DETAILED ACTION
Claims 1-20 are pending. This is in response to the application filed on March 30, 2023 which is a 371 of PCT/CN2021/132838 filed on November 24, 2021 which claims priority to the CHINA application 202110471943.2 filed on April 29, 2021.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claims 2-3 and 5-7 contain values, symbols written so illegible that need to be corrected.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(d):
(d) REFERENCE IN DEPENDENT FORMS.—Subject to subsection (e), a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
The following is a quotation of pre-AIA 35 U.S.C. 112, fourth paragraph:
Subject to the following paragraph [i.e., the fifth paragraph of pre-AIA 35 U.S.C. 112], a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
Claims 10-20 are rejected under 35 U.S.C. 112(d) or pre-AIA 35 U.S.C. 112, 4th paragraph, as being of improper dependent form for failing to further limit the subject matter of the claim upon which it depends, or for failing to include all the limitations of the claim upon which it depends. Claims 10-15 are system claim claiming dependency on dependent claims 2-8 of the method claim 1. Similarly, claims 16-20 are storage medium claim claiming dependency on dependent claims 2-5 of the method claim 1. Applicant may cancel the claim(s), amend the claim(s) to place the claim(s) in proper dependent form, rewrite the claim(s) in independent form, or present a sufficient showing that the dependent claim(s) complies with the statutory requirements.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 8-9 are rejected since the claimed invention is directed to non-statutory subject matter. The claims do not fall within at least one of the four categories of patent eligible subject matter because claim 8 is a system claim reciting to comprise a pre-processing module, a text feature extraction module and a model construction module which are interpreted as software module under broadest interpretation; claim 9 is claiming a storage medium but there is no definition the medium is hardware. Hence, it is interpreted as non-transitory, signal per se medium which is not one of the four eligible subject matter.
Claims 1, 8-9 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
The rationale for this determination is explained below:
Step 2A: It is determined that claimed invention is directed to an abstract idea or at least one of the judicial exceptions, because the concept of the invention is to convert binary into text data then use TD-IDF, XGBoost, Lightboost and k-fold algorithms on feature data sets to obtain a result which may or may not indicate malware in the binary. As such, the claimed invention is directed to a series of steps similar to mental process wherein concepts are performed in the human mind or by a human analyst (obtaining feature data, reading files, extracting and vectorizing features, dividing feature data sets of different dimensions, etc. ) with or without aid of computer. When giving broadest reasonable interpretations, a human analyst can perform such process by using a computer.
Step 2B: The identified additional elements – pre-processing module, a text feature extraction module and a model construction module– fail to integrate the idea of into a practical application. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the claim merely recites the above steps are executed using these modules. These elements only perform functions of a general computer such as processing data, reading binary file, extract text data, constructing models to be used in TF-IDF, XGBoost, LightBoost and K-fold validation algorithms. Further, the claims do not recite an improvement to another technology or technical field, an improvement to the functioning of the computer itself, or meaningful limitations beyond generally linking the use of an abstract idea to a particular technological environment. For example, there is not disclosure what result obtained is considered malware. Even so, what mitigation step is taken to prevent malware. Therefore, the claims are abstract without significantly more.
Dependent claims 2-7 as presented thus far, when analyzed individually or as a whole, are held to be patent ineligible under 35 U.S.C. 101 because, the additional recited limitation(s) fail(s) to amount to “significantly more” than the judicial exception, and thereby non-statutory. Since the claims only further disclose parameters used to perform the calculation based on TD-IDF algorithm.
Please see “The 2019 Revised Patent Subject Matter Eligibility Guidance (or “2019 PEG” for short) published in January 2019 at USPTO Website. Note that the groupings of abstract ideas in the 2019 PEG are not the same as those on the Abstract Ideas QRS or in the MPEP. The groupings in the 2019 PEG should be FOLLOWED for identifying abstract ideas. The 2019 PEG does not change the analysis at Step 2B which pertains to an improvement to conventional functioning of a computer or to technological processes; see also MPEP 2106.05(a).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Pub 20220253691 (hereinafter Rokka) in view of CN-111797394-A (hereinafter Li)
Regarding claim 1, Rokka discloses a method for recognizing mining malware, comprising the following steps:
pre-processing data: performing multi-dimensional data operation on a binary sample, and obtaining corresponding feature data of different dimensions (Figs. 1-2 and par. [0016]-[0027] discloses malware analyses using n-gram, a token frequency-inverse document frequency (TF-IDF), and a boosting model trainer using XGBoost, Gradient Boosting algorithm, etc. Par. [0029] discloses the text file dynamic malware analysis report is generated from a dynamic malware analysis of a file (e.g. program) where data is expressed in multi-dimension as {description,action,call}, {action,call,function}, {call,function,library}, {call,library,function}, {action,call,function,export}, etc.).
wherein the multi-dimensional data operation comprises:
reading files from binary file samples in a form of binary bytecode, then decoding the files into character strings, and screening out a character string with a length in a certain interval;
extracting text data defined in the binary file samples, comprising a name of a feature operation function, a dynamic link library and text data related to the mining software (see above reasoning);
disassembling the binary file samples, and performing feature statistics on section size of the binary file samples; disassembling the binary file samples to obtain entry function data of the binary file samples (Fig. 2, see 103-115);
extracting text features: extracting and vectorizing features from feature data of different dimensions by combining a TF-IDF algorithm with n-gram (Fig. 2 and related text);
Rokka does not disclose using stacking during boosting model training. Li discloses this feature (Fig. 2 and related text). Therefore, it would have been obvious before the effective filing dated of the claimed invention to modify Rokka with Li to further teaches on the basis of Stacking, constructing a mining malware recognition model integrated with multiple models and obtaining a prediction result, wherein the step of Stacking comprises: dividing feature data sets of different dimensions into a training data set and a test data set; on the basis of an XGBoost algorithm, performing K-fold cross validation training in the training set, and obtaining base learners and training results of the base learners; on the basis of a LightGBM algorithm, performing training in the training results of the base learners, and obtaining a meta learner; and predicting the test data set by using the base learners and the meta learner, and obtaining a final prediction result. One would have done so use known stack process to the replace the boosting model trainer 133 as shown in Fig. 2 of Rokka in order to improve the prediction result as disclosed in Li.
Regarding claim 2, Rokka discloses wherein extracting and vectorizing features from feature data of different dimensions by combining a TF-IDF algorithm with the n-gram specifically comprise the steps:
firstly, generating word items of the n-gram by using feature data of different dimensions; counting a word frequency that each word item appears, and attaching a weight parameter to each word item; and computing a final weight for each word item (par. [0020]).
Regarding claim 3, Li discloses this feature (Fig. 1 and related text).
Regarding claim 5, Li discloses wherein dividing feature data sets of different dimensions into a training data set and a test data set specifically comprises the step: dividing four feature data sets of different dimensions obtained by pre-processing and vectorizing the original data sets into the training data set and the test data set, the training data set comprises D1, D2, D3 and D4:
D1 = {(x1i, yi), i = 1,2, ... , m}, D2 = {(x2i, yi), i = 1,2, ... , m},
D3 = {(x2i, yi), i = 1,2, ... , m}, D4 = {(x4i, yi), i = 1,2, ... , m},
wherein xni is a feature vector for the ith sample of the nth training data set Dn, n =
1, 2, 3, 4 and so on; yi is a label corresponding to the ith sample; m is the number of
samples in each data set; and the test data set is set as T (Fig.1 and related text. Note that the data set can be any size not four as recited).
Regarding claim 6, Li discloses wherein on the basis of the XGBoost algorithm, performing K-fold cross validation training in the training data set and obtaining base learners and training results of the base learners, and on the basis of the LightGBM algorithm, performing training in the training results of the base learners and obtaining a meta learner, specifically comprise the steps:
for K-fold cross validation training, setting D-nK as a Kth fold training set of the nth training data set Dn, and setting DnK as a Kth fold test set of the nth training data set Dn (Fig. 2 and related text);
on the basis of the XGBoost algorithm, performing training in the D-nK to obtain
base learners XGBoost_n, wherein n=l, 2, 3 and 4; for each sample Xi in the DnK,
prediction results of the each sample Xi from the base learners XGBoost_n are
expressed as ZKi, and a new data set Dnew = {(Z1i,Z2i, ... ,ZKi,Yi), i = 1,2, ... ,m} is
constructed (Fig. 2 and related text); and
on the basis of the LightGBM algorithm, performing training m Dnew, and
obtaining a meta learner LightGBM model (although Li discloses using SVM AdaBoost to stack with XGBoost, but one skilled in the art would have understood any combination of LightGBM, XGBoost would not change the invention but rather a designer choice since LightGBM and XGBoost are known as base leaner as well as meta leaner. See https://datascience.stackexchange.com/questions/49567/lightgbm-vs-xgboost-vs-catboost).
Regarding claim 7, Li discloses wherein predicting the test data set by using the base learners and the meta learner, and obtaining a final prediction result specifically comprise the steps:
predicting the test set T by using the base learners to obtain the prediction results W1, W2, W3 and W4, and constructing a new test data set Tnew = {(W1, W2, W3 and W4)}; and predicting Tnew with the meta learner to obtain the final prediction result (using stacking technique, Li can divide the data to n-portion data as input for base leaner step where Li run SVM, RF and AdaBoost as base learners shown in Fig. 2. This same process can iterate another the round of stacking after obtaining the result as data then divide the result into n-portion result. Hence the result can split into four portions to obtain is final result is just matter of choice or an obvious variation but with another iteration stacking round. Note that Rokka also discloses iteration during C2 step during base learner process (par. [0025])).
Claims 8-20 are rejected in view of claim 1 rejection.
Allowable Subject Matter
Claim 4 is objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Inquiry communication
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TRI M TRAN whose telephone number is (571)270-1994. The examiner can normally be reached Mon-Fri: 9am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached at (469)295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TRI M TRAN/Primary Examiner, Art Unit 2432