or (ii) whether the behavioral characteristics are detected on a single computing node or different computing nodes of the at least one computing node; identifying, using the instructions, an attack comprising the at least one behavioral fragment by correlating the at least one behavioral fragment against an attack profile including information associated with a set of behavioral fragments that form an attack pattern; and performing, using the instructions, one or more remedial actions when the attack is identified, the one or more remedial actions including reporting the attack.
receiving, using an operations management application with instructions stored on a non-transitory medium and executed on at least one processor, information collected from at least one computing node in a computing environment;
detecting, using the instructions, a plurality of behavioral characteristics from the received information, each of the plurality of behavioral characteristics representing an action conducted in the computing environment;
identifying, using the instructions, at least one behavioral fragment comprising one or more of the detected behavioral characteristics that are related by correlating the behavioral characteristics against a correlation profile including information associated with a set of behavioral characteristic that form a behavior pattern, the related behavioral characteristics are determined based, at least in part, on (i) whether the behavioral characteristics occur within a prescribed window of time or (ii) whether the behavioral characteristics are detected on a single computing node or different computing nodes of the at least one computing node;
identifying, using the instructions, an attack comprising the at least one behavioral fragment by correlating the at least one behavioral fragment against an attack profile including information associated with a set of behavioral fragments that form an attack pattern; and
performing, using the instructions, one or more remedial actions when the attack is identified, the one or more remedial actions including reporting the attack.
The analytics-based security monitoring method of claim 13 , further comprising: identifying the attack by generating an attack score based on the correlated one or more determined behavioral fragments.
identifying the attack by generating an attack score based on the correlated one or more determined behavioral fragments.
The analytics-based security monitoring method of claim 13 , further comprising: correlating a first behavioral characteristic against one or more other behavioral characteristics; generating a behavioral characteristic score indicative of a level of relevance of the first behavioral characteristic to the one or more other behavioral characteristics using at least one correlation weighting factor applied to the first behavioral characteristic and the one or more other behavioral characteristics; and identify the attack by generating an attack score based on the correlated one or more determined behavioral fragments.
correlating a first behavioral characteristic against one or more other behavioral characteristics;
generating a behavioral characteristic score indicative of a level of relevance of the first behavioral characteristic to the one or more other behavioral characteristics using at least one correlation weighting factor applied to the first behavioral characteristic and the one or more other behavioral characteristics; and
identify the attack by generating an attack score based on the correlated one or more determined behavioral fragments.
The analytics-based security monitoring method of claim 15 , further comprising performing a learning process that includes analyzing a previously identified attack, and modifying the at least one correlation weighting factor according to the analyzed attack.
The analytics-based security monitoring method of claim 16 , further comprising: detecting the plurality of behavioral characteristics using one or more detection weighting factors with respect to behavioral data of the received information.
The analytics-based security monitoring method of claim 16 , further comprising performing a learning process that includes analyzing a previously identified attack, and modifying the correlation weighting factors according to the analyzed attack.
The analytics-based security monitoring method of claim 14 , further comprising identifying an inter-computing environment-based attack by comparing the correlated behavioral fragments against a profile including information associated with one or more other attacks identified in other computing environments.
The analytics-based security monitoring method of claim 19 , further comprising performing a learning process that includes analyzing the other attacks, and modifying a similarity weighting factor of the profile according to the analyzed other attacks.
A security monitoring system comprising: a security monitoring framework stored in at least one memory and executed on at least one processor of a computing system, the security monitoring framework comprising: a behavioral characteristic detection module that, when executed by the at least one processor, analyzes data in an event log to detect a plurality of behavioral characteristics from the event log data collected from at least one computing node in a computing environment, each of the plurality of behavioral characteristics representing an action conducted in the computing environment; a behavioral fragment determination module that, when executed by the at least one processor, correlates a first of the detected behavioral characteristics against at least one other of the detected behavioral characteristics, and a second of the detected behavioral characteristics against at least one other of the detected behavioral characteristics, using a correlation profile to identify thereby respective first and second behavioral fragments, the correlation profile includes factors including whether the first of the detected behavioral characteristics and the at least one other of the detected behavioral characteristics occur within a prescribed period of time; an attack identification module that, when executed by the at least one processor, identifies an attack by correlating the first and second behavioral fragments against an attack profile including information associated with a plurality of sets of behavioral fragments that each form a malicious behavior pattern of the attack; and a remedial action generation module that, when executed by the at least one processor, performs one or more remedial actions when the attack is identified.
a security monitoring framework stored in at least one memory and executed on at least one processor of a computing system, the security monitoring framework comprising:
a behavioral characteristic detection module that, when executed by the at least one processor, analyzes data in an event log to detect a plurality of behavioral characteristics from the event log data collected from at least one computing node in a computing environment, each of the plurality of behavioral characteristics representing an action conducted in the computing environment;
a behavioral fragment determination module that, when executed by the at least one processor, correlates a first of the detected behavioral characteristics against at least one other of the detected behavioral characteristics, and a second of the detected behavioral characteristics against at least one other of the detected behavioral characteristics, using a correlation profile to identify thereby respective first and second behavioral fragments, the correlation profile includes factors including whether the first of the detected behavioral characteristics and the at least one other of the detected behavioral characteristics occur within a prescribed period of time;
an attack identification module that, when executed by the at least one processor, identifies an attack by correlating the first and second behavioral fragments against an attack profile including information associated with a plurality of sets of behavioral fragments that each form a malicious behavior pattern of the attack; and
a remedial action generation module that, when executed by the at least one processor, performs one or more remedial actions when the attack is identified.
The security monitoring system of claim 21 , wherein the behavioral fragment determination module is further configured to provide a control signal to the behavioral characteristic detection module to cause the behavioral characteristic detection module to re-analyze the event log data to detect, based on a fragment profile, a behavioral characteristic that was not detected when the event log data was analyzed previously.
The security monitoring system of claim 21 , wherein the attack identification module is further configured to provide a control signal to the behavioral characteristic detection module to cause the behavioral characteristic detection module to re-analyze the event log data to detect, based on a fragment profile, a behavioral characteristic that was not detected when the event log data was analyzed previously.
The security monitoring system of claim 21 , wherein the attack identification module is further configured to provide a control signal to the behavioral fragment determination module to cause the behavioral fragment determination module to re-correlate the behavioral characteristics based on the attack profile, to determine either a third behavioral fragment constituting part of the attack or an additional behavioral characteristic that was previously omitted from the first and second behavioral fragments.
Computer program product code implemented in a non-transitory, computer readable medium that when executed by at least one processor, is operable to perform at least the following: receiving, using an operations management application with instructions stored on a non-transitory medium and executed on at least one processor, information collected from at least one computing node in a computing environment; detecting, using the instructions, a plurality of behavioral characteristics from the received information, each of the plurality of behavioral characteristics representing an action conducted in the computing environment; determining, using the instructions, a behavioral fragment by correlating a first of the detected behavioral characteristics against at least one other detected behavioral characteristic, and a second of the detected behavior
[Truncated to input limit]