BitLaw

Example 47. Anomaly Detection

This example illustrates the application of the eligibility analysis to claims that recite limitations specific to artificial intelligence, particularly the use of an artificial neural network to identify or detect anomalies. Claim 1 is eligible because it falls within a statutory category and does not recite any judicial exceptions. Claim 2 is ineligible because it recites a judicial exception (abstract idea), and the claim as a whole does not integrate the exception into a practical application (and is thus directed to an abstract idea), and the claim does not provide significantly more than the exception (does not provide an inventive concept). Claim 3 is eligible because it recites a judicial exception (abstract idea), but the claim as a whole integrates the judicial exception into a practical application by improving network security.

BACKGROUND

The present invention seeks to use an artificial neural network (ANN) to identify or detect anomalies. The use of specially trained ANNs to detect anomalies realizes a number of improvements over traditional methods of detecting anomalies, including more accurate detection of anomalies. The application further provides methods for training an ANN that lead to faster training times and a more accurate model for detecting anomalies.

ANNs are a type of machine learning model used to perform a wide variety of complex tasks, including image recognition, speech recognition, pattern recognition, and detection of anomalies. An ANN is a biologically inspired algorithm that learns from training data. An ANN can be realized through software, hardware, or a combination of software and hardware. The structure of an exemplary ANN has a series of layers, each comprising one or more neurons arranged in one or more neuron arrays. In an exemplary embodiment, a neuron may comprise a register, a microprocessor, and at least one input. Each neuron produces an output, or activation, based on an activation function that uses the outputs of the previous layer and a set of weights as inputs. Each neuron in a neuron array may be connected to another neuron via a synaptic circuit. A synaptic circuit may include a memory for storing a synaptic weight. An exemplary ANN may be a Deep Neural Network having an input layer, an output layer, and a plurality of fully connected hidden layers. ANNs are particularly useful in anomaly detection because they can effectively extract features in linear and nonlinear relationships. In some embodiments, an ANN may be implemented by an application-specific integrated circuit (ASIC). ASICs may be specially customized for a specific artificial intelligence application and provide superior computing capabilities and reduced electricity consumption compared to traditional CPUs.

In some embodiments, training data is generated by receiving continuous data at a computer and using the computer to discretize the continuous data. In some embodiments, the continuous data may be received remotely over a network. The continuous data may be historical data, which the neural network can use to learn patterns to identify or detect potential anomalies. Continuous data is data that is measured and can have any number of possible values. Machine learning models may benefit from being trained with discrete data rather than continuous data. Discrete data can be counted and has a limited number of values. Any type of discretization method may be used to convert continuous data to discrete data, including binning, clustering, and numerical discretization. The ANN is then trained using any known training techniques to generate a trained neural network which can be used to detect anomalies. The trained ANN monitors incoming data sets to detect anomalies. If the trained ANN detects one or more anomalies, it additionally analyzes the detected anomalies to generate anomaly data which can be output to a user and/or used to re-train the ANN. For example, the anomaly data may explain the type of anomaly or a cause of the anomaly.

A conventional backpropagation algorithm and a conventional gradient descent algorithm may be used to train the neural network. Gradient descent is an optimization algorithm used to minimize differentiable real-valued multivariate functions. Gradient descent begins by initializing the values of parameters and then applying a gradient descent calculation, which uses mathematical calculations to iteratively adjust the values so they minimize a loss function to optimize the ANN. Backpropagation is the mathematical process of calculating the derivatives and gradient descent is the process of adjusting model parameters using the calculated derivatives to minimize the loss function. Backpropagation is a mathematical calculation for supervised learning of ANNs using gradient descent. Given an ANN and an error function, backpropagation is used to calculate the gradient of the error function with respect to the neural network's weights.

Anomaly detection is an important task that impacts any industry that benefits from identifying abnormal data that deviates from expected data or from a general pattern. For example, an intrusion detection system may use the disclosed anomaly detection method to improve detection of malicious network packets. A difficulty in anomaly detection is that a system must define the boundary between ordinary and anomalous data and accurately classify data as ordinary or anomalous. The line between ordinary and anomalous data may be difficult to determine with cases approaching a boundary and based on an application-specific domain. For example, small variations may trigger an identification of an anomaly in network security or medicine while relatively larger deviations may be considered normal in less sensitive applications. Furthermore, malicious actors may attempt to make anomalies appear like ordinary activity. This application provides solutions for using a trained ANN to quickly and accurately identify anomalies as compared to anomaly detection performed using traditional methods.

In some embodiments, the ANN may detect anomalies in a network where the anomalies indicate potential network intrusions or malicious attacks. If the ANN detects one or more anomalies in network traffic, the ANN can additionally determine whether the detected anomaly is associated with a malicious packet. If the detected anomaly is associated with a malicious packet, the ANN may cause a network device to drop the malicious packet and block future traffic from the sender of the malicious packet. By automatically detecting network intrusions or other malicious attacks, the present invention enhances network security by allowing for automatic, proactive remediation of network attacks. In some embodiments, the system may use various detection techniques for detecting potentially malicious network packets and the source of the potentially malicious network packet and can alert a network administrator to potential problems. The system may detect the source of a potentially malicious network packet through a tracing operation or the use of a software tool. The disclosed system detects network intrusions and takes remedial actions, including automatically dropping suspicious packets and blocking traffic from suspicious source addresses without the need for alerting a network administrator. Unlike conventional network remediation solutions, the disclosed method and system are able to identify malicious network packets and take remediation actions, including dropping suspicious packets and blocking traffic from suspicious source addresses in real time. The disclosed system realizes an improvement in network security by avoiding the delay involved in waiting on a network administrator to react to a network intrusion by automatically dropping suspicious packets and blocking traffic from suspicious source addresses based on anomalies identified by the ANN in real time.

CLAIMS

[Claim 1] An application specific integrated circuit (ASIC) for an artificial neural network (ANN), the ASIC comprising:

a plurality of neurons organized in an array, wherein each neuron comprises a register, a microprocessor, and at least one input; and

a plurality of synaptic circuits, each synaptic circuit including a memory for storing a synaptic weight, wherein each neuron is connected to at least one other neuron via one of the plurality of synaptic circuits.

[Claim 2] A method of using an artificial neural network (ANN) comprising:

(a) receiving, at a computer, continuous training data;

(b) discretizing, by the computer, the continuous training data to generate input data;

(c) training, by the computer, the ANN based on the input data and a selected training algorithm to generate a trained ANN, wherein the selected training algorithm includes a backpropagation algorithm and a gradient descent algorithm;

(d) detecting one or more anomalies in a data set using the trained ANN;

(e) analyzing the one or more detected anomalies using the trained ANN to generate anomaly data; and

(f) outputting the anomaly data from the trained ANN.

[Claim 3] A method of using an artificial neural network (ANN) to detect malicious network packets comprising:

(a) training, by a computer, the ANN based on input data and a selected training algorithm to generate a trained ANN, wherein the selected training algorithm includes a backpropagation algorithm and a gradient descent algorithm;

(b) detecting one or more anomalies in network traffic using the trained ANN;

(c) determining at least one detected anomaly is associated with one or more malicious network packets;

(d) detecting a source address associated with the one or more malicious network packets in real time;

(e) dropping the one or more malicious network packets in real time; and

(f) blocking future traffic from the source address.

ANALYSIS

Claim 1 is eligible.

Claim Interpretation: Under the broadest reasonable interpretation, the terms of the claim are presumed to have their plain meaning consistent with the specification as it would be interpreted by one of ordinary skill in the art. See Manual of Patent Examining Procedure (MPEP) 2111. The claim recites an application specific integrated circuit (ASIC) used for an artificial neural network (ANN). While the background explains that "[a]n ANN can be realized through software, hardware, or a combination of software and hardware," the broadest reasonable interpretation of the claimed ANN requires hardware because the claimed ASIC is a physical circuit.

Step 1:This part of the eligibility analysis evaluates whether the claim falls within any statutory category. See MPEP 2106.03. The claim recites an ASIC that implements an ANN. The claim is directed to a physical circuit, which is a machine and/or manufacture, and falls within one of the statutory categories of invention. (Step 1: YES).

Step 2A, Prong One: This part of the eligibility analysis evaluates whether the claim recites a judicial exception. As explained in MPEP 2106.04, subsection II, a claim "recites" a judicial exception when the judicial exception is "set forth" or "described" in the claim. There is no judicial exception recited in the claim. The claim recites a plurality of neurons, which are hardware components comprising a register and a microprocessor, and a plurality of synaptic circuits which together form an ANN. The claim does not recite any abstract ideas, such as a mathematical concept, mental process, or a method of organizing human activity, such as a fundamental economic concept or managing interactions between people. See MPEP 2106.04(a)(2). While ANNs may be trained using mathematics, there is no mathematical concept recited in the claim. Because the claim does not recite a judicial exception (Step 2A, Prong One: NO), it cannot be directed to one (Step 2A: NO). The claim is eligible.

Claim 2 is ineligible.

Claim Interpretation: Under the broadest reasonable interpretation, the terms of the claim are presumed to have their plain meaning consistent with the specification as it would be interpreted by one of ordinary skill in the art. See MPEP 2111.

Steps (a) and (b) recite receiving and discretizing continuous training data to generate input data. The term "continuous data" is recognized as having its plain meaning of any data that is measured and can take on any number of possible values. The plain meaning of discrete data, as supported by the third paragraph of the background, is data that can be counted, has a limited number of values, and is more suitable for use as training data.

The claim does not put any limits on how the continuous data is received, but the background supports the plain meaning of "receiving" as encompassing receiving the data remotely over a network. The claim also does not limit the plain meaning of "discretizing," which, as explained in the background, includes any known discretization method, including binning and clustering, as well as numerical discretization, such as rounding continuous data values or performing other basic mathematical calculations that can be performed mentally (see the third paragraph of the background). Step (c) recites training an ANN using a selected algorithm. The training algorithm is a backpropagation algorithm and a gradient descent algorithm. When given their broadest reasonable interpretation in light of the background, the backpropagation algorithm and gradient descent algorithm are mathematical calculations. The plain meaning of these terms are optimization algorithms, which compute neural network parameters using a series of mathematical calculations. The fourth paragraph of the background supports the plain meaning by stating the "gradient descent begins by initializing the values of parameters and then applying a gradient descent calculation, which uses mathematical calculations to iteratively adjust the values so they minimize a loss function." The background also states that "backpropagation is a mathematical calculation for supervised learning of ANNs using gradient descent.

Steps (a), (b), and (c) are all recited as being performed by a computer. The recited computer is recited at a high level of generality, i.e., as a generic computer performing generic computer functions.

Step (d) recites detecting one or more anomalies in a data set using the trained ANN. The claim does not provide any details about how the trained ANN operates or how the detection is made, and the plain meaning of "detecting" encompasses mental observations or evaluations, e.g., a computer programmer's mental identification of an anomaly in a data set.

Step (e) recites analyzing the one or more detected anomalies using the trained artificial neural network to generate anomaly data. The step of analyzing includes both determining that an anomaly has been detected and may further include suggesting a type or cause of the anomaly. The plain meaning of "analyzing" encompasses evaluating information, which in this claim is limited to evaluating detected anomalies to generate anomaly data by the trained ANN. The claim does not limit how the analysis (evaluation) is performed, and there is nothing about a detected anomaly itself that would limit how it can be analyzed. As explained in the background, "the anomaly data may explain the type of anomaly or a cause of the anomaly." The claim does not include any additional details that explain the analysis of detected anomalies.

Regarding step (f), the step of outputting the anomaly data merely requires a generic output using the trained ANN. The claim does not impose any limits on how the data is output or require any particular components that are used to output the anomaly data.

Based on the plain meaning of the words in the claim, the broadest reasonable interpretation of claim 2 is a method that receives continuous training data at a computer, uses the computer to discretize the continuous training data to generate input data, trains the ANN using the input data and a selected backpropagation algorithm and gradient descent algorithm, detects and analyzes anomalies in a data set using the trained ANN, and outputs anomaly data from the trained ANN. The claimed discretizing, detecting, and analyzing steps encompass mental choices or evaluations, and the claimed discretizing and training using a backpropagation algorithm and gradient descent algorithm encompasses performing mathematical calculations.

Step 1: This part of the eligibility analysis evaluates whether the claim falls within any statutory category. See MPEP 2106.03. The claim recites at least one step or act, including receiving continuous training data. Thus, the claim is to a process, which is one of the statutory categories of invention. (Step 1: YES).

Step 2A, Prong One: This part of the eligibility analysis evaluates whether the claim recites a judicial exception. As explained in MPEP 2106.04, subsection II, a claim "recites" a judicial exception when the judicial exception is "set forth" or "described" in the claim.

As discussed above, the broadest reasonable interpretation of steps (b), (d), and (e) is that those steps fall within the mental process groupings of abstract ideas because they cover concepts performed in the human mind, including observation, evaluation, judgment, and opinion. See MPEP 2106.04(a)(2), subsection III.

Specifically, step (b) recites discretizing continuous training data to generate input data by processes including rounding, binning, or clustering continuous data, which may be practically performed in the human mind using observation, evaluation, judgment, and opinion. For example, the claimed discretizing of continuous data encompasses observing continuous data and performing an evaluation, such as rounding the continuous data. Step (d) recites detecting one or more anomalies in a data set using the trained ANN. Under its broadest reasonable interpretation when read in light of the specification, the "detecting" encompasses mental observations or evaluations that are practically performed in the human mind. For example, the claimed detecting of anomalies in a data set encompasses observing data in a data set and performing an evaluation by comparing anomalous and non-anomalous data. Step (e) recites analyzing the one or more detected anomalies using the trained ANN to generate anomaly data. Step (e) encompasses performing evaluation, judgment, and opinion to make a determination about detected anomalies. Under its broadest reasonable interpretation when read in light of the specification, the "analyzing" encompasses mental processes practically performed in the human mind by observation, evaluation, judgment, and opinion. See MPEP 2106.04(a)(2), subsection III.

As discussed above, the broadest reasonable interpretation of discretizing in step (b) also encompasses mathematical concepts (e.g., rounding data values) that can be performed mentally. Step (c) requires specific mathematical calculations (a backpropagation algorithm and a gradient descent algorithm) to perform the training of the ANN and therefore encompasses mathematical concepts.

"Unless it is clear that a claim recites distinct exceptions, such as a law of nature and an abstract idea, care should be taken not to parse the claim into multiple exceptions, particularly in claims involving abstract ideas." MPEP 2106.04, subsection II.B. However, if possible, the examiner should consider the limitations together as a single abstract idea rather than as a plurality of separate abstract ideas to be analyzed individually. "For example, in a claim that includes a series of steps that recite mental steps as well as a mathematical calculation, an examiner should identify the claim as reciting both a mental process and a mathematical concept for Step 2A, Prong One to make the analysis clear on the record." MPEP 2106.04, subsection II.B. Under such circumstances, however, the Supreme Court has treated such claims in the same manner as claims reciting a single judicial exception. Id. (discussing Bilski v. Kappos, 561 U.S. 593 (2010)). Here, steps (b), (d), and (e) fall within the mental process grouping of abstract ideas, and steps (b) and (c) fall within the mathematical concepts grouping of abstract ideas. Limitations (b)-(e) are considered together as a single abstract idea for further analysis. (Step 2A, Prong One: YES).

Step 2A, Prong Two: This part of the eligibility analysis evaluates whether the claim as a whole integrates the recited judicial exception into a practical application of the exception or whether the claim is "directed to" the judicial exception. This evaluation is performed by (1) identifying whether there are any additional elements recited in the claim beyond the judicial exception, and (2) evaluating those additional elements individually and in combination to determine whether the claim as a whole integrates the exception into a practical application. See MPEP 2106.04(d). The claim recites the additional elements of "(a) receiving, at a computer, continuous training data," "using the trained ANN" in limitations (d) and (e), and "(f) outputting the anomaly data from the trained ANN." The claim also recites that steps (b) and (c) are performed by a computer.

The limitations "(a) receiving, at a computer, continuous training data" and "(f) outputting the anomaly data from the trained ANN" are mere data gathering and output recited at a high level of generality, and thus are insignificant extra-solution activity. See MPEP 2106.05(g) ("whether the limitation is significant"). In addition, all uses of the recited judicial exceptions require such data gathering and output, and, as such, these limitations do not impose any meaningful limits on the claim. These limitations amount to necessary data gathering and outputting. See MPEP 2106.05.

Further, limitations (a), (b), and (c) are recited as being performed by a computer. The computer is recited at a high level of generality. In limitation (a), the computer is used as a tool to perform the generic computer function of receiving data. See MPEP 2106.05(f). In limitations (b) and (c), the computer is used to perform an abstract idea, as discussed above in Step 2A, Prong One, such that it amounts to no more than mere instructions to apply the exception using a generic computer. See MPEP 2106.05(f).

The limitations in (d) and (e) reciting "using the trained ANN" provide nothing more than mere instructions to implement an abstract idea on a generic computer. See MPEP 2106.05(f). MPEP 2106.05(f) provides the following considerations for determining whether a claim simply recites a judicial exception with the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer: (1) whether the claim recites only the idea of a solution or outcome i.e., the claim fails to recite details of how a solution to a problem is accomplished; (2) whether the claim invokes computers or other machinery merely as a tool to perform an existing process; and (3) the particularity or generality of the application of the judicial exception.

The judicial exception of "detecting one or more anomalies in a data set using the trained ANN" and "analyzing the one or more detected anomalies using the trained ANN to generate anomaly data" is performed "using the trained ANN." The trained ANN is used to generally apply the abstract idea without placing any limits on how the trained ANN functions. Rather, these limitations only recite the outcome of "detecting one or more anomalies" and "analyzing the one or more detected anomalies" and do not include any details about how the "detecting" and "analyzing" are accomplished. See MPEP 2106.05(f).

The recitation of "using a trained ANN" in limitations (d) and (e) also merely indicates a field of use or technological environment in which the judicial exception is performed. Although the additional element "using a trained ANN" limits the identified judicial exceptions "detecting one or more anomalies in a data set using the trained ANN" and "analyzing the one or more detected anomalies using the trained ANN to generate anomaly data," this type of limitation merely confines the use of the abstract idea to a particular technological environment (neural networks) and thus fails to add an inventive concept to the claims. See MPEP 2106.05(h).

Even when viewed in combination, these additional elements do not integrate the recited judicial exception into a practical application (Step 2A, Prong Two: NO), and the claim is directed to the judicial exception. (Step 2A: YES).

Step 2B: This part of the eligibility analysis evaluates whether the claim as a whole amounts to significantly more than the recited exception i.e., whether any additional element, or combination of additional elements, adds an inventive concept to the claim. See MPEP 2106.05.

As explained with respect to Step 2A, Prong Two, there are four additional elements. The additional element of "using the trained ANN" in limitations (d) and (e) are at best mere instructions to "apply" the abstract ideas, which cannot provide an inventive concept. See MPEP 2106.05(f).

Additional elements (a) and (f) were both found to be insignificant extra-solution activity in Step 2A, Prong Two, because they were determined to be insignificant limitations as necessary data gathering and outputting. However, a conclusion that an additional element is insignificant extra- solution activity in Step 2A, Prong Two should be re-evaluated in Step 2B. See MPEP 2106.05, subsection I.A. At Step 2B, the evaluation of the insignificant extra-solution activity consideration takes into account whether or not the extra-solution activity is well understood, routine, and conventional in the field. See MPEP 2106.05(g).

As discussed in Step 2A, Prong Two above, the recitations of "(a) receiving continuous training data" and "(g) outputting the anomaly data from the trained ANN" are recited at a high level of generality. These elements amount to receiving or transmitting data over a network and are well- understood, routine, conventional activity. See MPEP 2106.05(d), subsection II.

As discussed in Step 2A, Prong Two above, the recitation of a computer to perform limitations (a), (b), and (c) amounts to no more than mere instructions to apply the exception using a generic computer component.

Even when considered in combination, these additional elements represent mere instructions to implement an abstract idea or other exception on a computer and insignificant extra-solution activity, which do not provide an inventive concept. (Step 2B: NO).

Claim 3 is eligible.

Claim Interpretation: Under the broadest reasonable interpretation, the terms of the claim are presumed to have their plain meaning consistent with the specification as it would be interpreted by one of ordinary skill in the art. See MPEP 2111.

Step (a) recites "training . . . the ANN based on input data . . . to generate a trained ANN." The claim recites performing the training using a backpropagation algorithm and a gradient descent algorithm. When given their broadest reasonable interpretation in light of the disclosure, the backpropagation algorithm and gradient descent algorithm are mathematical calculations. The plain meaning of these terms are optimization algorithms which compute neural network parameters using a series of mathematical calculations. The background supports this plain meaning in the fourth paragraph ("gradient descent begins by initializing the values of parameters and then applying a gradient descent calculation, which uses mathematical calculations to iteratively adjust the values so they minimize a loss function.") Limitation (a) is also recited as being performed by a computer. The recited computer is recited at a high level of generality.

Step (b) recites "detecting one or more anomalies in network traffic using the trained ANN." The claim does not provide any details about how the trained ANN operates or how the detection is made, and the plain meaning of "detecting" encompasses mental observations or evaluations (e.g., a computer programmer's mental identification of an anomaly in a data set).

Step (c) recites "determining at least one detected anomaly is associated with one or more malicious network packets." Under its broadest reasonable interpretation, this step only requires associating a detected anomaly with a malicious network packet. This step does not require the use of any specific process or component for associating a detected anomaly with one or more malicious network packets.

Step (d) further recites "detecting a source address associated with the one or more malicious network packets in real time." The broadest reasonable interpretation of "detecting a source address associated with one or more malicious network packets in real time" is that the detection is a computer function that is described at a high level. Specifically, the sixth paragraph of the background notes that a computer may perform the detection by a tracing operation or by using a software tool.

Steps (e) and (f) further specify remedial actions that are executed to remediate or prevent network intrusions. The claimed steps of (e), automatically dropping the one or more malicious network packets, and (f), blocking future traffic from the source address, provide specific computer solutions that use the output from the ANN to provide security solutions to the detected anomalies. As indicated in paragraph six of the background, the system may "automatically" perform dropping of malicious network packets and blocking future traffic without the need for any action by a network administrator. Instead, the ANN may make decisions about whether a network packet is potentially malicious and take action to drop malicious network packets and block future traffic.

Step 1:This part of the eligibility analysis evaluates whether the claim falls within any statutory category. See MPEP 2106.03. The claim recites a series of steps and, therefore, is a process. See MPEP 2106.03. (Step 1: YES).

Step 2A, Prong One: This part of the eligibility analysis evaluates whether the claim recites a judicial exception. As explained in MPEP 2106.04, subsection II, a claim "recites" a judicial exception when the judicial exception is "set forth" or "described" in the claim.

Step (a) provides use of specific mathematical calculations (a backpropagation algorithm and a gradient descent algorithm) to perform the training of the ANN and therefore encompasses mathematical concepts.

As discussed above, the broadest reasonable interpretation of steps (b) and (c) is that they fall within the mental process groupings of abstract ideas because they cover concepts performed in the human mind, including observation, evaluation, judgment, and opinion. See MPEP 2106.04(a)(2), subsection III.

Specifically, "detecting one or more anomalies in network traffic" is a mental process because the claimed detection is a process that is practically performed in the human mind by a human observing network traffic data and using "evaluation, judgment, and opinion" to detect whether an anomaly has occurred. "[D]etermining that at least one detected anomaly is associated with one or more malicious network packets" only requires associating a detected anomaly with a malicious network packet as stated above. The claim recites limitations that fall within the mental process grouping of abstract ideas.

"Unless it is clear that a claim recites distinct exceptions, such as a law of nature and an abstract idea, care should be taken not to parse the claim into multiple exceptions, particularly in claims involving abstract ideas." MPEP 2106.04, subsection II.B (discussing Bilski v. Kappos, 561 U.S. 593 (2010)). Here, step (a) recites a mathematical concept, and steps (b) and (c) recite mental processes; therefore, claim 3 recites multiple abstract ideas. As discussed above for claim 2, in this case, it is appropriate to consider the limitations together as a single abstract idea rather than as a plurality of separate abstract ideas to be analyzed individually. Limitations (d)-(f) do not recite mental processes because they cannot be practically performed in the human mind. That is, the human mind is not equipped to detect a source address associated with malicious network packets, drop the malicious network packets in real time, and block future traffic as recited in the claim. See MPEP 2106.04(a)(2), subsection III.A (discussing SRI Int'l, Inc. v. Cisco Systems, Inc., 930 F.3d 1295, 1303 (Fed. Cir. 2019)). As step (a) and steps (b)-(c) fall within different groupings of abstract ideas (i.e., mathematical concepts and mental processes, respectively), these limitations are considered together as a single abstract idea for further analysis. (Step 2A, Prong One: YES).

Step 2A, Prong Two: This part of the eligibility analysis evaluates whether the claim as a whole integrates the recited judicial exception into a practical application of the exception. This evaluation is performed by (1) identifying whether there are any additional elements recited in the claim beyond the judicial exception, and (2) evaluating those additional elements individually and in combination to determine whether the claim as a whole integrates the exception into a practical application. See MPEP 2106.04(d).

One way to determine integration into a practical application is when the claimed invention improves the functioning of a computer or improves another technology or technical field. To evaluate an improvement to a computer or technical field, the specification must set forth an improvement in technology and the claim itself must reflect the disclosed improvement. See MPEP 2106.04(d)(1) and 2106.05(a).

The claim recites the additional elements of "(d) detecting a source address associated with the one or more malicious network packets," "(e) dropping the one or more malicious network packets," and "(f) blocking future traffic from the source address." The claim also recites that limitation (a) is performed by a computer.

In limitation (a), the computer is used to perform an abstract idea, as discussed above in Step 2A, Prong One such that it amounts to no more than mere instructions to apply the exception using a generic computer. See MPEP 2106.05(f). In limitation (b), use of a trained ANN does not integrate the abstract idea of limitation (b) into a practical application for similar reasons as explained above in limitation (d) of Claim 2. Additionally, the recitation of "network traffic" generally links the abstract idea recited in limitation (b) to a particular field of use. See MPEP 2106.05(h).

The consideration of whether the claim as a whole includes an improvement to a computer or to a technological field requires an evaluation of the specification and the claim to ensure that a technical explanation of the asserted improvement is present in the specification, and that the claim reflects the asserted improvement. See MPEP 2106.04(d)(1). According to the background section, existing systems use various detection techniques for detecting potentially malicious network packets and can alert a network administrator to potential problems. The disclosed system detects network intrusions and takes real-time remedial actions, including dropping suspicious packets and blocking traffic from suspicious source addresses. The background section further explains that the disclosed system enhances security by acting in real time to proactively prevent network intrusions.

The claimed invention reflects this improvement in the technical field of network intrusion detection. Steps (d)-(f) provide for improved network security using the information from the detection to enhance security by taking proactive measures to remediate the danger by detecting the source address associated with the potentially malicious packets. Specifically, the claim reflects the improvement in step (d), dropping potentially malicious packets in step (e), and blocking future traffic from the source address in step (f). These steps reflect the improvement described in the background. Thus, the claim as a whole integrates the judicial exception into a practical application such that the claim is not directed to the judicial exception.

The additional elements in steps (d)-(f), when considered in combination, integrate the abstract idea into a practical application because the claim improves the functioning of a computer or technical field. See MPEP 2106.04(d)(1) and 2106.05(a). The claimed invention reflects this improvement in the technical field of network intrusion detection. Thus, the claim as a whole integrates the judicial exception into a practical application (Step 2A, Prong Two: YES), such that the claim is not directed to the judicial exception. (Step 2A: NO). The claim is eligible.