Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
The instant application having Application No. 18/364,461 is presented for examination by the examiner. Claims 6, 7, 12-15, and 18 are amended. Claims 1-20 are pending.
Response to Amendment
Specification
The objection to the specification is overcome by amendment.
Claim Rejections - 35 USC § 112
The rejection under this statute is overcome by amendment.
Response to Arguments
Applicant's arguments filed 18/364,461 have been fully considered but they are not persuasive. As per claim 1, Applicant argues, (i) that Kimball determines only a likelihood that security threat is malicious, derived from human behaviors not from outlier status of an embedding and (ii) nothing in Kimball concludes that source code comprises malicious code because an embedding of that source code is an outlier. Examiner respectfully disagrees.
Regarding (i), claim 1 does not prescribe which features the embedding represents or requires them to describe execution behavior. The embedding of Kimball is interpreted as the source-code-structure vector described in col. 7, lines 24-30. The fact that they made be derived from human behaviors does not require them to be generated by observing humans while they write source code. The basis of the structure vector is from the source code itself (col. 11, lines 60-64). The argument improperly treats the human behavior assessment as necessarily separate from the embedding analysis. The claim does not require more than this teaching.
Regarding (ii), the argument appears to take a narrow position of what an outlier is. This term is broad and lacks context. Thus, Kimball covers this teaching as follows. Outlier is a departure from normality. Kimball clearly establishes what is normal in source code and human behaviors. The analyzed structure vectors are then probabilistically deemed as security threats. It is reasonable to assume categorizes security threats found in source is outside the norm. It is precisely what is being searched for which stands out from normal source code. In col. 12, lines 1-5 the vector-based clustering framework expressly distinguishes malicious from non-malicious source code. Pattern normalcy in the structure vector is established back in col. 9, lines 23-25. The structure vector was mathematically created to present the source code in col. 7, lines 24-30. Looking at that flow, when the system is locating potential security threats within the source code, it uses the associated behaviors that are associated with each vector structure of the source code. The structures that deviate from normal as therefore outliers. The outliers, which are the embedding of the source code, are then determined as a security threat/maliciousness which in turn draw the conclusion back to the actual source code as having malicious code. The abnormality finding concerning the represented features constitutes an outlier finding concerning the embedding. The broad claim does differentiate itself from this process in Kimball.
On page 6, Applicant argues that the vector representation of source code by Kimball is not the claimed embedding. As stated above the claim provides no conditions on the embedding and the statement by Applicant than Kimball’s vector cannot support the semantic proximity between implementations of a function is a conclusion not grounded in the scope of the claim. There is nothing in the claim that establishes the embedding process.
With respect to claim 3, 4, and 17, the same argument applies because the process by which embedding of function is not claimed. The argument is basically comparing what Kimball does specifically to the claimed phrase. The argument does not persuasively show how what is claimed is different than the mathematical tokenization and subsequently vectorization of the source code is different.
In regards to the 35 USC §103 arguments, the “[Kimball: 0110]” is clearly a typo when as Applicant points out Clement is the reference with paragraph numbers and was just cited for teaching of a deep learning model at paragraph 0110. Examiner thanks Applicant for pointing out this typo and it is corrected in this Office Action. The additional specific paragraph showing model selection is also explicitly listed as well. The argument that claim 13 would be allowable implies that the prior art does not teach model selection is not persuasive. Claim 13 adds the basis of the model selection, namely the length of the source code. Claim 12 does not require this teaching.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1, 3-6, 8-11, 16, and 17 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by USP 10,817,604 to Kimball et al., hereinafter Kimball.
As per claims 1 and 16, Kimball teaches a method for malicious source code detection, the method comprising:(a) obtaining, by a processing circuit, an embedding of a source code for a function (col. 7, lines 14-30);
(b) applying, by the processing circuit, an anomaly detection process on the embedding of the source code (col. 7, lines 30-33; col. 13, line 60-col. 14, line 2) and
(c) concluding, by the processing circuit, that the source code comprises a malicious code when the anomaly detection process indicates that the embedding of the source code is an outlier (col. 12, lines 1-6).
As per claims 3 and 17, Kimball teaches the applying of the anomaly detection process comprises matching the embedding of the source code to clusters of embeddings of functions (col. 12, lines 18-30).
As per claim 4, Kimball teaches at least one cluster of the clusters comprises embeddings of different training source codes for different functions (col. 11, line 60-col. 12, line 4).
As per claim 5, Kimball teaches the applying of the anomaly detection process comprises calculating distances between the embedding of the source code and centroids of the clusters (col. 12, lines 30-44).
As per claim 6, Kimball teaches the applying of the anomaly detection process comprises calculating an anomaly score (col. 9, lines 60-61 and col. 14, lines 25-29) of the source code based on a distance between the embedding of the source code and a closets cluster of the clusters (col. 12, lines 45-54)
As per claims 7 and 18, Kimball teaches repeating steps (a), (b) and (c) for different source codes for different functions (col. 11, line 60-col. 12, line 4); and ranking the different source codes based on distances between each source code and a centroid of a closest cluster of the clusters (col. 12, lines 23-35).
As per claim 8, Kimball teaches the obtaining of the source code comprises analyzing an evaluated source code (col. 11, line 65-col. 12, line 4).
As per claim 9, Kimball teaches repeating steps (a), (b) and (c) for different source codes for different functions (col. 5, line 62-col. 6, line 1).
As per claim 10, Kimball teaches repeating steps (a), (b) and (c) for different source code versions for a single function [training date includes same source code over analyzed over version control; col. 12, lines 9-20].
As per claim 11, Kimball teaches the obtaining of the embedding of the source code comprises calculating the embedding (col. 7, lines 24-33).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 2, 12, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Kimball in view of USP Application Publication 2023/0161567 to Clement et al., hereinafter Clement.
As per claim 2, Kimball is silent in explicitly teaching the embedding is generated by a deep learning model. Clement teaches one way to the embedding is generated is by a deep learning model (0110). Clement teaches a way in which the model type used to embed source is a deep learning model. Kimball already teaches embedding source code through a mathematical vector. Kimball could have used a deep learning model to generate its mathematical vector as taught by Clement with predictable results. The claim is obvious because one of ordinary skill in the art can substitute methods known before the effective filing date which produce predictable results.
As per claim 12, the combined teaching of Kimball and Clement teaches selecting a deep learning model out of multiple deep learning models [Clement: 0056]; and wherein the calculating of the embedding comprises applying the selected deep model on the source code [Clement: 0110].
As per claim 19, Kimball teaches the obtaining of the embedding of the source code comprises calculating the embedding (col. 7, lines 24-33). Kimball is silent in explicitly teaching the calculating of the embedding comprises selecting a deep learning model out of multiple deep learning models; and wherein the calculating of the embedding comprises applying the selected deep model on the source code. Clement teaches the calculating of the embedding comprises selecting a deep learning model out of multiple deep learning models; and wherein the calculating of the embedding comprises applying the selected deep model on the source code (0110). Clement teaches a way in which the model type used to embed source is a deep learning model. Kimball already teaches embedding source code through a mathematical vector. Kimball could have used a deep learning model to generate its mathematical vector as taught by Clement with predictable results. The claim is obvious because one of ordinary skill in the art can substitute methods known before the effective filing date which produce predictable results.
Claims 7 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Kimball in view of USP Application Publication 2019/0294933 to Gupta et al., hereinafter Gupta.
As per claims 7 and 18, Kimball teaches repeating steps (a), (b) and (c) for different source codes for different functions (col. 11, line 60-col. 12, line 4). Kimball is silent in explicitly teaching ranking the different source codes based on distances between each source code and a nearest border point of a closest cluster of the clusters. Kimball teaches ranking the different source codes based on distances between each source code and a centroid of a closest cluster of the clusters. (col. 12, lines 23-35). Gupta teaches during the distance between a current point and the cluster (0052). Specifically, Gupta teaches the distance can be equal to the Euclidean distance between the point and a consistent point in the cluster and lists both the cluster centroid and nearest topological boundary of the cluster. Thus, both points were known positions to calculate distance to the cluster and either could have been used with predictable results. The claim is obvious because one of ordinary skill in the art can substitute methods known before the effective filing date which produce predictable results.
Claims 14 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Kimball in view of CN 112416358 B to Liu et al., hereinafter Liu.
As per claim 14, Kimball is silent in explicitly teaching the calculating of the embedding comprises representing the source code as one or more abstract syntax trees (ASTs). Liu teaches the calculating of the embedding comprises representing the source code as one or more abstract syntax trees (ASTs). This is a machine translation of one paragraph from Liu,
“Because the structured source code is not convenient to be directly loaded into the deep learning model, the common method is converting the source file into abstract syntax tree, extracting variable declaration from the grammar tree, function call, sentence returning node to obtain the word sequence. Then performing word embedding operation according to the word sequence, obtaining the word embedding matrix after training. Based on the word embedding matrix, each source code file can be converted into the corresponding word embedding vector. Comparing the similarity of the word embedding vector of the source code with the known defect, and judging whether the new code has the defect. or based on the word embedding matrix, constructing a convolutional neural network module or neural network, adding several convolutional layer or circulating layer, full connection layer, finally through a logistic regression classifier. Through the training of the data set, a classifier with good effect can be obtained.”
Thus, Liu teaches source code can be converted into an AST in order to loaded into a learning model. Kimball could have obviously used the same process to load the source code via AST into a model to achieve the intended result. The claim is obvious because one of ordinary skill in the art can combine methods known before the effective filing date which produce predictable results.
As per claim 15, the combined system of Kimball and Liu teaches the calculating of the embedding comprises using a code to sequence conversion[step 2 in Fig. 6 reads: converting the source code into the abstract syntax tree, the abstract syntax tree into the word sequence and so on two steps, converting all the contract code into word sequence set].
Allowable Subject Matter
Claims 13 and 20 objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL R. VAUGHAN whose telephone number is (571)270-7316. The examiner can normally be reached on Monday - Thursday, 7:30am - 5:00pm, EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached on (571) 272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL R VAUGHAN/
Primary Examiner, Art Unit 2431
