Remarks
Claims 1-3, 5-13, and 15-22 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 5/6/2026 has been entered.
Response to Arguments
Applicant's arguments filed 5/6/2026 have been fully considered but they are not persuasive.
With respect to Applicant’s allegations regarding the claim interpretation, it is noted that the ransomware process is the candidate process. Thus, Applicant’s allegations are moot.
With respect to Applicant’s allegations on page 10, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). As to how the combination is cited against this subject matter, please see the following:
Regarding Claim 1,
Patton discloses …
…
While the candidate process is running and writing one or more files, taking, in a site, a set of zoom in snapshots, wherein each of the zoom in snapshots corresponds to a respective time period during which the candidate process was running, and writing the one or more files, and each of the zoom in snapshots includes write operating information for the candidate process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, line 5 to Column 7, line 58; and associated figures; file snapshots taken and associated with timestamps, including information related to the writing/encrypting of files which may be used to and/or include number of written/encrypted files, for example);
…
Halcrow also discloses …
While the candidate process is running and writing one or more files, taking, in a site, a set of zoom in snapshots of the candidate process, wherein each of the zoom in snapshots corresponds to a respective time period during which the candidate process was running and writing the one or more files, and each of the zoom in snapshots includes write operating information for the candidate process (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; snapshots as well as all data captured during heightened level of auditing, such data effectively being delta snapshots noting every change in state, taken while the process is running (e.g., during a time period from attack start to attack end or certain time period thereafter, or the like, as examples), for example);
…
Derbeko, however, discloses that the site is a production site (Exemplary Citations: for example, Column 2, lines 41-52; Column 3, lines 4-19; Column 4, lines 43-53; Column 6, line 43 to Column 7, line 12; Column 7, line 64 to Column 8, line 24; and associated figures; production system, for example);
…
Thus, the combination of Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the argued subject matter, not solely Patton alone. Since Applicant did not provide any argument against the combination as it is cited, no further response is possible.
Again, with respect to the next paragraph, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). As to how the combination is cited against this subject matter, please see the following:
Regarding Claim 1,
Patton discloses …
…
While the candidate process is running and writing one or more files, taking, in a site, a set of zoom in snapshots, wherein each of the zoom in snapshots corresponds to a respective time period during which the candidate process was running, and writing the one or more files, and each of the zoom in snapshots includes write operating information for the candidate process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, line 5 to Column 7, line 58; and associated figures; file snapshots taken and associated with timestamps, including information related to the writing/encrypting of files which may be used to and/or include number of written/encrypted files, for example);
…
Halcrow also discloses …
While the candidate process is running and writing one or more files, taking, in a site, a set of zoom in snapshots of the candidate process, wherein each of the zoom in snapshots corresponds to a respective time period during which the candidate process was running and writing the one or more files, and each of the zoom in snapshots includes write operating information for the candidate process (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; snapshots as well as all data captured during heightened level of auditing, such data effectively being delta snapshots noting every change in state, taken while the process is running (e.g., during a time period from attack start to attack end or certain time period thereafter, or the like, as examples), for example);
Thus, the combination of Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the argued subject matter, not solely Patton alone. Since Applicant did not provide any argument against the combination as it is cited, no further response is possible.
With respect to Applicant’s allegations at the top of page 11, Applicant's arguments fail to comply with 37 CFR 1.111(b) because they amount to a general allegation that the claims define a patentable invention without specifically pointing out how the language of the claims patentably distinguishes them from the references. Moreover, Patton discloses this subject matter in Patton’s disclosure of determining to sample at each change or not (e.g., safe process) and file snapshots taken and associated with timestamps, for example; stopping monitoring if safe process, whitelisting after determining safe process, continuing monitoring if not safe process, etc., as examples.
With respect to Applicant’s allegations in the second paragraph on page 11, Applicant begins this quotation of paragraph 39 a bit late. It actually starts with “In some implementations, no snapshotting…”. Thus, in other implementations, snapshotting may occur. Moreover, clearly, since Halcrow is discussing snapshotting, Halcrow contemplated use thereof.
Furthermore, the claim has actually been amended to define a zoom in snapshot as including “write-operating information for the candidate process”. Halcrow undeniably discloses this, since Halcrow discloses “data 334H captured while the attack is in progress … may show that the memory address was written with a new value during the attack and then re-written with the original value”. This clearly includes write-operating information, which is all that the claim requires is included in the snapshot.
Applicant then alleges “Halcrow nowhere discloses that the snapshots of the candidate process.” It is unclear just what is being argued here. This appears to be an incomplete sentence and no argument is found therein.
Applicant then provides a general allegation regarding the snapshot including write-operating information. This has already been discussed above. Moreover, Applicant's arguments fail to comply with 37 CFR 1.111(b) because they amount to a general allegation that the claims define a patentable invention without specifically pointing out how the language of the claims patentably distinguishes them from the references.
The next paragraph (fourth on page 11), includes an incorrect analysis, since Halcrow’s audited information (e.g., 334H, discussed above) is, itself, a snapshot and is included in the definition of a zoom-in snapshot within the claim. Thus, Applicant’s allegations are erroneous. Moreover, Halcrow does, indeed, disclose this subject matter in Halcrow’s disclosure of higher frequency during heightened level of auditing (process is suspected of being malware), with lower frequency snapshots occurring while an attack is not in progress and any use of snapshots as well as all data captured during heightened level of auditing, such data effectively being delta snapshots noting every change in state, taken while the process is running (e.g., during a time period from attack start to attack end or certain time period thereafter, or the like, as examples), with lower frequency snapshots occurring while an attack is not in progress, for example.
Claim Interpretation
Various claims include subject matter that does not affect the scope of the claims. For example, multiple claims attempt to claim what the ransomware/candidate process is (e.g., the candidate process comprise a file overwriting process in claims 6 and 16), however, this is not actually part of Applicant’s method of protecting against ransomware. It is noted that claim 9 is fine since it defines what occurs in the protection method (snapshots being taken while the process is overwriting a file).
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 8 and 18 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claim 8 has been amended to sate “wherein analysis of the zoom-in snapshots reveals the candidate process to comprise a fileless ransomware process.” However, the application as originally filed does not appear to include basis for the analysis to reveal that the candidate process comprises a fileless ransomware process. Claim 18 has the same issue and is rejected for the same reasons.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 11-13, 15-20, and 22 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim(s) does/do not fall within at least one of the four categories of patent eligible subject matter because the claimed medium need not be statutory. For example, paragraphs 74 and 75 of the instant application state the following:
[0074] As indicated above, embodiments within the scope of the present invention also include computer storage media, which are physical media for carrying or having computer- executable instructions or data structures stored thereon. Such computer storage media may be any available physical media that may be accessed by a general purpose or special purpose computer.
[0075] By way of example, and not limitation, such computer storage media may comprise hardware storage such as solid state disk/device (SSD), RAM, ROM, EEPROM, CD-ROM, flash memory, phase-change memory ("PCM"), or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other hardware storage devices which may be used to store program code in the form of computer-executable instructions or data structures, which may be accessed and executed by a general-purpose or special-purpose computer system to implement the disclosed functionality of the invention. Combinations of the above should also be included within the scope of computer storage media. Such media are also examples of non- transitory storage media, and non-transitory storage media also embraces cloud-based storage systems and structures, although the scope of the invention is not limited to these examples of non-transitory storage media.
Therefore, based on the definitions provided, non-transitory storage media “also embraces cloud-based storage systems and structures, although the scope of the invention is not limited to these examples of non-transitory storage media”. Cloud based storage systems and structures include virtual storage systems and data structures. Thus, the non-transitory storage medium of claim 11 is not statutory, since a statutory medium must be physical. None of claims 12, 13, 15-20, or 22 fix this issue and they are rejected for the same reasons.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 5-7, 9-13, 15-17, and 19-22 are rejected under 35 U.S.C. 103 as being unpatentable over Patton (U.S. Patent 10,229,269) in view of Halcrow (U.S. Patent Application Publication 2021/0049031), Striem-Amit (U.S. Patent 10,503,897), and Derbeko (U.S. Patent 10,320,828).
Regarding Claim 1,
Patton discloses a method comprising:
Identifying a candidate process for monitoring, wherein the candidate process for monitoring has not been included in a whitelist (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures; process, application, etc. to monitor, for example. Anything on the whitelist is considered safe and is not monitored, for example);
While the candidate process is running and writing one or more files, taking, in a site, a set of zoom in snapshots, wherein each of the zoom in snapshots corresponds to a respective time period during which the candidate process was running, and writing the one or more files, and each of the zoom in snapshots includes write operating information for the candidate process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, line 5 to Column 7, line 58; and associated figures; file snapshots taken and associated with timestamps, including information related to the writing/encrypting of files which may be used to and/or include number of written/encrypted files, for example);
Determining a sampling frequency based on dissimilarity of the candidate process to known malware (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures; determining to sample at each change or not (e.g., safe process), for example);
Sampling the set of zoom in snapshots according to the sampling frequency to select a subset of the zoom in snapshots (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures; file snapshots taken and associated with timestamps, for example; stopping monitoring if safe process, whitelisting after determining safe process, continuing monitoring if not safe process, etc., as examples);
Analyzing the selected subset of the zoom in snapshots to determine whether the candidate process comprises a ransomware process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures; determining ransomware based on the snapshots in some fashion, such as by detecting changes to files, a certain number of encrypted files within a time window, or many other methods, for example); and
Taking a remedial action to stop the ransomware process in a case where it is determined that the candidate process comprises the ransomware process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures; remediate, such as terminating, quarantining, removing from whitelist, etc., as examples);
But does not appear to explicitly disclose that the writing comprises overwriting, that the site is a production site, that the snapshots are of the candidate process, transmitting the selected subset of the zoom in snapshots to a vault, which is isolated from the production site by an air gap, and that analyzing occurs in the vault.
Halcrow, however, discloses that the snapshots are of the candidate process (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; snapshots as well as all data captured during heightened level of auditing, such data effectively being delta snapshots noting every change in state, taken while the process is running, for example. It is noted that the entire memory state can be captured in Halcrow, which includes the entirety of the memory space taken by any given process being monitored). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the attack detection techniques of Halcrow into the ransomware detecting system of Patton in order to allow the system to better detect attacks and malware, to provide the system with additional information from which to base attack/malware detections on, to make it harder for attacks to hide their tracks, and/or to increase security in the system.
Halcrow also discloses identifying a candidate process for monitoring (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; processes, programs, applications, etc., and/or virtual machine including such, being monitored, for example);
While the candidate process is running and writing one or more files, taking, in a site, a set of zoom in snapshots of the candidate process, wherein each of the zoom in snapshots corresponds to a respective time period during which the candidate process was running and writing the one or more files, and each of the zoom in snapshots includes write operating information for the candidate process (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; snapshots as well as all data captured during heightened level of auditing, such data effectively being delta snapshots noting every change in state, taken while the process is running (e.g., during a time period from attack start to attack end or certain time period thereafter, or the like, as examples), for example);
Determining a sampling frequency based on dissimilarity of the candidate process to known malware (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; higher frequency during heightened level of auditing (process is suspected of being malware), with lower frequency snapshots occurring while an attack is not in progress, for example);
Sampling the set of zoom in snapshots according to the sampling frequency to select a subset of the zoom in snapshots (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; any use of snapshots as well as all data captured during heightened level of auditing, such data effectively being delta snapshots noting every change in state, taken while the process is running (e.g., during a time period from attack start to attack end or certain time period thereafter, or the like, as examples), with lower frequency snapshots occurring while an attack is not in progress, for example);
Analyzing the selected subset of the zoom in snapshots to determine whether the candidate process comprises a malicious process (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; analyzing the above to detect attack, for example); and
Taking a remedial action to stop the malicious process in a case where it is determined that the candidate process comprises the malicious process (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated; process termination, VM termination, restoring any damage done by an attack, effectively stopping the process, since no changes that the process made are effective, etc., as examples). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the attack detection techniques of Halcrow into the ransomware detecting system of Patton in order to allow the system to better detect attacks and malware, to provide the system with additional information from which to base attack/malware detections on, to make it harder for attacks to hide their tracks, and/or to increase security in the system.
Striem-Amit, however, discloses that the writing comprises overwriting (Exemplary Citations: for example, Abstract, Column 1, lines 17-32; Column 2, line 26 to Column 3, line 6; Column 3, line 54 to Column 4, line 7; and associated figures; ransomware overwrites files, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the ransomware detection and remediation techniques of Striem-Amit into the ransomware detecting system of Patton as modified by Halcrow in order to allow the system to detect additional ransomware patterns, to provide huge redundancy of files in a system’s storage, making it more likely ransomware will attack unnecessary files, to increase resilience of the system, and/or to increase security in the system.
Derbeko, however, discloses that the site is a production site (Exemplary Citations: for example, Column 2, lines 41-52; Column 3, lines 4-19; Column 4, lines 43-53; Column 6, line 43 to Column 7, line 12; Column 7, line 64 to Column 8, line 24; and associated figures; production system, for example);
Transmitting the selected subset of the zoom in snapshots to a vault, which is isolated from the production site by an air gap (Exemplary Citations: for example, Column 2, lines 41-52; Column 3, lines 4-19; Column 4, lines 43-53; Column 6, line 43 to Column 7, line 12; Column 7, line 64 to Column 8, line 24; and associated figures; air gap from production system to testbed, where testbed detects malware and the like in the production system, for example); and
That analyzing occurs in the vault (Exemplary Citations: for example, Column 2, lines 41-52; Column 3, lines 4-19; Column 4, lines 43-53; Column 6, line 43 to Column 7, line 12; Column 7, line 64 to Column 8, line 24; and associated figures; testbed detects malware and the like in the production system, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the cyber testbed techniques of Derbeko into the ransomware detecting system of Patton as modified by Halcrow and Striem-Amit in order to allow for malware and vulnerabilities to be detected and tested for in a virtual environment, to allow an administrator to balance a high level of security with business usability, to detect additional attacks/attack vectors, and/or to increase security in the system.
Regarding Claim 11,
Claim 11 is a medium claim that corresponds to method claim 1 and is rejected for the same reasons.
Regarding Claim 2,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton discloses determining whether or not the candidate process does not comprise a ransomware process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures; determining if ransomware/not, for example); and
When it is determined that the candidate process does not comprise the ransomware process, adding the candidate process to the whitelist (Exemplary Citations: for example, Abstract, Column 6, line 56 to Column 7, line 10, and associated figures; adding non-ransomware process to whitelist, for example).
Regarding Claim 12,
Claim 12 is a medium claim that corresponds to method claim 2 and is rejected for the same reasons.
Regarding Claim 3,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton as modified by Halcrow discloses when a counter indicates that the candidate process comprises a number of write operations that exceeds a threshold, the candidate process is identified as a ransomware process (Patton: Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures; comparing number of encryptions (which are file edits/writes) to a threshold; Halcrow: Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; tracking and checking all writes, for example).
Regarding Claim 13,
Claim 13 is a medium claim that corresponds to method claim 3 and is rejected for the same reasons.
Regarding Claim 5,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton discloses that the zoom in snapshots are analyzed in real time as they are taken (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures); and
Halcrow discloses that the zoom in snapshots are analyzed in real time as they are taken (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures).
Regarding Claim 15,
Claim 15 is a medium claim that corresponds to method claim 5 and is rejected for the same reasons.
Regarding Claim 6,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton discloses that the candidate process comprises a file writing process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures; editing a file, saving edited file, etc., as examples); and
Striem-Amit discloses that the candidate process comprises a file overwriting process (Exemplary Citations: for example, Abstract, Column 1, lines 17-32; Column 2, line 26 to Column 3, line 6; Column 3, line 54 to Column 4, line 7; and associated figures; ransomware overwrites files, for example).
Regarding Claim 16,
Claim 16 is a medium claim that corresponds to method claim 6 and is rejected for the same reasons.
Regarding Claim 7,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton discloses that analysis of the zoom in snapshots reveals the candidate process to comprise a ransomware process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures).
Regarding Claim 17,
Claim 17 is a medium claim that corresponds to method claim 7 and is rejected for the same reasons.
Regarding Claim 9,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton discloses that the zoom in snapshots are taken while the candidate process is writing a file (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures); and
Striem-Amit discloses that the writing comprises overwriting (Exemplary Citations: for example, Abstract, Column 1, lines 17-32; Column 2, line 26 to Column 3, line 6; Column 3, line 54 to Column 4, line 7; and associated figures).
Regarding Claim 19,
Claim 19 is a medium claim that corresponds to method claim 9 and is rejected for the same reasons.
Regarding Claim 10,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton discloses that a known program or known process is listed in the whitelist before the zoom in snapshots are taken of the candidate process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, line 5 to Column 7, line 58; and associated figures; whitelist used to determine whether or not to monitor process, for example).
Regarding Claim 20,
Claim 20 is a medium claim that corresponds to method claim 10 and is rejected for the same reasons.
Regarding Claim 21,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton discloses that the write operating information for the candidate process includes a number of writes being performed by the candidate process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, line 5 to Column 7, line 58; and associated figures; as above, for example); and
Halcrow discloses that the write operating information for the candidate process includes a number of writes being performed by the candidate process (Exemplary Citations: for example, Abstract, Paragraphs 3-9, 22, 23, 29, 33-44, and associated figures; tracking and checking all writes, for example).
Regarding Claim 22,
Claim 22 is a medium claim that corresponds to method claim 21 and is rejected for the same reasons.
Claims 8 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Patton in view of Halcrow, Striem-Amit, Derbeko, and Johansen (Johansen, Alison Grace, “What is fileless malware and how does it work?”, 8/8/2018, 9 pages, obtained from https://us.norton.com/blog/malware/what-is-fileless-malware).
Regarding Claim 8,
Patton as modified by Halcrow, Striem-Amit, and Derbeko discloses the method of claim 1, in addition, Patton discloses that analysis of the zoom-in snapshots reveals the candidate process to comprise a ransomware process (Exemplary Citations: for example, Abstract, Column 4, line 11 to Column 5, line 39; Column 6, lines 5-55; Column 7, lines 11-58; and associated figures);
But does not explicitly disclose that the ransomware process comprises a fileless ransomware process.
Johansen, however, discloses that the ransomware process comprises a fileless ransomware process (Exemplary Citations: for example, Pages 1-5; fileless malware/ransomware, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the fileless malware and protection techniques of Johansen into the ransomware detecting system of Patton as modified by Halcrow, Striem-Amit, and Derbeko in order to allow the system to protect against additional forms of malware, to assist users in best practices for security, and/or to increase security in the system.
Regarding Claim 18,
Claim 18 is a medium claim that corresponds to method claim 8 and is rejected for the same reasons.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Jeffrey D Popham whose telephone number is (571)272-7215. The examiner can normally be reached Monday through Friday 9:00-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey D. Popham/Primary Examiner, Art Unit 2432
