Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed 8/17/2026 have been fully considered but they are not persuasive.
The applicant argues that Nguyen does not disclose the SBOM that generates the SBOM data for itself and reporting it.
Nguyen discloses the SBOM as it defined in the specifications as a list of software components and dependencies that used by an software see Spec. Par. 004. That is, Nguyen discloses components that are complied during run-time and dependencies see1 Member Dependency Graph & 3. Dependency Graphs & 3.2 Component Dependency Graph. And the dependencies and graphs are used to detect vulnerabilities about the executing software that is the as the execution of the software happens the components that is references as determined as vulnerable are based on vulnerability data and provided to the software see 3.3 Predicting Vulnerable Components & Fig. 5 & $. Experiment and Discussion.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 9-17, 19-21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Predicting Vulnerable Software Components with Dependency Graphs to Nguyen1 in view of SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities to Li.
Regarding Claim 9. Nguyen discloses A computer system for locating potentially-exploitable software dependencies, comprising: one or more computers comprising one or more SBOM-reporting software applications(§ 1 Member Dependency Graph & § 3. Dependency Graphs & § 3.2 Component Dependency Graph, components that are complied during run-time and dependencies), wherein an SBOM-reporting software application is programmed to generate dynamic SBOM data for itself and report it and comprises an SBOM module that is programed to generate and output dynamic SBOM data for the software application(3.3 Predicting Vulnerable Components & Fig. 5 & $. Experiment and Discussion, the executing components are reference with vulnerability data to report to itself that one or more components are known as vulnerable), wherein the dynamic SBOM data reported by the SBOM module identifies the SBOM module as a loaded dependency of the SBOM-reporting software application(§3. Dependency Graphs & 2. Vulnerability Prediction Model & Fig. 5 & Fig. 1, the java programs dependencies are classified as vulnerabilities).
Nguyen does not disclose a computer-implemented SBOM server coupled via a computer network to the one or more computers, wherein the SBOM server is programmed to receive dynamic SBOM data from the one or more SBOM-reporting software applications and store said dynamic SBOM data in a computer-implemented dependency database coupled to the SBOM server.
In the same field of endeavor as the claimed invention, Li discloses a computer-implemented SBOM server coupled via a computer network to the one or more computers, wherein the SBOM server is programmed to receive dynamic SBOM data from the one or more SBOM-reporting software applications and store said dynamic SBOM data in a computer-implemented dependency database coupled to the SBOM server(2. The Sysevr Framework & 2.3.1 Basic Definitions & Fig. 1, the various dependencies are determined and server communicates the vulnerable candidates).
It would have been obvious to one of ordinary skill in the art before the effective filing date of claimed invention to modify Nguyen invention to incorporate a computer-implemented SBOM server coupled via a computer network to the one or more computers, wherein the SBOM server is programmed to receive dynamic SBOM data from the one or more SBOM-reporting software applications and store said dynamic SBOM data in a computer-implemented dependency database coupled to the SBOM server for the advantage of providing potential candidates for vulnerability based on previous knowledge as taught in Li see 1. Introduction.
Regarding Claim 10. Li discloses The computer system for locating exploitable software dependencies of claim 9, wherein the one or more SBOM-reporting software applications self-report their dynamic SBOM data to the SBOM server(1. Introduction & Fig. 1 & Fig. 2 & 2. 3 Transforming SyVcs to SeVCs, the dependencies are extracted for vulnerabilities analysis).
Regarding Claim 11. Li discloses The computer system for locating potentially-exploitable software dependencies of claim 10, wherein the one or more SBOM-reporting software applications self-report their dynamic SBOM data to the SBOM server on a configurable schedule(1. Introduction & Fig. 1 & Fig. 2 & 2. 3 Transforming SyVcs to SeVCs, the dependencies are extracted for vulnerabilities analysis).
Regarding Claim 12. Li discloses The computer system for locating potentially-exploitable software dependencies of claim 10, wherein the one or more SBOM-reporting software applications are configurable to self-report their dynamic SBOM data to the SBOM server upon occurrence of an event(1. Introduction & Fig. 1 & Fig. 2 & 2. 3 Transforming SyVcs to SeVCs, the dependencies are extracted for vulnerabilities analysis)..
Regarding Claim 13. Li discloses The computer system for locating potentially-exploitable software dependencies of claim 9, wherein the SBOM server is further programmed to request dynamic SBOM data from the one or more SBOM-reporting software applications(1. Introduction & Fig. 1 & Fig. 2 & 2. 3 Transforming SyVcs to SeVCs & Fig. 4, the dependencies are extracted for vulnerabilities analysis).
Regarding Claim 14. Nguyen discloses The computer system for locating potentially-exploitable software dependencies of claim 9, further comprising a computer-implemented SBOM collector coupled to the SBOM server, said SBOM collector being programmed to collect dynamic SBOM data from the one or more SBOM-reporting software applications and provide it to the SBOM server(Fig. 5 & Fig. 1, the server to coordinate the dependency determination).
Regarding Claim 15. Nguyen discloses The computer system for locating potentially-exploitable software dependencies of claim 9, wherein the dynamic SBOM data reported by a SBOM-reporting software application comprises dependency identification data for all accessible and currently-loaded dependencies of the SBOM-reporting software application(Fig. 3 & 3.1 Member Dependency Graph).
Regarding Claim 16. Nguyen discloses The computer system for locating potentially-exploitable software dependencies of claim 9, wherein the SBOM server is further programmed to provide a user interface that enables filtered searches of the dependency database, dependency tracking, alerts, and reporting to users(4.2 Results and Discussion, the alerts for the user).
Regarding Claim 17. Nguyen discloses The computer system for locating potentially-exploitable software dependencies of claim 9, wherein the SBOM server is further programmed to report an alert when dynamic SBOM data for a SBOM-reporting software application reveals the presence of a potentially-exploitable software dependency(3.2 Component Dependency Graph, the graph for detecting connections).
Regarding Claim 19. Nguyen discloses The computer system for locating potentially-exploitable software dependencies of claim 9, wherein the one or more SBOM-reporting applications comprise a first SBOM-reporting application comprising a first SBOM module, said first SBOM-reporting application and first SBOM module written in a first programming language, and a second SBOM-reporting application comprising a second SBOM module, said second SBOM-reporting application and second SBOM module written in a different second programming language(2. Vulnerability Prediction Model).
Regarding Claim 20. Nguyen discloses The computer system for locating potentially-exploitable software dependencies of claim 19, wherein the first SBOM module and the second SBOM module are programmed to listen for an SBOM request on the same communications port number(Fig. 5 & 3.1 Member Dependency Graph & Predicting Vulnerable Components & Table 2, the attributes are analyzed).
Regarding Claim 21. Nguyen discloses The computer system for locating potentially-exploitable software dependencies of claim 9, wherein dynamic SBOM data comprises identification data for components and dependencies of an application that are loaded during run-time, while the application is being run or executed(§ 1 Member Dependency Graph & § 3. Dependency Graphs & § 3.2 Component Dependency Graph, components that are complied during run-time and dependencies).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Venkat Perungavoor whose telephone number is (571)272-7213. The examiner can normally be reached 9-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal Dharia can be reached at 571-272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/VENKAT PERUNGAVOOR/Primary Examiner, Art Unit 2492 Email: venkatanarayan.perungavoor@uspto.gov
1 Both references in the file as of 12/18/2025, consult the file for these non patent literatures/articles, it is not provided with this office action.
