Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Response to Arguments
Applicant’s arguments with respect to claim(s) have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention. The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph: The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 17 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim 17 recites “the system” and is unclear if the reference is “firewall system”. Appropriate clarification required.
Claim Rejections - 35 USC §103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim/s 1, 2, 6, 7, 9, 10, 14, 15, 17, 18, 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Thomas (Pub. No. US 2024/0214420) in view of Martin (Pub. No. US 2024/0154992) in view of Kilby (Pat. No. US 12,659,326).
Claims 1, 9, 17, Thomas teaches “a method of operating a firewall for a virtual machine (VM) application, the method comprising: initiating event monitoring of the VM application, the event monitoring occurring while the VM application is executing on a VM ([0034] Behavioral based protection may monitor code when it runs and intervene if the code is deemed to be suspicious or malicious. [0112] For example, during the course of execution, a specific process (as evidenced by its observed actions) may be assigned color descriptors indicating that it is a browser process. [0070] the computing device 210 may be implemented using hardware (e.g., in a desktop computer), software (e.g., in a virtual machine or the like), [0052] Remedial action may be provided as a result of a detection of a threat or violation. The detection techniques facility 130 may include monitoring the enterprise facility 102 network or endpoint devices, such as by monitoring streaming data through the gateway, across the network, through routers and hubs, and the like. [0093] In general, the endpoint 402 may include any number of computing objects such as an object 418 labeled with a descriptor 420. While the term object has a number of specific meanings in the art, and in particular in object-oriented programming, it will be understood that the term ‘object’ as used herein is intended to be significantly broader, and may include any data, process, file or combination of these including without limitation any process, application,); receiving an event generated by the executing VM application during the event monitoring, ([0094] The object 418 may be an item that is performing an action or causing an event, or the object 418 may be an item that is receiving the action or result of an event (i.e., the item in the system 400 being acted upon).); comparing the event to a plurality of events stored in a baseline profile of the VM application ([0099] An object coloring system 414 may apply descriptors 420 to objects 418 on the endpoint 402. This may be performed continuously by a background process on the endpoint 402, or it may occur whenever an object 418 is involved in an action, such as when a process makes a call to an application programming interface (API) or takes some other action, or when a URL is used to initiate a network request, or when a read or a write is performed on data in a file. This may also or instead include a combination of these approaches as well as other approaches, such as by labeling a file or application when it is moved to the endpoint 402, or when the endpoint 402 is started up or instantiated. In general, the object coloring system 414 may add, remove or change a color at any location and at any moment that can be practicably instrumented on a computer system.); and when the event differs from any of the plurality of events performing an action corresponding to the VM application based on the event, wherein the action comprises at least one of: isolating the VM, stopping the VM, making a Hypertext Transfer Protocol (HTTP) call, loading a class/method or running a function ([0112] In general, the IOC monitor 421 applies rules to determine when there is an IOC 422 suitable for reporting to a threat management facility 404. It will be understood that an endpoint 402 may, in suitable circumstances and with appropriate information, take immediate local action to remediate a threat. However, the monitor 421 may advantageously accumulate a sequence of actions, and still more advantageously may identify inconsistencies or unexpected behavior within a group of actions with improved sensitivity by comparing descriptors 420 for various objects 418 involved in relevant actions and events. In this manner, rules may be applied based upon the descriptors 420 that better discriminate malicious activity while reducing the quantity and frequency of information that must be communicated to a remote threat management facility 404. At the same time, all of the relevant information provided by the descriptors 420 can be sent in an IOC 422 when communicating a potential issue to the threat management facility 404. For example, during the course of execution, a specific process (as evidenced by its observed actions) may be assigned color descriptors indicating that it is a browser process. Further, the specific process may be assigned an attribute indicating that it has exposed itself to external URLs or other external data. Subsequently, the same process may be observed to be taking an action suitable for an internal or system process, such as opening up shared memory to another process that has coloring descriptions indicating that it is a system process. When this last action is observed, an inconsistency in the various color descriptors between the subject of the action—the externally exposed browser process- and the target of the action may result in a well-defined IOC, which may be directly processed with immediate local action taken. The IOC may also or instead be reported externally as appropriate (i.e. running a function))”.
However, Thomas may not explicitly teach details of the actions.
Martin teaches “the event comprising a name, a time stamp, and an optional payload ([0019] In some embodiments, the at least one cloud computing event comprises a first cloud computing event, and wherein obtaining, from the cloud computing environment, information about the at least one cloud computing event comprises obtaining information about features including a time at which the first cloud computing event occurred, an event type for the first cloud computing event, one or more unique event identifiers for the first cloud computing event, storage associated with the cloud computing event, and a virtual cloud computing resource associated with the first cloud computing event.)”.
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Martin with the teachings of Thomas in order to provide a system that teaches details of event information. The motivation for applying Martin teaching with Thomas teaching is to provide a system that allows for design choice. Thomas, Martin are analogous art directed towards event monitoring. Together Thomas, Martin teaches every limitation of the claimed invention. Since the teachings were analogous art known at the filing time of invention, one of ordinary skill could have applied the teachings of Martin with the teachings of Thomas by known methods before the effective filing date of the claimed invention and gained expected results.
However, the combination may not explicitly teach baseline information.
Kilby teaches “the baseline profile generated during a previous execution period of the VM application during which no anomalies occurred ([Col. 15, Line 47-61] (91) For some protocols (e.g., HTTP), typically, a connection is opened, a string is sent, a string is received, and the connection is closed. For other protocols (e.g., NFS), both sides of the connection engage in a constant chatter. Histograms allow data platform 12 to model application behavior (e.g., using machine learning techniques), for establishing baselines, and for detecting deviations. As one example, suppose that a given HTTP server typically sends/receives 1,000 bytes (in each direction) whenever a connection is made with it. If a connection generates 500 bytes of traffic, or 2,000 bytes of traffic, such connections would be considered within the typical usage pattern of the server. Suppose, however, that a connection is made that results in 10G of traffic. Such a connection is anomalous and can be flagged accordingly.)”.
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Kilby with the teachings of Thomas, Martin in order to provide a system that teaches details of baseline information. The motivation for applying Kilby teaching with Thomas, Martin teaching is to provide a system that allows for a starting point for profiled information. Thomas, Martin, Kilby are analogous art directed towards event monitoring. Together Thomas, Martin, Kilby teaches every limitation of the claimed invention. Since the teachings were analogous art known at the filing time of invention, one of ordinary skill could have applied the teachings of Kilby with the teachings of Thomas, Martin by known methods before the effective filing date of the claimed invention and gained expected results.
Claims 2, 10, 18, Thomas teaches “the method of claim 1, wherein, when the event differs from any of the plurality of events, further generating an alert ([0112] In general, the IOC monitor 421 applies rules to determine when there is an IOC 422 suitable for reporting to a threat management facility 404. It will be understood that an endpoint 402 may, in suitable circumstances and with appropriate information, take immediate local action to remediate a threat. However, the monitor 421 may advantageously accumulate a sequence of actions, and still more advantageously may identify inconsistencies or unexpected behavior within a group of actions with improved sensitivity by comparing descriptors 420 for various objects 418 involved in relevant actions and events. In this manner, rules may be applied based upon the descriptors 420 that better discriminate malicious activity while reducing the quantity and frequency of information that must be communicated to a remote threat management facility 404. At the same time, all of the relevant information provided by the descriptors 420 can be sent in an IOC 422 when communicating a potential issue to the threat management facility 404. For example, during the course of execution, a specific process (as evidenced by its observed actions) may be assigned color descriptors indicating that it is a browser process. Further, the specific process may be assigned an attribute indicating that it has exposed itself to external URLs or other external data. Subsequently, the same process may be observed to be taking an action suitable for an internal or system process, such as opening up shared memory to another process that has coloring descriptions indicating that it is a system process. When this last action is observed, an inconsistency in the various color descriptors between the subject of the action—the externally exposed browser process- and the target of the action may result in a well-defined IOC, which may be directly processed with immediate local action taken. The IOC may also or instead be reported externally as appropriate (i.e. running a function)”.
Claims 6, 14, 21, Thomas teaches “the method of claim 1, wherein the firewall is executed by a first cloud based infrastructure and the VM application is executed by a second cloud based infrastructure that is different then the first cloud based infrastructure ([Fig. 604 and 602] in respective cloud based infrastructure)”.
Claims 7, 15, Thomas teaches “the method of claim 1, wherein the firewall is executed by a cloud based infrastructure and the VM application is executed on-premise ([Fig. 604 and 602] in respective cloud based infrastructure, application on-premise of endpoint)”.
Claim/s 3, 11, 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Thomas, Martin, Kilby, in view of Giral (Pub. No. US 2018/0052759).
Claim 3, 11, 19, the combination may not explicitly teach the limitation.
Giral teaches “the method of claim 1, wherein the VM application is a Java application, and the VM is a Java VM ([0020] The JVM 106 can also include various application components (e.g., servlets) for execution therein. In this example, in response to loading an application X, an application component 170 and an application component 188 are instantiated in the JVM 106 for execution therein.)”.
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Giral with the teachings of Thomas, Martin, Kilby in order to provide a system that teaches details of different environments. The motivation for applying Giral teaching with Thomas, Martin, Kilby teaching is to provide a system that allows for design choice. Thomas, Martin, Kilby, Giral are analogous art directed towards virtual environments. Together Thomas, Martin, Kilby, Giral teaches every limitation of the claimed invention. Since the teachings were analogous art known at the filing time of invention, one of ordinary skill could have applied the teachings of Giral with the teachings of Thomas, Martin, Kilby by known methods before the effective filing date of the claimed invention and gained expected results.
Claim/s 4, 12, 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Thomas, Martin, Kilby, Giral in view of Larsen (Pub. No. US 2013/0111273).
Claim 4, 12, 20, the combination may not explicitly teach the limitation.
Larsen teaches “the method of claim 3, wherein the event monitoring is implemented by a Java Flight Recorder ([0013] As described above, an important aspect of any environment that includes an application server and a virtual machine is the ability to identify problems that may manifest at the application level, down to any underlying issues in the virtual machine. To address this, disclosed herein is a system and method for providing virtual machine diagnostic information. In accordance with an embodiment, a "flight recorder" (referred to herein in some instances as "JRockit Flight Recorder", "Java Flight Recorder", or "Flight Recorder"), for use with a virtual machine, such as a Java virtual machine (JVM), allows a system administrator, software developer or other user experiencing a system problem to "go back in time" and analyze what happened right before a particular problem occurred in their system, and/or obtain an extremely detailed level of profiling without impacting system performance.)”.
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Larsen with the teachings of Thomas, Martin, Kilby, Giral in order to provide a system that teaches details of monitoring tools. The motivation for applying Larsen teaching with Thomas, Martin, Kilby, Giral teaching is to provide a system that allows for design choice. Thomas, Martin, Kilby, Giral, Larsen are analogous art directed towards monitoring environments. Together Thomas, Martin, Kilby, Giral, Larsen teaches every limitation of the claimed invention. Since the teachings were analogous art known at the filing time of invention, one of ordinary skill could have applied the teachings of Larsen with the teachings of Thomas, Martin, Kilby, Giral by known methods before the effective filing date of the claimed invention and gained expected results.
Claim/s 8, 16, 22 is/are rejected under 35 U.S.C. 103 as being unpatentable over Thomas, Martin, Kilby in view of Higashiyama (Pub. No. US 2021/0049275).
Claim 8, 16, 22 Thomas may not explicitly teach the limitation.
Higashiyama teaches “the method of claim 1, wherein the baseline profile comprises one or more of central processing unit (CPU) usage ([0084] According to the resource monitoring, an execution profile of the program is monitored, and the execution of the program can be limited when the monitored execution profile shows the abnormal behavior, thus it is possible to counteract the execution of the unauthenticated program. The monitored execution profile is the usage rate of the CPU cores 1020, 1021, 1022, and 1023 and the used amount of the inter-core shared memory 1160, for example.), memory usage, garbage collection or thread activity”.
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Higashiyama with the teachings of Thomas, Martin, Kilby in order to provide a system that teaches details of monitoring. The motivation for applying Higashiyama teaching with Thomas, Martin, Kilby teaching is to provide a system that allows for design choice. Thomas, Higashiyama are analogous art directed towards virtual environments. Together Thomas, Martin, Kilby, Higashiyama teaches every limitation of the claimed invention. Since the teachings were analogous art known at the filing time of invention, one of ordinary skill could have applied the teachings of Higashiyama with the teachings of Thomas, Martin, Kilby by known methods before the effective filing date of the claimed invention and gained expected results.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WYNUEL S AQUINO whose telephone number is (571)272-7478. The examiner can normally be reached 9AM-5PM EST M-F.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lewis Bullock can be reached at 571-272-3759. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/WYNUEL S AQUINO/Primary Examiner, Art Unit 2199
Prosecution Insights