Remarks
Claims 1-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claims 4, 10-12, and 15-20 are objected to because of the following informalities:
Claim 4 does not include any conjunction (e.g., “and” or “or”) at the end of the penultimate limitation. Thus, it is unclear whether every limitation is required or only a single one. Claims 11 and 18 have the same issue.
Claim 10 includes multiple limitations combined on a single line in multiple instances. Please compare claim 10 with corresponding claim 3. Many additional claims have the same issue, including, for example, claims 11, 12, and 15-20.
Appropriate correction is required.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 3, 5, 7, 8, 10, 12, 14, 15, 17, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Moreno (U.S. Patent Application Publication 2018/0137270) in view of Uddin (U.S. Patent Application Publication 2021/0294893).
Regarding Claim 1,
Moreno discloses a method for detecting anomalous software behavior in an electronic device, the method comprising:
Storing, in a memory of the electronic device, a plurality of frequency spectrum profiles, wherein each frequency spectrum profile corresponds with a software application executable by the electronic device and an operational mode of the software application (Exemplary Citations: for example, Abstract, Paragraphs 38, 46-48, and associated figures; sample database with traces (e.g., power or EM traces) stored with labels including the portion of program code and/or behavior, for example);
Detecting an operational mode of a software application executing on the electronic device (Exemplary Citations: for example, Abstract, Paragraphs 46-48, 67, 78-82, and associated figures; determining auxiliary information, determining transition that must be to a certain subset of samples (e.g., after executing candidate sample 1, samples 5 or 7 will be executed), checking for markers for fragments of program code, or the like, as examples);
Retrieving, from the memory by a processor of the electronic device, a frequency spectrum profile corresponding with the software application and the detected operational mode (Exemplary Citations: for example, Abstract, Paragraphs 46-48, 67, 71, 78-82, and associated figures; getting any relevant samples from database, for example);
Measuring, by a sensor of the electronic device, a real time frequency spectrum emanating from the electronic device while the software application executes in the detected operational mode, thereby yielding an observed real time frequency spectrum (Exemplary Citations: for example, Abstract, Paragraphs 63-68 and associated figures; trace for currently executing program, for example);
Comparing, by the processor, the observed real time frequency spectrum with the retrieved frequency spectrum profile corresponding to the software application and the detected operational mode (Exemplary Citations: for example, Abstract, Paragraphs 43, 44, 71-81, and associated figures; comparing current trace with previous ones in database, for example); and
Determining, by the processor based on the comparison, that a deviation exists between the observed real time frequency spectrum and the frequency spectrum profile (Exemplary Citations: for example, Abstract, Paragraphs 43, 44, 71-81, and associated figures; does not match sufficiently, for example);
But does not appear to explicitly disclose performing, by the processor, one or more remedial actions based on determining that the deviation exists.
Uddin, however, discloses performing, by the processor, one or more remedial actions based on determining that the deviation exists (Exemplary Citations: for example, Abstract, Paragraphs 17, 29, 47, 47, and associated figures; remedial action if error greater than max tolerance, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the program fingerprinting and error remediation techniques of Uddin into the program tracing system of Moreno in order to allow the system to take action when errors that may be malicious are present, to prevent malware from harming the system further, and/or to increase security in the system.
Regarding Claim 8,
Claim 8 is a system claim that corresponds to method claim 1 and is rejected for the same reasons.
Regarding Claim 15,
Claim 15 is a medium claim that corresponds to method claim 1 and is rejected for the same reasons.
Regarding Claim 3,
Moreno as modified by Uddin discloses the method of claim 1, in addition, Moreno discloses that the plurality of frequency spectrum profiles are obtained by querying a frequency spectrum profile database that includes, for each software application in a plurality of software applications, values for one or more frequency spectrum profiles corresponding to an operational state of the software application, the operational state representing a function being performed by the software application, the function comprising one of: facilitating an audio-based communication session; facilitating a video-based communication session; streaming audio content; streaming video content; executing an interactive gaming application; actively transferring data; playing locally stored audio content; playing locally stored video content; performing an intensive computational task; transitioning between two operational states; and an idle state in which the application is open but not actively being used (Exemplary Citations: for example, Abstract, Paragraphs 38, 46-48, 67, 78-82, and associated figures).
Regarding Claim 10,
Claim 10 is a system claim that corresponds to method claim 3 and is rejected for the same reasons.
Regarding Claim 17,
Claim 17 is a medium claim that corresponds to method claim 3 and is rejected for the same reasons.
Regarding Claim 5,
Moreno as modified by Uddin discloses the method of claim 1, in addition, Uddin discloses subsequent to determining that the deviation between the observed frequency spectrum and the frequency spectrum profile indicates anomalous behavior representing a high likelihood that an unknown software application is executing on the electronic device, automatically initiating an action comprising: disconnecting the electronic device from a network; shutting down the electronic device; generating an alert message to a user of the electronic device; switching execution of a software application to a different computing device; initiating a corrective action in a client application executing on the electronic device; initiating a corrective action in a backend server application communicating with the client application; executing a predefined remedial procedure to address the anomalous frequency spectrum deviation; or any combination thereof (Exemplary Citations: for example, Abstract, Paragraphs 17, 29, 47, 47, and associated figures).
Regarding Claim 12,
Claim 12 is a system claim that corresponds to method claim 5 and is rejected for the same reasons.
Regarding Claim 19,
Claim 19 is a medium claim that corresponds to method claim 5 and is rejected for the same reasons.
Regarding Claim 7,
Moreno as modified by Uddin discloses the method of claim 1, in addition, Moreno as modified by Uddin discloses subsequent to determining that the deviation between the observed frequency spectrum and the frequency spectrum profile indicates anomalous behavior, performing an analysis of processor utilization for software processes and services executing on the electronic device to identify any unknown processes correlated with the detected anomalous behavior (Moreno: Exemplary Citations: for example, Abstract, Paragraphs 38, 43, 44, 46-48, 63-68, 71-82, and associated figures; Moreno continuously runs and identifies known and unknown processes, for example; Uddin: Exemplary Citations: for example, Abstract, Paragraphs 15-17, 22, 36-47, and associated figures; Uddin continuously runs to identify and remediate errors and malicious entities, for example).
Regarding Claim 14,
Claim 14 is a system claim that corresponds to method claim 7 and is rejected for the same reasons.
Claims 2, 4, 9, 11, 16, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Moreno in view of Uddin and Carbajal (U.S. Patent Application Publication 2019/0230540).
Regarding Claim 2,
Moreno as modified by Uddin does not appear to explicitly disclose that determining that the deviation between the observed real time frequency spectrum and the frequency spectrum profile indicates anomalous behavior comprises calculating a deviation metric representing a degree of deviation between the observed real time frequency spectrum and the frequency spectrum profile over a plurality of time intervals, comparing the deviation metric to a deviation threshold, and determining that anomalous behavior exists only when the deviation metric exceeds the deviation threshold for at least a predetermined minimum number of the plurality of time intervals.
Carbajal, however, discloses that determining that the deviation between the observed real time frequency spectrum and the frequency spectrum profile indicates anomalous behavior comprises:
Calculating a deviation metric representing a degree of deviation between the observed real time frequency spectrum and the frequency spectrum profile over a plurality of time intervals (Exemplary Citations: for example, Paragraphs 36, 103, 106, 109, 110, 115, 122-126, 145-149, 181 and associated figures; determining deviations in frequency based blocks, for example);
Comparing the deviation metric to a deviation threshold (Exemplary Citations: for example, Paragraphs 36, 103, 106, 109, 110, 115, 122-126, 145-149, 181 and associated figures; comparing to threshold, for example); and
Determining that anomalous behavior exists only when the deviation metric exceeds the deviation threshold for at least a predetermined minimum number of the plurality of time intervals (Exemplary Citations: for example, Paragraphs 36, 103, 106, 109, 110, 115, 122-126, 145-149, 181 and associated figures; anomalous if greater than threshold in a number of blocks, where the number is greater than or equal to 1, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the change detection techniques of Carbajal into the program tracing system of Moreno as modified by Uddin in order to allow the system to better detect changes, to allow for amplitude based detection of changes, and/or to increase security in the system.
Regarding Claim 9,
Claim 9 is a system claim that corresponds to method claim 2 and is rejected for the same reasons.
Regarding Claim 16,
Claim 16 is a medium claim that corresponds to method claim 2 and is rejected for the same reasons.
Regarding Claim 4,
Moreno as modified by Uddin does not appear to disclose that measuring the real-time frequency spectrum emanating from the electronic device comprises: tapping an output of a baseband modulator of the electronic device, providing the tapped output of the baseband modulator to a spectral analyzer circuit, applying, by the spectral analyzer circuit, a Fast Fourier Transform (FFT) to the tapped output of the baseband modulator, yielding FFT frequency data representing amplitude and phase information for a plurality of frequency components in the tapped baseband modulator output, identifying, by the spectral analyzer circuit, a subset of the plurality of frequency components having an amplitude exceeding a predetermined amplitude threshold, designating, by the spectral analyzer circuit, the subset of frequency components having the amplitudes exceeding the predetermined amplitude threshold as the observed real-time frequency spectrum emanating from the electronic device.
Carbajal, however, discloses that measuring the real-time frequency spectrum emanating from the electronic device comprises:
Tapping an output of a baseband modulator of the electronic device (Exemplary Citations: for example, Paragraphs 36, 103, 106, 110, 115, 122-126, 145-149, 181 and associated figures; getting outputs from a modulator, such as a modem, for example. It is noted that the modulators within Carbajal are baseband modulators, since they modulate a baseband to a modulated signal for transmission, for example);
Providing the tapped output of the baseband modulator to a spectral analyzer circuit (Exemplary Citations: for example, Paragraphs 36, 103, 106, 110, 115, 122-126, 145-149, 181 and associated figures; sending this data on for analysis, for example);
Applying, by the spectral analyzer circuit, a Fast Fourier Transform (FFT) to the tapped output of the baseband modulator, yielding FFT frequency data representing amplitude and phase information for a plurality of frequency components in the tapped baseband modulator output (Exemplary Citations: for example, Paragraphs 36, 103, 106, 109, 110, 115, 122-126, 145-149, 181 and associated figures; FFT, amplitude, phase, for frequency components, such as each Hz, for example);
Identifying, by the spectral analyzer circuit, a subset of the plurality of frequency components having an amplitude exceeding a predetermined amplitude threshold (Exemplary Citations: for example, Paragraphs 36, 103, 106, 109, 110, 115, 122-126, 145-149, 181 and associated figures; amplitude threshold for each frequency based block, for example);
Designating, by the spectral analyzer circuit, the subset of frequency components having the amplitudes exceeding the predetermined amplitude threshold as the observed real-time frequency spectrum emanating from the electronic device (Exemplary Citations: for example, Paragraphs 36, 103, 106, 109, 110, 115, 122-126, 145-149, 181 and associated figures; noting the above, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the change detection techniques of Carbajal into the program tracing system of Moreno as modified by Uddin in order to allow the system to better detect changes, to allow for amplitude based detection of changes, and/or to increase security in the system.
Regarding Claim 11,
Claim 11 is a system claim that corresponds to method claim 4 and is rejected for the same reasons.
Regarding Claim 18,
Claim 18 is a medium claim that corresponds to method claim 4 and is rejected for the same reasons.
Claims 6, 13, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Moreno in view of Uddin, Seely (U.S. Patent Application Publication 2006/0248524), and Orhan (U.S. Patent 10,607,011).
Regarding Claim 6,
Moreno as modified by Uddin discloses the method of claim 1, in addition, Moreno as modified by Uddin discloses updating the plurality of frequency spectrum profiles stored in the memory by (Moreno: Exemplary Citations: for example, Abstract, Paragraphs 46-48, 67, 78-82, and associated figures; Uddin: Exemplary Citations: for example, Abstract, Paragraphs 17, 29, 33, 47, 47, and associated figures; updating database, for example):
Executing the new software application such that each operational mode of the new software application is executed (Moreno: Exemplary Citations: for example, Abstract, Paragraphs 46-48, 67, 78-82, and associated figures; Uddin: Exemplary Citations: for example, Abstract, Paragraphs 17, 29, 33, 47, 47, and associated figures; executing, as above, for example);
Measuring, during the execution of each operational mode, a corresponding frequency spectrum profile emanating from the electronic device (Moreno: Exemplary Citations: for example, Abstract, Paragraphs 43, 44, 46-48, 67, 71-82, and associated figures; Uddin: Exemplary Citations: for example, Abstract, Paragraphs 17, 29, 33, 47, 47, and associated figures; monitoring as above, for example); and
Storing the measured frequency spectrum profiles corresponding to each operational mode of the new software application in the memory as an updated plurality of frequency spectrum profiles (Exemplary Citations: for example, Abstract, Paragraphs 43, 44, 46-48, 67, 71-82, and associated figures; Uddin: Exemplary Citations: for example, Abstract, Paragraphs 17, 29, 33, 47, 47, and associated figures; updating database, for example).
But does not appear to explicitly disclose detecting a new software application installed on the electronic device, prompting a user of the electronic device to execute the new software application and executing the application for a predetermined time period.
Seely, however, discloses detecting a new software application installed on the electronic device (Exemplary Citations: for example, Figure 4 and associated written description; detecting application install, for example);
Prompting a user of the electronic device to execute the new software application (Exemplary Citations: for example, Figure 4 and associated written description; prompting the user to decide whether or not to run the recently installed software, for example. It is noted that this is simply a standard prompt at the end of an installation wizard in Windows, for example, as well). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the installation techniques of Seely into the program tracing system of Moreno as modified by Uddin in order to allow the system to install new programs, to allow for monitoring of new programs, to allow a user to specifically decide whether or not to run new software, and/or to increase security in the system.
Orhan, however, discloses that the executions are performed for a predetermined time period (Exemplary Citations: for example, Column 5, lines 20-64 and associated figures; running installed application for a predefined period of time to monitor it, for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the installed application monitoring techniques of Orhan into the program tracing system of Moreno as modified by Uddin and Seely in order to ensure that the program has been run long enough to determine its behavior properly, to allow for multiple different VMs running the program to be monitored, and/or to increase security in the system.
Regarding Claim 13,
Claim 13 is a system claim that corresponds to method claim 6 and is rejected for the same reasons.
Regarding Claim 20,
Claim 20 is a medium claim that corresponds to method claim 6 and is rejected for the same reasons.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Jeffrey D Popham whose telephone number is (571)272-7215. The examiner can normally be reached Monday through Friday 9:00-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey D. Popham/Primary Examiner, Art Unit 2432
Prosecution Insights