DETAILED ACTION
This Office Action is in response to the Amendments filed on 11/19/2025.
Claims 1-3, 9-11, 16-18 are amended.
Claims 19-21 are cancelled, and Claim 23 has been added.
Claims 1-18, and 21-22 are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed on 11/19/2025 in Remarks pg 9-12, and 13-14 regarding 35 USC 103 rejections to the claims have been fully considered but they are not persuasive.
Applicant argues in essence:
[a] “Lu discusses "processing information associated with detecting and handling malware," where "such methods may include one or more of unpacking and/or decrypting malware samples." Lu, Abstract. At the portions cited by the Office Action, Lu describes "a piece of malware sample code is sent to a malware analyzing platform, appliance, etc." Id. 1 [0042]. Lu further describes that "malware samples typically embed information enabling determination of the needed unpacking/decrypting engine inside its code. Here, then, one or more memory blocks of malware may be obtain after unpacking/decrypting." That is, Lu describes decrypting malware samples to obtain information about the malware samples.
However, features of decrypted malware samples do not teach or suggest "wherein the one or more encrypted machine learning model features include a file header of the computing object, packer information associated with the computing object, and one or more parameters associated with an operating system of the computing system," as recited in amended independent claim 1. For example, Lu describes that "a gatekeeper routine may check the sample from input queue and validate each sample [of malware code]. This validation may include validating PE header information." Id. However, PE header information of a piece of malware sample code is not the same as "wherein the one or more encrypted machine learning model features include a file header," as recited in amended independent claim 1. Indeed, a PE header for malware code that is decrypted by an analyzing platform is not the same as "one or more encrypted machine learning model features include a file header," as recited in amended independent claim 1. Thus, Lu does not teach or suggest "wherein the one or more encrypted machine learning model features include a file header of the computing object, packer information associated with the computing object, and one or more parameters associated with an operating system of the computing system," as recited in amended independent claim 1.” pg. 10-12 of Remarks.
In response to [a], examiner respectfully disagrees. In response to applicant's arguments against the references individually, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986).
Applicant argues in essence that because the machine learning model features of Lu are first decrypted, Lu does not teach the limitations. However, Examiner only relies upon Lu for the types of data that is within the machine learning model features to be analyzed. Primary reference Hoang teaches the concept of encrypting all data to be sent to the server for analysis in step 215 of Fig. 2, prior to the sending step in 225.
That is, Lu discloses each of a file header of the computing object, packer information associated with the computing object, and one or more parameters associated with an operating system of the computing system as shown below, however this information is obtained in a processing that step that decrypts the malware samples to obtain this information. Hoang discloses that in order to analyze the information gathered and the protect the privacy of the customer, all plain text data is encrypted in step 215 in order to protect privacy of the companies that request the analysis in para.0012 and the task of analysis is offloaded to a server in step 225. Therefore even though the decryption occurs in Lu, the data is ultimately encrypted in Hoang prior to analysis at the server.
Therefore it would be obvious to apply the types of information that is obtained in Lu, and incorporate this information to the plaintext data that is sent to the server for analysis, which would all then be encrypted for privacy of the customers, for encrypted analysis performed at the server in step 265 of Fig. 2. Thereby teaching the newly added limitations of the independent claims.
Therefore examiner respectfully disagrees with applicant and relies upon Lu for the rejection of newly added limitations to the independent claims (that incorporate limitations from previous claim 21 that relied upon Lu).
Hoang: para.0019 “On a client 200, the facility subjects plaintext data to homomorphic encryption 215 with a public key 201. The homomorphic encryption produces ciphertext data 220, which the facility sends 225 from the client to a server 250.”
Hoang: Para.0012 “The inventors have identified cases in which conventional solutions for malware detection are not optimal. Namely, these are cases when companies cannot use cloud malware detection providers because their privacy is not protected during the process. Further, when cloud providers cannot be used, companies frequently opt for an in-house solution to protect privacy, but which can be expensive to build and maintain over time.”
Lu discloses a file header of the computing object (Lu: para.0042 “Referring to FIG. 5, a piece of malware sample code is sent to a malware analyzing platform, appliance, etc., at 510, it is received in the repository input queue at 512. Further, at 514, a gatekeeper routine may check the sample from input queue and validate each sample. This validation may include validating PE header information” the portable executable header information is provided.),
packer information associated with the computing object (Lu: para.0042 “As one of the first steps in such analysis process, at 522, the analysis engine may check to determine whether or not a given sample is packed or encrypted. If so, and if the detected packing/encryption is found to be of a known packer, the analysis engine will unpack or decrypt the malware sample.” Packer information is included.),
and one or more parameters associated with an operating system of the computing system (Lu: para.0042 “If not, the analysis engine may invoke the malware sample to run on a relevant OS/platform, such as a Windows OS for malware aimed at a Windows environment (however, the relevant OS/platform could be a different platform depending on the OS to which the malware is targeted)” information that allows determination which operating system the malware could be aimed at is included.).
[b] “Dependent claims 3-15, 18, and 22 each depend from one of independent claims 1, 9, and 16 and are therefore allowable for at least the same reasons that independent claims 1, 9, and 16 are allowable. Dependent claims 3-15, 18, and 22 also recite allowable features that have not been shown to be taught or suggested by Hoang, Wing, Lu, and Donovan, alone or in any combination.”
In response to [b], applicant argues that because these claims are dependent on allowable claims these claims are also allowable. Examiner respectfully disagrees as the independent claims remain rejected; this argument does not apply.
Applicant further argues that these claims recite features that are not taught or suggested by Hoang, Wing, Lu and Donovan, however only states that this is true without any rationale regarding the teachings of these reference. Therefore examiner maintains rejection for each of these claims under the same rationale and combination of references.
[c] “New claim 23 is added herein. Dependent claim 23 depends from independent claim 1 and is therefore allowable for at least the same reasons that independent claim 53 is allowable. Moreover, dependent claims 23 recites inventive features that have not been shown to be taught or suggested by Hoang, Wing, Lu, and Donovan, alone or in any combination.” Pg. 14 of Remarks.
In response to [c], examiner respectfully disagrees. Claim 23 reads “receiving, from the computing system, a request to transmit the indication of the script that comprises code operable to generate and encrypt the machine learning model features, wherein transmitting the indication of the script is based at least in part on the request.”
Hoang and Wing are relied upon for claim 23. Hoang teaches the usage of a script that generates and encrypts the machine learning model features in para.0024 and para.0019 as shown below, however does not explicitly disclose how this script is received. Wing discloses the concept of the client device sending a request in para.0216 and para.0012-0013 wherein a user selects an option on his/her device for the type of analysis that needs to be performed, and in response to the request, a script that corresponds to that type of analysis is obtained from the server, as seen below.
Therefore examiner rejects new claim 23 in view of Hoang and Wing, explained in more detail below.
Hoang: para.0019 “On a client 200, the facility subjects plaintext data to homomorphic encryption 215 with a public key 201. The homomorphic encryption produces ciphertext data 220, which the facility sends 225 from the client to a server 250.”
Wing: para.0216 “ In addition, a link 3604 may be provided to allow the user to automatically initiate a defragmentation utility. Therefore, a user may defragment a hard disk drive 336 simply be selecting the appropriate link (e.g., defragmentation link 3604) without needing to locate a program capable of defragmenting the hard disk drive 336. Alternatively, in response to selection of the defragmentation link 3604, a defragmentation script or utility may be downloaded from the server 104 to the client computer 108 to allow defragmentation of the disk drive 336 to be performed.”
Wing para.0013 “According to still another embodiment of the present invention, the user of the client computer is prompted to specify whether the problem is believed to be a hardware, software or performance problem. Based on the user's selection, additional scripts or commands may be downloaded to the client application and executed. For instance, if a user specifies a software problem, a script may be downloaded to the client application to determine the nature of the problem.”
Applicant’s arguments with respect to the 35 USC 103 rejection of claims 2, 10 and 17 filed in Remarks pg. 12-13 on 11/19/2025 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 4-9, 12-16 and 23 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hoang et al. (hereinafter Hoang, US 2021/0326439 A1) in view of Wing et al. (hereinafter Wing, US 2004/0236843 A1) in view of Lu (US 2013/0091571 A1).
Regarding Claim 1, Hoang teaches A method for data management, comprising: a script that comprises code operable to generate and encrypt machine learning model features associated with a computing object (Hoang: para.0024 “Here, the encrypted data contains any data necessary about the suspecting file so that the server can adequately perform its malware detection process. ” data about a particular file) of the computing system (Hoang: para.0019 “On a client 200, the facility subjects plaintext data to homomorphic encryption 215 with a public key 201. The homomorphic encryption produces ciphertext data 220, which the facility sends 225 from the client to a server 250. On the server, the facility subjects the ciphertext data 260 to a homomorphic computation 265 to produce a ciphertext result 270. The server sends 275 the ciphertext result from the server to the client. On the client, the facility subjects the ciphertext result 230 to homomorphic decryption 235 with a secret key 202 possessed by the client. This homomorphic decryption produces a plaintext result 240.” Para.0087-0089 “The server performs homomorphic operations, such as to execute a machine learning algorithm, to return an encrypted detection result.” The client device 200 Fig. 2, performs a series of steps that encrypt the features of the suspecting file, to be sent to the server for machine learning analysis. Therefore, the client device comprises a script, i.e. a series of instructions, for generating and encrypting the machine learning model features.);
transmitting, by the data management system to the computing system backed up by the data management system (Hoang: Fig. 3, para.0024 the server transmits to the client.), first signaling that instructs the computing system to execute the code of the script, (Hoang: para.0024 “ Here, the encrypted data contains any data necessary about the suspecting file so that the server can adequately perform its malware detection process. ” data about a particular file) of the computing system (Hoang: para.0024 “First, the sender/client 310 and receiver/server 320 perform a handshake 315 in which they share encryption parameters, a data format, and any other information needed in order to exchange encrypted data. After the handshake, the sender/client sends encrypted data 335 to the receiver/server 340, which replies with an encrypted result 345.” A handshake agreement is made between client and server in Fig. 3 315. This process instructions are sent between devices wherein they share encryption parameters, format and other information; therefore, this is an instruction to activate the script, i.e. series of instructions, that is stored on the client device to encrypt and send machine learning model features. Para.0087-0089 “The server performs homomorphic operations, such as to execute a machine learning algorithm, to return an encrypted detection result. The client finally receives and decrypts the detection result with its private key.” shows that machine learning algorithms are used to generate the encrypted result)
wherein an execution of the code extracts one or more machine learning model features indicative of a presence of malware on the computing object and encrypts the one or more machine learning model features (Hoang: para.0093-0097 “3. The client performs malware detonation on one or more suspicious files to collect behavior information. The client further preprocesses these behavior data into a format as agreed upon in step 1. 4. In the online phase: a. The client encrypts the formatted data according to the encryption schema as agreed upon in step 1 and sends the ciphertexts to the server. b. The server executes the pretrained malware detection model in inference mode using homomorphic operations and sends encrypted predictions back to the client.” The set of instructions that are executed include obtaining behavior data of the suspicious files, i.e. the machine learning model features, and encrypts this files prior to sending the encrypted behavior data to the server, which are then input to a machine learning model.);
receiving, at the data management system from the computing system, second signaling comprising the one or more encrypted machine learning model features (Hoang: para.0024 “After the handshake, the sender/client sends encrypted data 335 to the receiver/server 340,” the encrypted machine learning model features are received. Fig. 3 335.);
generating, using a machine learning model and the one or more encrypted machine learning model features as inputs to the machine learning model, an encrypted indication of whether malware is present on the computing object (Hoang: para.0094-0097 “b. The server executes the pretrained malware detection model in inference mode using homomorphic operations and sends encrypted predictions back to the client.” Para.0087 “This method protects the privacy of the client who desires to learn if the behavior is malicious but does not wish to share the result with outsiders. At a high level, the facility lets the client encrypt the behavior data, according to a predefined format and schema, and send the ciphertexts to the server. The server performs homomorphic operations, such as to execute a machine learning algorithm, to return an encrypted detection result.” para.0024 “ Here, the encrypted data contains any data necessary about the suspecting file so that the server can adequately perform its malware detection process. ” The server inputs the machine learning model features into the machine learning model and determines if malware is present on the file of client device.); and
transmitting, from the data management system to the computing system, the encrypted indication (Hoang: para.0024 “ After the handshake, the sender/client sends encrypted data 335 to the receiver/server 340, which replies with an encrypted result 345.” Para.0094-0097 “b. The server executes the pretrained malware detection model in inference mode using homomorphic operations and sends encrypted predictions back to the client..” Fig. 3 345, the encrypted results are sent back to the client.).
However Hoang does not explicitly disclose transmitting, by a data management system to a computing system backed up by the data management system, an indication of a script that comprises code operable to generate and encrypt machine learning model features associated with a computing object, wherein the one or more encrypted machine learning model features include a file header of the computing object, packer information associated with the computing object, and one or more parameters associated with an operating system of the computing system; in a 2 step process wherein the script is first loaded to the computing system, and in a second step activated by the data management system.
Wing discloses transmitting, by a data management system to a computing system backed up by the data management system, an indication of a script that comprises code operable to generate features associated with a computing object (Wing: para.0012 “Next, a script or command, for execution using the client application, is downloaded to the client computer.” Para.0013 “For instance, if a user specifies a software problem, a script may be downloaded to the client application to determine the nature of the problem. For instance, upon execution, such a script can instruct the user to start the problem application. The script may then determine the amount of time required for the computer to load the application, or may collect an error message generated in response to the user's attempt to start the problem application and return that error message to the server for analysis.” A script is downloaded by the client computer from the server to diagnose software, and the script is operable to obtain features of the problem application such that the information can be returned to the server for analysis.)
transmitting, by the data management system to the computing system backed up by the data management system first signaling that instructs the computing system to execute the code of the script (Wing: para.0011 “According to still another embodiment of the present invention, the client application polls a server application running on a remotely located server. In particular, the client application polls the server for instructions concerning a next operation to be performed in connection with the computer. For instance, the client application may poll a server application for an instruction to execute a script or command.” para.0012 “The indication to execute the script or command maybe provided in response to a signal from the browser or other communications interface authorizing such execution. Upon detection of the indication, the script is executed, and the results are returned to the server.” Para.0009 “In general, the scripts comprise diagnostic tools for collecting various information regarding the client computer. The results obtained from executing the client scripts or individual commands are returned to the diagnosing server. The returned results are compared to stored results using a rules based analysis, and a disposition is returned to the browser of the computer.” The client computer waits until an indication is received from the server to activate the script, and after the server provides the indication to execute the script, the script is executed to obtain diagnostic information to be sent to the server for analysis.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Hoang with Wing to incorporate transmitting, by a data management system to a computing system backed up by the data management system, an indication of a script that comprises code operable to generate features associated with a computing object, and apply this technique to the malware detection in Hoang, and thereby perform the simple substitution of (the client device already having a script to generate machine learning feature data) in Hoang with (transmitting, by a data management system to a computing system backed up by the data management system, an indication of a script that comprises code operable to generate features associated with a computing object, and later activating the script by the data management system) in Hoang.
The simple substitution of (the client device already having a script to generate machine learning feature data) for another (transmitting, by a data management system to a computing system backed up by the data management system, an indication of a script that comprises code operable to generate features associated with a computing object) would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention because the substitution would have yielded predictable results, namely activating a series of instructions to obtain feature data for analysis for identification of issues at another computing system (Hoang: para.0024, Wing: para.0013).
However Hoang-Wing does not explicitly disclose wherein the one or more encrypted machine learning model features include a file header of the computing object, packer information associated with the computing object, and one or more parameters associated with an operating system of the computing system.
Lu disclose wherein the features (Lu: Fig. 8 para.0051-0052 “Malware classification components or features consistent with the innovations herein may perform processes such as classifying malware as a particular type of malware and/or grouping malware variants that belong to subject families as a function of the classification analysis….Another classification aspect herein relates to grouping all variants that belong to the same family, e.g., as a function of the malware behavior. Here, for example, new malware variants that use different packer” features of the received file are used to classify malware into various categories.)
include a file header of the computing object (Lu: para.0042 “Referring to FIG. 5, a piece of malware sample code is sent to a malware analyzing platform, appliance, etc., at 510, it is received in the repository input queue at 512. Further, at 514, a gatekeeper routine may check the sample from input queue and validate each sample. This validation may include validating PE header information” the portable executable header information is provided.),
packer information associated with the computing object (Lu: para.0042 “As one of the first steps in such analysis process, at 522, the analysis engine may check to determine whether or not a given sample is packed or encrypted. If so, and if the detected packing/encryption is found to be of a known packer, the analysis engine will unpack or decrypt the malware sample.” Packer information is included.),
and one or more parameters associated with an operating system of the computing system (Lu: para.0042 “If not, the analysis engine may invoke the malware sample to run on a relevant OS/platform, such as a Windows OS for malware aimed at a Windows environment (however, the relevant OS/platform could be a different platform depending on the OS to which the malware is targeted)” information that allows determination which operating system the malware could be aimed at is included.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Hoang- Wing with Lu in order to incorporate wherein the one or more features include a file header of the computing object, packer information associated with the computing object, and one or more parameters associated with an operating system of the computing system, and apply these features of potential malware to the information that is encrypted and sent to the machine learning model of Hoang.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved malware detection (Lu: abstract, para.0002, para.0017).
Regarding Claim 4, Hoang-Wing-Lu discloses claim 1 as set forth above.
Hoang further discloses refraining, at the data management system, from accessing data of the computing object in association with determining whether malware is present on the computing object based at least in part on generating the encrypted indication using the one or more encrypted machine learning model features (Examiner notes that this limitation is reference in specification para.0049 and para.0096. “By implementing these malware detection techniques, the DMS 210 may support increased data privacy and security while supporting malware detection. For example, because the DMS 210 may be able to use encrypted ML model features 230 to detect the presence of malware on the computing object 215 and generate the encrypted indication 245, the DMS 210 may refrain from (e.g., directly) accessing data of the computing object 215 (e.g., plain text data, unencrypted data) in association with (e.g., as part of) determining whether malware is present on the computing object 215.” And step 920 in Fig. 9. The act of refraining is defined to be an act of processing the data without “directly” accessing the data. Hoang: para.0088 “In the online phase, the server executes the machine learning model in inference mode over homomorphic ciphertexts, which returns predictions that are also encrypted. To make sure the model is up to date with latest threat, the offline model training process is repeated periodically as soon as new malware data is available.” Para.0094-0097 “b. The server executes the pretrained malware detection model in inference mode using homomorphic operations and sends encrypted predictions back to the client.” In each embodiment of Hoang, the ciphertext from the client device is never decrypted, and computed using machine learning processes in its encrypted form using homomorphic computations, and the results are also outputted in encrypted format, therefore the system refrains from accessing data of the computing object in the same way as described in application specification.).
Regarding Claim 5, Hoang-Wing-Lu discloses claim 1 as set forth above.
Hoang further discloses wherein presence or absence of malware on the computing object is unknown to the data management system based at least in part on using the one or more encrypted machine learning model features to generate the encrypted indication (Hoang: para.0015 “A facility for zero trust malware detection in a two-party setup between a client and a server is described. In some embodiments, the client (or “sender”) uses homomorphic encryption to encrypt its data. The encrypted ciphertexts are sent to the server (or “receiver”), who performs the desired processing and returns the encrypted result to the client. The client uses its secret key to decrypt the server's result to obtain the final detection in plaintext. In this way, the client can detect malware while fully preserving its privacy.” Para.0019 “FIG. 2 is a flow diagram showing a client-server homomorphic computation process performed by the facility in some embodiments to encrypt the input data with a homomorphic encryption scheme using the public key on the client, send the input ciphertext to the server, perform some computation on the server to produce an output ciphertext (or ciphertexts), send the output ciphertext(s) back to the client, decrypt the output ciphertext to obtain the plaintext result. Note that in this process, only the client has access to the secret key. On a client 200, the facility subjects plaintext data to homomorphic encryption 215 with a public key 201. The homomorphic encryption produces ciphertext data 220, which the facility sends 225 from the client to a server 250. On the server, the facility subjects the ciphertext data 260 to a homomorphic computation 265 to produce a ciphertext result 270. The server sends 275 the ciphertext result from the server to the client. On the client, the facility subjects the ciphertext result 230 to homomorphic decryption 235 with a secret key 202 possessed by the client. This homomorphic decryption produces a plaintext result 240.” The server never decrypts the homomorphic encrypted data prior to determining the result, and never knows the result of the machine learning process for malware, and sends the encrypted result to the client.).
Regarding Claim 6, Hoang-Wing-Lu discloses claim 1 as set forth above.
However Hoang- Wing does not explicitly disclose wherein the one or more machine learning model features comprise a file size of the computing object, one or more changes to the file size of the computing object, a file header of the computing object, a time of creation of the computing object, an entropy associated with the computing object, packer information associated with the computing object, one or more parameters associated with an operating system of the computing system, or any combination thereof.
Lu discloses wherein the one or more features (Lu: Fig. 8 para.0051-0052 “Malware classification components or features consistent with the innovations herein may perform processes such as classifying malware as a particular type of malware and/or grouping malware variants that belong to subject families as a function of the classification analysis….Another classification aspect herein relates to grouping all variants that belong to the same family, e.g., as a function of the malware behavior. Here, for example, new malware variants that use different packer” features of the received file are used to classify malware into various categories.)
comprise a file size of the computing object, one or more changes to the file size of the computing object, a file header of the computing object (Lu: para.0042 “Referring to FIG. 5, a piece of malware sample code is sent to a malware analyzing platform, appliance, etc., at 510, it is received in the repository input queue at 512. Further, at 514, a gatekeeper routine may check the sample from input queue and validate each sample. This validation may include validating PE header information” the portable executable header information is provided.),
a time of creation of the computing object, an entropy associated with the computing object, packer information associated with the computing object (Lu: para.0042 “As one of the first steps in such analysis process, at 522, the analysis engine may check to determine whether or not a given sample is packed or encrypted. If so, and if the detected packing/encryption is found to be of a known packer, the analysis engine will unpack or decrypt the malware sample.” Packer information is included.),
one or more parameters associated with an operating system of the computing system, or any combination thereof (Lu: para.0042 “If not, the analysis engine may invoke the malware sample to run on a relevant OS/platform, such as a Windows OS for malware aimed at a Windows environment (however, the relevant OS/platform could be a different platform depending on the OS to which the malware is targeted)” information that allows determination which operating system the malware could be aimed at is included.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Hoang- Wing with Lu in order to incorporate wherein the one or more features comprise a file size of the computing object, one or more changes to the file size of the computing object, a file header of the computing object, a time of creation of the computing object, an entropy associated with the computing object, packer information associated with the computing object, one or more parameters associated with an operating system of the computing system, or any combination thereof, and apply these features of potential malware to the machine learning model of Hoang.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved malware detection (Lu: abstract, para.0002, para.0017).
Regarding Claim 7, Hoang-Wing-Lu discloses claim 1 as set forth above.
Hoang further discloses wherein the indication of whether malware is present on the computing object is encrypted based at least in part on using the one or more encrypted machine learning model features as the inputs to the machine learning model (Hoang: para.0094-0097 “a. The client encrypts the formatted data according to the encryption schema as agreed upon in step 1 and sends the ciphertexts to the server. b. The server executes the pretrained malware detection model in inference mode using homomorphic operations and sends encrypted predictions back to the client. c. The client decrypts the prediction results.” The input to the machine learning process for malware detection is encrypted, and the output is encrypted.).
Regarding Claim 8, Hoang-Wing-Lu discloses claim 1 as set forth above.
Hoang further discloses wherein: the one or more machine learning model features are encrypted based at least in part on a public key associated with the computing system, and the encrypted indication is decrypted based at least in part on a private key associated with the computing system (Hoang: para.0019 “FIG. 2 is a flow diagram showing a client-server homomorphic computation process performed by the facility in some embodiments to encrypt the input data with a homomorphic encryption scheme using the public key on the client, send the input ciphertext to the server, perform some computation on the server to produce an output ciphertext (or ciphertexts), send the output ciphertext(s) back to the client, decrypt the output ciphertext to obtain the plaintext result. Note that in this process, only the client has access to the secret key. … On the client, the facility subjects the ciphertext result 230 to homomorphic decryption 235 with a secret key 202 possessed by the client.” The client uses a public key to first encrypt the data, and decrypts the encrypted result using a secret key, 215 and 202 in Fig. 2.).
Regarding Claims 9, 12-15, they recite the same steps as Claims 1, 5-8 but in An apparatus for data management, comprising: at least one processor; memory coupled with the at least one processor; and instructions stored in the memory and executable by the at least one processor to cause the apparatus to: (Hoang: para.0107), therefore the supporting rationale for the rejection to 1, 5-8 apply equally as well to that of claims 9, 12-15.
Regarding Claims 16 it recites the same steps as claim 1 but in A non-transitory computer-readable medium storing code for data management, the code comprising instructions executable by at least one processor to: (Hoang: para.0106), therefore the supporting rationale for the rejection to claim 1 apply equally as well to that of claim 16.
Regarding Claim 23, Hoang-Wing-Lu discloses claim 1 as set forth above.
Hoang further discloses the indication of the script that comprises code operable to generate and encrypt the machine learning model features (Hoang: para.0024 “Here, the encrypted data contains any data necessary about the suspecting file so that the server can adequately perform its malware detection process. ” data about a particular file) of the computing system (Hoang: para.0019 “On a client 200, the facility subjects plaintext data to homomorphic encryption 215 with a public key 201. The homomorphic encryption produces ciphertext data 220, which the facility sends 225 from the client to a server 250. On the server, the facility subjects the ciphertext data 260 to a homomorphic computation 265 to produce a ciphertext result 270. The server sends 275 the ciphertext result from the server to the client. On the client, the facility subjects the ciphertext result 230 to homomorphic decryption 235 with a secret key 202 possessed by the client. This homomorphic decryption produces a plaintext result 240.” Para.0087-0089 “The server performs homomorphic operations, such as to execute a machine learning algorithm, to return an encrypted detection result.” The client device 200 Fig. 2, performs a series of steps that encrypt the features of the suspecting file, to be sent to the server for machine learning analysis. Therefore, the client device comprises a script, i.e. a series of instructions, for generating and encrypting the machine learning model features.),
However Hoang does not explicitly disclose receiving, from the computing system, a request to transmit the indication of the script that comprises code operable to generate and encrypt the machine learning model features, wherein transmitting the indication of the script is based at least in part on the request.
Wing discloses receiving, from the computing system, a request to transmit the indication of the script (Wing: para.0216 “ In addition, a link 3604 may be provided to allow the user to automatically initiate a defragmentation utility. Therefore, a user may defragment a hard disk drive 336 simply be selecting the appropriate link (e.g., defragmentation link 3604) without needing to locate a program capable of defragmenting the hard disk drive 336. Alternatively, in response to selection of the defragmentation link 3604, a defragmentation script or utility may be downloaded from the server 104 to the client computer 108 to allow defragmentation of the disk drive 336 to be performed.” para.0013 “According to still another embodiment of the present invention, the user of the client computer is prompted to specify whether the problem is believed to be a hardware, software or performance problem. Based on the user's selection, additional scripts or commands may be downloaded to the client application and executed. For instance, if a user specifies a software problem, a script may be downloaded to the client application to determine the nature of the problem.” The client device is presented with a link or option for particular scripts. Once a user selects an option or link, the script is downloaded onto the client device. Therefore the selection of these options is a request that is sent to the server to download the scripts.)
that comprises code operable to generate features (Wing: para.0012 “Next, a script or command, for execution using the client application, is downloaded to the client computer.” Para.0013 “For instance, if a user specifies a software problem, a script may be downloaded to the client application to determine the nature of the problem. For instance, upon execution, such a script can instruct the user to start the problem application. The script may then determine the amount of time required for the computer to load the application, or may collect an error message generated in response to the user's attempt to start the problem application and return that error message to the server for analysis.” A script is downloaded by the client computer from the server to diagnose software, and the script is operable to obtain features of the problem application such that the information can be returned to the server for analysis.),
wherein transmitting the indication of the script is based at least in part on the request (Wing: para.0216 “ In addition, a link 3604 may be provided to allow the user to automatically initiate a defragmentation utility. Therefore, a user may defragment a hard disk drive 336 simply be selecting the appropriate link (e.g., defragmentation link 3604) without needing to locate a program capable of defragmenting the hard disk drive 336. Alternatively, in response to selection of the defragmentation link 3604, a defragmentation script or utility may be downloaded from the server 104 to the client computer 108 to allow defragmentation of the disk drive 336 to be performed.” para.0013 “According to still another embodiment of the present invention, the user of the client computer is prompted to specify whether the problem is believed to be a hardware, software or performance problem. Based on the user's selection, additional scripts or commands may be downloaded to the client application and executed. For instance, if a user specifies a software problem, a script may be downloaded to the client application to determine the nature of the problem.” The transmission, i.e. downloading, of the script is based on the selection of the link or indication of which problem to solve, i.e. the request).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Hoang and Wing in order to incorporate receiving, from the computing system, a request to transmit the indication of the script that comprises code operable to generate features, wherein transmitting the indication of the script is based at least in part on the request, and apply this to the indication of the script that comprises code operable to generate and encrypt the machine learning model features as described in Hoang.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of effective and cost efficient diagnosis (Wing: para.0002-0003).
Claim(s) 2-3, 10-11, and 17-18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hoang et al. (hereinafter Hoang, US 2021/0326439 A1) in view of Wing et al. (hereinafter Wing, US 2004/0236843 A1) in view of Lu (US 2013/0091571 A1) in view of Graves et al. (hereinafter Graves, US 2023/0362177 A1).
Regarding Claim 2, Hoang-Wing-Lu discloses claim 1 as set forth above.
Hoang further discloses receiving, at the data management system threat information comprising a set of unencrypted machine learning model features (Hoang: para.0088 “To make sure the model is up to date with latest threat, the offline model training process is repeated periodically as soon as new malware data is available.” Para.0092-0097 “2. In the offline phase, the server trains a machine learning model to detect malware based on plaintext behavior data. The training process is repeated whenever new data is available...” as new plaintext malware data is available, i.e. unencrypted, the machine learning model is trained, therefore the system occasionally receives new data, i.e. threat information.)
using the training data to train the machine learning model to detect the presence of malware on the computing object, wherein generating the encrypted indication is based at least in part on training the machine learning model using the training data (Hoang: para.0088 “In some embodiments, the facility trains a machine learning model, in the offline phase, to be used by the server to predict whether the provided behavior data is malware or benign. The model training uses data from known malware behavior and is done entirely in plaintext. As this process is completely contained within the server, there is no concern about privacy or security of the data. In the online phase, the server executes the machine learning model in inference mode over homomorphic ciphertexts, which returns predictions that are also encrypted. To make sure the model is up to date with latest threat, the offline model training process is repeated periodically as soon as new malware data is available.” Para.0092-0097 “2. In the offline phase, the server trains a machine learning model to detect malware based on plaintext behavior data. The training process is repeated whenever new data is available... b. The server executes the pretrained malware detection model in inference mode using homomorphic operations and sends encrypted predictions back to the client.” The machine learning model is trained on plaintext data, that is the new plaintext data is used as training data, and used to generated encrypted results for the client.)
However Hoang-Wing-Lu does not explicitly disclose receiving, at the data management system and from a malware database, threat information comprising a set of unencrypted machine learning model features, wherein a first subset of the set of unencrypted machine learning model features are indicative of a presence of malware on computing objects and a second subset of the set of unencrypted machine learning model features are indicative of an absence of malware on computing objects; converting the set of unencrypted machine learning model features into training data.
Graves discloses receiving, at the data management system and from a malware database (Graves: Fig. 1 data store 120 para.0063 “In one or more embodiments, the server computer system 110 may obtain the training set of network data from the data store 120”), threat information comprising a set of unencrypted machine learning model features (Graves: para.0062 “The method 200 includes obtaining a training set of network data that includes benign network data and malware network data (step 210).” A training set of network data comprises unencrypted machine learning model features of benign and malware network data.),
wherein a first subset of the set of unencrypted machine learning model features are indicative of a presence of malware on computing objects and a second subset of the set of unencrypted machine learning model features are indicative of an absence of malware on computing objects (Graves: para.0063 “In one or more embodiments, the server computer system 110 may obtain the training set of network data from the data store 120. As mentioned, the malware network data may be generated by the malware engine 130. The benign network data includes network data that is known to be benign and the malware network data includes network data that is known to be malware.” The training set comprises known malware network data and known benign network data. This training set for both benign and malware network data comprise features, as feature extraction is performed in step 220 from this data in Fig. 2.);
converting the set of unencrypted machine learning model features (Graves: para.0071 training set) into training data (Graves: para.0071 dryads) (Graves: para.0071 “The method 200 includes engaging a feature extraction engine to generate a set of dyads for each source-destination pair in the training set of network data (step 220).” Para.0072 “As mentioned, to generate the set of dyads for each source-destination pair in the network data, the feature extraction engine 140 may analyze the network data to categorize the network data by source-destination pair. For each source-destination pair, the set of dyads may include a number of flow events, a mean of bytes down, a standard deviation of bytes down, a mean of bytes up, a standard deviation of bytes up, a communication interval mean, a communication interval standard deviation, a communication interval skew, a communication interval kurtosis, a number of local end points that made a connection to the destination and a number of remote end points that the local endpoint connected to.” The training data obtained in step 210, i.e. the set of unencrypted machine learning model features, are converted into dryads, i.e. training data.); and
using the training data to train the machine learning model to detect the presence of malware on the computing object (Graves: para.0073 “The method 200 includes training, using the set of dyads, a machine learning engine to differentiate between the benign network data and the malware network data (step 230).” The dryads, i.e. the training data, is used to train the machine learning model.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Hoang-Wing-Lu with Graves in order to incorporate receiving, at the data management system and from a malware database, threat information comprising a set of unencrypted machine learning model features, wherein a first subset of the set of unencrypted machine learning model features are indicative of a presence of malware on computing objects and a second subset of the set of unencrypted machine learning model features are indicative of an absence of malware on computing objects; converting the set of unencrypted machine learning model features into training data.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improving detection of malware (Graves: para.0003).
Regarding Claim 3, Hoang-Wing-Lu-Graves discloses claim 2 as set forth above.
Hoang further discloses the one or more machine learning model features are encrypted according to a homomorphic encryption scheme (Hoang: para.0015 “In some embodiments, the client (or “sender”) uses homomorphic encryption to encrypt its data. The encrypted ciphertexts are sent to the server (or “receiver”), who performs the desired processing and returns the encrypted result to the client.” The client uses homomorphic encryption to encrypt the data prior to sending to the server in Fig. 2), and
the machine learning model trained using the set of unencrypted machine learning model features is used to detect whether malware is present on the computing object using the one or more encrypted machine learning model features as inputs based at least in part on the one or more machine learning model features being encrypted according to the homomorphic encryption scheme (Hoang: para.0019 “On the server, the facility subjects the ciphertext data 260 to a homomorphic computation 265 to produce a ciphertext result 270. The server sends 275 the ciphertext result from the server to the client. On the client, the facility subjects the ciphertext result 230 to homomorphic decryption 235 with a secret key 202 possessed by the client. This homomorphic decryption produces a plaintext result 240.” Para.0094-0097 “b. The server executes the pretrained malware detection model in inference mode using homomorphic operations and sends encrypted predictions back to the client..” Fig. 2-3 the encrypted data that is subject to machine learning processes to obtain the result are encrypted using homomorphic encryption, and the encrypted result is sent back in homomorphic encrypted format.).
Regarding Claims 10-11, and 17-18, they do not teach nor further define over the limitations of claims 2-3, therefore the supporting rationale for the rejection of claims 2-3 apply equally as well to that of claims 10-11 and 17-18.
Claim(s) 22 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hoang et al. (hereinafter Hoang, US 2021/0326439 A1) in view of Wing et al. (hereinafter Wing, US 2004/0236843 A1) in view of Lu (US 2013/0091571 A1) in view of Donovan et al. (hereinafter Donovan, US 11,403,405 B1).
Regarding Claim 22, Hoang-Wing-Lu discloses claim 1 as set forth above.
Hoang further discloses wherein the script comprises the code operable to generate and encrypt the machine learning model features (Hoang: para.0019 “On a client 200, the facility subjects plaintext data to homomorphic encryption 215 with a public key 201. The homomorphic encryption produces ciphertext data 220, which the facility sends 225 from the client to a server 250. On the server, the facility subjects the ciphertext data 260 to a homomorphic computation 265 to produce a ciphertext result 270. The server sends 275 the ciphertext result from the server to the client. On the client, the facility subjects the ciphertext result 230 to homomorphic decryption 235 with a secret key 202 possessed by the client. This homomorphic decryption produces a plaintext result 240.” Para.0087-0089 “The server performs homomorphic operations, such as to execute a machine learning algorithm, to return an encrypted detection result.” The client device 200 Fig. 2, performs a series of steps that encrypt the features of the suspecting file, to be sent to the server for machine learning analysis. Therefore, the client device comprises code for generating and encrypting the machine learning model features.).
While Hoang disclose the script itself being able to generate and encrypt the machine learning model features, Hoang does not explicitly disclose wherein the indication of the script comprises the code operable to encrypt the machine learning model features.
Wing discloses wherein the indication of the script comprises the code operable to generate diagnostic features (Wing: Para.0009 “In general, the scripts comprise diagnostic tools for collecting various information regarding the client computer. The results obtained from executing the client scripts or individual commands are returned to the diagnosing server. The returned results are compared to stored results using a rules based analysis, and a disposition is returned to the browser of the computer.” para.0012 “Next, a script or command, for execution using the client application, is downloaded to the client computer.” Para.0013 “For instance, if a user specifies a software problem, a script may be downloaded to the client application to determine the nature of the problem. For instance, upon execution, such a script can instruct the user to start the problem application. The script may then determine the amount of time required for the computer to load the application, or may collect an error message generated in response to the user's attempt to start the problem application and return that error message to the server for analysis.” A script is downloaded by the client computer from the server to diagnose software, and the script is operable to obtain features of the problem application such that the information can be returned to the server for analysis.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Hoang with Wing to incorporate wherein the indication of the script comprises the code operable to generate diagnostic features i.e. obtaining a script comprising code that for obtaining data for diagnosing a piece of software para.0009, para.0012 in Wing, and apply this technique to the malware detection code in Hoang, and thereby perform the simple substitution of (the client device already having a script to generate and encrypt machine learning feature data) in Hoang with (obtaining a script prior to activation for diagnosing a software issue) in Wing, such that the code operable to generate and encrypt the machine learning model features, is obtained from the server prior to activation.
The simple substitution of (the client device already having a script to generate machine learning feature data) for another (obtaining a script prior to activation for diagnosing a software issue) would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention because the substitution would have yielded predictable results, namely activating a series of instructions to obtain feature data for analysis for identification of issues at another computing system (Hoang: para.0024, Wing: para.0013).
However, while Hoang teach the concept of a script that is able to encrypt and generate machine learning features, and Wing teaches providing a script to be later activated to obtain the results of the script, Hoang-Wing-Lu does not explicitly disclose wherein the indication of the script comprises the code operable to encrypt the machine learning model features, i.e. the received code itself contains instructions to encrypt the results.
Donovan discloses wherein the indication of the script comprises the code operable to generate and encrypt the features (Donovan: Fig. 3 302, 312 col. 7 lines 30-40 “The method may begin at step 302, where the computer may transmit test instructions to an embedded non-IP device based upon a test script. The test script may be provided by a user through an application programming interface (API). The test script may include a plurality of test instructions. The test instructions may be configured to interact with the firmware of the embedded non-IP device. For example, the firmware of the embedded non-IP device may execute a test instruction. As another example, the test instructions may be for the embedded non-IP device to send a response to the computer.” Col. 8 lines 29-40 “At step 312, the computer may receive a test result generated by the firmware of the embedded non-IP device. The embedded non-IP device may generate the test result by executing an executable code in the test instructions. For example, the test instructions may include an executable code to encrypt a password, and the test result may be an encrypted password. At step 314, the computer may identify a second vulnerability based upon the test result. The second vulnerability may include, for example, a weak encryption protocol.” A set of executable test instructions are sent to the non-ip device, that executes to obtain particular types of data from the device and to encrypt the data prior to sending back the test result, in this case encrypted password.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Hoang-Wing with that of Donovan in order to incorporate wherein the indication of the script comprises the code operable to generate and encrypt the features, and apply this concept to the sent script such that it would cause encryption of machine learning model features in Hoang-Wing.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security (Donovan: col. 1 lines 40-60).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Zifroni et al. US 2022/0191223 A1 para.0005 para.0015, para.0035 all describe detection of anomalous data and malware in encrypted traffic using machine learning systems.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to EUI H KIM whose telephone number is (571)272-8133. The examiner can normally be reached 7:30-5 M-R, M-F alternating.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamal B Divecha can be reached on 5712725863. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/EUI H KIM/Examiner, Art Unit 2453
/KAMAL B DIVECHA/Supervisory Patent Examiner, Art Unit 2453