DETAILED ACTION
This Action is in consideration of the Applicant’s response on July 28, 2026. Claims 1, 6, and 8 – 20 are amended by the Applicant. Claims 1 – 20, where Claims 1, 8, and 15 are in independent form, are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed July 28, 2026 have been fully considered but they are moot based on the new grounds of rejection necessitated by amendment.
Claim Rejections - 35 USC § 103
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
Claim(s) 1, 6, 8, 13, and 15 are rejected under 35 U.S.C. 103 as being unpatentable over PGPub 2024/0152624 (hereinafter “Helyar”), in view of U.S. Patent 11,579,868 (hereinafter “Zhang”).
1. Regarding Claims 1, 8, and 15, Helyar discloses a system [Fig. 14, Para. 0140] comprising:
a processing device [Fig. 14, item 1414; Para. 0143, 0145]; and
a memory to store instructions that, when executed by the processing device [Fig. 14, item 1412; Para. 0143-145], cause the processing device to:
identify a vulnerability corresponding to an initial source code [Fig. 2; Para. 0036-37, 0044; source code scanner uses a CWE dictionary to identify vulnerabilities];
generate a prompt comprising the initial source code and the vulnerability [Fig. 1 and 5; Para. 0033-36, 0051-53; input code including the code vulnerability are input into the code vulnerability detection tool; input can be a prompt directly from code completion tool or via user input to an AI endpoint],
input the prompt into an artificial intelligence model (AIM) that is trained to determine whether the initial source code comprises the vulnerability [Fig. 1 and 5; Para. 0033-36, 0039, 0051-53; input code including the code vulnerability are input into the code vulnerability detection tool that has been trained to recognize code vulnerabilities; input can be a prompt directly from code completion tool or via user input to an AI endpoint]; and
remove, using the AIM , the vulnerability from the initial source code to produce a refactored source code in response to determining that the initial source code comprises the vulnerability [Fig. 1; Para. 0038; code vulnerability detection tool corrects the code vulnerability, such as by using a replacement passage of code without a vulnerability (refactored code)].
Helvar, however, does not disclose the prompt comprises a source code refactoring technique description corresponding to the vulnerability and the vulnerability is removed based on the source code refactoring technique description.
Zhang discloses a system and method of utilizing AI models to perform software modernization that can automatically refactor source code based on analysis of the source code [Abstract]. Zhang further discloses that the source code and one or more refactoring templates are used as input for the AI refactoring models to refactor the source code to address one or more identified issues (a source code refactoring technique description corresponding to the vulnerability and the vulnerability is removed based on the source code refactoring technique description) [Figs. 1 and 3; Col. 2, lines 46-55, Col. 9, lines 20-31, Col. 10, lines 33-55]. It would have been obvious to one skilled in the art before the effective filing date of the current invention to incorporate the teachings of Zhang with Helvar since both systems utilize AI models to remove vulnerabilities with source code. The combination enables the Helvar system to utilize specific mechanisms that correct the detected vulnerability. The motivation is to improve the AI model’s performance and ability to remedy the determined vulnerabilities utilizing known correction that can be implemented (obvious to one skilled in the art).
2. Regarding Claims 6 and 13, Helvar, in view of Zhang, discloses the limitations of Claims 1 and 8. Helvar further discloses that the vulnerability is identified by a vulnerability scanner [Fig. 2; Para. 0044-45] the method further comprising:
determining, buy (sic) the vulnerability scanner, one or more properties of the initial source code [Fig. 2; Para. 0044-45]; and
identifying, based on the one or more properties, the vulnerability from a plurality of vulnerabilities included in a global vulnerability database [Fig. 2; Para. 0044-45].
Claim(s) 2 – 5, 7, 9 – 12, 14, and 16 – 20 are rejected under 35 U.S.C. 103 as being unpatentable over Helvar, in view of Zhang, in further view of PGPub. 2024/0346151 (hereinafter “Goswami”).
3. Regarding Claims 2, 9, and 16, Helvar, in view of Zhang, discloses the limitations of Claims 1, 8, and 15. Helvar discloses of refactoring operations that are used to remove the vulnerability in the source code [Fig. 1; Para. 0038; code vulnerability detection tool corrects the code vulnerability, such as by using a replacement passage of code without a vulnerability (refactored code)]. Neither Helvar nor Zhang, however, specifically discloses that the vulnerability is a zero-day vulnerability and a new prompt comprising the initial source code, the zero-day vulnerability, and the one or more zero-day refactoring operations is used to evaluate the source code.
Goswami discloses a system and method of implementing machine learning models to perform an assessment of a computing environment with potential fixes to a detected vulnerability [Abstract; Para. 0077, 0089-90]. Goswami further discloses that the vulnerability can be a zero-day vulnerability [Para. 0044, 0077]. Goswami also discloses of using a machine learning model to determine at least one potential fix to the vulnerability, which is then input into a machine learning model to determine if it can resolve the vulnerability (determining one or more zero-day refactoring operations corresponding to the zero-day vulnerability, generating a new prompt comprising the initial source code, the zero-day vulnerability, and the one or more zero-day refactoring operations) [Fig. 3; Para. 0076-101]. It would have been obvious to one skilled in the art before the effective filing date to incorporate the teachings of Goswami with Helvar since both systems utilize AI models to analyze code for vulnerabilities and to create a fix for that vulnerability. The motivation to do so is to improve the accuracy of a potential fix to the vulnerability prior to implementing it for better efficiency (obvious to one skilled in the art).
4. Regarding Claims 3, 10, and 17, Helvar, in view of Zhang, discloses the limitations of Claims 1, 8, and 15. Helvar further discloses that the AIM is a security code analysis copilot AIM [Fig. 12], and wherein, prior to identifying the vulnerability, the method further comprises: generating a training prompt that comprises training source code, one or more vulnerabilities contexts corresponding to the training source code [Fig. 9; Para. 0058-59].
Neither Helvar nor Zhang, however, specifically discloses of a training prompt comprising one or more code refactoring techniques descriptions and inputting the training prompt and a ground truth into a pretrained AIM, wherein the pretrained AIM performs fine tune training based on the training prompt and the ground truth to produce the security code analysis copilot AIM.
Goswami discloses a system and method of implementing machine learning models to perform an assessment of a computing environment with potential fixes to a detected vulnerability [Abstract; Para. 0077, 0089-90]. Goswami also discloses of using a machine learning model to determine at least one potential fix to the vulnerability, which is then input into a machine learning model to determine if it can resolve the vulnerability [Fig. 3; Para. 0076-101]. Goswami further discloses of tuning the AI model by repeatedly executing cycles of experimentation, testing, and tuning to improve accuracy (a training prompt comprising one or more code refactoring techniques descriptions and inputting the training prompt and a ground truth into a pretrained AIM, wherein the pretrained AIM performs fine tune training based on the training prompt and the ground truth to produce the security code analysis copilot AIM) [Fig. 2; Para. 0071-73]. It would have been obvious to one skilled in the art before the effective filing date to incorporate the teachings of Goswami with Helvar since both systems utilize AI models to analyze code for vulnerabilities and to create a fix for that vulnerability. The motivation to do so is to improve the accuracy of a potential fix to the vulnerability prior to implementing it for better efficiency (obvious to one skilled in the art).
5. Regarding Claims 4, 11, and 18, Helvar, in view of Zhang and Goswami, discloses the limitations of Claims 3, 10, and 17. Goswami further discloses of:
detecting one or more new vulnerabilities [Fig. 3; Para. 0076-101];
in response to determining that the one or more new vulnerabilities comprise one or more distinguishing contexts relative to the one or more vulnerabilities contexts, retraining the security code analysis copilot AIM [Fig. 2; Para. 0071-73], wherein the retraining comprises:
generating a new training prompt that comprises new training source code, the one or more new vulnerabilities, and the one or more distinguishing contexts [Fig. 2; Para. 0071-73]; and
inputting the new training prompt into the security code analysis copilot AIM, wherein the security code analysis copilot AIM performs new fine tune training based on the new prompt to produce a retrained security code analysis copilot AIM [Fig. 2; Para. 0071-73].
6. Regarding Claims 5, 12, and 19, Helvar, in view of Zhang, discloses the limitations of Claims 1, 8, and 15. Helvar discloses of refactoring operations that are used to remove the vulnerability in the source code [Fig. 1; Para. 0038; code vulnerability detection tool corrects the code vulnerability, such as by using a replacement passage of code without a vulnerability (refactored code)]. Neither Helvar nor Zhang, however, specifically discloses that the AIM produces a plurality of refactored candidate samples, the method further comprising: testing at least a portion of code included in each of the plurality of refactored candidate samples to produce one or more test results; and constructing the refactored source code based on the one or more test results.
Goswami discloses a system and method of implementing machine learning models to perform an assessment of a computing environment with potential fixes to a detected vulnerability [Abstract; Para. 0077, 0089-90]. Goswami also discloses of using a machine learning model to determine at least one potential fix to the vulnerability, which is then input into a machine learning model to determine if it can resolve the vulnerability (AIM produces a plurality of refactored candidate samples; testing at least a portion of code included in each of the plurality of refactored candidate samples to produce one or more test results, and constructing the refactored source code based on the one or more test results) [Fig. 3; Para. 0076-101]. It would have been obvious to one skilled in the art before the effective filing date to incorporate the teachings of Goswami with Helvar since both systems utilize AI models to analyze code for vulnerabilities and to create a fix for that vulnerability. The motivation to do so is to improve the accuracy of a potential fix to the vulnerability prior to implementing it for better efficiency (obvious to one skilled in the art).
7. Regarding Claims 7, 14, and 20, Helvar, in view of Zhang, discloses the limitations of Claims 1, 8, and 15. Helvar further discloses of:
evaluating the initial source code by the AIM prior to generating the prompt [Fig. 12; Para. 0070-73; input code portions analyzed by applying a sliding window to the input code];
identifying, by the AIM in response to evaluating the initial source code, a plurality of potential vulnerabilities that correspond to the initial source code [Fig. 12; Para. 0070-73; input code portions analyzed by applying a sliding window to the input code; Figs. 6A and 6B; potential code vulnerabilities]; and
removing, by the AIM, the first vulnerability from the initial source code to produce a new refactored source code [Fig. 1; Para. 0038; code vulnerability detection tool corrects the code vulnerability, such as by using a replacement passage of code without a vulnerability (refactored code)].
Neither Helvar nor Zhang, however, specifically discloses of generating a new prompt comprising the initial source code and the plurality of potential vulnerabilities, in response to inputting the new prompt into the AIM and determining, by the AIM, that the initial source code comprises a first vulnerability from the plurality of potential vulnerabilities.
Goswami discloses a system and method of implementing machine learning models to perform an assessment of a computing environment with potential fixes to a detected vulnerability [Abstract; Para. 0077, 0089-90]. Goswami also discloses of using a machine learning model to determine at least one potential fix to the vulnerability, which is then input into a machine learning model to determine if it can resolve the vulnerability [Fig. 3; Para. 0076-101]. Goswami further discloses of tuning the AI model by repeatedly executing cycles of experimentation, testing, and tuning to improve accuracy (generating a new prompt comprising the initial source code and the plurality of potential vulnerabilities, in response to inputting the new prompt into the AIM and determining, by the AIM, that the initial source code comprises a first vulnerability from the plurality of potential vulnerabilities) [Fig. 2; Para. 0071-73]. It would have been obvious to one skilled in the art before the effective filing date to incorporate the teachings of Goswami with Helvar since both systems utilize AI models to analyze code for vulnerabilities and to create a fix for that vulnerability. The motivation to do so is to improve the accuracy of a potential fix to the vulnerability prior to implementing it for better efficiency (obvious to one skilled in the art).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contacts
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TAE K KIM whose telephone number is (571)270-1979. The examiner can normally be reached M-F 9:30-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge Ortiz-Criado can be reached at 5712727642. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TAE K KIM/Primary Examiner, Art Unit 2496
