DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application is being examined under the pre-AIA first to invent provisions.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 8/24/2026 has been entered.
Response to Amendment / Arguments
Regarding claims rejected under 35 USC 112(a):
Applicant’s amendment is considered to have overcome the applied rejection. Therefore, the rejection has been withdrawn.
Regarding claims rejected under 35 USC 103:
Applicant’s arguments, in view of the amended claim language, have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Hsueh (US 8,769,691 B1).
Claim Rejections - 35 USC § 103
The following is a quotation of pre-AIA 35 U.S.C. 103(a) which forms the basis for all obviousness rejections set forth in this Office action:
(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102, if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the invention was made.
Claims 1, 4, 6-15, 17, and 19 is/are rejected under pre-AIA 35 U.S.C. 103(a) as being unpatentable over Ahuja (US 2013/0246371 A1) in view of Morris (US 2007/0016953 A1) and Hsueh (US 8,769,691 B1).
Regarding claim 1, Ahuja discloses: A computer program product comprising a non-transitory computer- readable medium storing thereon a set of instructions executable by a processor, the set of instructions comprising instructions for:
receiving [Hash / Signature] data about a computer object from each of plural remote computers on which the computer object is located;
Refer to at least [0029], [0031]-[0032], and [0044]-[0053] of Ahuja with respect to object capture and classification, the classification involving signatures
storing said [Hash / Signature] data in a database;
Refer to at least FIG. 5 and [0055]-[0063] of Ahuja with respect to storage of object data such as that of indexing and signature data.
presenting, on a display and in response to receiving a selection of a first group of plural objects having commonality amongst an attribute,
Refer to at least [0067], [0073], and [0096] of Ahuja with respect to an initial search / query focused on specific object data.
information relating to a second group of plural objects including the first group of plural objects and additional objects not in the first group of plural objects, and information relating to one or more [Hashed / Tagged] attributes of the objects of the second group of plural objects from the database, the information relating to the second group of plural objects being arranged such that one or more values of the one or more [Hashed / Tagged] attributes and one or more symbols are shown, wherein the one or more symbols are assigned to the one or more values based on at least one of a uniqueness and a commonality among the one or more values of the one or more [Hashed / Tagged] attributes of the second group of plural objects,
Refer to at least the abstract, [0068], [0072], [0074], [0078], and [0101] of Ahuja with respect to automatically obtaining additionally relevant object data responsive to the initial query.
Refer to at least FIG. 9A-B with respect to an exemplary display, wherein additionally relevant results are presented to the user, organized according to their relevance and frequency.
Refer to at least [0062]-[0063], [0086], and [0092]-[0093] of Ahuja with respect to object attributes and tagging.
monitoring queries of the database run by users;
Refer to at least [0102] and [0096]-[0099] of Ahuja with respect to monitoring user queries.
Ahuja does not specify: that the object is from each of plural remote computers on which the computer object is located; checksum; checksummed; determining that a same user query is repeatedly returning malware objects as query results; and responsive to determining that the same user query is repeatedly returning malware objects as query results, automatically creating, from the same user query, a malware classification rule, wherein the rule is configured to be applied based on a determination of a specific criterion of a received object. However, Ahuja in view of Morris discloses: from each of plural remote computers on which the computer object is located;
Refer to at least [0015] of Morris with respect to a base computer receiving data about a computer object from each of plural remote computers on which the object or similar objects are stored.
checksum; checksummed;
Refer to at least [0007] and [0088] of Morris with respect to checksums: “the request for authorisation to run the file that is sent by a local computer to the central computer may comprise sending a checksum or "signature" or "key" that uniquely represents the file.”
The teachings of both Ahuja and Morris concern securing data and creating security rules, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art at the time of Applicant’s invention to modify the teachings of Ahuja to further comprise obtaining additional data (from multiple computers and of multiple different types of objects) for at least the purpose of increasing security through increased coverage. It further would have been obvious to modify the teachings to use a checksum because the substitution of one known element for another (hashes for checksums) would have yielded predictable results to one of ordinary skill in the art at the time of the invention.
Ahuja-Morris discloses observing the frequency of user query expressions (e.g., [0100]-[0101] of Ahuja) and rule authoring (e.g., [0037] of Ahuja), but does not specify: determining that a same user query is repeatedly returning malware objects as query results; and responsive to determining that the same user query is repeatedly returning malware objects as query results, automatically creating, from the same user query, a malware classification rule, wherein the rule is configured to be applied based on a determination of a specific criterion of a received object. However, Ahuja-Morris in view of Hsueh discloses: determining that a same user query is repeatedly returning malware objects as query results; and
Refer to at least Col. 3, Ll. 56-61 and Col. 7, Ll. 64-Col. 8, Ll. 22 of Hsueh with respect to identifying repeated queries associated with, e.g., a certain software product.
responsive to determining that the same user query is repeatedly returning malware objects as query results, automatically creating, from the same user query, a malware classification rule, wherein the rule is configured to be applied based on a determination of a specific criterion (e.g., CRC in Hsueh) of a received object.
Refer to at least FIG. 3, Col. 4, Ll. 42-56, Col. 7, Ll. 64-Col. 8, Ll. 22, and Col. 8, Ll. 26-31 of Hsueh with respect to deploying malware classifications as pre-fetch caches to users based on the identified repeated queries.
The teachings of Hsueh concern malware analysis and analyst queries to a database, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art at the time of Applicant’s invention to modify the teachings of Ahuja-Morris to further implement identifying repeated queries and generating malware classification rules to cache on target computers for at least the purpose of reducing server traffic as in the cited portions of Hsueh (i.e., less query traffic for a backend server to respond to).
Regarding claim 4, Ahuja-Morris-Hsueh discloses: The computer program product of claim 1, wherein the set of instructions further comprises instructions for: identifying a commonality of one or more attribute values between the second group of plural objects; and refining a query in accordance with the commonality.
Refer to at least the abstract, [0073]-[0078], and [0101] of Ahuja with respect to iterative search queries.
Regarding claim 6, it is rejected for substantially the same reasons as claim 5 above (i.e., the citations and obviousness rationale).
Regarding claim 7, it is rejected for substantially the same reasons as claim 5 above (i.e., the citations and obviousness rationale).
Regarding claim 8, Ahuja-Morris-Hsueh discloses: The computer program product of claim 7, wherein the set of instructions further comprises instructions for: storing a classification of the object as safe or unsafe according to the rule in the database.
Refer to at least [0034]-[0037] of Ahuja with respect to rule creation and object classification.
Regarding claim 9, Ahuja-Morris-Hsueh discloses: The computer program product of claim 8, wherein the set of instructions further comprises instructions for: receiving an indication from a remote computer that an object classified as malware by said rule is believed not to be malware; and amending or deleting the rule in accordance with said indication.
Refer to at least [0118] of Morris with respect to continually monitoring at remote computers and updating a classification based on newer data.
Therefore it would have been obvious to one of ordinary skill in the art at the time of Applicant’s invention to modify the teachings of Ahuja-Morris-Hsueh to further continual monitoring and updating classifications for at least the purpose of reducing false positives and false negatives.
Regarding claim 10, Ahuja-Morris-Hsueh discloses: The computer program product of claim 1, wherein the set of instructions further comprises instructions for sending the rule to a remote computer such that the remote computer can apply the rule to an object at the remote computer.
Refer to at least FIG. 3 and [0033]-[0035] of Ahuja with respect to a capture system and its capture rules; applying the rule via actions taken.
This claim would have been obvious for substantially the same reasons as claim 1 above.
Regarding claims 11-12, they are substantially similar to claims 8-9 above, and are therefore likewise rejected for substantially the same reasons.
Regarding claim 13, Ahuja-Morris-Hsueh discloses: The computer program product of claim 1, wherein the set of instructions further comprises instructions for receiving actor information pertaining to an actor object performing an act and victim information pertaining to a victim object upon which the act is being performed.
Refer to at least FIG. 10A of Ahuja with respect to source and destination information for rules.
Regarding claim 14, Ahuja-Morris-Hsueh discloses: The computer program product of claim 1, wherein the one or more checksummed attributes correspond to an object pathname and an object filename.
Refer to at least TABLE1-2 and [0061] of Ahuja.
Refer to at least the abstract of Morris with respect to pathname and filename.
This claim would have been obvious for substantially the same reasons as claim 1 above.
Regarding claim 17, Ahuja-Morris-Hsueh discloses: The computer program product of claim 1, wherein the set of instructions further comprises instructions for maintaining a count tracking a number of times that the checksum data is received.
Refer to at least [0085] of Morris stating that “the community database 7 may keep a log of each instance of the process which is found by the many remote computers 2 forming part of the network and after a particular number of instances have been recorded, possibly with another particular number of instances or the process being allowed to run and running safely, the signature in the community database 7 may then be marked as safe rather than unsafe.”
Therefore it would have been obvious to one of ordinary skill in the art at the time of Applicant’s invention to modify the teachings of Ahuja-Morris-Hsueh to further implement additional metadata (number of instances) for at least the purpose of increasing security through increased coverage.
Regarding claim 19, Ahuja-Morris-Hsueh discloses: The computer program product of claim 1, wherein information relating to another group of plural objects comprises a number of known objects that are not malware, a number of known malware objects, and a number of unknown objects.
Refer to at least [0080]-[0084] of Morris with respect to known safe, known malicious, and unknown objects.
This claim would have been obvious for substantially the same reasons as claim 1 above.
Claims 2-3, 15, and 18-19 are rejected under pre-AIA 35 U.S.C. 103(a) as being unpatentable over Ahuja-Morris-Hsueh as applied to claims 1, 4, 6-15, 17, and 19 above, and further in view of Thorman (US 2005/0131959 A1).
Regarding claim 18, Ahuja-Morris-Hsueh does not specify: wherein the set of instructions further comprises instructions for presenting on the display, a first symbol assigned to one or more values based on the uniqueness of the one or more values among the second group of plural objects when one or more values of the one or more checksummed attributes is unique amongst the second group of plural objects. However, Ahuja-Morris-Hsueh in view of Thorman discloses: wherein the set of instructions further comprises instructions for presenting on the display, a first symbol assigned to one or more values based on the uniqueness of the one or more values among the second group of plural objects when one or more values of the one or more checksummed attributes is unique amongst the second group of plural objects.
Refer to at least the abstract, [0020], [0024], and [0031] of Thorman with respect to information concerning the uniqueness and/or overlap of objects being indicated via color, icons, and/or other graphical means.
The teachings of Ahuja-Morris-Hsueh concern a GUI for displaying object information, and are considered to be combinable with those of Thorman concerning the same.
Therefore it would have been obvious to one of ordinary skill in the art at the time of Applicant’s invention to modify the teachings of Ahuja-Morris-Hsueh to further include graphical representations of commonality for at least the purpose of increasing ease-of-use for an analyst as per at least [0003]-[0007] of Thorman.
Regarding claim 19, it is rejected for substantially the same reasons as claim 18 above (i.e., the citations and obviousness rationale).
Regarding claim 2, Ahuja-Morris-Hsueh-Thorman discloses: The computer program product of claim 1, wherein the information relating to the second group of plural objects is displayed in tabular form with rows of the table corresponding to objects and columns of the table corresponding to attributes of the objects.
Refer to at least FIG. 9A-B of Ahuja with respect to an exemplary GUI.
Refer to at least FIG. 4-8 of Thorman with respect to an exemplary GUI.
This claim would have been obvious for substantially the same reasons as claim 1 above.
Regarding claim 3, it is rejected for substantially the same reasons as claim 1 above (i.e., the citations to Thorman and the obviousness rationale).
Regarding claim 15, it is rejected for substantially the same reasons as claim 1 above (i.e., the citations to Thorman and the obviousness rationale).
Claim 16 is rejected under pre-AIA 35 U.S.C. 103(a) as being unpatentable over Ahuja-Morris-Thorman-Rubin as applied to claims 1, 4, 6-15, 17, and 19 above, and further in view of Ramzan (US 2011/0040825 A1).
Regarding claim 16, Ahuja-Morris-Hsueh does not specify: wherein the set of instructions further comprises instructions for determining a popularity of the computer object based on the count. However, Ahuja-Morris-Hsueh in view of Ramzan discloses: wherein the set of instructions further comprises instructions for determining a popularity of the computer object based on the count.
Refer to at least [0050] of Ramzan, which states that “the object reputation module 306 calculates the reputation scores for objects based at least in part on the reported prevalence of the objects on the clients. Objects that are widely distributed among clients, such as a popular word processing application, are more likely to be legitimate, while objects that are rarely encountered by the clients may be malware.”
The teachings of Ramzan likewise concern detecting malicious objects, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art at the time of Applicant’s invention to modify the teachings of Ahuja-Morris-Hsueh to further implement an object reputation based on its prevalence and popularity for at least the purpose of filtering out extremely well known and used programs as in Ramzan for reducing computational load.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VADIM SAVENKOV whose telephone number is (571)270-5751. The examiner can normally be reached 12PM-8PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey L Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
/V.S/Examiner, Art Unit 2432
