Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claims 8-10,18-20 objected to because of the following informalities: grammar errors. Appropriate correction is required.
Regarding claim 8, the phrase “determining the respective one of the current processes is accessed by another one of the current processes;” should have the word “that” after determining. For the purposes of examination, claim 8 will be interpreted as “The method of claim 1, further comprising: determining that the respective one of the current processes is accessed by another one of the current processes; and maintaining the respective one of the current processes in the computing system.”
Regarding claim 9, the phrase “determining the terminating” is awkwardly worded, it makes more sense as “determining that terminating” because we are describing the effect of an action. For the purposes of examination, limitations “… and further comprising: determining the terminating the respective one of the current processes causes an unexpected error with another one of the current processes; … ” Will be interpreted as “… and further comprising: determining that terminating the respective one of the current processes causes an unexpected error with another one of the current processes; ….”.
Regarding claim 10, the phrase “determining the terminating” is awkwardly worded, it makes more sense as “determining that terminating” because we are describing the effect of an action. For the purposes of examination, limitations “… further comprising: determining the terminating the respective one of the current processes causes an unexpected error with another one of the current processes; … ” Will be interpreted as “… further comprising: determining that terminating the respective one of the current processes causes an unexpected error with another one of the current processes; …”.
Regarding claims 18, the phrase “are executable to: determining the respective one” is awkwardly worded, it makes more sense as “are executable to: determine that the respective one” because we are describing the effect of an action. For the purposes of examination, limitations “… are executable to: determining the respective one of the current processes is accessed by another one of the current processes;” Will be interpreted as “… are executable to: determine that the respective one of the current processes is accessed by another one of the current processes; …”.
Regarding claim 19, the phrase “are executable to: determining the terminating” is awkwardly worded, it makes more sense as “are executable to: determine that terminating” because we are describing the effect of an action. For the purposes of examination, limitations “… are executable to: determining the terminating the respective one of the current processes causes an unexpected error with another one of the current processes; … ” Will be interpreted as “… are executable to: determine that terminating the respective one of the current processes causes an unexpected error with another one of the current processes; …”.
Regarding claim 20, the phrase “are executable to: determining the terminating” is awkwardly worded, it makes more sense as “are executable to: determine that terminating” because we are describing the effect of an action. For the purposes of examination, limitations “… are executable to: determining the terminating the respective one of the current processes causes an unexpected error with another one of the current processes; … ” Will be interpreted as “… are executable to: determine that terminating the respective one of the current processes causes an unexpected error with another one of the current processes; …”.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1,4-8,10-11,14-18,20 is/are rejected under 35 U.S.C. 103 as being unpatentable over US 9760399 B1 (Fraser) in view of US 20230106369 A1 (Flynn).
Regarding claim 1, Fraser teaches,
A method comprising:
creating, by a processor set, a process classification model using historic usage and context data of historic processes in a computing system,(col 13 ln 46-51 “As mentioned, application usage predictions can be determined using a number of different approaches. In one embodiment, an application history prediction algorithm is based on a modified Finite Response Filter (FIR). The algorithm is broken into two parts: building (training) and 50 using (predicting).”; col 6 ln 24-27 “These and/or other such algorithms can 25 compare the context information with information that has been collected previously for the user (and potentially other users), as well as patterns of usage and other such data.”) wherein the process classification model generates a probability that a process is in an unused state;(col 6 ln 24-34 “… . The output from the predictors can be a ranked or ordered set of application identifiers, as well as potentially other values such as a likelihood, probability, or confidence value. In some embodiments, termination for an application might only be initiated if a confidence level or likelihood of being accessed over a period of time does not at least meet a minimum threshold value.” Fraser’s low likelihood of being accessed corresponds to a high likelihood of being unused.)
detecting, by the processor set, current processes in the computing system;(col 2 ln 38-49 “The state of the device can include, for example, the availability of resources such as … , amount of memory used by each application or process, number of applications currently running on the device, … , background processor usage, presence of orphaned processes ( e.g., processes associated with an application that is no longer executing on the device), … , and the like.”)
generating, by the processor set, a probability score of a respective one of the current processes using current usage and context data of the respective one of the current processes with the process classification model;(fig 3; col 10 ln 24-41 “In this example, raw event data and hint data are received 306 from one or more sources that are local and/or external to the computing device. As mentioned, in some embodiments the raw system event data can come from the operating system ( e.g., an activity manager of the OS, where an activity is a sub-portion of the application lifecycle) and the hints can come from various applications or components, such as may be related to the home screen and various other navigational elements of the computing device. The event data and hint data can be processed and/or aggregated 308 in order to be in a form to pass to the predictor algorithm, eliminating spurious or duplicative data, etc. The aggregated data can be analyzed 310 using one or more predictor algorithms, or other such processes. The predictor algorithms in this example can determine the most likely applications to be accessed, or can provide a confidence or likelihood score for access of each of a set of applications, among other such options.”) and
performing, by the processor set, an action with the respective one of the current processes(col 2 ln 30-38 “In some embodiments different types of termination actions can be performed based upon state of the device or other such information. These can include actions of a first type that terminate, kill, or cleanup applications or processes on the device, or actions of a second type that throttle, slow, or otherwise adjust the operation of applications or processes on the device, among other such options. Other actions can be provided as well, such as an option to uninstall an application or process from the device.”) based on the probability score of the respective one of the current processes exceeding a predefined threshold.(col 6 ln 30-34 “In some embodiments, termination for an application might only be initiated if a confidence level or likelihood of being accessed over a period of time does not at least meet a minimum threshold value.”)
However, although Fraser teaches analyzing historical usage and context data, Fraser does not specifically teach using historic transactional data and current transactional data.
On the other hand, Flynn teaches,
A method comprising:
creating, by a processor set, a plug-in execution classification model using historic transactional data of historic processes in a computing system,( fig 4B; par 61; par 62 “In operation 432, a model training system 720 (see, e.g., FIG. 7) loads training data including telemetry data collected from one or more computing devices regarding the execution of a particular plugin. As noted above, the telemetry data may include resource consumption metrics of the plugin during execution (CPU, memory, input/output (I/O), number of threads, number of items processed) and information about the physical computing resources available in the computing device ( e.g., processor speed, total installed memory, total CPU load and memory load at the time of executing the plugin, etc.). In some examples, the training data further includes plugin usage information based on the activities of users of the computing device. The usage behavior includes, for example, the frequency in which users make use of particular plugins or make use of information generated by particular plugins.”;) wherein the process classification model generates a classification that a process should not be run;( par 66 “In operation 434, the model training system 720 trains a statistical model or machine learning model based on the labeled training data to predict execution state classifications (e.g., "run," "do not run," and "conservative run") corresponding to particular input features or an input feature vector including a plurality of input features. Examples of types of statistical models and types of machine learning models that may be used in accordance with examples of the present disclosure include, but are not limited to: a logistic regression model, a support vector machine (SVM), a neural network (including a deep neural network), and the like.”)
detecting, by the processor set, current plugins in the computing system;(par 35 “Thus, the plugin resource manager 120 or, more generally, resource manager 120, may be configured to monitor and manage the execution of plugins. In particular, some examples may provide a plugin isolation feature, which assists in isolating ( e.g., sandboxing), monitoring, and controlling the execution of these plugins.”; par 38 “In operation 206, the plugin resource manager 120 begins monitoring the plugin process 112 including collecting resource consumption metrics associated with the plugin. In operation 208, the plugin process 112 executes the plugin to handle the task while the plugin resource manager 120 monitors its execution.”)
generating, by the processor set, a categorization of a respective one of the current plugins using current transactional data(par 58 “In operation 406, the plugin resource manager 120 begins monitoring the plugin process that will handle the task. In various examples, the monitoring includes storing metrics regarding the CPU usage (e.g., CPU time or cycles), memory usage, input/output device bandwidth usage (e.g., on a per-device basis, such as local storage bandwidth and network bandwidth), thread count, number of items processed (e.g., if more than one task is handled during a run), total duration of time spent in user mode and kernel mode, and the like….”) of the respective one of the current plugins with the plugin classification model;(par 70 “The evaluation of the plugin execution policy includes supplying a feature vector representing the current state of the computing device to a trained model ( e.g., a trained statistical model or machine learning model as trained in accordance with methods described above with FIG. 4B based on metrics or telemetry collected in accordance with the methods of FIG. 4A). In some examples, the trained model generates a classification of the task (e.g., "run," "do not run," or "run conservatively") in which case the task scheduler 104 sets a priority for the task based on the classification. Continuing the above example, the task scheduler 104 may set a high priority in the case where the trained model outputs "run" for the current condition, a very low or negative priority when the trained model outputs "do not run." In some cases, the task scheduler 104 also sets a low or negative priority when the trained model returns "run conservatively" or may set a moderate or medium priority for such tasks while also setting additional limits or quotas on the plugin process 112 executing the plugin when handling the task.”) and
performing, by the processor set, an action with the respective one of the current plugins based on the misbehavior count of the respective one of the current plugins exceeding a predefined threshold.(par 40 “If the threshold value has been satisfied, then, in operation 262, the plugin resource manager 120 marks or flags the plugin as a misbehaving plugin, and the process ends.”; par 41 “In some examples, when an ACK was not received within the timeout period, the plugin is terminated (e.g., the plugin process executing the plugin is terminated). In some examples, plugins marked as misbehaving plugins in operation 262 are no longer run ( e.g., are disabled or blocked), such that tasks associated with misbehaving plugins are either dropped (and not handled) or deferred until a low usage time when the misbehaving or high-consumption plugins can run. For example, the task scheduler 104 may ignore or drop tasks (e.g., not assign tasks) or assign a low priority to tasks that would be processed by misbehaving plugins.”)
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to further modify Fraser to incorporate the using historic transactional data and current transactional data of Flynn. One of ordinary skill in the art would have been motivated to improve on the goal of Fraser -- a way to monitor programs that are consuming resources and control the running of those programs (Flynn par 5 “However, these plugins may not perform as desired due to errors or malicious code incorporated in the plugins. For instance, the plugins sometimes behave in ways that are user unfriendly or user-hostile, such as by consuming excessive resources (e.g., CPU time, memory, energy, and input/output bandwidth on devices such as mass storage or network), thereby causing the computing device to hang while a user is trying to accomplish other work. Accordingly, to help address these negative impacts on computing performance, examples of the present technology may monitor plugins to detect undesired behaviors. Based on the detected behaviors, the technology may pause, reschedule, deprioritize, or otherwise control the running of such plugins.”) -- with Flynn providing a known method to solve a similar problem. Flynn provides “The plugin resource manager may also, or alternatively, monitor resource consumption metrics (e.g., CPU, memory, and input/output operations) used by each plugin during execution. The per-plugin telemetry data or metrics collected may be aggregated across multiple executions of the plugin across multiple computing devices. The telemetry data or metrics are used, in some examples, to determine policies for future executions of the plugins ( e.g., scheduling resource-intensive plugins to run at particular times of the day when the user is not active or when the computing device is not performing a resource intensive task such as running a computer game).”(Flynn par 7)
Regarding claim 4, Fraser and Flynn teaches,
The method of claim 1,
Fraser further teaches,
wherein the respective one of the current processes comprises an unintentional orphan process. (col 2 ln 38-49 “The state of the device can include, for example, the availability of resources such as … , amount of memory used by each application or process, number of applications currently running on the device, … , background processor usage, presence of orphaned processes ( e.g., processes associated with an application that is no longer executing on the device), …, and the like.”; col 2 ln 56-62 “The actions can also include terminating or otherwise operationally modifying the execution of processes ( or sub-processes) that are determined to be operating in an irregular or 60 unexpected fashion, or that are determined to be orphaned or no longer assisting open applications executing ( or likely to be executing) on the device.”)
Regarding claim 5, Fraser and Flynn teaches,
The method of claim 1,
Fraser further teaches,
wherein the action comprises alerting a user that the respective one of the current processes is an unused process.(col 14 ln 56-63 “In some embodiments any application that is user-facing may be prevented from being terminated. … . For these applications and services, other actions might be taken, such as logging data about the compromise or otherwise providing a notification such that other actions can be taken to attempt to prevent such compromises in the future.”; col 8 ln 1-3 “In some embodiments, the applications can be notified or requested to approve the termination, among other such options.” )
Regarding claim 6, Fraser and Flynn teaches,
The method of claim 1,
Fraser further teaches,
wherein the action comprises automatically terminating the respective one of the current processes.(col 14 ln 63-67 “For other embodiments very aggressive termination decisions might be made, such as may include any application with atypical behavior, such as irregular communication patterns, lengthy execution times, excess memory usage, and the like.”; col 13 ln 15-25 “In at least some embodiments an application determined to cause the problem might first be analyzed to determine the impact on the user and/or system, and if the impact is determined to be acceptable then that application can be selected for a termination action to attempt to remedy the device health situation before attempting to terminate other applications or services. Accordingly, one or more termination actions can be determined 610 for those applications to attempt to remedy the device health, and at least some of those termination actions performed 612 on the device.”)
Regarding claim 7, Fraser and Flynn teaches,
The method of claim 1,
Fraser further teaches,
wherein: the threshold comprises a first threshold;
the action comprises alerting a user that the respective one of the current processes is an unused process(col 14 ln 56-63 “In some embodiments any application that is user-facing may be prevented from being terminated. … . For these applications and services, other actions might be taken, such as logging data about the compromise or otherwise providing a notification such that other actions can be taken to attempt to prevent such compromises in the future.”; col 8 ln 1-3 “In some embodiments, the applications can be notified or requested to approve the termination, among other such options.”) based on the probability score being greater than the first threshold and less than a second threshold;( col 8 ln 1-3 “In some embodiments, the applications can be notified or requested to approve the termination, among other such options.”; col 14 ln 63-67 “For other embodiments very aggressive termination decisions might be made, such as may include any application with atypical behavior, such as irregular communication patterns, lengthy execution times, excess memory usage, and the like.”; col 6 ln 30-40 “In some embodiments, termination for an application might only be initiated if a confidence level or likelihood of being accessed over a period of time does not at least meet a minimum threshold value. …”) and
the action comprises automatically terminating the respective one of the current processes based on the probability score being greater than the second threshold.(col 6 ln 30-40 “In some embodiments, termination for an application might only be initiated if a confidence level or likelihood of being accessed over a period of time does not at least meet a minimum threshold value. For example, an application might only be terminated if it not at least 25% or at least 50% likely to be accessed over an upcoming period of time. In some embodiments, the minimum confidence level might be adjustable by the user and/or adjustable based at least in part upon the availability of various resources and/or the state of the device.” col 2 ln 30-36 “In some embodiments different types of termination actions can be performed based upon state of the device or other such information. These can include actions of a first type that terminate, kill, or cleanup applications or processes on the device, or actions of a second type that throttle, slow, or otherwise adjust the operation of applications or processes on the device, among other such options.”;)
Fraser teaches using multiple threshold probability levels and different actions based on the probability/confidence/likelihood score(col 6 ln 30-40; col 2 ln 30-36 referenced above). Therefore Fraser teaches or at least suggests using a first confidence threshold to perform a lower-severity action such as a notification and a second confidence threshold to perform a higher severity action such as an automatic termination.
Regarding claim 8, Fraser and Flynn teaches,
The method of claim 1,
Fraser further teaches,
further comprising: determining that the respective one of the current processes is accessed by another one of the current processes; and maintaining the respective one of the current processes in the computing system. (col 10 ln 42- 50 “In this example, a determination can be made 312 as to the impact a termination event for an application might have on the application, other applications, and related services, among other such aspects. For example, a background service for an application that is unlikely to be accessed in a near period of time might be a possibility for termination, but if other applications might utilize that background service in the near future then it might be determined not to terminate that background service at the present time.”)
Regarding claim 10, Fraser and Flynn teaches,
The method of claim 1,
Fraser further teaches,
wherein the action comprises terminating the respective one of the current processes, and further comprising: (col 2 ln 30-36 “In some embodiments different types of termination actions can be performed based upon state of the device or other such information. These can include actions of a first type that terminate, kill, or cleanup applications or processes on the device,”)
determining that terminating the respective one of the current processes causes an unexpected error with another one of the current processes; (col 10 ln 42- 50 “In this example, a determination can be made 312 as to the impact a termination event for an application might have on the application, other applications, and related services, among other such aspects. For example, a background service for an application that is unlikely to be accessed in a near period of time might be a possibility for termination, but if other applications might utilize that background service in the near future then it might be determined not to terminate that background service at the present time.”; col 8-9 ln 65-10 “In some embodiments, the result of the performing of the actions can be monitored in order to make better decisions in the future. For example, terminating a particular application to a particular stage … The termination can involve functions such as …, termination of background services, releasing of connections or sockets, and other such tasks, and a determination can be made as to which of these tasks is needed for each action to ensure that the action can be performed when making the termination decision. … . For example, an application might be selected for termination over a less likely accessed application if the selected application will … result in less stable state if not terminated.”; col 9 ln 54-67 “The same ( or a separate) component or service can also provide information relating to feedback from the user, device, or another service, among other such options. For example, the effects of certain termination actions and acceptability of the actions might be monitored and provided back to the termination service in order to assist with predictions and/or action selections. ….”)
providing feedback on termination results to help with the prediction and/or action selection process; (col 9 ln 29-45 “In some embodiments, at least some of … , system events, termination results, and other such data can be sent to a remote location, such as a service operating in a resource environment, or "the cloud," in order to aggregate information. The information can be aggregated across various users in order to determine default application rankings for new users. The information also can be aggregated for different devices for a single user, in order to enable the user's preferences or behavior to be used to make better decisions on different devices.” … “This information can be fed back to the monitoring service, which in at least some embodiments can be a service operating as part of the operating system that can log functions, store received information, and periodically synchronize information with remote resources and other such entities.”; col 9 ln 54-67 “The same ( or a separate) component or service can also provide information relating to feedback from the user, device, or another service, among other such options. For example, the effects of certain termination actions and acceptability of the actions might be monitored and provided back to the termination service in order to assist with predictions and/or action selections. If the observed performance gain for a termination action is less than a certain amount, which may depend upon the state of the device, then a weighting of that action or selection might be impacted accordingly. This information can help with the prediction and/or action selection process, or can trump or override the selection actions, among other such options.”)
However, although Fraser does save termination results to help with the prediction and/or action selection process, Fraser does not specifically teach updating training data to include the respective one of the current processes with a revised classification; and retraining the process classification model using the updated training data.
On the other hand, Flynn further teaches,
wherein the action comprises terminating the respective one of the current processes, and further comprising: (par 38 “In operation 210, the plugin resource manager 120 controls the execution of the plugin based on the monitored resource consumption metrics of the plugin process 112 executing the plugin, such as by limiting the CPU cycles or memory that the plugin process 112 is permitted to use, terminating hung processes, and the like, as described in more detail below.”)
determining that terminating the respective one of the current processes causes an unexpected error with another one of the current processes;(par 65 “In some examples, the labels are generated automatically, such as based on the resource usage metrics collected from the computing device during execution of the plugin by a particular process, information regarding the responsiveness of a plugin in generating ACKs, and/or information regarding crashes or hangs by the process during the execution of plugins.”)
updating training data to include the respective one of the current processes with a revised classification; (par 66 “In operation 434, the model training system 720 trains a statistical model or machine learning model based on the labeled training data to predict execution state classifications (e.g., "run," "do not run," and "conservative run") corresponding to particular input features or an input feature vector including a plurality of input features. Examples of types of statistical models and types of machine learning models that may be used in accordance with examples of the present disclosure include, but are not limited to: a logistic regression model, a support vector machine (SVM), a neural network (including a deep neural network), and the like.”; par 67;) and
retraining the process classification model using the updated training data. (par 67 “If training is not complete, then the model training system 720 returns to operation 434 to continue training, such as by refining the model based on the same training data or by using additional training data.”)
Regarding claim 11, it is a computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to implement the method of claim 1, and is rejected for the same reasons.
The combination further discloses a non-transitory computer readable medium storing executable instructions(see Fraser col 30 ln 36-53; Flynn par 85), and “create a process classification model by employing logistic regression”(see Flynn par 66 “Examples of types of statistical models and types of machine learning models that may be used in accordance with examples of the present disclosure include, but are not limited to: a logistic regression model, a support vector machine (SVM), a neural network (including a deep neural network), and the like.”).
Regarding claim 14, it is a computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to implement the method of claim 4, and is rejected for the same reasons.
Regarding claim 15, Fraser and Flynn teaches,
The computer program product of claim 11,
Fraser further teaches,
wherein the action comprises one of alerting a user that the respective one of the current processes is an unused process(col 14 ln 56-63 “In some embodiments any application that is user-facing may be prevented from being terminated. … . For these applications and services, other actions might be taken, such as logging data about the compromise or otherwise providing a notification such that other actions can be taken to attempt to prevent such compromises in the future.”; col 8 ln 1-3 “In some embodiments, the applications can be notified or requested to approve the termination, among other such options.” )
and automatically terminating the respective one of the current processes. (col 14 ln 63-67 “For other embodiments very aggressive termination decisions might be made, such as may include any application with atypical behavior, such as irregular communication patterns, lengthy execution times, excess memory usage, and the like.”; col 13 ln 15-25 “In at least some embodiments an application determined to cause the problem might first be analyzed to determine the impact on the user and/or system, and if the impact is determined to be acceptable then that application can be selected for a termination action to attempt to remedy the device health situation before attempting to terminate other applications or services. Accordingly, one or more termination actions can be determined 610 for those applications to attempt to remedy the device health, and at least some of those termination actions performed 612 on the device.”)
Regarding claim 16, it is a system that implements the method of claim 1, and is rejected for the same reasons.
The combination further discloses a system(see Fraser col 1 ln 59-63; Flynn par 95), and “create a process classification model by employing feature selection and logistic regression with historic transactional data”(see Flynn par 100 “evaluating a plugin execution policy by supplying a feature vector to a machine learning model trained on historical telemetry data associated with the plugin, wherein the feature vector includes an identity of the determined plugin and computing state data;”; Flynn par 66 “Examples of types of statistical models and types of machine learning models that may be used in accordance with examples of the present disclosure include, but are not limited to: a logistic regression model, a support vector machine (SVM), a neural network (including a deep neural network), and the like.”).
Regarding claim 17-18, 20 they are the system that implements the method of claims 7-8,10 and are rejected for the same reasons.
Claim(s) 2-3,12-13 is/are rejected under 35 U.S.C. 103 as being unpatentable over US 9760399 B1 (Fraser) in view of US 20230106369 A1 (Flynn) as applied to claim 1 above, and further in view of US 20040255299 A1 (Brenner).
Regarding claim 2, Fraser and Flynn teaches,
The method of claim 1,
Flynn further teaches,
wherein: the current plugin has details pulled from a process table in an operating system of the computing system;(par 58 “In operation 406, the plugin resource manager 120 begins monitoring the plugin process that will handle the task. In various examples, the monitoring includes storing metrics regarding the CPU usage (e.g., CPU time or cycles), memory usage, … ), thread count, number of items processed (e.g., if more than one task is handled during a run), total duration of time spent in user mode and kernel mode, and the like. For example, in Unix-like and BSD-like systems such as Linux, MacOS®, iOS®, and Android®, these statistics regarding resource usage by a particular process may be accessed using calls to sysctl or libproc (such as through proc_pidinfo) and/or read from the "proc" pseudo-filesystem (typically mounted at "/proc") in a sub-directory corresponding to the process id (pid) of the process running the plugin or may be read using a tool configured to collect and print information from the proc pseudo-filesystem. …” A person having ordinary skill in the art would understand that the stated /proc, sysctl, and libproc calls are standard ways of accessing process table details from a Unix-based operating system. Flynn also gives examples of getting process information from a Microsoft Windows based operating system later in paragraph 58.)
However, although Flynn teaches monitoring data from the process table, Fraser and Flynn does not specifically teach the current processes comprise processes in a process table in an operating system of the computing system; and the respective one of the current processes comprises a child process.
On the other hand, Brenner teaches,
A method of identifying child processes that should be removed and removing them (Brenner par 14 “The kernel exit routine identifies child processes that exited (i.e., terminated) before the parent process. These previously-exited processes are known as "zombies." The kernel exit routine removes the zombie children by calling the internal service used indirectly by the wait system call (as when done by a parent process upon being notified that a child process has exited). In this manner, the zombie children of the exiting parent process are removed without re-parenting the zombie processes to a standard system process, such as init.”
wherein: the current processes comprise processes in a process table in an operating system of the computing system;(fig 3; par 35 “In one embodiment, processes, including ignored and flagged processes, are listed in process table 370.”) and
the respective one of the current processes comprises a child process. (fig 3; par 35 “In this embodiment, swapper process 300 identifies zombie processes that are ignored or that have been flagged by checking the process' SLOAD flag which is included in process table 370.”; zombie process are child processes. The term zombie is defined in Brenner par 14 “The kernel exit routine identifies child processes that exited (i.e., terminated) before the parent process. These previously-exited processes are known as "zombies."”)
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to further modify Fraser and Flynn to incorporate the monitoring of current processes in the process table and where the respective one of the current processes comprises a child process, of Brenner. One of ordinary skill in the art would have been motivated to remedy the shortcomings of Fraser and Flynn -- a need for how to clean up processes that unlikely to be used (Brenner par 6 “While zombie processes provide a means for parent processes to retrieve information about child processes that have exited, an abundance of zombie child processes can burden the operating system. When a parent process never requests its children's exit values (via a "wait" system call), and the parent eventually exits, the child processes are re-parented to and eventually cleaned up, or "harvested," by a standard system process. A standard system process that is often used in a UNIX™ environment is named "init." Because of the functions it performs, the init process is typically a user process (i.e., not a kernel process) and therefore relatively expensive, in terms of system resources, to execute. … .”; par 12 “What is needed, therefore, is a system and method for efficiently harvesting zombie processes without overburdening system processes, such as init. …”) -- with Brenner providing a known method to solve a similar problem. Brenner provides a way of identifying child processes that should be removed and removes them (Brenner par 14 “The kernel exit routine identifies child processes that exited (i.e., terminated) before the parent process. These previously-exited processes are known as "zombies." The kernel exit routine removes the zombie children by calling the internal service used indirectly by the wait system call (as when done by a parent process upon being notified that a child process has exited). In this manner, the zombie children of the exiting parent process are removed without re-parenting the zombie processes to a standard system process, such as init.”).
Regarding claim 3, Fraser and Flynn teaches,
The method of claim 1,
Fraser further teaches,
wherein the respective one of the current processes comprises a orphaned process.(col 2 ln 38-49 “The state of the device can include, for example, the availability of resources such as … , amount of memory used by each application or process, number of applications currently running on the device, … , background processor usage, presence of orphaned processes ( e.g., processes associated with an application that is no longer executing on the device), …, and the like.”)
However, Fraser and Flynn does not specifically teach wherein the respective one of the current processes comprises a zombie process.
On the other hand, Brenner teaches,
A method of identifying child processes that should be removed and removing them (Brenner par 14 “The kernel exit routine identifies child processes that exited (i.e., terminated) before the parent process. These previously-exited processes are known as "zombies." The kernel exit routine removes the zombie children by calling the internal service used indirectly by the wait system call (as when done by a parent process upon being notified that a child process has exited). In this manner, the zombie children of the exiting parent process are removed without re-parenting the zombie processes to a standard system process, such as init.”)
wherein the respective one of the current processes comprises a zombie process. (fig 3; par 35 “In this embodiment, swapper process 300 identifies zombie processes that are ignored or that have been flagged by checking the process' SLOAD flag which is included in process table 370.”; zombie process are child processes. The term zombie is defined in Brenner par 14 “The kernel exit routine identifies child processes that exited (i.e., terminated) before the parent process. These previously-exited processes are known as "zombies."”)
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to further modify Fraser and Flynn to incorporate the monitoring of current processes in the process table and where the respective one of the current processes comprises a child process, of Brenner. One of ordinary skill in the art would have been motivated to remedy the shortcomings of Fraser and Flynn -- a need for how to clean up processes that unlikely to be used (Brenner par 6 “While zombie processes provide a means for parent processes to retrieve information about child processes that have exited, an abundance of zombie child processes can burden the operating system. When a parent process never requests its children's exit values (via a "wait" system call), and the parent eventually exits, the child processes are re-parented to and eventually cleaned up, or "harvested," by a standard system process. A standard system process that is often used in a UNIX™ environment is named "init." Because of the functions it performs, the init process is typically a user process (i.e., not a kernel process) and therefore relatively expensive, in terms of system resources, to execute. … .”; par 12 “What is needed, therefore, is a system and method for efficiently harvesting zombie processes without overburdening system processes, such as init. …”) -- with Brenner providing a known method to solve a similar problem. Brenner provides a way of identifying child processes that should be removed and removes them (Brenner par 14 “The kernel exit routine identifies child processes that exited (i.e., terminated) before the parent process. These previously-exited processes are known as "zombies." The kernel exit routine removes the zombie children by calling the internal service used indirectly by the wait system call (as when done by a parent process upon being notified that a child process has exited). In this manner, the zombie children of the exiting parent process are removed without re-parenting the zombie processes to a standard system process, such as init.”).
Regarding claims 12,13, they are a computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to implement the method of claims 2,3, and are rejected for the same reasons.
Claim(s) 9,19 is/are rejected under 35 U.S.C. 103 as being unpatentable over US 9760399 B1 (Fraser) in view of US 20230106369 A1 (Flynn) as applied to claim 1 above, and further in view of US 20070168496 A1 (Bansod).
Regarding claim 9, Fraser and Flynn teaches,
The method of claim 1,
Fraser further teaches,
wherein the action comprises terminating the respective one of the current processes, and further comprising: (col 2 ln 30-36 “In some embodiments different types of termination actions can be performed based upon state of the device or other such information. These can include actions of a first type that terminate, kill, or cleanup applications or processes on the device,”)
determining that terminating the respective one of the current processes causes an unexpected error with another one of the current processes; (col 10 ln 42- 50 “In this example, a determination can be made 312 as to the impact a termination event for an application might have on the application, other applications, and related services, among other such aspects. For example, a background service for an application that is unlikely to be accessed in a near period of time might be a possibility for termination, but if other applications might utilize that background service in the near future then it might be determined not to terminate that background service at the present time.”; col 8-9 ln 65-10 “In some embodiments, the result of the performing of the actions can be monitored in order to make better decisions in the future. For example, terminating a particular application to a particular stage … The termination can involve functions such as …, termination of background services, releasing of connections or sockets, and other such tasks, and a determination can be made as to which of these tasks is needed for each action to ensure that the action can be performed when making the termination decision. … . For example, an application might be selected for termination over a less likely accessed application if the selected application will … result in less stable state if not terminated.”; col 9 ln 54-67 “The same ( or a separate) component or service can also provide information relating to feedback from the user, device, or another service, among other such options. For example, the effects of certain termination actions and acceptability of the actions might be monitored and provided back to the termination service in order to assist with predictions and/or action selections. ….”) and
adding the respective one of the current processes to a watchlist to assist with future classifications.(col 9 ln 29-45 “In some embodiments, at least some of … , system events, termination results, and other such data can be sent to a remote location, such as a service operating in a resource environment, or "the cloud," in order to aggregate information. The information can be aggregated across various users in order to determine default application rankings for new users. The information also can be aggregated for different devices for a single user, in order to enable the user's preferences or behavior to be used to make better decisions on different devices.” … “This information can be fed back to the monitoring service, which in at least some embodiments can be a service operating as part of the operating system that can log functions, store received information, and periodically synchronize information with remote resources and other such entities.”; col 9 ln 54-67 “The same ( or a separate) component or service can also provide information relating to feedback from the user, device, or another service, among other such options. For example, the effects of certain termination actions and acceptability of the actions might be monitored and provided back to the termination service in order to assist with predictions and/or action selections. If the observed performance gain for a termination action is less than a certain amount, which may depend upon the state of the device, then a weighting of that action or selection might be impacted accordingly. This information can help with the prediction and/or action selection process, or can trump or override the selection actions, among other such options.”; claim 11 col 32 ln 56-65 “…wherein the first termination action includes at least one of partially terminating the first application, …, terminating a background process associated with the first application, …, terminating an orphaned process associated with the first application, logging data for the first application, or throttling an operational level of the first application.”)
However, Fraser and Flynn does not specifically teach adding the respective one of the current processes to a watchlist for further investigation.
On the other hand, Bansod teaches,
A backend server process monitor(par 5 “The technology includes a backend server process monitor operating on application servers which access resources on backend servers. The monitor tracks, failures, latency and errors at an interval.”)
determining if a resource request has an unexpected error (par 5 “The technology includes a backend server process monitor operating on application servers which access resources on backend servers. The monitor tracks, failures, latency and errors at an interval.”; par 6 “The method includes monitoring a plurality of resource requests from the application sever to a backend server and determining whether each of the plurality of resource requests was completed successfully and within a specified latency by the backend server. For each unsuccessful or slow response to a resource request, an addition is made to an event tracking monitor watch list.”); and
adding the respective one of the current resource request events to a watchlist for further investigation.(par 6 “The method includes monitoring a plurality of resource requests from the application sever to a backend server and determining whether each of the plurality of resource requests was completed successfully and within a specified latency by the backend server. For each unsuccessful or slow response to a resource request, an addition is made to an event tracking monitor watch list.”; par 25 “Each of the watched backend servers keeps track of all the failures that happen for that particular backend. This includes when it occurred and what severity. At any point in time, one can calculate the cumulative severity for that particular backend.”; par 33 “If a failure or a slow event is received, then the relative weight and decay duration is retrieved at step 220 and the event is added to a watch list 222. The watch list is maintained by the external event monitor 34 in a data store. 38.”)
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to further modify Fraser and Flynn to incorporate the unexpected error watchlist of Bansod. One of ordinary skill in the art would have been motivated to remedy the shortcomings of Fraser and Flynn -- a need for how to monitor and report important system events, such as unexpected errors (Bansod par 3)-- with Bansod providing a known method to solve a similar problem. Bansod provides “The technology includes a backend server process monitor operating on application servers which access resources on backend servers. The monitor tracks, failures, latency and errors at an interval.”(Bansod par 5).
Regarding claim 19 it is the system that implements the method of claim 9 and is rejected for the same reasons.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US 20190294482 A1 - Li - process state processing
US 20030037290 A1 - Price - teaches managing defunct processes
US 6480877 B1 - Odonnell - orphan computer process identification
US 20230281315 A1 - Capellman - monitors processes and uses machine learning to determine if the process is malware or not. If risk score is greater than threshold, sends a command to the client device (to turn off the process)
US 20160269424 A1 - Chandola - compares process sets with known historical process sets to classify them.
US 20240020153 A1 - Xu - process monitor classifies a process as inactive and takes remedial actions to address inactive computing process.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL XU whose telephone number is (571)272-5688. The examiner can normally be reached Monday-Friday 8:00am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bryce Bonzo can be reached at (571) 272-3655. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL XU/Examiner, Art Unit 2113
Prosecution Insights