CTNF 17/368,627 CTNF 98137 DETAILED ACTION Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Continued Examination Under 37 CFR 1.114 07-42-04 A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 03/05/2026 has been entered. Response to Applicant’s Remarks Regarding 35 USC § 101 rejection, the rejection is maintained. The claims, as amended, lacks sufficient technical details to support a conclusion that they recite a technological improvement. Specifically, the claims fail to adequately explain how the implementation improves the technical field of malware detection and defense against malicious software attacks. Rather, the claimed improvement is directed to the abstract idea itself and does not reflect an improvement to the functioning of a computer or any other technology. The cited portion of paragraph 37, describes a conceptual weighting scheme, i.e.: multiplying a macro node vote by the number of merged individual nodes to reflect relative "strength" of relational dependencies. However, neither the rejected claim nor the amended limitation sets forth specific technical implementation details demonstrating how this selection mechanism improves underlying computer functionality or Malware detection system itself. Claim Rejections - 35 USC § 101 07-04-01 AIA 07-04 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claim(s) 1 – 25 rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e. an abstract idea) without significantly more. In step 1, of the 101-analysis set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, falls within one or more statutory categories (process). In step 2A prong 1, Determine whether a claim recites an abstract idea by (1) identifying the specific limitation(s) in the claim under examination that the examiner believes recites (i.e. sets forth or describes) an abstract idea, and (2) determining whether the identified limitation(s) fall within at least one of the groupings of abstract ideas. Regarding claim 1, expanding …, … a set of nodes to include an additional node generated in response to received data corresponding to an event query (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves expanding or updating a graph by adding a new node based on the data received from an event query. The process of expanding a set of nodes and generating a new node corresponds to building or modifying a graphical data structure (like a network or graph) using the provided data.) generating, …and using the set of nodes, a base graph, (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves creating a graph data structure using a set of nodes.) selecting, …, nodes from the set of nodes to include in the base graph that each have associated therewith a discriminant power that exceeds a predetermined entity threshold (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It includes selecting nodes from a set of nodes based on whether each node’s associated discriminant power exceeds a predetermined threshold to include it to a graph.) traversing the base graph (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It includes navigating a graph data structure by evaluating node connections and paths.) to determine a first inference of an inference ensemble associated with the event query (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of evaluation and judgment, which involves analyzing a received data related to an event, evaluating possible outcomes and making a judgment or forecast.) generating, …and using the set of nodes, a micro-view graph, (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves creating a graph data structure using a set of nodes.) selecting, …, nodes from the set of nodes to include in the micro-view graph that each have associated therewith a number of parent nodes that exceeds a predetermined reference threshold; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It includes selecting nodes from a set of nodes based on a number of parent nodes that exceeds a predetermined reference threshold to include it to a graph.) traversing the micro-view graph (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It includes navigating a graph data structure by evaluating node connections and paths.) to determine a second inference of the inference ensemble, (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of evaluation and judgment, which involves evaluating possible outcomes and making a judgment or forecast.) generating, … and using the set of nodes, a macro-view graph containing one or more committee nodes generated from the set of nodes (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves creating a graph data structure using a set of nodes that are edge-connected to the same parent node.) merging nodes from the set of nodes that are edge-connected to a common parent node to generate the one or more committee nodes ; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves identifying relationships or similarities between nodes and grouping two or more nodes that are edge-connected to the same parent node.) selecting the one or more committee nodes based on having an associated macro-node vote that exceeds a predetermined value; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves selecting nodes that are edge-connected to the same parent node from a set of nodes based on a vote that exceeds a predetermined value.) wherein the associated macro-node vote of each committee node is multiplied by a number of individual nodes merged into the committee node (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: it involves evaluating the relative significance of a committee node based on the number of individual nodes it represents and adjusting the vote accordingly.) traversing the macro-view graph (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It includes navigating a graph data structure by evaluating node connections and paths.) to determine a third inference of the inference ensemble, (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of evaluation and judgment, which involves evaluating possible outcomes and making a judgment or forecast.) generating a response to the event query based on the inference ensemble (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves creating a response to an event, which corresponds to analyzing related data and formulate a reply based on generated predictions.) generating, based on the response, a recommendation associated with guarding against attacks associated with the malware family. (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves analyzing the response and making a judgment to produce a course of action to defend against attacks associated with the malware family.) If the claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process, but for the recitation of generic computer components, then it falls within the mental process. Accordingly, the claim recites an abstract idea. Step 2A Prone: Two: This part of the eligibility analysis evaluates whether the claim as a whole integrates the recited judicial exception into a practical application. As evaluated below: • The preamble is deemed insufficient to transform the judicial exception to a patentable invention to a patentable invention because the preamble generally links the use of a judicial exception to a particular technological environment or field of use, see MPEP 2106.0S(h). … with a processor at run-time…, …by a base graph engine…, … by a micro-view graph engine…, … by a macro-view graph engine…, Deemed insufficient to transform the judicial exception to a patentable invention because the claim recites limitation which does not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer2106.05(f). wherein including the additional node yields one or more traversable paths extending from the additional node to a node associated with a malware family, and wherein the event query is associated with inferring a relationship between the additional node and the malware family ; Deemed insufficient to transform the judicial exception to a patentable invention because, the recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). wherein the response is determined based on identifying the malware family based on a majority vote, wherein the majority vote is determined by two or more of the traversal of the base graph, the traversal of the micro-view graph, or the traversal of the macro-view graph leading to a same node; Deemed insufficient to transform the judicial exception to a patentable invention because, the recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). wherein the same node represents the malware family ; Deemed insufficient to transform the judicial exception to a patentable invention because, the recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). In Step 2B: This part of the eligibility analysis evaluates whether the claim as a whole amount to significantly more than the recited exception, i.e., whether any additional element, or combination of additional elements, adds an inventive concept to the claim. MPEP 2106.05. First, the additional elements considered as part of the preamble are deemed insufficient to transform the judicial exception to a patentable invention because they generally link the judicial exception to the technology environment, see MPEP 2106.05(h). Second, the additional element ( I ) mere application of the abstract idea or mere instructions to implement an abstract idea on a computer are deemed insufficient to transform the judicial exception to a patentable invention because the limitations generally apply the use of a generic computer and/or process with the judicial exception, see MPEP 2106.05(f). Third, the additional elements ( II, III and IV ) deemed insufficient to transform the judicial exception to a patentable invention because they generally link the judicial exception to the technology environment, see MPEP 2106.05(h). Claim(s) 13 and 25 recite similar subject matter as claim 1, so are rejected under the same rationale. Regarding claim 2, dependent upon claim 1, and fail to resolve the deficiencies identified above by integrating the judicial exception into a practical application, or introducing significantly more than the judicial exception. The claim recites: wherein the discriminant power of each node is inversely related to a count of child nodes edge-connected to each node . The recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). Limitations directed to field of use cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. Claim(s) 10, 14, and 22 recite similar subject matter as claim 2, so are rejected under the same rationale. Regarding claim 3, dependent upon claim 1, and fail to resolve the deficiencies identified above by integrating the judicial exception into a practical application, or introducing significantly more than the judicial exception. The claim recites: wherein each parent node belongs to a predefined class and each child node belongs to a different predefined class . The recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). Limitations directed to field of use cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. Claim 15 recites similar subject matter as claim 3, so is rejected under the same rationale. Regarding claim 4, dependent upon claim 1, and fail to resolve the deficiencies identified above by integrating the judicial exception into a practical application, or introducing significantly more than the judicial exception. The claim recites: wherein the macro-view graph is a probabilistic graph model and wherein the associated macro-node vote of each committee node is determined based on a weighted probability that the committee node is edge-connected to a predetermined target node . The recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). Limitations directed to field of use cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. Claim(s) 11, 16 and 23 recite similar subject matter as claim 4, so are rejected under the same rationale. Regarding claim 5, dependent upon claim 1, and fail to resolve the deficiencies identified above by integrating the judicial exception into a practical application, or introducing significantly more than the judicial exception. The claim recites: wherein the received data is one or more indicators of compromise (IoCs) associated with a malware attack and the event query is based on the one or more indicators of compromise (IoCs) . The recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). Limitations directed to field of use cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. Claim 17 recites similar subject matter as claim 5, so is rejected under the same rationale. Regarding claim 6, dependent upon claim 5, and fail to resolve the deficiencies identified above by integrating the judicial exception into a practical application, or introducing significantly more than the judicial exception. The claim recites: wherein the malware family is a likely malware family associated with the one or more IoCs . The recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). Limitations directed to field of use cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. Claim 18 recites similar subject matter as claim 6, so is rejected under the same rationale. Regarding claim 7, dependent upon claim 5, and fail to resolve the deficiencies identified above by integrating the judicial exception into a practical application, or introducing significantly more than the judicial exception. The claim recites: wherein the response is an identifier identifying a likely threat actor that instigated the malware attack . The recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). Limitations directed to field of use cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. Claim 19 recites similar subject matter as claim 7, so is rejected under the same rationale. Regarding claim 8, dependent upon claim 5, and fail to resolve the deficiencies identified above by integrating the judicial exception into a practical application, or introducing significantly more than the judicial exception. The claim recites: wherein the recommendation is that a computer system be defended against one or more malware families associated with a malicious file corresponding to the one or more IoCs . The recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). Limitations directed to field of use cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. Claim 20 recites similar subject matter as claim 8, so is rejected under the same rationale. Regarding claim 9, generating, based on received data corresponding to an event query, a graph ; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves creating a graph by adding a new node based on the data received from an event query.) detecting one or more attributes of each object, of the objects , (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation. It involves gathering and identifying information.) discovering one or more inferential relational dependencies between one or more of the objects, one or more of the nodes and one or more child nodes, including the child node, wherein each inferential relational dependency, of the one or more inferential relational dependencies, is represented by an edge ; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves identifying relationships, patterns, associations, or dependencies between different objects and entities based on observation or reasoning.) determining a discriminant power corresponding to each edge representing each inferential relational dependency, of the one or more inferential relational dependencies, (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves making an observation of how many child nodes a parent node has on a graphical data structure (like a network or graph).) generating a base-view graph by pruning a graph of each child node, of the one or more child nodes, for which a corresponding edge is less than a first predetermined threshold ; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves creating a graph data structure using a set of nodes by removing a child node, which corresponds to edges less than a predetermined threshold.) determining a reference value for each child node, (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves making determination to values for each child nodes.) generating a micro-view graph by pruning the graph of each child node having a reference value that is less than a predetermined value; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves creating a graph by removing child nodes with reference values less than certain threshold.) generating one or more committee nodes by combining the child nodes that are edge- connected to a same node , (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves modifying a graph by combining child nodes with same parent nodes and edges.) determining a macro-node vote for each committee node, of the one or more committee nodes, (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves making determination to values for committee nodes.) generating a macro-view graph by pruning one or more committee nodes having the macro-node vote that is less than a second predetermined threshold; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves creating a graph by removing nodes based on calculated thresholds.) wherein the macro-node vote of each committee node is multiplied by a number of individual nodes merged into the committee node ; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: it involves evaluating the relative significance of a committee node based on the number of individual nodes it represents and adjusting the vote accordingly.) generating a response to the event query based on generating the base-view graph, the micro-view graph, and the macro-view graph, (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves analyzing and organizing information, such as examining a graph structure, to make a determination about a malware classification to generate a course of action in response to an event.) generating a detector tag for each of the one or more attributes, wherein each detector tag is represented as a child node of a node having a data structure that represents an object, of the objects, having an attribute, of the one or more attributes, corresponding to the detector tag ; (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves analyzing information (attribute of objects), labeling it (via tags) and organizing it in a hierarchical data structure (as child nodes under an object node).) generating, based on the response, a recommendation to guard against attacks associated with the likely malware family . (i.e.: the broadest reasonable interpretation, the claim recites abstract idea: mental process: a step of observation, evaluation, and judgment. It involves analyzing the response and making a judgment to produce a course of action to defend against attacks associated with the malware family.) If the claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process, but for the recitation of generic computer components, then it falls within the mental process. Accordingly, the claim recites an abstract idea. Step 2A Prone: Two: This part of the eligibility analysis evaluates whether the claim as a whole integrates the recited judicial exception into a practical application. As evaluated below: • The preamble is deemed insufficient to transform the judicial exception to a patentable invention to a patentable invention because the preamble generally links the use of a judicial exception to a particular technological environment or field of use, see MPEP 2106.0S(h). having a node for each of a plurality of electronically generated data structures Deemed insufficient to transform the judicial exception to a patentable invention because the claim recites limitation which does not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer2106.05(f). wherein the plurality of electronically generated data structures represent objects, wherein the event query is associated with identifying a likely malware family associated with the received data; Deemed insufficient to transform the judicial exception to a patentable invention because, the recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). wherein the response identifies the likely malware family based on a majority vote, Deemed insufficient to transform the judicial exception to a patentable invention because, the recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). wherein the majority vote is determined by two or more of a traversal of the base graph, a traversal of the micro-view graph, or a traversal of the macro-view graph leading to a same node, and wherein the same node represents the likely malware family: Deemed insufficient to transform the judicial exception to a patentable invention because, the recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). In Step 2B: This part of the eligibility analysis evaluates whether the claim as a whole amount to significantly more than the recited exception, i.e., whether any additional element, or combination of additional elements, adds an inventive concept to the claim. MPEP 2106.05. first, the additional element ( I ) mere application of the abstract idea or mere instructions to implement an abstract idea on a computer are deemed insufficient to transform the judicial exception to a patentable invention to a patentable invention because the limitations generally apply the use of a generic computer and/or process with the judicial exception, see MPEP 2106.05(f). second, the additional element ( II, III and IV ) considered as part of the preamble are deemed insufficient to transform the judicial exception to a patentable invention to a patentable invention because they generally link the judicial exception to the technology environment, see MPEP 2106.05(h). Claim 21 recites similar subject matter as claim 9, so is rejected under the same rationale. Regarding claim 12, dependent upon claim 9, and fail to resolve the deficiencies identified above by integrating the judicial exception into a practical application, or introducing significantly more than the judicial exception. The claim recites: wherein the objects include one or more indicators of compromise (IoC) associated with a malware attack . The recitation in the additional limitation simply links the judicial exception to a field of use and/or technology environment, see MPEP 2106.05(h). Limitations directed to field of use cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. Claim 24 recites similar subject matter as claim 12, so is rejected under the same rationale. Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to MATIYAS T MARU whose telephone number is (571)270-0902 or via email: matiyas.maru@uspto.gov. The examiner can normally be reached Monday 8:00am - Friday 4:00pm EST. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Michelle Bechtold can be reached on (571)431-0762. The fax phone number for the organization were this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /M.T.M./Examiner, Art Unit 2148 /MICHELLE T BECHTOLD/Supervisory Patent Examiner, Art Unit 2148 Application/Control Number: 17/368,627 Page 2 Art Unit: 2148 Application/Control Number: 17/368,627 Page 3 Art Unit: 2148 Application/Control Number: 17/368,627 Page 4 Art Unit: 2148 Application/Control Number: 17/368,627 Page 5 Art Unit: 2148 Application/Control Number: 17/368,627 Page 6 Art Unit: 2148 Application/Control Number: 17/368,627 Page 7 Art Unit: 2148 Application/Control Number: 17/368,627 Page 8 Art Unit: 2148 Application/Control Number: 17/368,627 Page 9 Art Unit: 2148 Application/Control Number: 17/368,627 Page 10 Art Unit: 2148 Application/Control Number: 17/368,627 Page 11 Art Unit: 2148 Application/Control Number: 17/368,627 Page 12 Art Unit: 2148 Application/Control Number: 17/368,627 Page 13 Art Unit: 2148 Application/Control Number: 17/368,627 Page 14 Art Unit: 2148 Application/Control Number: 17/368,627 Page 15 Art Unit: 2148 Application/Control Number: 17/368,627 Page 16 Art Unit: 2148 Application/Control Number: 17/368,627 Page 17 Art Unit: 2148 Application/Control Number: 17/368,627 Page 18 Art Unit: 2148
Prosecution Insights