DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are pending. Claims 1, 13 are independent and amended. No claims have been added or canceled. Amendments to the claims have been accepted.
Response to Arguments
Applicant’s arguments, see pp. 12-15 (pp. 3-6 of Remarks), filed 04/13/2026, with respect to the rejection(s) of claim(s) 1 and 13 under 35 U.S.C. § 103 over Labreche in view of Bellis and Weber have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of 35 U.S.C. § 103 over Pan in view of Ngweta and Bellis.
Applicant’s arguments with respect to claim(s) 2-12, 14-20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 1, 13 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Claims 2-12, 14-20 are rejected for containing the indefinite subject matter by reference.
Claim 1 recites the limitation "the historical corpus" in line 9. There is insufficient antecedent basis for this limitation in the claim.
Claim 13 recites the limitation "the historical corpus" in line 11. There is insufficient antecedent basis for this limitation in the claim.
Claim Rejections - 35 USC § 103
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
Claim(s) 1, 3-6, 8, 10, 13, 15-17, 19-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Pan (PAN et al., WO 2023092511 A1, cited in a prior office action) in view of Ngweta (Ngweta et al., US 20220131887 A1) and Bellis (US 20220207152 A1, cited in a prior office action)
Regarding claim 1, and substantially claim 13, Pan teaches a method of predicting risks related to software vulnerabilities, the method comprising: applying input data to a prediction engine, the input data comprising one or more bug reports of a first vulnerability, wherein the one or more bug reports comprise prose that is unstructured data, and wherein the prediction engine comprises a natural language model trained to encode the unstructured data (p. 3, "An issue report (IR), which is often used interchangeably with a bug report, a security bug report (SBR) or a problem report, generally contains a title which summarizes the issue and a body that explains the details of the issue.") into contextual embeddings (p. 24, "In some embodiments, the description is a natural language description". pp. 24-25, "In some embodiments, BERT (i.e., Bidirectional Encoder Representations from Transformers), a type of language model developed and released by Google™ in late 2018, may be used as an encoder component 302A in the matching module 302. BERT makes use of an attention mechanism that learns contextual relations between words (or sub-words) in a text."); comparing the contextual embeddings of the one or more bug reports of the first vulnerability to embeddings of bug reports in the historical corpus (p.27, "The matching module 302 may comprise the following components: a shared encoder 302A which is configured to convert the two inputs into two feature vectors in hidden space, and a matching classifier 302B which is configured to determine whether the two feature vectors (i.e., u and v) will match, the degree to which the two features match, or a combination thereof"), p. 23, "An issue report, to be compared against entries in the knowledge database, can be of a type which is similar to (e.g. contains languages similar to) one of the entries"); deriving a statistical relationship of exploit outcomes associated with a set of historical vulnerabilities corresponding to the compared embeddings (p.27, "… the matching module will generate a matching score value 305 as the output, which indicates the similarity between the IR and the anchor/entry content. In some embodiments, the matching score 305 is a measure p, for example ranging between zero and one. The measure p can be interpreted for example as the probability or likelihood that the subject issue report matches the subject anchor node… ", p. 31, "In other words, a best match is identified when one of the plurality of entries most closely and sufficiently closely matches the issue report. When the best match is identified, the issue report indicates a potentially exploitable software vulnerability.", a vulnerability and its potential exploitability is identified and indicated via the probability they match from the comparison of feature vectors (contextual embeddings) obtained from the encoder. See also Fig. 6B as well as Fig. 10.
Pan does not teach but, in an analogous art, Ngweta teaches generating output data in response to the input data being applied to the prediction engine, the output data comprising one or more scores including a value for a first score, the first score representing a likelihood of an exploit being developed for the first vulnerability based at least in part on the statistical relationship of exploit outcomes (¶67, "For example, as described above, estimation component 110 can use the mappings to calculate similarity scores corresponding to the vulnerability and respective attack techniques. In this example, estimation component 110 can then use the similarity scores to identify the above described one or more attack techniques having a relatively low, moderate, and/or high probability of being used to exploit the vulnerability to attack the computing resource.". ¶35-¶39, the likelihood of the attack technique to be used to exploit the vulnerability (likelihood of an exploit being developed for the first vulnerability) is calculated based on the similarity scores (statistical relationship of exploit outcomes). ¶63, ¶70, historical security reports (bug reports) are used for the analysis to determine the probability of an exploit).
One of ordinary skill in the art prior to the effective filing date of the claimed invention could modify Pan using Ngweta to generate output data comprising a likelihood of an exploit being developed for the first vulnerability based at least in part on the statistical relationship of exploit outcomes with predictable results, as the matching score of Pan is substantially similar to the similarity score of Ngweta as a statistical relationship of exploit outcomes between the current report and the historical reports, such that the estimation component of Ngweta can be chained to/added to the BERT model of Pan to calculate the exploit probability of Ngweta and improve the functionality of Pan. It would be obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify Pan using Ngweta to generate output data comprising a likelihood of an exploit being developed for the first vulnerability based at least in part on the statistical relationship of exploit outcomes because determining the probability that an attack will be developed such that the vulnerability will be exploited can help protect the computing resources involved (Ngweta, ¶4).
Pan in view of Ngweta does not teach but, in an analogous art, Bellis teaches that the output data comprising two or more scores including a value for a first score and a value for a second score, the second score representing a likelihood the first vulnerability will be attacked using said exploit, (Fig. 3, Step 304, ¶106, "… return output data indicating a prediction of whether an exploit will be developed for each software vulnerability of the plurality of software vulnerabilities… ", Step 310, ¶110, "… return output data indicating a prediction of whether there will be an attack involving an exploit to be developed for each software vulnerability in the subset of the plurality of software vulnerabilities."), wherein the second score is based at least in part on the first score being an input (¶108-¶109, "The subset of the input data is limited to software vulnerabilities that are predicted to have exploits developed for them. Determination of the subset of the input data may be based on the output data of optional block 304… The prediction indicates whether an exploit to be developed for the software vulnerability will be used in an attack"); and triaging the first vulnerability with respect to other vulnerabilities using the two or more scores (¶111).
One of ordinary skill in the art prior to the effective filing date of the claimed invention could modify Pan in view of Ngweta using Bellis to predict a second score using the first score representing the likelihood the first vulnerability will be attacked using the developed exploit and triage the vulnerability based on both scores with predictable results, as the likelihood the exploit will be developed is a binary category for both Ngweta (Pan in view of Ngweta) (¶39, in or out of the fixed radius of similarity for the vulnerability) and Bellis (¶46, ¶93, the predicted developed exploit feature is binary as 'Yes' or 'No'), such that the second model of Bellis that determines the second score can be trained on and use as input the binary score of Pan in view of Ngweta to determine the second score for the vulnerability and subsequently triage the vulnerability compared to other vulnerabilities (as remediation is prioritized according to the exploit development feature and attack usage feature).It would be obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify Pan in view of Ngweta using Bellis to predict a second score using the first score representing the likelihood the first vulnerability will be attacked using the developed exploit and triage the vulnerability based on both scores because it would help for determining how to prioritize remediating multiple vulnerabilities (Bellis, ¶6-¶7).
Regarding Claim 3, and substantially claim 15, Pan in view of Ngweta and Bellis teaches the method of claim 1, further comprising: signaling the values of the output to a user; receiving user feedback regarding the values of the output; and performing reinforcement learning based on the received user feedback to update the prediction engine (Pan pp. 38-39, "The user interface module 1001 may be configured to display the output of the neural network or voting module on a user display and accept input from the user (e.g., knowledge expert) . The input from the user can be indicative of whether or not the output of the neural network (i.e., matching module 302) or voting module 303 is correct or incorrect. The input from the user can be indicative of a desired change to the external knowledge base 901 or memory module 301, based on a user perceived inaccuracy in the output of the neural network (i.e., matching module 302) or voting module 303. In some embodiments, the input from the user can be used to generate a new entry in the external knowledge base 901 (or memory module 301) or to update an existing entry. Neural network training can be performed periodically or in an ongoing manner in order to incorporate updates to the memory module 301.").
Contextualized by Bellis, where the output is two or more scores, Pan in view of Ngweta and Bellis teaches signaling the values of the two or more scores to a user and receiving user feedback regarding the values of the two or more scores.
Regarding claim 4, and substantially claim 16, Pan in view of Ngweta and Bellis teaches the method of claim 1, wherein: the prediction engine is trained to classify the first vulnerability based on similarities of the first vulnerability to training vulnerabilities, wherein a set of training data used to train the prediction engine comprises training bug reports and the training vulnerabilities, and, in the set of training data, each of the training vulnerabilities is associated with a corresponding training bug report of the training bug reports (Pan, p. 28, "The top encoder, configured to process issue reports, and the bottom encoder, configured to process anchor content, may be trained together during a training phase. In some embodiments, one encoder may be trained during the training phase and then duplicated to generate the top and bottom encoders. In some embodiments, the top encoder may learn knowledge with the help from the bottom encoder. The encoders 302A can be trained using every positive labeled issue report (of which its vulnerability type is known) and every anchor/entry in the memory module 301 respectively to learn the semantic representation (i.e., u and v) , then the same matching classifier 302B can be applied to further learn the similarity knowledge between them. ").
Regarding claim 5, Pan in view of Ngweta and Bellis teaches the method of claim 4, wherein: the prediction engine has been trained to learn patterns in the training bug reports (Pan, pp. 24-25, "In some embodiments, BERT (i.e., Bidirectional Encoder Representations from Transformers), a type of language model developed and released by Google™ in late 2018, may be used as an encoder component 302A in the matching module 302. BERT makes use of an attention mechanism that learns contextual relations between words (or sub-words) in a text.") and the similarities are based, in part, on a degree to which the one or more bug reports matches the learned patterns (Pan, p. 27, "The matching module 302 may comprise the following components: a shared encoder 302A which is configured to convert the two inputs into two feature vectors in hidden space, and a matching classifier 302B which is configured to determine whether the two feature vectors (i.e., u and v) will match, the degree to which the two features match, or a combination thereof"), p. 23, "An issue report, to be compared against entries in the knowledge database, can be of a type which is similar to (e.g. contains languages similar to) one of the entries") to determine from among the training vulnerabilities a subset of similar vulnerabilities from the training vulnerabilities (Pan, p. 31, "In other words, a best match is identified when one of the plurality of entries most closely and sufficiently closely matches the issue report. When the best match is identified, the issue report indicates a potentially exploitable software vulnerability.").
Ngweta further teaches that the value of the first score of the first vulnerability are determined based on probabilities that exploits were developed for the subset of similar vulnerabilities (Ngweta, ¶67, "For example, as described above, estimation component 110 can use the mappings to calculate similarity scores corresponding to the vulnerability and respective attack techniques. In this example, estimation component 110 can then use the similarity scores to identify the above described one or more attack techniques having a relatively low, moderate, and/or high probability of being used to exploit the vulnerability to attack the computing resource.". ¶35-¶39, the likelihood of the attack technique to be used to exploit the vulnerability (first score) is calculated based on the similarity scores (probabilities that exploits were developed for the subset of similar vulnerabilities)(see claim 1 for motivation to combine).
Bellis further teaches that the value of the second score of the first vulnerability are determined based on probabilities that the exploits were used to attack the subset of similar vulnerabilities (Bellis, ¶108-¶109, "The subset of the input data is limited to software vulnerabilities that are predicted to have exploits developed for them. Determination of the subset of the input data may be based on the output data of optional block 304… The prediction indicates whether an exploit to be developed for the software vulnerability will be used in an attack") (see claim 1 for motivation to combine).
Regarding claim 6, and substantially claim 17, Pan in view of Ngweta and Bellis teaches the method of claim 1, wherein the prediction engine comprises one or more machine learning (ML) methods, the one or more ML methods selected from the group consisting of: a transformer neural network (Pan, pp. 24-25, "In some embodiments, BERT (i.e., Bidirectional Encoder Representations from Transformers), a type of language model developed and released by Google™ in late 2018, may be used as an encoder component 302A in the matching module 302. BERT makes use of an attention mechanism that learns contextual relations between words (or sub-words) in a text."), a natural language processing method (Ngweta, ¶33, "and/or any supervised or unsupervised ML and/or AI model that can perform natural language processing (NLP) using a similarity learning process") (natural language processing acts as a possible alternative to analyze unstructured data), a named entity recognition keyword extraction method, a text classification neural network, and a tokenization neural network (Bellis, ¶42, " However, some features may exist as unstructured data that may or may not undergo feature transformation to enable organization in a structured format. Non-limiting examples of feature transformation involve tokenization, n-grams, orthogonal sparse bigrams, quantile binning, normalization, and Cartesian products of multiple features.") (tokenization acts as a possible alternative to analyze unstructured data).
Regarding Claim 8, and substantially claim 19, Pan in view of Ngweta and Bellis teaches the method of claim 1. Bellis further teaches that the prediction engine comprises a first ML method that generates the first score (Bellis, ¶92, "Prediction logic 208 may apply a prediction model for determining whether and/or when an exploit will be developed for a particular software vulnerability"); the prediction engine comprises a second ML method that generates the second score; and the second ML method uses the first score as an input to generate an output comprising the second score (Bellis, ¶92- ¶93, "Thus, values of a developed exploit feature/developed exploit time feature may be predicted. These values may be sent to risk assessment computer(s) 202 as output data 214 or at least some of these values may be used as input data for predicting values of an attack feature. If predicted values of a developed exploit feature/developed exploit time feature are used as input data, prediction logic 208 may apply a prediction model for determining whether an exploit to be developed for a particular software vulnerability will be used in an attack". ¶82, the prediction models are ML methods) (see claim 1 for motivation to combine).
Regarding Claim 10, and substantially claim 20, Pan in view of Ngweta and Bellis teaches the method of claim 1. Bellis further teaches applying another input data to the prediction engine, and in response generating the output data comprising another two or more scores including another value of the first score and another value of the second score (Bellis, Abstract, "The one or more models are applied to input data comprising the prevalence feature for each vulnerability of a second plurality of vulnerabilities. Based on the application of the one or more models to the input data, output data is received. The output data indicates a prediction of whether an exploit will be developed for each vulnerability of the second plurality. Additionally or alternatively, the output data indicates, for each vulnerability of the second plurality, a prediction of whether an exploit that has yet to be developed will be used in an attack."); and triaging the second vulnerability with respect to the first vulnerability using the two or more scores and the another two or more scores, such that the second score serves a primary role and the first score serves a secondary role in determining an order in which the second vulnerability is triaged with respect to the first vulnerability (Bellis, ¶111, "In some embodiments, the output data of block 310 is used to adjust a risk score for one or more software vulnerabilities. Risk scores may be used to prioritize remediation of software vulnerabilities. For example, remediation may be prioritized in the following order: (1) software vulnerabilities predicted to have exploits developed for them, where the exploits are predicted to be used in attacks; (2) software vulnerabilities predicted to have exploits developed for them, where the exploits are predicted not to be used in attacks; and (3) software vulnerabilities predicted not to have exploits developed for them. Furthermore, software vulnerabilities predicted to have exploits developed for them may be prioritized according to when exploits are predicted to be developed and/or when attacks are predicted to occur.").
Contextualized by Pan, where the input data of a vulnerability is a bug report, Pan in view of Ngweta and Bellis teaches another input data comprising another bug report of a second vulnerability. It would be obvious to one of ordinary skill in the art prior to the effective filing date of the invention to further modify Pan in view of Ngweta and Bellis using Bellis to use the two scores to triage the vulnerabilities because it allows for the prioritization of higher risk vulnerabilities, as not all vulnerabilities can be remediated at the same time (Bellis, ¶6).
Claims 2, 11, and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Pan in view of Ngweta and Bellis as applied to claims 1 and 13 above, and further in view of Dunn (Dunn et al., US 20230336581 A1, cited in a prior office action)
Regarding Claim 2, and substantially claim 14, Pan in view of Ngweta and Bellis teaches the method of claim 1. Pan in view of Ngweta and Bellis does not teach the rest of the claim. In an analogous art, Dunn teaches generating, as part of the output data resulting from applying the input data being applied to the prediction engine, a third score representing a likelihood the first vulnerability will become a common vulnerability and exposure (CVE); and (Dunn, ¶47, ¶65, the node exposure score generator takes outputs regarding the device weakness as input and calculates the possibility of future critical vulnerability CVEs); and triaging the first vulnerability with respect to other vulnerabilities using the third score (Dunn, ¶72, ¶74, CVE information is used to intelligently prioritize remediation actions).
Contextualized by Pan in view of Ngweta and Bellis, where the vulnerability is additionally triaged with respect to the first and second score, Dunn suggests triaging the first vulnerability with respect to other vulnerabilities using the first score, the second score, and the third score. It would be obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify Pan in view of Ngweta and Bellis using Dunn to generate a third score representing a likelihood the vulnerability will become a CVE and triaging vulnerabilities with respect to the CVE because CVEs allow for identification of important vulnerabilities in light of a particular network and the danger the vulnerabilities provide, allowing for the determination of why a particular vulnerability is important and why it should be remediated first or not (Dunn, ¶71).
Regarding Claim 11, Pan in view of Ngweta, Bellis, and Dunn teaches the method of claim 2. Bellis further teaches applying another input data to the prediction engine, and in response generating the output data comprising another two or more scores including another value of the first score and another value of the second score (Bellis, Abstract, "The one or more models are applied to input data comprising the prevalence feature for each vulnerability of a second plurality of vulnerabilities. Based on the application of the one or more models to the input data, output data is received. The output data indicates a prediction of whether an exploit will be developed for each vulnerability of the second plurality. Additionally or alternatively, the output data indicates, for each vulnerability of the second plurality, a prediction of whether an exploit that has yet to be developed will be used in an attack."); and triaging the second vulnerability with respect to the first vulnerability using the two or more scores and the another two or more scores, such that the second score serves a primary role and the first score serves a secondary role in determining an order in which the second vulnerability is triaged with respect to the first vulnerability (Bellis, ¶111, "In some embodiments, the output data of block 310 is used to adjust a risk score for one or more software vulnerabilities. Risk scores may be used to prioritize remediation of software vulnerabilities. For example, remediation may be prioritized in the following order: (1) software vulnerabilities predicted to have exploits developed for them, where the exploits are predicted to be used in attacks; (2) software vulnerabilities predicted to have exploits developed for them, where the exploits are predicted not to be used in attacks; and (3) software vulnerabilities predicted not to have exploits developed for them. Furthermore, software vulnerabilities predicted to have exploits developed for them may be prioritized according to when exploits are predicted to be developed and/or when attacks are predicted to occur.").
Contextualized by Pan, where the input data of a vulnerability is a bug report, Pan in view of Ngweta, Bellis, and Dunn teaches another input data comprising another bug report of a second vulnerability. It would be obvious to one of ordinary skill in the art prior to the effective filing date of the invention to further modify Pan in view of Ngweta, Bellis and Dunn using Bellis to use the two scores to triage the vulnerabilities because it allows for the prioritization of higher risk vulnerabilities, as not all vulnerabilities can be remediated at the same time (Bellis, ¶6).
Dunn further teaches generating the output data further comprising another value of the third score (Dunn, ¶65, the node exposure score generator takes outputs regarding the device weakness as input and calculates the possibility of future critical vulnerability CVEs. ¶60, vulnerabilities are prioritized compared to other vulnerabilities, such that output is generated for multiple vulnerabilities) such that for triaging the vulnerabilities, the third score serves a primary role (Dunn, ¶71, the existing CVEs in the network are used to prioritize which vulnerabilities are most important to remediate). Contextualized by Bellis, where the second score serves a primary role and the first score serves a secondary role, Dunn suggests that the third score serves a primary role, the second score serves a secondary role and the first score serves a tertiary role in triaging vulnerabilities. It would be obvious to one of ordinary skill in the art prior to the effective filing date of the invention to further modify Pan in view of Ngweta, Bellis, and Dunn using Dunn to have the third score serve a primary role in triaging vulnerabilities because CVEs allow for identification of important vulnerabilities in light of a particular network and the danger the vulnerabilities provide, allowing for the determination of why a particular vulnerability is important and why it should be remediated first or not (Dunn, ¶71)
Claim 9 is rejected under 35 U.S.C. 103 as being unpatentable over Pan in view of Ngweta and Bellis as applied to claim 1 above, and further in view of Cam (US 20160248794 A1, cited in a prior office action)
Regarding Claim 9, Pan in view of Ngweta and Bellis teaches the method of claim 1. Bellis further teaches applying another input data to the prediction engine, and in response, generating the output data comprising another two or more scores including another value of the first score and another value of the second score (Bellis, Abstract, "The one or more models are applied to input data comprising the prevalence feature for each vulnerability of a second plurality of vulnerabilities. Based on the application of the one or more models to the input data, output data is received. The output data indicates a prediction of whether an exploit will be developed for each vulnerability of the second plurality. Additionally or alternatively, the output data indicates, for each vulnerability of the second plurality, a prediction of whether an exploit that has yet to be developed will be used in an attack."); and triaging the second vulnerability with respect to the first vulnerability using the values of the two or more scores and using the another values of the two or more scores (Bellis, ¶111, both probabilities of exploit development and attacks using that exploit (first and second score) may be used to prioritize the remediation of a software vulnerability).
Contextualized by Pan, where the input data of a vulnerability is a bug report, Pan in view of Ngweta and Bellis teaches another input data comprising another bug report of a second vulnerability. It would be obvious to one of ordinary skill in the art prior to the effective filing date of the invention to further modify Pan in view of Ngweta and Bellis using Bellis to use the two scores to triage the vulnerabilities because it allows for the prioritization of higher risk vulnerabilities, as not all vulnerabilities can be remediated at the same time (Bellis, ¶6).
Although Pan in view of Ngweta and Bellis teaches prioritizing exploits with attacks over exploits without attacks (Bellis, ¶6, ¶111), Pan in view of Ngweta and Bellis does not teach the rest of the claim. In an analogous art, Cam teaches that based on the values and another value for the primary score, the primary score are assigned to bins that correspond to respective ranges for the primary score; whichever of the first vulnerability and the second vulnerability is assigned to a bin that corresponds to a higher value for the primary score is ranked higher; and when the first vulnerability and the second vulnerability are assigned to a same bin, then whichever of the first vulnerability and the second vulnerability has a higher value for the secondary score is ranked higher (Cam, ¶63, "Multiple node attributes are ranked as primary attributes, secondary attributes, tertiary attributes, and the like. During the ancestor nomination process, the primary attribute values of nodes are considered first for comparison and nomination. If the primary attribute values of two nodes happen to be very close to each other according to its threshold, then the next high-ranking attribute (i.e., secondary attribute) values of these two nodes are compared to break the tie. This tie-breaking process is applied until the tie is broken", the multiple attributes (two or more scores) are used to rank the nodes, where the primary attribute (primary score) has a threshold of closeness (bins that correspond to respective ranges) where they are considered to be tied (assigned to the bin), where the secondary attribute (secondary score) is compared to break the tie.).
Contextualized by Bellis, where attacks with exploit are prioritized over vulnerabilities that have exploits but haven't been attacked, such that the second score is prioritized over the first score (and thus, the second score is considered the primary score as it is considered first), and where ranking is performed to triage vulnerabilities for remediation, Cam suggests the rest of the claimed limitations.
It would be obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify Pan in view of Ngweta and Bellis using Cam to achieve the claimed invention because it would allow someone to break ties between two vulnerabilities that are too close (Cam, ¶63)
Claim 12 is rejected under 35 U.S.C. 103 as being unpatentable over Pan in view of Ngweta and Bellis as applied to claim 1 above, and further in view of Bulut (Bulut et al., US 20210075814 A1, cited in a prior office action).
Regarding Claim 12, Pan in view of Ngweta and Bellis teaches the method of claim 1. Pan in view of Ngweta and Bellis does not teach the rest of claim 12. In an analogous art, Bulut teaches applying the input data to the prediction engine further generates the output data comprising explanations of an attack mode for the vulnerability, wherein the explanations include information selected from the group consisting of tactics information, techniques information, procedures information, access vector information, attack complexity information, authentication information, confidentiality information; integrity information, and availability information (Bulut, ¶59, "Metric assignment component 108 can employ such a model defined above (e.g., LSTM, GRU, CNN, etc.) to assign one or more risk assessment metrics based on vulnerability data of a compliance process, where such one or more risk assessment metrics can comprise exploitability metrics, impact metrics, and/or another risk assessment metric of a compliance process vulnerability scoring system. For example, such one or more risk assessment metrics can comprise exploitability metrics and/or impact metrics including, but not limited to, attack vector (AV), access complexity (AC), authentication (Au), confidentiality impact (C), integrity impact (I), availability impact (A), and/or another exploitability metric and/or impact metric of a compliance process vulnerability scoring system such as, for instance, the Common Vulnerability Scoring System (CVSS) and/or another compliance process vulnerability scoring system.").
It would be obvious to one of ordinary skill in the art prior to the effective filing date of the invention to modify Pan in view of Ngweta and Bellis using Bulut to achieve the claimed invention because it allows for the protection of operating system resources (Bulut, ¶105, "In some embodiments, system 400c can comprise an illustration of a health check control example that can be implemented using one or more embodiments of the subject disclosure described herein to protect one or more operating system resources").
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Srivastava (Srivastava et al., US 20240330473 A1) teaches a method for automatically classifying and triaging security vulnerabilities based on comparing the vulnerability description of the vulnerability to historical vulnerabilities using a machine-learning model (¶103-¶109, ¶59) with natural language processing (¶61)
Bozorgi (Bozorgi et al., "Beyond Heuristics: Learning to Classify Vulnerabilities and Predict Exploits", 2010) teaches using a machine learning model to determine how soon a vulnerability will be exploited (p.6, 5.5 'Predicting Time to Exploit', "In practice, in addition to knowing whether a vulnerability will be exploited, it is also useful to know how soon it will be exploited. (Even if all vulnerabilities will eventually be exploited, it is valuable to know when.) With this knowledge, software vendors can prioritize the patches they release; system administrators can similarly prioritize the installation of these patches.")
Handurukande (Handurukande et al., US 20210157926 A1) teaches using historical data to determine if a vulnerability is exploitable or not (¶32) as well as extracting features from bug reports to identify whether there is a vulnerability or not (¶24, ¶27)
Tavabi (Tavabi et al., US 20220229912 A1) teaches using a machine learning model that takes in a corpus of text and uses contextual embeddings to analyze them (¶31) to detect vulnerabilities from ground truth data (¶22)
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AMIR MAHDI HAJIABBASI whose telephone number is (703)756-5511. The examiner can normally be reached M-F 7:30-5 EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Catherine Thiaw can be reached at (571) 270-1138. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/A.M.H./
Amir Mahdi HajiabbasiExaminer, Art Unit 2407
/Catherine Thiaw/Supervisory Patent Examiner, Art Unit 2407 6/19/2026
Prosecution Insights