DETAILED ACTION
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is responsive to the amendment filed 06/03/2026.
Claims 1-19 and 21 are pending in this application.
The objection of the title has been withdrawn in view of Applicant's amendment.
The rejection of claims 1-20 under 35 USC § 101 has been withdrawn in view of Applicant's amendment and arguments.
Claim Rejections - 35 USC § 103
2. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the invention was made.
Claims 1-19 and 21 are rejected under 35 U.S.C. 103 as being unpatentable over Brdiczka et al. (US 20110302169) in view of Flores et al. (US 20070240215).
It is noted that any citations to specific, pages, columns, paragraphs, lines, or figures in the prior art references and any interpretation of the reference should not be considered to be limiting in any way. A reference is relevant for all it contains and may be relied upon for all that it would have reasonably suggested to one having ordinary skill in the art. See MPEP 2123.
As to claim 1:
Brdiczka teaches a system (Fig.7 and [0053]: a computer system 700), said system comprising: a memory (Fig.7 and [0054]: memory 724); and a processor (Fig.7 and [0053]: one or more processors 710) in communication with said memory, said processor being configured to perform operations, said operations comprising:
obtaining social interaction data for a user ([0007]: receiving the user-action information may involve monitoring user interaction with an electronic device...the user activities may be associated with one or more corresponding objectives of a project. [0056-0057]: Tracking module 730 may monitor or track user-action information 738 (which is associated with one or more user activities) when a user is using a computer (or, more generally, an electronic device). For example, tracking module 730 may perform event tracking while the user is using the computer... aggregation module 732 may identify subsets 740 of user-action information 738);
monitoring a system for activity of said user ([0024]: In a user-activity identification technique, a user's actions are monitored while the user is using a computer...the one or more current user activities can be identified; see also, [0026], [0028], [0038], and [0050]);
analyzing said activity and said social interaction data to obtain an analysis ([0029]: Then, the computer system identifies subsets of the user-action information (operation 114), and receives classifications from a user of the user activities associated with the identified subsets of the user-action information (operation 116). Note that the identified subsets of the user-action information comprise supervised data. For example, identifying the subsets of the user-action information may involve performing a clustering analysis. In addition, a given classification of the user activities in the received classifications of the user activities may be associated with multiple subsets of the user-action information; see also, 0030], [0042], and [0057]).
performing statistical linear regression on said activity and said social interaction data to obtain statistical linear regression data; and deriving a task clustering model based on said analysis and said statistical linear regression data ([0046]: Referring back to FIG. 3, the combination of the clusters and the associated activity labels may be used to generate a user-activity model (operation 316), such as a supervised-learning model that associates new or current user-action information with one or more of the identified and labeled clusters. For example, the supervised-learning model may be based on a technique such as: classification and regression trees (CART), support vector machines (SVM), linear regression, non-linear regression, ridge regression, LASSO, and/or a neural network).
Brdiczka, however, does not explicitly teach, Flores teaches the task clustering model: weights relationships based on social interaction data distinct from said monitored activity; and upon detection of a first task in a first application, automatically triggering a second task in a different application when a relationship strength exceeds a threshold. ([0011]: a detection program that detects malware programs by performing a real-time weighted analysis of a program's complete execution path. In an illustrative embodiment, the detection program monitors normal execution of programs in real time to generate probability ratings or weightings. A weighting is generated based on interactions between the running program and its internal functional modules, as well as externally called functional modules and/or application programming interfaces (APIs). If the weighting reaches a pre-defined threshold of infection, the detection program identifies the running program as a malware program and automatically triggers an alert and/or takes corrective action to address the threat; [0017]: If a relationship is found where the program of interest is designed to initiate other function calls or programs that may indicate the presence of malware, but has not yet called those functions, the weighting of the program may also increase. For example, the detection program 104 may detect that KL.exe calls other programs, such as KLHELPER.exe, and that KLHELPER.exe includes behavior that may indicate the presence of malware. The weighting of KLHELPER.exe's behavior is added to KL.exe's weighting, which raises the probability that KL.exe is a malware program. Thus, the detection program 104 monitors the interactions across multiple program modules instead of a single program or program module.
[0018]: If the weighting of the program of interest reaches a pre-defined threshold of infection, the detection program 104 identifies the program as a malware program and triggers an alert. The alert may perform any number of predefined actions, including informing a user that further analysis is needed or causing the detection program 104 to automatically take corrective action to address the malware threat. When the alert is triggered, the detection program 104 may also perform a module analysis that may result in lowering the probability of the program being a malware program. For example, the module analysis may be based upon the program's association with, and its ability to call, other non-malware programs, such as APIs or programs whose behavior in conjunction with the calling program is associated with normal maintenance of the system, software updates, operating system updates, and the like).
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Brdiczka with Flores because it would have provided the enhanced capability for monitoring the behavior of a potential malware program (i.e., a "program of interest") based on the interaction between the program of interest and the operating system as well as the interaction between the program of interest and other external programs and program modules.
As to claim 2:
Brdiczka teaches generating a visual with said task clustering model ([0026] and [0035]).
As to claim 3:
Brdiczka teaches providing a visual of a weighted relationship ([0009, [0031], [0040], and [0048]).
As to claim 4:
Brdiczka teaches providing said visual to said user ([0026] and [0035]); observing a user interaction between said user and said visual ([0026] and [0035]); and incorporating said user interaction into a learning database ([0031] and [0039]).
As to claim 5:
Brdiczka teaches identifying related tasks within said activity with said task clustering model ([0027], [0033], and [0039]).
As to claim 6:
Brdiczka teaches providing a visual of a weighted relationship of said related tasks ([0027], [0031], and [0059]).
As to claim 7:
Brdiczka teaches weighting relationships of said related tasks based on said social interaction ([0027], [0031], and [0059]).
As to claims 8-13:
Refer to the discussion of claims 1-4, 6, and 7 above, respectively, for rejection. Claims 8-13 are the same as claims -4, 6, and 7, except claims 8-13 are method claims and claims 1-4, 6, and 7 are system claims.
As to claim 14:
Brdiczka teaches implementing said task clustering model in an environment with a given set of constraints ([0040-0041]).
As to claims 15-19:
Refer to the discussion of claims 1-5above, respectively, for rejection. Claims 15-19 are the same as claims 1-5, except claims 15-19 are computer program product claims and claims 1-5 are system claims.
As to claim 21:
Brdiczka, however, does not explicitly teach, Flores teaches said automatically triggering said second task includes generating and transmitting an executable command to said second application ([0011], [0017-0018, and [0024-0025]).
It would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Brdiczka with Flores because it would have provided the enhanced capability for monitoring the behavior of a potential malware program (i.e., a "program of interest") based on the interaction between the program of interest and the operating system as well as the interaction between the program of interest and other external programs and program modules.
Response to Arguments
3. Applicant's arguments filed 06/03/2026 have been fully considered but are deemed to be moot in view of the new ground(s) of rejection necessitated by Applicant's amendments.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Contact Information
4. Any inquiry concerning this communication or earlier communications from the examiner should be directed to VAN H. NGUYEN whose telephone number is (571) 272-3765. The examiner can normally be reached on Monday- Friday from 9:00AM to 5:30 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, LEWIS BULLOCK, can be reached at telephone number (571) 272-3759. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center or Private PAIR to authorized users only. Should you have questions about access to Patent Center or the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/uspto-automated- interview-request-air-form.
/VAN H NGUYEN/Primary Examiner, Art Unit 2199
Prosecution Insights