DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments, see page 5, filed 09/15/2025, with respect to the objection to claims 2-5 have been fully considered but they are not persuasive. The claims still contain grammatical problems and will be presented in the objections below.
Applicant's arguments, see page 5, filed 09/15/2025, with respect to the rejection of claims 1-5 under 35 U.S.C. § 112(a) have been fully considered.
The rejection concerning the limitation “tampering detection circuitry” has been withdrawn in light of Applicant amending the claims to recite “one or more circuit” instead, in light of paragraph [0035] of the originally filed disclosure.
Applicant then attests that “As to claim 2, the ‘genetic algorithm’ is a known approach for optimization. One skilled in the art would clearly understand that this approach is applied to determine an optimum ‘scan pattern’ while satisfying a plurality of constraint conditions representing by formulas disclosed in paras 78-82, for example” and implies that the rejection should be withdrawn.
The Examiner respectfully disagrees.
Dependent claim 2, as currently drafted, is drawn to all conceivable ways of determining the “optimum” “scan pattern using a genetic algorithm”, while the originally filed disclosure does not adequately describe how the inventor achieved/obtained a genetic algorithm that preferably selects or determines the optimal scan pattern. Applicant admitting on the record that genetic algorithms are known, and that using a genetic algorithm to determine an optimum scan pattern is known does not cure the deficiency found with regard to 112(a) written description. As in pages 4-5 of the Non-Final Rejection mailed 06/13/2025, “For computer-implemented inventions, the determination of the sufficiency of disclosure will require an inquiry into the sufficiency of both the disclosed hardware and the disclosed software due to the interrelationship and interdependence of computer hardware and software. The critical inquiry is whether the disclosure of the application relied upon reasonably conveys to those skilled in the art that the inventor had possession of the claimed subject matter as of the filing date… It is not enough that one skilled in the art could write a program to achieve the claimed function because the specification must explain how the inventor intends to achieve the claimed function to satisfy the written description requirement. See, e.g., Vasudevan Software, Inc. v. MicroStrategy, Inc., 782 F.3d 671, 681-683, 114 USPQ2d 1349, 1356, 1357 (Fed. Cir. 2015)”.
Here, the originally disclosure does not disclose how the inventor intended to have the genetic algorithm achieve the desired function of being able to determine an optimum scan pattern, and Applicant’s arguments relying explicitly on one of ordinary skill of the art to fill in the missing disclosure further show that there is no such disclosure of how the inventor achieved the claimed function. The proper test for written description is not whether one of ordinary skill could write a program that achieves the claimed functions, it is instead whether or not the specification sufficiently explains how the inventor intended to achieve the desired results.
Applicant’s arguments, see page 5, filed 09/15/2025, with respect to the rejection of claims 2 and 4 under 35 U.S.C. § 112(b) have been fully considered and are persuasive. The Examiner will interpret time series pattern of access to mean the same as the access pattern of data ordered by time in light of Applicant’s remarks and paragraph [0082] of the originally filed disclosure, “Thus, it is possible to generate a scan pattern in consideration of not only the access frequency to a file but also the time-series pattern of access (for example, after accessing "file A", "file B" is always accessed)”. The rejection of claims 2 and 4 under 35 U.S.C. § 112(b) have been withdrawn.
Applicant’s arguments, see pages 5-7, filed 09/15/2025, with respect to the rejection(s) of amended claim(s) 1-4 and 6-7 under 35 U.S.C. § 102(a)(1) have been fully considered. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of newly discovered prior art.
Claim Objections
Claims 1-5 are objected to because of the following informalities:
Claim 1 recites the limitation “one or more circuit configured to”, and should instead read “one or more circuits configured to”.
Claims 2-5 recite the limitation “wherein the one or more circuit is further configured to”, and should instead read “wherein the one or more circuits [[is]] are further configured to”.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 2 is rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Regarding Claim 2:
Claim 2 recites the limitation “determine the scan pattern using a genetic algorithm”. the specification does not describe the limitation in sufficient detail so that one of ordinary skill in the art would recognize that the applicant had possession of the claimed invention. There is no disclosure regarding how the inventor intended to configure one or more circuits to “use” a genetic algorithm to perform the claimed function of “determin[ing] the scan pattern” in the originally filed disclosure, other than that a genetic algorithm may be used or is executed.
In MPEP 2161.01, "computer-implemented functional claim language must still be evaluated for sufficient disclosure under the written description". And MPEP 2161.01(I) "generic claim language in the original disclosure does not satisfy the written description requirement if it fails to support the scope of the genus claimed." For computer-implemented inventions, the determination of the sufficiency of disclosure will require an inquiry into the sufficiency of both the disclosed hardware and the disclosed software due to the interrelationship and interdependence of computer hardware and software. The critical inquiry is whether the disclosure of the application relied upon reasonably conveys to those skilled in the art that the inventor had possession of the claimed subject matter as of the filing date.
As in MPEP 2161.01 (I), "The description requirement of the patent statute requires a description of an invention, not an indication of a result that one might achieve if one made that invention."). It is not enough that one skilled in the art could write a program to achieve the claimed function because the specification must explain how the inventor intends to achieve the claimed function to satisfy the written description requirement. See, e.g., Vasudevan Software, Inc. v. MicroStrategy, Inc., 782 F.3d 671, 681-683, 114 USPQ2d 1349, 1356, 1357 (Fed. Cir. 2015).
AS in MPEP 2161.01 “For instance, generic claim language in the original disclosure does not satisfy the written description requirement if it fails to support the scope of the genus claimed. Ariad, 598 F.3d at 1349-50, 94 USPQ2d at 1171 ("[A]n adequate written description of a claimed genus requires more than a generic statement of an invention' s boundaries.") (citing Eli Lilly, 119 F.3d at 1568, 43 USPQ2d at 1405-06); Enzo Biochem, Inc. v. Gen-Probe, Inc., 323 F.3d 956, 968, 63 USPQ2d 1609, 1616 (Fed. Cir. 2002) (holding that generic claim language appearing in ipsis verbis in the original specification did not satisfy the written description requirement because it failed to support the scope of the genus claimed); Fiers v. Revel, 984 F.2d 1164, 1170, 25 USPQ2d 1601, 1606 (Fed. Cir. 1993) (rejecting the argument that "only similar language in the specification or original claims is necessary to satisfy the written description requirement").”
“The Federal Circuit has explained that a specification cannot always support expansive claim language and satisfy the requirements of 35 U.S.C. 112 "merely by clearly describing one embodiment of the thing claimed." LizardTech v. Earth Resource Mapping, Inc., 424 F.3d 1336, 1346, 76 USPQ2d 1731, 1733 (Fed. Cir. 2005). The issue is whether a person skilled in the art would understand applicant to have invented, and been in possession of, the invention as broadly claimed. In LizardTech, claims to a generic method of making a seamless discrete wavelet transformation (DWT) were held invalid under 35 U.S.C. 112, first paragraph, because the specification taught only one particular method for making a seamless DWT and there was no evidence that the specification contemplated a more generic method. "[T]he description of one method for creating a seamless DWT does not entitle the inventor . . . to claim any and all means for achieving that objective." LizardTech, 424 F.3d at 1346, 76 USPQ2d at 1733.”
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-4 and 6-7 are rejected under 35 U.S.C. 103 as being unpatentable over Toley et. al. (US Publication No. US 2020/0034534 A1) hereinafter Toley, in view of NECHAEV; Sergey Petrovich (US Publication No. US 2017/0286439 A1) hereinafter Nechaev.
Regarding Claims 1, 6, and 7:
Regarding Claims 1, 6, and 7:
Claim 1. Toley discloses a tampering detection device comprising: one or more circuit (Toley [0046-0047] and [0052]) configured to: acquire information on resources of a monitoring target device as well as an access pattern and a file size of a monitoring target file in the monitoring target device (Toley [0027] “the following parameters associated with a file stored within the distributed file storage system could be considered when prioritizing files for scheduled antivirus scanning: an access frequency for the stored file, a date of a last access request for the stored file, a time of a last access request for the stored file, … a size for the stored file, … a creation time for the stored file, a last modification time for the stored file, or a last definition update time for the stored files.”; [0028] system and facility resources and conditions are evaluated to set thresholds); … extract a time-series pattern of access for each monitoring target file from the access pattern acquired (Toley [0027] “the following parameters associated with a file stored within the distributed file storage system could be considered when prioritizing files for scheduled antivirus scanning: … a date of a last access request for the stored file, a time of a last access request for the stored file, … a creation time for the stored file, a last modification time for the stored file, or a last definition update time for the stored files.”); and determine a scan pattern on a basis of the extracted time-series pattern of access (Toley [0027-0028] factors to determine a scheduled antivirus scanning, [0037-0039]).
Toley does not explicitly disclose use the information on the resources and the file size to calculate a time required for hash calculation; … and the time required for hash calculation.
Nechaev teaches use the information on the resources and the file size to calculate a time required for hash calculation (Nechaev Fig. 2A, [0037-0039], and [0042-0044] time required to compute a hash for a file is contemplated); … and the time required for hash calculation (Nechaev Fig. 2A, [0037-0039], and [0042-0044] time required to compute a hash for a file is contemplated and a determination is made in view of the calculated hashing time).
It would have been obvious to one having ordinary skill in the art before the time the invention was effectively filed to combine the predictive scanning system disclosed by Toley with the hash calculation and determination taught by Nechaev. The motivation for this combination would be to improve the efficiency of the file scanning system because both Toley and Nechaev are concerned about using large amounts of potentially limited computer resources (“It would, therefore, be beneficial to provide a mechanism that balances system resource usage against the likelihood that a particular file will be accessed by a client. In designing systems, methods, and computer program products that accomplish this general principle, there are many factors that can be taken into consideration when prioritizing files for scheduled antivirus scanning” Toley [0027] and “In another example aspect, the decision module 109 may use heuristically information about the available computational resources of the user device, characteristics of the user device, the type of and size of the file and other available information to determine whether to calculate the unique file identifiers on the user device 101 or on the cloud storage server 110. For example, if the user device 101 is a mobile device (e.g., a smart phone or tablet), which typically have low computing power, the decision module 109 may not compute hashes on this type of the device, and start uploading of the file to the cloud storage server 110 right away” Nechaev [0044]). Therefore, it would have been obvious to incorporate the hashing time calculation taught by Nechaev into the list of factors enumerated by Toley to determine the best schedule for scanning.
Claims 6 and 7 recite substantially the same content and is therefore rejected under the same rationales. Toley further discloses a method (Toley Fig. 3) and a non-transitory computer-readable recording medium storing therein a tampering detection program causing a computer to execute a process (Toley [0046-0047]).
Regarding Claim 2:
The combination of Toley and Nechaev further teaches the tampering detection device according to claim 1 (Toley [0046-0047] and [0052]), wherein the one or more circuit is further configured to: acquire a set time of the scan pattern (Toley [0027] file access and modification times; [0034] scheduled scanning time); extract an access frequency for each monitoring target file from the access pattern (Toley [0027] access frequency considered); and determine the scan pattern using a genetic algorithm (Toley [0030] heuristics data set and machine learning considered; [0037] “In most embodiments, parameters can be stored in a heuristics data set 144. A machine learning module 142 could be used to evaluate the heuristics data set 144 in order to create 312 a predictive scheduled scan queue 244.”).
Regarding Claim 3:
The combination of Toley and Nechaev further teaches the tampering detection device according to claim 2 (Toley [0046-0047] and [0052]), wherein the one or more circuit is further configured to: determine a scan pattern in which all monitoring target files are included at least once by adding a predetermined penalty (Toley [0028] “it could be beneficial in embodiments to allow the system administrator to set threshold conditions for scheduled antivirus scanning. By way of example, some threshold conditions could be a total runtime amount, a total number of files to scan, a total percentage of files to scan, a total amount of resource consumption, real-time file access/usage exceeding a predetermined limit, and the like” and set the percentage of files to scan to be 100 percent).
Regarding Claim 4:
The combination of Toley and Nechaev further teaches the tampering detection device according to claim 2 (Toley [0046-0047] and [0052]), wherein the one or more circuit is further configured to determine the scan pattern that minimizes an average time from scanning of the monitoring target file to a latest access (Toley [0037] order the files to be scanned based on last update).
Claim(s) 5 is rejected under 35 U.S.C. 103 as being unpatentable over Toley and Nechaev as applied to claims 1-4 and 6-7 above, and further in view of Yuki; Nara (JP 2010-211453 A) hereinafter Yuki.
Regarding Claim 5:
The combination of Toley and Nechaev further teaches the tampering detection device according to claim 2 (Toley [0046-0047] and [0052]), wherein the one or more circuit is further configured to: acquire the access pattern from the monitoring target device that stores the monitoring target file (Toley [0040-0041] “Once the prioritized list has been created 312, the scan requestor 226 can coordinate with the antivirus server 232 to perform 314 the scheduled antivirus scan in the sequential order established in the prioritized list.”); transmit the scan pattern to the monitoring target device (Toley [0040] “Once the prioritized list has been created 312, the scan requestor 226 can coordinate with the antivirus server 232 to perform 314 the scheduled antivirus scan in the sequential order established in the prioritized list.”).
Toley and Nechaev do not explicitly teach and verify whether or not the monitoring target file has been tampered by using a digest of a file generated on a basis of the scan pattern by the monitoring target device.
Yuki teaches and verify whether or not the monitoring target file has been tampered by using a digest of a file generated on a basis of the scan pattern by the monitoring target device (Yuki [0014-0020]).
It would have been obvious to one having ordinary skill in the art before the time the invention was effectively filed to combine the scanning system disclosed by Toley with the hash calculation and determination taught by Nechaev, further with the hash/digest comparison as taught by Yuki.
The motivation for this combination would be to improve security by utilizing hashing algorithms to quickly and accurately determine whether a sampled file has been tampered with by comparing against the previously stored version of its hash.
Conclusion
The prior art made of record in the submitted PTO-892 Notice of References Cited and not relied upon is considered pertinent to applicant’s disclosure.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MIGUEL A LOPEZ whose telephone number is (703)756-1241. The examiner can normally be reached 8:00AM-5:00PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge Ortiz-Criado can be reached on 5712727624. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/M.A.L./ Examiner, Art Unit 2496
/HARESH N PATEL/ Primary Examiner, Art Unit 2496
Prosecution Insights