Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the
first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible
for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been
timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR
1.114. Applicant’s submission filed on 06/04/2026 has been entered.
Claims 1, 8 and 15 are independent claims. The applicant has amended claims 1, 8 and 15. Claims 1-20 have been examined and are pending. This Action is made Non-FINAL.
Response to Arguments
Applicants’ arguments with respect to claim(s) 1, 8 and 15 in the instant Amendment, filed on 06/04/2026, with respect to limitations listed below, have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
The Examiner respectfully suggests that the claim be further amended; details in the specification be incorporated, to distinguish the claimed invention over prior art of record. Should the Applicant desire an interview to further clarify the claim interpretation/rejections, please contact the Examiner at (571) 272-1531 to schedule an interview.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 6-9, 13-16 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Camp (US 2024/0061937 A1), in view of Bazalgette (US 20240223592 A1) and in further view of Rossi N.P.L. “TEMPORAL GRAPH NETWORKS FOR DEEP LEARNING ON DYNAMIC GRAPHS”.
Regarding Claim 1
Camp discloses
A method for performing real-time analytics based on generated telemetry (Camp: [0033]: backend collecting telemetry from protected devices; [0092]: telemetry stream of discrete events classified as attack words)
identifying an executable file and an action associated with the executable file and performed on a host (Camp: [0056]-[0059]: an event in which a process is an initiating actor, an action such as opening a file is an action actor, and the file is a targeted actor; further disclosing events in which an initiating process executes a file);
generating, by a data processing unit, a behavioral graph having nodes and edges based on the executable file and the action (Camp: [0057], [0060]-[0062]: a processor in operable communication with memory implementing a behavioral anti-malware graph engine which stores actors and classified events in a directed graph store having edge connections and causal relationships; Camp's processor executing the behavioral graph engine corresponds to the claimed data processing unit, being a processing unit configured to perform the claimed graph-processing operations);
wherein the nodes include a node representing the executable file and action nodes representing actions performed by the executable file (Camp: [0056]-[0059], [0066]-[0071]: process and file actors represented in the directed graph, attack words corresponding to events or sequences of events, and attack-word nodes representing actions associated with a process);
wherein the edges represent temporal or causal relationships between the actions performed by the executable file (Camp: [0057], [0066], [0069]-[0071]: temporally ordered sequences of events originating from the same process and graph links representing causal relationships between earlier and later events);
upon execution of subsequent actions associated with the executable file, continually adding corresponding additional nodes and edges to the behavioral graph (Camp: [0063]-[0066], [0069]-[0071], [0084]: appending and committing classified events to an attack graph and extending the graph as additional events occur);
including adding a new action node corresponding to a most recently executed action of the executable file and adding a new edge connecting the new action node to a prior node of the behavioral graph (Camp: [0070]-[0071], [0084]: attack-word events creating new attack-word nodes and links within the graph; event 1007/AW4 extending the existing PID2 graph to include AW1→AW2→AW4 and AW1→AW3→AW4);
predicting a plurality of possible subsequent actions of the executable file based on at least one of the additional edges on the behavioral graph,
identifying that at least one of the plurality of possible subsequent actions is a malicious action (Camp: [0021]-[0023], [0064], [0084]: predicted next attack words representing continuation of an attack sentence and remediation directed to the predicted attack activity); and
adding a policy to a policy engine to prevent execution of the at least one of the plurality of possible subsequent actions by the executable file before the at least one of the plurality of possible subsequent actions is attempted (Camp: [0061], [0064], [0084]: an event classification engine applying rules and invoking a reaction module, corresponding to the claimed policy engine; prediction of AW5 for PID2 at event 1007, addition of a rule to react if AW5 is subsequently detected, and blocking AW5 when event 1009 occurs). Camp further discloses that a process is created from a file and that the particular process instance is identified by a Process ID Number (PID), tying the PID-specific predictive rule to the process instantiated from the associated executable file (Camp: [0071]; see also [0056]).
However, Camp does not explicitly disclose wherein the predicting includes using the new edge as an input to a predictive model to generate respective probabilities for the plurality of possible subsequent actions of the executable file before the plurality of actions are executed. Bazalgette further discloses generating probability predictions for possible future cyber-incident activities before the activities occur: a GNN model analyzing a current graph of events and predicting future activity having, e.g., greater than a 50% or greater than an 80% chance/distribution of occurring, including predicting with high probability that a current cyber incident will subsequently include unauthorized encryption activity (Bazalgette: [0056]). Bazalgette also teaches correlating the ongoing incident graph to one or more likely progressions and to one or more end result incident graphs each having a high likelihood of occurring (Bazalgette: [0033], [0066]). Bazalgette further discloses a probability on how current events will escalate into future incident activity and predicting that a ransomware unauthorized encryption event will occur before the encryption event actually happens, providing a time advantage for taking mitigating action (Bazalgette: [0039], [0079]).
It would have been obvious to one having ordinary skill in the art to modify Camp's prediction of possible subsequent attack actions to include Bazalgette's probability prediction of future cyber incident activities because doing so would provide a quantitative indication of the likelihood of the predicted future activities, allowing the anti-malware system to more effectively prioritize and respond to likely malicious subsequent activity.
Camp as modified by Bazalgette does not explicitly disclose using the new edge as an input to the predictive model. Rossi discloses a Temporal Graph Network operating on continuous-time dynamic graphs represented as sequences of time-stamped events, wherein an interaction event between two nodes is represented as a directed temporal edge eij(t), and the dynamic graph evolves through additions or changes of nodes and edges (Rossi: §2). Rossi further discloses that, for each interaction event, the temporal edge eij(t) is provided as an input to a learnable message function used to update the model state (Rossi: §3.1, Message Function), and that temporal-edge features are used as inputs to a graph-attention embedding operation such that the predictive representation incorporates information from the observed edge and its timing (Rossi: §3.1, Embedding). Rossi further discloses predicting future interactions from previously observed time-ordered interactions, wherein previous interactions update the model state before subsequent interactions are predicted; Figure 1 expressly illustrates the architecture producing edge probabilities (Rossi: Fig. 1; §3.2). Rossi also discloses MLP decoders maps two node embedding to the probability of an edge between respective probability for each candidate interaction.
It would have been obvious to one having ordinary skill in the art to further modify the dynamic behavioral-graph prediction system of Camp as modified by Bazalgette to incorporate Rossi's temporal graph-network processing because Camp’s behavioral graph is a directed graph of time ordered events to which Rossi continuous dynamic graph directly applies. The motivation to combine would have been to permit the predictive model to account for the most recently observed relationship in the evolving graph and thereby improve prediction of subsequent activity using the most current behavioral information. Thus, Camp in view of Bazalgette and Rossi teaches using the newly added edge as input to a predictive model to generate probabilities for possible subsequent actions before those subsequent actions occur.
Regarding Claim 2
Camp discloses the computer-implemented method of claim 1, further comprising:
identifying a subsequent action associated with the executable file and performed on the host (Camp ¶61-62: Teaches identifying subsequent actions performed on the host by monitoring and filtering events in real time);
updating nodes of the behavioral graph based on the subsequent action (Camp ¶62: Teaches updating nodes of a behavioral graph by provisionally appending and committing events to the attack graph.);
predicting a second plurality of possible subsequent actions based on the updated behavioral graph (Camp ¶64: Teaches predicting multiple subsequent actions using classification of extended graph fragments.);
determining that at least one of the second plurality of possible subsequent actions is the malicious action or another malicious action (Camp ¶62: Teaches identifying that predicted actions are malicious if the graph forms a valid attack sentence.); and
updating the policy to prevent execution of the at least one of the second plurality of possible subsequent actions (Camp ¶64: Teaches predicative policy enforcement by blocking or restricting execution based on next predicted attack words in an attack graph.).
Regarding Claim 6
Camp discloses the computer-implemented method of claim 1, further comprising: determining, by the policy engine, an attempt associated with the executable file to perform the at least one of the plurality of possible subsequent actions; and determining, based on determining the attempt, that the executable file is a malicious file (Camp ¶84: Teaches predictive detection of a malicious file by matching an attempted action against previously predicted attack words in the attack graph.).
Regarding Claim 7
Camp discloses the computer-implemented method of claim 7, further comprising: preventing, by the policy engine, the execution of the at least one of the plurality of possible subsequent actions based on determining the attempt (Camp ¶64: Teaches predictive policy enforcement by blocking execution based on next predicted words in an attack graph. Camp ¶123: further teaches prevention through active termination of the process upon detecting a predicted malicious action.).
Regarding Claim 8
Claim 8 is directed to a computer-readable storage medium corresponding to the computer-implemented method in claim 1. Claim 8 is similar in scope to claim 1 and is therefore rejected under similar rationale.
Regarding Claim 9
Claim 9 is directed to a computer-readable storage medium corresponding to the computer-implemented method in claim 2. Claim 9 is similar in scope to claim 2 and is therefore rejected under similar rationale.
Regarding Claim 13
Claim 13 is directed to a computer-readable storage medium corresponding to the computer-implemented method in claim 6. Claim 13 is similar in scope to claim 6 and is therefore rejected under similar rationale.
Regarding Claim 14
Claim 14 is directed to a computer-readable storage medium corresponding to the computer-implemented method in claim 7. Claim 14 is similar in scope to claim 7 and is therefore rejected under similar rationale.
Regarding Claim 15
Claim 15 is directed to a system corresponding to the computer-implemented method in claim 1. Claim 15 is similar in scope to claim 1 and is therefore rejected under similar rationale.
Regarding Claim 16
Claim 16 is directed to a system corresponding to the computer-implemented method in claim 2. Claim 16 is similar in scope to claim 2 and is therefore rejected under similar rationale.
Regarding Claim 20
Claim 20 is directed to a system corresponding to the computer-implemented method in claim 6. Claim 20 is similar in scope to claim 6 and is therefore rejected under similar rationale.
Claims 3-5, 10-12 and 17-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Camp, in view of Bazalgette, in view of Rossi as applied to claim 1 above, and in further view of Ding (US 2021/0064751 A1).
Regarding Claim 3
Camp discloses the computer-implemented method of claim 1, wherein predicting the plurality of possible subsequent actions includes determining probabilities of possible subsequent actions based on the behavioral graph and a predictive model (Camp ¶85, 90, 112: Teaches using a predictive model (attack model or NLP model) that operates on a behavioral graph (attack graph) to determine probability scores for various next actions. These probabilities reflects how likely each predicted actions is to follow based on prior behavioral patterns encoded in the graph.),
Camp, Bazalgette and Rossi do not disclose the following limitation “selecting a predetermined number of most probable possible subsequent actions”. Ding discloses a top t system/method that includes and selecting a predetermined number of most probable possible subsequent actions (Ding ¶86: teaches selecting a predetermined number of most possible subsequent actions by using a threshold-based method that evaluates path embedding vectors from a province graph and triggers a decision when the top t predicted paths are classified as malicious. This reflects both probability-based ranking and fixed-number selection of the most likely malicious outcomes.).
Given the teachings of Ding, a person having ordinary skill in the art before the effective filing date would have found it obvious to modify the teaching of Camp, Bazalgette and Rossi by selecting a predetermined number of the most probable subsequent actions for decision making. Ding teaches using an outlier detection model to evaluate path embedding vectors from a provenance graph and trigger a decision when the top t paths are predicted as malicious, thereby ranking future behavioral sequences and selecting a fixed number of high-probability ones for early classification and mitigation. Since selecting the top t or k results based on model output is a well-known design choice in graph-based predictive analytics and reduces detection overhead while preserving accuracy, it would have been obvious to implement top-N selection on predicated actions to prioritize enforcement or mitigation steps (Ding ¶86).
Regarding Claim 4
Camp discloses the computer-implemented method of claim 3, wherein the predictive model is a statistical or machine learning model trained to predict a probability distribution of subsequent actions based on a behavioral graph input (Camp ¶86, 90, 104, 112: teaches a ML model (LSTM, multilayer perception) that is trained to operate on attack graph and output probability values (confidence score) for predicted next action (attack words). These values represent a probability distribution over possible subsequent action.).
Regarding Claim 5
Camp discloses the computer-implemented method of claim 3, wherein the predictive model is trained on a dataset of behavioral graphs of benign software and/or malware (Camp ¶93-94 and 104: discloses generating attack words graphs from detonating malware in a test environment, as well as using public infosec articles to create labeled attack word sequences. These serve as training datasets for the predictive model, which is thereby trained on known malicious behavior.).
Regarding Claim 10
Claim 10 is directed to a computer-readable storage medium corresponding to the computer-implemented method in claim 3. Claim 10 is similar in scope to claim 3 and is therefore rejected under similar rationale.
Regarding Claim 11
Claim 11 is directed to a computer-readable storage medium corresponding to the computer-implemented method in claim 4. Claim 11 is similar in scope to claim 4 and is therefore rejected under similar rationale.
Regarding Claim 12
Claim 12 is directed to a computer-readable storage medium corresponding to the computer-implemented method in claim 5. Claim 12 is similar in scope to claim 5 and is therefore rejected under similar rationale.
Regarding Claim 17
Claim 17 is directed to a system corresponding to the computer-implemented method in claim 3. Claim 17 is similar in scope to claim 3 and is therefore rejected under similar rationale.
Regarding Claim 18
Claim 18 is directed to a system corresponding to the computer-implemented method in claim 4. Claim 18 is similar in scope to claim 4 and is therefore rejected under similar rationale.
Regarding Claim 19
Claim 19 is directed to a system corresponding to the computer-implemented method in claim 5. Claim 19 is similar in scope to claim 5 and is therefore rejected under similar rationale.
Conclusion
Any inquiry concerning this communication or earlier communications from the
examiner should be directed to SAAD ABDULLAH whose telephone number is 571 -272-1531.
The examiner can normally be reached on Monday-Friday 9am-5pm EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, LYNN FIELD can be
reached on 571-272-2092.
Information regarding the status of an application may be obtained from the Patent
Application Information Retrieval (PAIR) system. Status information for published applications
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished
applications is available through Private PAIR only. For more information about the PAIR
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would
like assistance from a USPTO Customer Service Representative or access to the automated
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAAD AHMAD ABDULLAH/Examiner, Art Unit 2431
/LYNN D FEILD/Supervisory Patent Examiner, Art Unit 2431
