DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17 (e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17 (e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 03/12/2026 has been entered.
This office Action is in response to the RCE filed on 03/12/2026. As per instant Amendment, Claims 1-3, 9, 11-12, 15-16, and 19 have been amended; Claim 13 was previously cancelled. Claims 1, 11, and 15 are independent Claims; Claims 1-12 and 14-21 have been examined and are pending. This Office Action is made Non-Final.
Response to Arguments
The rejections of claims 1-12 and 14-21 under 35 U.S.C. § 101 are maintained as the claims are directed to an abstract idea without being integrated into a practical application or significantly more.
Applicant's representative asserts that the claims as amended are directed to eligible subject matter under the two-part test. For Step 2A, Prong One, the Office concludes that the claims recite concepts that fall into the "mental process" group of ideas. Applicant's representative contends that the claims cannot practically be performed in the mind, even with the assistance of pencil and paper. It is not feasible for a human to mentally parse a report generated based on a security analysis of a detected software sample and generate a causality tree comprising nodes and edges based on the relationships among the plurality of entities according to the recited technique of claim 1 as amended. Even if pen and paper are employed, it is an unrealistic hypothetical that a human can sit down and generate a causality tree from a complex report that does not represent causal relationships among entities referenced therein in an organized or intuitive manner. The claims thus cannot be assumed to recite a mental process. Claims 11 and 15 do not recite mental processes at least for similar reasons. For instance, manually parsing a report generated from performing threat analysis based on detection of a potential threat, extracting actions, behaviors, and objects from the parsed report, and generating a causality tree based on the parsed report and extracted information according to the technique of claim 11 as amended is not a practical task for a human.
The Examiner respectfully disagrees with the Applicants.
Regarding claims 1, 11 and 15, the claim is directed to an abstract idea as reciting the limitations “determining, from the report, relationships among the plurality of entities;” “determining a root entity of the causality tree …;” “determining a subset of the plurality of actions …;” “determining that a first node of the plurality of nodes corresponds to the reason for the verdict and designating the node as corresponding to the reason for the verdict.” Said steps are “mental process” as broadly interpreted said steps could be performed in the human mind and/or by a human using pencil/paper. Therefore, the claims recite an abstract idea.
Said abstract idea and/or judicial exception is not integrated into a practical application as the claim does not recite any other active steps that utilize determination result into a practical application. It’s noted that the claim 1 recites the limitation “parsing a report;” “extracting, from the parsed report;” “generating a causality tree based on the report;” “displaying a visualization of the causality tree on a graphical user interface.” However, said steps are not sufficiently to consider that the abstract idea is being integrated into a practical application as the steps cited at high level of generality of data gathering/processing and the displaying step is recited at high level of generality of displaying information which is a form of insignificant extra-solution activity (See MPEP 2106.05 for details). Claim 15 recites additional elements (i.e., processor). However, said additional elements are recited at a high-level of generality (i.e., as a generic processor performing a generic computer function of determining operations etc.,) such that it amounts no more than mere instructions to apply the exception or abstract idea using a generic computer component. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea.
Applicant's representative asserts that the claims as amended are directed to eligible subject matter under the two-part test. For Step 2A, Prong Two, the Office concludes that the subject matter of the claims is not integrated into a practical application. Applicant's representative contends that the claims as amended indeed recite elements reflecting integration of any alleged mental process into a practical application. In particular, the claims recite functionality that is integrated into the practical application of visualizing information included in reports generated from analysis of software samples determined to be malicious (as in claims 1 and 15) and analysis of potential threats (as in claim 11) through causality tree generation. "The resulting causality tree data determined from the processing capture the hierarchical relationships among entities referenced in the report and are structured such that behaviors, actions, and other data gathered from the analysis are associated with nodes created for the entities rather than distributed throughout the report as in their original format... The GUI depiction of the causality tree can also be navigated to selectively expand and view the information corresponding to nodes representative of the involved entities, thus providing for the report items of interest to be viewed in a user-friendly and intuitive manner." This is reflected in the elements of claim 1 as amended that recite "generating a causality tree based on the parsed report generated based on the security analysis of the detected software sample, wherein the causality tree comprises a plurality of nodes representing the plurality of entities and corresponding ones of the plurality of actions and the plurality of behaviors" and "displaying a visualization of the causality tree on a graphical user interface (GUI)" and the similar elements of claims 11 and 15 as amended.
The Examiner respectfully disagrees with the Applicants.
As discussed in section a) above, Prong Two — no practical application. The improvements Applicant identifies are not recited in claims 1, 11, and 15, Said abstract idea and/or judicial exception is not integrated into a practical application as the claim does not recite any other active steps that utilize determination result into a practical application. It’s noted that the claim 1 recites the limitation “parsing a report;” “extracting, from the parsed report;” “generating a causality tree based on the report;” “displaying a visualization of the causality tree on a graphical user interface.” However, said steps are not sufficiently to consider that the abstract idea is being integrated into a practical application as the steps cited at high level of generality of data gathering/processing and the displaying step is recited at high level of generality of displaying information which is a form of insignificant extra-solution activity (See MPEP 2106.05 for details). Claim 15 recites additional elements (i.e., processor). However, said additional elements are recited at a high-level of generality (i.e., as a generic processor performing a generic computer function of determining operations etc.,) such that it amounts no more than mere instructions to apply the exception or abstract idea using a generic computer component. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea.
The claims do not include additional elements/limitations/embodiments that are sufficient to amount to significantly more than the judicial exception because the additional elements when considered both individually and as an ordered combination do not amount to significantly more than the abstract idea.
As mentioned above, although the claims recite additional elements, said elements taken individually or as a combination, do not result in the claim amounting to significantly more than the abstract idea because as the additional elements perform generic computer content distributing functions routinely used in information technology field. As discussed above, the additional elements recited at a high-level of generality such that they amount no more than mere instructions to apply the exception using a generic computer component. Therefore, the claim is directed to non-statutory subject matter.
Regarding dependent claims 2-10, 12, 14 and 16-21; claims 2-10, 12-14 and 16-21 are rejected under 35 U.S.C. 101 as being directed to an abstract idea without being integrated into a practical application or significantly more for the same reason discussed above. It’s noted that claim 2 recites the limitations “adding a node to the causality tree;” “determining if a process tree is associated with the entity in the report;” “adding a plurality of nodes to the causality tree;” Claim 3 recites the limitations “creating the root node of the causality tree” and “adding a node to the causality tree;” Claim 4 recites the limitations “adding a first node … to the causality tree” and “adding child nodes …;” Claim 6 recites the limitations “determining a plurality of objects” and “associating indications;” Claim 8 recites the limitations “determining counts” and “associating the counts with the node;” Claim 9 recites the limitations “displaying an indicator…;” Claim 12 recites the limitations “determine a count of indications;” Claim 14 recites the limitations “determine the first malware instance” and “determine a plurality of processes;” Claim 16 recites the limitations “determine that the primary malware instance is identified …;” Claim 17 recites the limitations “associate indications …;” Claim 18 recites the limitations “determine if one or more actions were initiated in the process” and “associate indications [] with the node;” and Claim 21 recites the limitations “display and indicator …;” However, said limitations/steps are also mental processes and/or in a form of form of insignificant extra-solution activity as discussed above. As result claims 2-10, 12, 14 and 16-21 are also rejected under 35 U.S.C. 101 as being directed to an abstract idea without being integrated into a practical application or significantly more.
Applicant’s arguments in the instant Amendment, filed on 03/12/2026, with respect to the prior-art rejections to claims 1, 11 and 15, and limitation listed below, have been fully considered but they are not persuasive.
As to independent claims 1, 11, and 15, Applicants stated in arguments that Ambichl/Huang fails to disclose generating a causality tree based on the report that was generated based on the security analysis of the detected software sample (Applicant Arguments/Remarks, 03/12/2026, pages 9-13).
The Examiner disagrees with the Applicants. The Examiner respectfully that Ambichl does disclose the cited limitations. For example, Ambichl discloses generating a causality tree based on the report that was generated based on the security analysis of the detected software sample (Ambichl: par 0005; the proposed monitoring system uses the topology data and a set of causality rules to estimate causal relationships between pairs of identified abnormal operating conditions to create directed graphs [i.e., generating a causality tree] that describe the causal dependencies between multiple abnormal operation conditions. Finally, the system analyzes those causality graphs to determine abnormal operating conditions in the causality graphs that have a high probability to be the root cause of the other abnormal operating conditions in the graph).
As to independent claims 1, 11, and 15, Applicants stated in arguments that Ambichl/Huang fails to disclose determining a root entity of the causality tree based on a first of the relationships corresponding to the first malware instance and initializing the causality tree with a root node that corresponds to the root entity (Applicant Arguments/Remarks, 03/12/2026, pages 9-13).
The Examiner disagrees with the Applicants. The Examiner respectfully that Ambichl does disclose the cited limitations. For example, Ambichl discloses determining a root entity of the causality tree based on a first of the relationships corresponding to the first malware instance (Ambichl: par 0005; the system analyzes those causality graphs to determine abnormal operating conditions in the causality graphs that have a high probability to be the root cause of the other abnormal operating conditions in the graph; par 0053; Identified transaction execution related anomalies are located on a topology element, and the connection data of the topology model used to identify topology entities [i.e., determining a root entity] that are related to the location. Monitoring data corresponding to those identified topology entities may then be used in a detailed and focused analysis to identify other unexpected operation conditions that are in a causal relationship with the first identified transaction related abnormal operating condition; par 0077; the identified or updated global causality graphs are forwarded to a root cause calculator, which identifies those events that have the highest probability of being the root cause of the other events contained in the global causality graph; par 0116; an abnormal operating condition was detected on an instance of service S. The topology stack related causality analysis may first search for anomalies that occurred on process A that provides service).
As to independent claims 1, 11, and 15, Applicants stated in arguments that Ambichl/Huang fails to disclose for each node of one or more of the plurality of nodes of the causality tree, determining a subset of the plurality of actions and a subset of the plurality of behaviors extracted from the parsed report that correspond to the node and associating indications of the subset of the plurality of actions and indications of the subset of the plurality of behaviors with the node (Applicant Arguments/Remarks, 03/12/2026, pages 9-13).
The Examiner disagrees with the Applicants. The Examiner respectfully that Ambichl does disclose the cited limitations. For example, Ambichl discloses for each node of one or more of the plurality of nodes of the causality tree, determining a subset of the plurality of actions and a subset of the plurality of behaviors extracted from the parsed report that correspond to the node and associating indications of the subset of the plurality of actions and indications of the subset of the plurality of behaviors with the node (Ambichl: par 0005; the system analyzes those causality graphs to determine abnormal operating conditions in the causality graphs that have a high probability to be the root cause of the other abnormal operating conditions in the graph; 0053; Identified transaction execution related anomalies are located on a topology element, and the connection data of the topology model used to identify topology entities [i.e., subset entity] that are related to the location. Monitoring data corresponding to those identified topology entities may then be used in a detailed and focused analysis to identify other unexpected operation conditions [i.e., subset of the plurality of actions] that are in a causal relationship with the first identified transaction related abnormal operating condition; par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified).
The Examiner respectfully suggests that the claims be further amended and details in the specification be incorporated to distinguish the claimed invention over prior art of record. Should the Applicant desire an interview to further clarify the claim interpretation/rejections, please contact the Examiner at (313) 446-6644 to schedule an interview.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-12 and 14-21 are rejected under 35 U. S. C. 101 as being directed to non-statutory subject matter as being directed to an abstract idea without being integrated into a practical application or significantly more.
Regarding claims 1, 11 and 15, the claim is directed to an abstract idea as reciting the limitations “determining, from the report, relationships among the plurality of entities;” “determining a root entity of the causality tree …;” “determining a subset of the plurality of actions …; ” “determining that a first node of the plurality of nodes corresponds to the reason for the verdict and designating the node as corresponding to the reason for the verdict.” Said steps are “mental process” as broadly interpreted said steps could be performed in the human mind and/or by a human using pencil/paper. Therefore, the claims recite an abstract idea.
Said abstract idea and/or judicial exception is not integrated into a practical application as the claim does not recite any other active steps that utilize determination result into a practical application. It’s noted that the claim 1 recites the limitation “parsing a report;” “extracting, from the parsed report;” “generating a causality tree based on the report;” “displaying a visualization of the causality tree on a graphical user interface.” However, said steps are not sufficiently to consider that the abstract idea is being integrated into a practical application as the steps cited at high level of generality of data gathering/processing and the displaying step is recited at high level of generality of displaying information which is a form of insignificant extra-solution activity (See MPEP 2106.05 for details). Claim 15 recites additional elements (i.e., processor). However, said additional elements are recited at a high-level of generality (i.e., as a generic processor performing a generic computer function of determining operations etc.,) such that it amounts no more than mere instructions to apply the exception or abstract idea using a generic computer component. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea.
The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements when considered both individually and as an ordered combination do not amount to significantly more than the abstract idea. As mentioned above, although the claims recite additional elements, said elements taken individually or as a combination, do not result in the claim amounting to significantly more than the abstract idea because as the additional elements perform generic computer content distributing functions routinely used in information technology field. See US Application 20200059481, CN 108171056, and US Application 20210319172. As discussed above, the additional elements recited at a high-level of generality such that they amount no more than mere instructions to apply the exception using a generic computer component. Therefore, the claim is directed to non-statutory subject matter.
Regarding dependent claims 2-10, 12, 14 and 16-21; claims 2-10, 12-14 and 16-21 are rejected under 35 U.S.C. 101 as being directed to an abstract idea without being integrated into a practical application or significantly more for the same reason discussed above. It’s noted that claim 2 recites the limitations “adding a node to the causality tree;” “determining if a process tree is associated with the entity in the report;” “adding a plurality of nodes to the causality tree;” Claim 3 recites the limitations “creating the root node of the causality tree” and “adding a node to the causality tree;” Claim 4 recites the limitations “adding a first node … to the causality tree” and “adding child nodes …;” Claim 6 recites the limitations “determining a plurality of objects” and “associating indications;” Claim 8 recites the limitations “determining counts” and “associating the counts with the node;” Claim 9 recites the limitations “displaying an indicator…;” Claim 12 recites the limitations “determine a count of indications;” Claim 14 recites the limitations “determine the first malware instance” and “determine a plurality of processes;” Claim 16 recites the limitations “determine that the primary malware instance is identified …;” Claim 17 recites the limitations “associate indications …;” Claim 18 recites the limitations “determine if one or more actions were initiated in the process” and “associate indications [] with the node;” and Claim 21 recites the limitations “display and indicator …;” However, said limitations/steps are also mental processes and/or in a form of form of insignificant extra-solution activity as discussed above. As result claims 2-10, 12, 14 and 16-21 are also rejected under 35 U.S.C. 101 as being directed to an abstract idea without being integrated into a practical application or significantly more.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-6, 8, 10-12, and 14-20 are rejected under 35 U.S.C. 103 as being unpatentable over AMBICHL et al. (“AMBICHL,” US 20200042426, published on 02/06/2020) in view of GAO et al. (“GAO,” CN 108171056 A, published on 06/15/2018), and further in view of Anderson et al. (“Anderson,” US 20210319172, filed on 05/11/2020).
Regarding Claim 1;
AMBICHL discloses a method comprising:
parsing a report generated based on a security analysis of a detected software sample, the report comprising identifiers of a plurality of entities associated with a sequence of events that occurred during the security analysis and a verdict that the detected software sample is malicious (par 0053; fig. 1b; identified transaction execution related anomalies are located on a topology element, and the connection data of the topology model used to identify topology entities; par 0069; creates a trigger event which is forwarded to a causality estimator for a detailed and focused causality analysis; par 0070; the analysis performed by causality estimator uses the topology model and the topology coordinates of available monitoring data to identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions);
extracting, from the parsed report, the plurality of entities, a plurality of actions, and a plurality of behaviors recorded during the security analysis, wherein the plurality of entities comprises a first malware instance detected from the security analysis of the software sample (par 0082; the service topology and measurement extractor analyzes end-to-end transaction records to extract the communication interfaces used by those transactions and service topology entities describing those communication interfaces. As the transaction trace data also contains topology data identifying the processes that performed the transaction execution; par 0061; topology records are received by a topology data processor and integrated into a topology model of the monitored environment. Topology records describe components of the monitored environment and contain identifying data for each of those components. This identifying data may also be used to identify corresponding topology entities. All other monitoring data, like log event records, scalar measurement records, transaction records and change event records also contain such identifying data that identifies for each of those records one or more corresponding topology entities; par 0069; creates a trigger event which is forwarded to a causality estimator for a detailed and focused causality analysis; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0098; the topology stack driven causal dependency searches for anomalies on the processing infrastructure used by an identified service instance; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph; par 0116; an abnormal operating condition was detected on an instance of service S. The topology stack related causality analysis may first search for anomalies that occurred on process A that provides service);
generating a causality tree based on the report that was generated based on the security analysis of the detected software sample, wherein the causality tree comprises a plurality of nodes representing the plurality of entities and corresponding ones of the plurality of actions and the plurality of behaviors (par 0005; uses monitoring data from agents to create a topological system of a monitored system and to identify abnormal operating conditions related to elements of a monitored system and to transactions executed by the monitored system. The proposed monitoring system uses the topology data and a set of causality rules to estimate causal relationships between pairs of identified abnormal operating conditions to create directed graphs that describe the causal dependencies between multiple abnormal operation conditions. Finally, the system analyzes those causality graphs to determine abnormal operating conditions in the causality graphs that have a high probability to be the root cause of the other abnormal operating conditions in the graph),
wherein generating the causality tree comprises, determining, from the report, relationships among the plurality of entities (par 0005; the system analyzes those causality graphs to determine abnormal operating conditions in the causality graphs that have a high probability to be the root cause of the other abnormal operating conditions in the graph; par 0053; Identified transaction execution related anomalies are located on a topology element, and the connection data of the topology model used to identify topology entities [i.e., determining a root entity] that are related to the location. Monitoring data corresponding to those identified topology entities may then be used in a detailed and focused analysis to identify other unexpected operation conditions that are in a causal relationship with the first identified transaction related abnormal operating condition; par 0077; the identified or updated global causality graphs are forwarded to a root cause calculator, which identifies those events that have the highest probability of being the root cause of the other events contained in the global causality graph; par 0116; an abnormal operating condition was detected on an instance of service S. The topology stack related causality analysis may first search for anomalies that occurred on process A that provides service);
creating the plurality of nodes and a plurality of edges that connects the plurality of nodes based on the relationships among the plurality of entities, wherein each of the plurality of nodes corresponds to a respective one of the plurality of entities, and wherein creating the plurality of nodes comprises determining a root entity of the causality tree based on a first of the relationships corresponding to the first malware instance, wherein the plurality of nodes includes the root node (par 0005; uses monitoring data from agents to create a topological system of a monitored system and to identify abnormal operating conditions related to elements of a monitored system and to transactions executed by the monitored system. The proposed monitoring system uses the topology data and a set of causality rules to estimate causal relationships between pairs of identified abnormal operating conditions to create directed graphs that describe the causal dependencies between multiple abnormal operation conditions; par 0053; Identified transaction execution related anomalies are located on a topology element, and the connection data of the topology model used to identify topology entities [i.e., determining a root entity] that are related to the location. Monitoring data corresponding to those identified topology entities may then be used in a detailed and focused analysis to identify other unexpected operation conditions that are in a causal relationship with the first identified transaction related abnormal operating condition; par 0077; the identified or updated global causality graphs are forwarded to a root cause calculator, which identifies those events that have the highest probability of being the root cause of the other events contained in the global causality graph; par 0116; an abnormal operating condition was detected on an instance of service S. The topology stack related causality analysis may first search for anomalies that occurred on process A that provides service);
for each node of one or more of the plurality of nodes of the causality tree, determining a subset of the plurality of actions and a subset of the plurality of behaviors extracted from the parsed report that correspond to the node and associating indications of the subset of the plurality of actions and indications of the subset of the plurality of behaviors with the node (par 0005; the system analyzes those causality graphs to determine abnormal operating conditions in the causality graphs that have a high probability to be the root cause of the other abnormal operating conditions in the graph; 0053; Identified transaction execution related anomalies are located on a topology element, and the connection data of the topology model used to identify topology entities [i.e., subset entity] that are related to the location. Monitoring data corresponding to those identified topology entities may then be used in a detailed and focused analysis to identify other unexpected operation conditions [i.e., subset of the plurality of actions] that are in a causal relationship with the first identified transaction related abnormal operating condition; par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified);
based on identifying in the report an indication of a reason for the verdict that the detected software sample is malicious, determining that a first node of the plurality of nodes corresponds to the reason for the verdict and designating the node as corresponding to the reason for the verdict (par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; the analysis performed by causality estimator uses the topology model and the topology coordinates of available monitoring data to identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions); and
displaying a visualization of the causality tree on a graphical user interface (GUI), wherein the visualization of the causality tree comprises graphical elements corresponding to the plurality of nodes and the plurality of edges that connects the plurality of nodes based on the relationships among the plurality of entities (par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified; par 0078; after root cause events were identified by the root cause calculator, the global event graphs forwarded for further processing, like sending notifications to users of the monitoring system, problem and causal dependency visualization).
AMBICHL discloses verdict that the detected software sample is abnormal as recited above, but do not explicitly disclose verdict that the detected software sample is malicious.
However, in an analogous art, GAO discloses determining malicious nature system/method that includes:
verdict that the detected software sample is malicious (GAO: page 3, par 15; judging module, main passively according to the sensitive call chain and a preset rule judging behaviour of sample, when the sample behaviour with passive, judging the sample has malicious nature).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of GAO with the method/system of AMBICHL to include verdict that the detected software sample is malicious. One would have been motivated to judge whether the sample comprises malicious nature (GAO: abstract).
The combination AMBICHL and GAO disclose causality tree and root entity as recited above, but do not explicitly disclose initializing the causality tree with a root node that corresponds to the root entity.
However, in an analogous art, Anderson discloses multiple cell linking system/method that includes:
initializing the causality tree with a root node that corresponds to the root entity (Anderson: par 0026; the causal tree structure starts with a root node and a collection of observation instances, from which all other instruction nodes branch).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Anderson with the method/system of AMBICHL and GAO to include v initializing the causality tree with a root node that corresponds to the root entity. One would have been motivated to retrieve by the computing device, the first set of content using the first link. Displaying the cell also includes updating, by the computing device, the user interface to display, within the cell, both the first set of content and a second set of content that is distinct from the first set of content (Anderson: abstract).
Regarding Claim 2;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 1,
AMBICHL discloses wherein pairs of the plurality of entities are related by one or more of the relationships (AMBICHL: par 0069; fig. 2b; creates a trigger event which is forwarded to a causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0165; parent topology identification data identifying the parent or enclosing topology node for a given topology node, entity type data [] for topology parent relationships described by parent topology data are processes executed by a host computer system, where the host computing system is the parent entity), and wherein creating the plurality of node of the causality tree for each entity in the pairs of the plurality of entities (AMBICHL: par 0040; data records that used to create and store causality graphs that describe the causal relations between different identified unexpected operating conditions; par 0165; parent topology identification data identifying the parent or enclosing topology node for a given topology node, entity type data [] for topology parent relationships described by parent topology data are processes executed by a host computer system, where the host computing system is the parent entity; par0187; causality event records and causality edge records used to represent identified causal relationships between identified abnormal operating conditions in form of a causality graph), adding a node to the causality tree which corresponds to the entity (AMBICHL: par 0081; add additional clustered causality estimator nodes and reconfigure the trigger event data filters in a way that also the additional clustered causality estimator nodes process their share of trigger input data); determining if a process tree is associated with the entity in the report (AMBICHL: par 0069; creates a trigger event which is forwarded to a causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0165; parent topology identification data identifying the parent or enclosing topology node for a given topology node, entity type data [] for topology parent relationships described by parent topology data are processes executed by a host computer system, where the host computing system is the parent entity); and based on determining that a process tree is associated with the entity, adding a plurality of nodes to the causality tree as children of the node which corresponds to the entity based, at least in part, on a hierarchical structure of processes in the process tree (AMBICHL: par 0069; creates a trigger event which is forwarded to a causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0081; add additional clustered causality estimator nodes and reconfigure the trigger event data filters in a way that also the additional clustered causality estimator nodes process their share of trigger input data; par 0165; parent topology identification data identifying the parent or enclosing topology node for a given topology node, entity type data [] for topology parent relationships described by parent topology data are processes executed by a host computer system, where the host computing system is the parent entity; par 0193; Topologically reachable means in this an entity is either in a parent/child relationship, shares a parent entity or is involved in observed communication activity with the entity on which the input event occurred).
Regarding Claim 3;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 2,
AMBICHL discloses wherein each of the one or more relationships indicates a source entity and a target entity relationship (AMBICHL: par 0169; topology identification data identifying the topology entity on which the logging activity was monitored, a log identifier specifying the source of the log activity data within the topology entity; par 0165; parent topology identification data identifying the parent or enclosing topology node for a given topology node, entity type data [] for topology parent relationships described by parent topology data are processes executed by a host computer system, where the host computing system is the parent entity; par 0193; Topologically reachable means in this an entity is either in a parent/child relationship, shares a parent entity or is involved in observed communication activity with the entity on which the input event occurred), and wherein adding the node to the causality tree which corresponds to the entity comprises, based on determining that the entity is identified as a source entity in a first of the one or more relationships and is not identified as a target entity in any of the one or more relationships, creating the root node of the causality tree (AMBICHL: par 0024; root cause calculation afterward be performed on merged causality graphs to identify those events that are the most probably root cause of other events of the graph; par 0077; the identified or updated global causality graphs are forwarded to a root cause calculator, which identifies those events that have the highest probability of being the root cause of the other events contained in the global causality graph; par 0082; graphically describes the identification of causal dependencies on a transaction/service execution level [] identifying the processes involved in the transaction execution and data describing the communication interfaces of those processes that were used to transfer requests and responses between the processes involved in the transaction execution. The service topology and measurement extractor analyzes end-to-end transaction records to extract the communication interfaces used by those transactions and service topology entities [] connected to corresponding process entities in the topology model that provide those services; par 0081; add additional clustered causality estimator nodes and reconfigure the trigger event data filters in a way that also the additional clustered causality estimator nodes process their share of trigger input data), wherein the root node corresponds to the first malware instance or corresponds to another of the plurality of entities that indicates the first malware instance as a target entity, and wherein the first malware instance or the another of the plurality of entities is the root entity (AMBICHL: par 0024; root cause calculation afterward be performed on merged causality graphs to identify those events that are the most probably root cause of other events of the graph; par 0070; the analysis performed by causality estimator uses the topology model and the topology coordinates of available monitoring data to identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0077; the identified or updated global causality graphs are forwarded to a root cause calculator, which identifies those events that have the highest probability of being the root cause of the other events contained in the global causality graph; par 0078; after root cause events were identified by the root cause calculator, the global event graphs forwarded for further processing, like sending notifications to users of the monitoring system, problem and causal dependency visualization or persistent storage; par 0116; an abnormal operating condition was detected on an instance of service S. The topology stack related causality analysis may first search for anomalies that occurred on process A that provides service); and based on determining that the entity is identified as a target entity in a first of the one or more relationships, adding a node to the causality tree as a child of a node which corresponds to its respective source entity (AMBICHL: par 0069; a causality estimator for a detailed and focused causality analysis; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0165; parent topology identification data identifying the parent or enclosing topology node for a given topology node, entity type data [] for topology parent relationships described by parent topology data are processes executed by a host computer system, where the host computing system is the parent entity; par 0081; add additional clustered causality estimator nodes and reconfigure the trigger event data filters in a way that also the additional clustered causality estimator nodes process their share of trigger input data; par 0165; parent topology identification data identifying the parent or enclosing topology node for a given topology node, entity type data [] for topology parent relationships described by parent topology data are processes executed by a host computer system, where the host computing system is the parent entity).
Regarding Claim 4;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 2,
AMBICHL discloses wherein adding the plurality of nodes to the causality tree comprises, based on determining a parent process of the process tree, adding a first node which corresponds to the parent process to the causality tree as a child of the node which corresponds to the entity (AMBICHL: par 0193; processing of a causality rule by the causality estimator. The process starts with when a causality rule and an input event was received, e.g. by the execution of the process “Calculate Causal Dependencies of Event” [] in this context that an entity is either in a parent/child relationship (e.g. a process running on a host computing system); par 0197; the currently processed hypothesis did not generate a new event for the causality graph but only added a new causal connection between already existing events; par 0214; causal event graph with a new event describing a new identified abnormal operating condition that has a causal relationship with one or more events already existing in the graph. then continues the search for other abnormal operating conditions that are causal related to the new added event); and for each child process remaining in the process tree, adding a node which corresponds to the child process to the causality tree as a child of the first node (AMBICHL: par 0193; processing of a causality rule by the causality estimator. The process starts with when a causality rule and an input event was received, e.g. by the execution of the process “Calculate Causal Dependencies of Event” [] in this context that an entity is either in a parent/child relationship (e.g. a process running on a host computing system); par 0197; the currently processed hypothesis did not generate a new event for the causality graph but only added a new causal connection between already existing events; par 0214; causal event graph with a new event describing a new identified abnormal operating condition that has a causal relationship with one or more events already existing in the graph. then continues the search for other abnormal operating conditions that are causal related to the new added event); and adding additional child nodes for children of the child process indicated in the process tree (AMBICHL: par 0193; processing of a causality rule by the causality estimator. The process starts with when a causality rule and an input event was received, e.g. by the execution of the process “Calculate Causal Dependencies of Event” [] in this context that an entity is either in a parent/child relationship (e.g. a process running on a host computing system); par 0197; the currently processed hypothesis did not generate a new event for the causality graph but only added a new causal connection between already existing events; par 0214; causal event graph with a new event describing a new identified abnormal operating condition that has a causal relationship with one or more events already existing in the graph. then continues the search for other abnormal operating conditions that are causal related to the new added event; par 0204; causal event graph with a new event describing a new identified abnormal operating condition that has a causal relationship with one or more events already existing in the graph. then continues the search for other abnormal operating conditions that are causal related to the new added event).
Regarding Claim 5;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 1,
AMBICHL discloses wherein displaying the visualization of the causality tree comprises visually distinguishing a graphical element that represents the first node as corresponding to a reason for the verdict (AMBICHL: par 0078; after root cause events were identified by the root cause calculator, the global event graphs forwarded for further processing, like sending notifications to users of the monitoring system, problem and causal dependency visualization).
GAO further discloses wherein identifying in the report the indication of the reason for the verdict that the detected software sample is malicious is based, at least in part, on a field in the report with values corresponding to reasons for the verdict (GAO: page 3, par 6-8; the rule judging sample according to active and passive behaviour of sensitive call chain and a preset method comprises: constructing active and passive trigger feature library; as to each node in each sensitive calling chain to characteristic quantity of the active and passive characteristic library matching, if the sensitive node in the chain driving characteristic quantity, then the call chain classified driving behaviour, if node of sensitive in the calling chain driven characteristic amount, and from the root node until the source drive not found characteristic quantity, then it is classified passive behavior chain; page 3, par 15; judging module, main passively according to the sensitive call chain and a preset rule judging behaviour of sample, when the sample behaviour with passive, judging the sample has malicious nature).
The motivation is the same that of claim 1 above.
Regarding Claim 6;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 1,
AMBICHL discloses determining a plurality of objects associated with the plurality of actions based, at least in part, on fields in the report which indicate inputs to and outputs of each of the plurality of actions, wherein each of the plurality of objects is an input to or an output of a corresponding one of the plurality of actions (AMBICHL: par 0135; fig. 4; processes that may be used on a monitoring server to process various types of monitoring data received from agents or APIs deployed to a monitored environment; par 0136; the processing of topology records performed by a topology data processor. When the topology data processor receives topology record. fetches the topology entity that corresponds to the received topology record from the topology model. Use the topology identification data contained in the received topology record to identify and fetch a topology node contained in the topology model with matching topology identification data; par 0137; determines if a topology model entity corresponding to the received topology record already exists in the topology model. Executed which creates a new topology model entity using the data of the received topology record. This also contains the linking of the newly created topology entity with its corresponding parent entity); and for each node of the one or more of the plurality of nodes, associating indications of corresponding ones of the plurality of objects with the node (AMBICHL: par 0069; fig. 2b; creates a trigger event which is forwarded to a causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0098; the topology stack driven causal dependency searches for anomalies on the processing infrastructure used by an identified service instance; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified; par 0103; when a response time change event is received, which indicates a specific service instance on which the response time change occurred, together with a filtered service instance call [] analyzed to determine whether a response time change occurred in those service instances);
Regarding Claim 8;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 1,
AMBICHL discloses for each node of the one or more of the plurality of nodes, determining counts of each of the corresponding ones of the plurality of behaviors and plurality of actions and associating the counts with the node (AMBICHL: par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified; par 0250; determine if the identified maximum difference exceeds a certain threshold and may, therefore, be considered as a significant change; par 0253; Afterwards, decision determines whether a sufficient amount of reference change points is available. In case additional reference change points are required, the process continues with minimum required number of reference change points for this decision), wherein displaying the visualization of the causality tree on the GUI comprises displaying the counts for each of the one or more nodes (AMBICHL: par 0078; after root cause events were identified by the root cause calculator, the global event graphs forwarded for further processing, like sending notifications to users of the monitoring system, problem and causal dependency visualization).
Regarding Claim 10;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 1,
Anderson discloses wherein each of the plurality of entities comprises a process, a file, or a malware instance (Anderson: par 0021; the first document has a first section represented by a first section entity, a second section represented by a second section entity, and a third section represented by a third section entity).
The motivation is the same that of claim 1 above.
Regarding Claim 11;
This Claim recites a non-transitory machine-readable media that perform the same steps as method of Claim 1, and has limitations that are similar to Claim 1, thus are rejected with the same rationale applied against claim 1.
Regarding Claim 12;
The combination of AMBICHL, GAO, and Anderson disclose the non-transitory machine-readable media of claim 11,
AMBICHL discloses program code to, for each node of the plurality of nodes, determine a count of indications of those of the plurality of actions associated with the node and a count of indications of those of the plurality of behaviors of associated with the node and associate the determined counts with each node of the plurality of nodes (AMBICHL: par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified; par 0250; determine if the identified maximum difference exceeds a certain threshold and may, therefore, be considered as a significant change; par 0253; Afterwards, decision determines whether a sufficient amount of reference change points is available. In case additional reference change points are required, the process continues with minimum required number of reference change points for this decision).
Regarding Claim 14;
The combination of AMBICHL, GAO, and Anderson disclose the non-transitory machine-readable media of claim 11,
AMBICHL discloses wherein the program code to determine the hierarchical structure comprises program code to determine the first malware instance identified from the threat analysis and determine a plurality of processes associated with the first malware instance in the report (AMBICHL: par 0069; creates a trigger event which is forwarded to a causality estimator for a detailed and focused causality analysis; par 0165; parent topology identification data identifying the parent or enclosing topology node for a given topology node, entity type data [] for topology parent relationships described by parent topology data are processes executed by a host computer system, where the host computing system is the parent entity; par 0193; Topologically reachable means in this an entity is either in a parent/child relationship, shares a parent entity or is involved in observed communication activity with the entity on which the input event occurred; par 0116; an abnormal operating condition was detected on an instance of service S. The topology stack related causality analysis may first search for anomalies that occurred on process A that provides service [] the causality analysis may continue to examine host operating system B which executes process A [] host operating system B reveals no abnormal operating condition on host operating system B, therefore also the hypothesis that conditions on operating system B are causally related to the abnormal operating conditions on service rejected).
Regarding Claim 15;
This Claim recites an apparatus that perform the same steps as method of Claim 1, and has limitations that are similar to Claim 1, thus are rejected with the same rationale applied against claim 1.
Regarding Claim 16;
The combination of AMBICHL, GAO, and Anderson disclose the apparatus of claim 15,
AMBICHL discloses wherein the instructions executable by the processor to cause the apparatus to determine the root entity and create the root node comprise instructions executable by the processor to cause the apparatus to determine that the primary malware instance is identified as corresponding to a source entity or a target entity in the relationship, wherein the root node that is created identifies the source entity (AMBICHL: par 0024; fig. 2b; root cause calculation afterward be performed on merged causality graphs to identify those events that are the most probably root cause of other events of the graph; par 0070; the analysis performed by causality estimator uses the topology model and the topology coordinates of available monitoring data to identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0077; the identified or updated global causality graphs are forwarded to a root cause calculator, which identifies those events that have the highest probability of being the root cause of the other events contained in the global causality graph; par 0116; an abnormal operating condition was detected on an instance of service S. The topology stack related causality analysis may first search for anomalies that occurred on process A that provides service [] the causality analysis may continue to examine host operating system B which executes process A [] host operating system B reveals no abnormal operating condition on host operating system B, therefore also the hypothesis that conditions on operating system B are causally related to the abnormal operating conditions on service rejected);
Regarding Claim 17;
The combination of AMBICHL, GAO, and Anderson disclose the apparatus of claim 15,
AMBICHL discloses instructions executable by the processor to, based on a determination that one or more actions are associated with the entity corresponding to the node, determine one or more computing objects indicated as inputs to or outputs of a corresponding action of the one or more actions in the report (AMBICHL: par 0135; fig. 4; processes that may be used on a monitoring server to process various types of monitoring data received from agents or APIs deployed to a monitored environment; par 0136; the processing of topology records performed by a topology data processor. When the topology data processor receives topology record. fetches the topology entity that corresponds to the received topology record from the topology model. Use the topology identification data contained in the received topology record to identify and fetch a topology node contained in the topology model with matching topology identification data; par 0137; determines if a topology model entity corresponding to the received topology record already exists in the topology model. Executed which creates a new topology model entity using the data of the received topology record. This also contains the linking of the newly created topology entity with its corresponding parent entity), wherein the instructions executable by the processor to cause the apparatus to associate indications of the one or more actions with the node comprise instructions executable by the processor to cause the apparatus to associate indications of the one or more computing objects with the corresponding action of the one or more actions (AMBICHL: par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified).
Regarding Claim 18;
The combination of AMBICHL, GAO, and Anderson disclose the apparatus of claim 15;
AMBICHL discloses wherein the instructions executable by the processor to cause the apparatus to determine if one or more actions are associated with an entity corresponding to the node in the report comprise instructions executable by the processor to, for each process in the process tree, determine if one or more actions were initiated in the process (AMBICHL: par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified), wherein the instructions executable by the processor to cause the apparatus to associate indications of the one or more actions with the node comprises instructions executable by the processor to cause the apparatus to, based on a determination that one or more actions were initiated in the process, associate indications of the one or more actions with the node corresponding to the process (AMBICHL: par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified; par 0104; checks if an abnormal response time behavior was detected on at least one called service. Executed which considers the identified service instances showing a response time anomaly for further causality estimation, e.g. by analyzing service instances called by those service instances in a subsequent execution or by performing a topology stack related causality search on those service instances).
Regarding Claim 19;
The combination of AMBICHL, GAO, and Anderson disclose the apparatus of claim 15,
AMBICHL discloses wherein the depiction of the causality tree comprises a plurality of GUI elements representing nodes of the causality tree and, for each GUI element of the plurality of GUI elements and corresponding node of the causality tree, at least one of a count of the indications of the one or more behaviors associated with the node and a count of the indications of the one or more actions associated with the node (AMBICHL: par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0078; after root cause events were identified by the root cause calculator, the global event graphs forwarded for further processing, like sending notifications to users of the monitoring system, problem and causal dependency visualization; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified; par 0250; determine if the identified maximum difference exceeds a certain threshold and may, therefore, be considered as a significant change; par 0253; Afterwards, decision determines whether a sufficient amount of reference change points is available. In case additional reference change points are required, the process continues with minimum required number of reference change points for this decision).
Regarding Claim 20;
The combination of AMBICHL, GAO, and Anderson disclose the apparatus of claim 15,
AMBICHL discloses wherein the instructions executable by the processor to cause the apparatus associate indications of the at least one of the one or more actions and one or more behaviors with the node comprise instructions executable by the processor to cause the apparatus to associate with the node (AMBICHL: par 0069; causality estimator for a detailed and focused causality analysis. Trigger events contain data specifying the type and the extend of an abnormal operation condition, the location of the abnormal operation condition and data describing the temporal extend of the abnormal operation condition; par 0070; identify topological entities that are connected to topology entities corresponding to identified abnormal operating conditions; par 0102; identification of causal relationships between services showing abnormal response time behavior [] a causality search for response time related abnormal behavior would follow the call direction of the service instance dependency graph and first check service instance for a response time related abnormal behavior that could be have caused the anomaly identified), for each of the at least one of the one of the one or more actions and one or more behaviors, at least one of an identifier, name, description, and associated application programming interface (API) call indicated in the report (AMBICHL: par 0055; a monitoring server interacts with a heterogeneous set of agents and APIs deployed to a monitored environment. The agents may instrument elements of the monitored environments, like processes, host computing systems, network components or virtualization component and use this instrumentation to receive monitoring data describing structure, activities and resource usage of the monitored environment. APIs may provide interfaces for operators of the monitored environment to provide additional data about the monitored environment, like data describing changes in an underlying cloud computing system, or the update of hardware or software components of the monitored environment).
Claims 7, 9, and 21 are rejected under 35 U.S.C. 103 as being unpatentable over AMBICHL et al. (US 20200042426) in view of GAO et al. (CN 108171056 A), and further in view of Anderson et al. (US 20210319172) and Li et al. (“Li,” US 20210064751, published on 03/04/2021).
Regarding Claim 7;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 1,
AMBICHL discloses wherein each node of the plurality of nodes comprises fields for a name of an entity corresponding to the node, a type of the entity, a command executed via a command line, and a process identifier (AMBICHL: par 0116; fig. 2c; an abnormal operating condition was detected on an instance of service. The topology stack related causality analysis may first search for anomalies that occurred on process A that provides service; par 0118; Host computing system B is a virtualized host computing system provided by hypervisor C. Causality analysis may continue by examining hypervisor C for abnormal operating conditions that may explain the abnormal operating conditions identified on service).
The combination of AMBICHL, GAO, and Anderson disclose an entity as recited above, but do not explicitly disclose a type of the entity.
However, in an analogous art, Li discloses malware detection system/method that includes:
a type of the entity (Li: par 0042; the provenance-based threat detection tool can be configured to break provenance graphs into sample or causal paths, as features for detection, and uses the causal paths as the basic components for detection; par 0039; the provenance-based threat detection tool can monitor three types of entities: processes, files, and network communications).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Li with the method/system of The combination of AMBICHL, GAO, and Anderson to include a type of the entity. One would have been motivated to builds a provenance graph including a plurality of paths using a processor device from provenance data obtained from one or more computer systems and/or networks; detects anomalies in the embedded paths to identify malicious process activities, and terminates a process related to the embedded path having the identified malicious process activities (Li: abstract).
Regarding Claim 9;
The combination of AMBICHL, GAO, and Anderson disclose the method of claim 1,
AMBICHL discloses in response to selection of a first of the graphical elements that represents a first node of the causality tree, displaying an indicator of a type of entity corresponding to the first node and descriptions of corresponding ones of the plurality of actions and the plurality of behaviors associated with the first node (AMBICHL: par 0053; Identified transaction execution related anomalies are located on a topology element, and the connection data of the topology model used to identify topology entities that are related to the location. Monitoring data corresponding to those identified topology entities may then be used in a detailed and focused analysis to identify other unexpected operation conditions that are in a causal relationship with the first identified transaction related abnormal operating condition; par 0068; the trigger event generator may monitor the availability of selected topology entities, like host computer systems or processes that are used by a high number of transactions and are therefore of high importance for the functionality of the services provided by the monitored environment ; par 0078; after root cause events were identified by the root cause calculator, the global event graphs forwarded for further processing, like sending notifications to users of the monitoring system, problem and causal dependency visualization).
The combination of AMBICHL, GAO, and Anderson displaying an indicator of entity as recited above, but do not explicitly disclose a type of entity corresponding to the first node and descriptions of corresponding ones of the plurality of actions and the plurality of behaviors associated with the first node.
However, in an analogous art, Li discloses malware detection system/method that includes:
a type of entity corresponding to the first node and descriptions of corresponding ones of the plurality of actions and the plurality of behaviors associated with the first node (Li: par 0042; the provenance-based threat detection tool can be configured to break provenance graphs into sample or causal paths, as features for detection, and uses the causal paths as the basic components for detection; par 0039; the provenance-based threat detection tool can monitor three types of entities: processes, files, and network communications; par 0104; the provenance graph is built from the recorded provenance data, where hatched circles of the graph are nodes representing entities, and edges are events connecting the entities of the observed process. The provenance graph includes a plurality of actions by the process represented by the nodes and edges of the provenance graph. select portion of a provenance graph for a process that was initiated at node and proceeds through nodes. Multiple other processes can also be executing on a system (e.g., computer, network, server, etc.) [] the time stamp of each action can identify where in time the action took place, so the events on a causal graph are temporally ordered).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Li with the method/system of AMBICHL, GAO, and Anderson to include a type of entity corresponding to the first node and descriptions of corresponding ones of the plurality of actions and the plurality of behaviors associated with the first node. One would have been motivated to builds a provenance graph including a plurality of paths using a processor device from provenance data obtained from one or more computer systems and/or networks; detects anomalies in the embedded paths to identify malicious process activities, and terminates a process related to the embedded path having the identified malicious process activities (Li: abstract).
Regarding Claim 21;
The combination of AMBICHL, GAO, and Anderson disclose the non-transitory machine-readable media of claim 12
AMBICHL discloses program code to, in response to selection of a graphical element that represents a first node of the causality tree, displaying an indicator of a type of entity corresponding to the first node and descriptions of the corresponding ones of the plurality of actions and the plurality of behaviors associated with the first node (AMBICHL: par 0053; Identified transaction execution related anomalies are located on a topology element, and the connection data of the topology model used to identify topology entities that are related to the location. Monitoring data corresponding to those identified topology entities may then be used in a detailed and focused analysis to identify other unexpected operation conditions that are in a causal relationship with the first identified transaction related abnormal operating condition; par 0068; the trigger event generator may monitor the availability of selected topology entities, like host computer systems or processes that are used by a high number of transactions and are therefore of high importance for the functionality of the services provided by the monitored environment ; par 0078; after root cause events were identified by the root cause calculator, the global event graphs forwarded for further processing, like sending notifications to users of the monitoring system, problem and causal dependency visualization).
The combination of AMBICHL, GAO, and Anderson displaying an indicator of an entity as recited above, but do not explicitly disclose a type of entity corresponding to the first node and descriptions of the corresponding ones of the plurality of actions and the plurality of behaviors associated with the first node.
However, in an analogous art, Li discloses malware detection system/method that includes:
a type of entity corresponding to the first node and descriptions of the corresponding ones of the plurality of actions and the plurality of behaviors associated with the first node (Li: par 0042; the provenance-based threat detection tool can be configured to break provenance graphs into sample or causal paths, as features for detection, and uses the causal paths as the basic components for detection; par 0039; the provenance-based threat detection tool can monitor three types of entities: processes, files, and network communications; par 0104; the provenance graph is built from the recorded provenance data, where hatched circles of the graph are nodes representing entities, and edges are events connecting the entities of the observed process. The provenance graph includes a plurality of actions by the process represented by the nodes and edges of the provenance graph. select portion of a provenance graph for a process that was initiated at node and proceeds through nodes. Multiple other processes can also be executing on a system (e.g., computer, network, server, etc.) [] the time stamp of each action can identify where in time the action took place, so the events on a causal graph are temporally ordered).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Li with the method/system of AMBICHL, GAO, and Anderson to include a type of entity corresponding to the first node and descriptions of corresponding ones of the plurality of actions and the plurality of behaviors associated with the first node. One would have been motivated to builds a provenance graph including a plurality of paths using a processor device from provenance data obtained from one or more computer systems and/or networks; detects anomalies in the embedded paths to identify malicious process activities, and terminates a process related to the embedded path having the identified malicious process activities (Li: abstract).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHAO WANG whose telephone number is (313)446-6644. The examiner can normally be reached on Monday-Friday 7:30-4:30PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached on (571)270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/C.W./Examiner, Art Unit 2439
/LUU T PHAM/Supervisory Patent Examiner, Art Unit 2439
