Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
The instant application having Application No.18/618,962 is presented for examination by
the examiner. Claims 20, 23-28 and 31-36 are amended. Claims 20-36 have been examined.
Response to Arguments
Applicant’s arguments with respect to claim(s) 1, 10 and 16 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 20, 24, 28-31 and 35 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chen (US 2016/0330226 A1), in view of Filar (NPL “ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships”).
Regarding Claim 20
Chen discloses:
A multi-stage anomaly detector deployed within a host endpoint agent configured to detect at least a potential cyber threat on an endpoint computing device, the multi-stage anomaly detector comprising:
a first stage of anomaly detectors including a symbol frequency anomaly detector configured to (i) analyze a first process chain of parameters to estimate how often a process associated with the first process chain has been executed on the endpoint computing device and
(ii) generate a first anomaly score (Chen ¶[0023]–[0024]; [0030]; [0034]; [0036]–[0038]; [0042]–[0045]: host-level analysis module includes user-to-process anomaly detection and malicious process path discovery; malicious process path discovery tracks possible process paths using incoming and previous events; directed graph stores timestamped events between entities, including processes; repeated events add timestamps to the same edge, indicating how often related events occur; candidate process paths are searched using valid path patterns and time-order constraints; random-walk transition probabilities and sender/receiver scores are used to calculate an anomaly score/suspiciousness score for the candidate process/path.);
(Chen ¶[0046]: discloses that once a suspicious path has been detected, the host-level analysis module provides information regarding the anomaly and generates a report that may include one or more alerts; the anomaly fusion module integrates the host alerts with other anomalies and filters false alarms; the resulting list of anomalies is provided via visualization module 45 to a user.), where the multi-stage anomaly detector is implemented with an electronic circuit, an algorithm implemented with lines of code in software, and any combination of both (Chen ¶[0023]; [0048]–[0051]: discloses hardware/software implementation because the host analysis module includes a processor and memory, functional modules are processor executed or implemented as ASICs/FPGAs, and embodiments may be entirely hardware, entirely software, or a hardware/software combination.).
Chen does not explicitly disclose a first stage of anomaly detectors including a symbol frequency anomaly detector configured to analyze a first process chain of parameters to estimate how often a process associated with the first process chain has been executed on the endpoint computing device and generate a first anomaly score; and a second stage of anomaly detectors arranged in a sequential array with the first stage of anomaly detectors, the second stage including a jump frequency anomaly detector configured to analyze a second process chain of parameters to estimate how often a particular process launches and then accesses or launches another process and generate a second anomaly score after the first anomaly score is generated; wherein a weighted combination of the first anomaly score and the second anomaly score is used to produce a combined anomaly score correlated to a likelihood that the potential cyber threat is maliciously harmful for the endpoint computing device. However, Filar discloses detecting anomalous parent-child process chains using system events extracted from ETW/Sysmon data, wherein process creation metadata is stored in graph form with nodes representing process names, edges representing actions such as process create/fork/terminate, and metadata including process IDs, command-line arguments, and timestamps (Filar §§4.1–4.2.) Filar further discloses a prevalence engine that determines how prevalent a process, parent-child chain, or process-command line is within a local or target environment. Filar determines process prevalence based on how often a process has been seen and determines parent-child chain prevalence using P(child | parent) = P(child, parent) / P(parent) to determine how often a child process appears from a given parent process (Filar §4.3). Filar further discloses generating a maliciousness weight/probability for a parent-child edge using an ML model, combining that maliciousness weight with the local prevalence score to generate an anomalous score, e.g., anomalous_score = weight × (1 − prevalence_score), and thresholding/ranking communities to return the highest scored malicious communities first (Filar §§4.2–4.4, Fig 4).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify Chen’s host level malicious process path discovery system with Filar’s prevalence based parent-child chain scoring because Chen and Filar are analogous art involving process event anomaly detection for identifying malicious process behavior. The motivation to combine would have been to improve Chen’s detection of malicious process paths by identifying rare parent-child process chains, suppressing commonly occurring benign process activity, reducing false positives/alert noise, and returning a manageable ranked list of potentially malicious process communities for review as expressly taught by Filar.
Regarding Claim 24
Chen in view of Filar discloses wherein different computational processes and factors are implemented by each of the first stage of the anomaly detectors and the second stage of the anomaly detectors to ultimately form the weighted combination of the first anomaly score and the second anomaly score. Filar discloses using different computational processes and factors to generate and combine anomaly scores. Specifically, Filar discloses using an XGBoost supervised learning model trained on malicious and benign process chain data to generate a maliciousness weight/probability for a parent-child edge, using factors including time between process creation and termination, parent-child process encoding, process signature information, process elevation information, process integrity information, whether the process is running as system parent-child user mismatch, process-name entropy, command-line entropy, and TF-IDF of command-line arguments. Filar further discloses a separate prevalence engine/statistical process that determines process prevalence and parent-child process chain prevalence using process count percentile scoring and conditional probability, P(child | parent) = P(child, parent) / P(parent), to determine how often a child process appears from a given parent process. Filar then combines the maliciousness weight from the global ML view with the prevalence score from the local statistical view to generate an anomalous score thereby forming the weighted combination (Filar §§4.2–4.4, Fig. 4.)
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify Chen’s host level malicious process path discovery system to implement Filar’s different computational processes and factors for generating the weighted anomaly score because Chen and Filar are analogous art directed to detecting malicious process behavior using path analysis. The motivation to combine would have been to improve Chen’s malicious process path detection by using both a global ML maliciousness view and a local statistical prevalence view, thereby identifying rare parent-child process chains, suppressing commonly occurring benign process activity, reducing false positives/alert noise, and ranking potentially malicious process communities for review.
Regarding Claim 28
Claim 28 is directed to a non-transitory computer readable medium corresponding to the system in claim 20. Claim 28 is similar in scope to claim 20 and is therefore rejected under similar rationale.
Regarding Claim 29
Chen in view of Filar discloses the non-transitory computer readable medium of claim 28 further comprising an autonomous response module configured to cause one or more actions to be taken autonomously to contain the detected potential cyber threat, wherein the one or more actions are configured to be triggered when a likelihood of a combined anomaly score, generated based on the first anomaly score and the second anomaly score, satisfies a predetermined threshold that indicates a high likelihood that the detected first potential cyber threat is malicious. Filar discloses generating a combined anomalous score based on a maliciousness weight and a prevalence score, e.g., anomalous_score = weight × (1 − prevalence_score), and comparing the anomalous score to a threshold, wherein if the score is greater than or equal to the threshold, the process community is deemed malicious (Filar §§4.2–4.4, Fig. 4). Chen further discloses automatically addressing detected anomalies by deploying security countermeasures or mitigations, including shutting down a device showing anomalous behavior until it can be reviewed by an administrator. Chen ¶[0046].
It would have been obvious to one having ordinary skill in the art to configure Chen’s automatic mitigation/countermeasure response to be triggered by Filar’s thresholded anomalous score because Chen and Filar are analogous art directed to detecting malicious process behavior, and triggering automatic containment when a score indicates a high likelihood of maliciousness would improve endpoint protection by reducing response time and limiting damage from detected malicious process activity.
Regarding Claim 30
Chen in view of Filar discloses or at least suggests wherein the cyber threat module is configured in the host endpoint agent and generates the combined anomaly score based on real-time analysis of collected pattern-of-life data deviating from normal pattern-of-life data for the endpoint computing device. Chen discloses modeling monitored system data as a directed graph with processes, files, UNIX sockets, and Internet sockets as vertices and timestamped events as edges; searching candidate event sequences/process paths using valid path patterns and time-order constraints; applying random-walk analysis to learn sender/receiver scores and transition probabilities as a profile of normal behavior; calculating anomaly/suspiciousness scores for candidate paths; and measuring deviation between suspicious paths and normal paths. Chen ¶¶[0030], [0034], [0036]–[0045]. Filar further discloses generating a combined anomalous score from local process and parent-child process-chain behavior by combining a maliciousness weight with a local prevalence score, e.g., anomalous_score = weight × (1 − prevalence_score) (Filar §§4.3–4.4, Fig. 4).
It would have been obvious to modify Chen with Filar’s local prevalence anomalous scoring to improve detection of rare and potentially malicious process-chain behavior while suppressing common benign activity and reducing false positives.
Regarding Claim 31
Claim 31 is directed to a method corresponding to the system in claim 20. Claim 31 is similar in scope to claim 20 and is therefore rejected under similar rationale.
Regarding Claim 35
Claim 35 is directed to a method corresponding to the system in claim 24. Claim 35 is similar in scope to claim 24 and is therefore rejected under similar rationale.
Claims 21-23 and 32-34 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chen (US 2016/0330226 A1), in view of Filar (NPL “ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships”), and in further view of Karasaridis (US 2020/0195669 A1).
Regarding Claim 21
In an analogous art, Karasaridis discloses a severeness factor system/method that includes:
The multi-stage anomaly detector of claim 20, wherein the combined anomaly score is determined based on one or more interest-level factors comprising at least one or more of a level of interest factor and an estimation level of severeness factor of an impact of the potential cyber threat could have on the endpoint computing device (Karasaridis ¶25–26: discloses computing a combined anomaly or reputation score based on weighted contributions reflecting the severity and type of detected anomalous behavior, such as assigning higher negative weights (−10, −5) for more severe anomalies and using thresholds to reclassify entities as “good,” “unknown,” or “bad”.).
Given the teachings of Karasaridis, a person having ordinary skill in the art would have recognized the desirability of modifying the teachings of Chen and Filar to incorporate weighted severity-based scoring for combining anomaly outputs. Karasaridis discloses assigning weighted contributions (e.g., −10, −5) to anomalies based on their type and severity and computing an overall score that correlates with the likelihood of malicious impact. It would have been obvious to apply a weighted scoring mechanism to a multi-stage anomaly scores to generate a single combined anomaly score reflecting both anomaly magnitude and threat severity, thereby improving prioritization and triage of detected cyber threats in a predictable manner (Karasaridis ¶25–26).
Regarding Claim 22
Chen discloses:
The multi-stage anomaly detector of claim 21 is deployed within the host endpoint agent configured to use one or more machine-learning models to analyze a collected pattern of life data for the endpoint computing device against a normal pattern of life data for the endpoint computing device to provide the determination of the combined anomaly score for the potential cyber threat for that endpoint computing device (Chen ¶20–28, 42–44: discloses that each endpoint includes an agent installed on the host to collect process, file, and socket telemetry, and that the host-level analysis module employs multiple anomaly detectors that model normal behavioral roles and apply learning-based statistical methods to generate an anomaly score for each process path.).
Regarding Claim 23
Chen discloses:
The multi-stage anomaly detector of claim 22, wherein at least one level of the interest factor is used to indicate a degree of difference of a behavior pattern of the potential cyber threat from a normal behavior pattern of life for the endpoint computing device (Chen ¶44–46: discloses determining how far suspicious behavior deviates from normal by calculating statistical deviation measures such as Box-Cox normalization and t-values between suspicious and normal paths. This quantifies the difference between a potential cyber threat and normal behavior, effectively serving as an interest-level factor indicating deviation from normal activity. Once a suspicious path has been detected, the host-level analysis module provides information regarding the anomaly, generating a report that may include one or more alerts).
Regarding Claim 32
Claim 32 is directed to a method corresponding to the system in claim 21. Claim 32 is similar in scope to claim 21 and is therefore rejected under similar rationale.
Regarding Claim 33
Claim 33 is directed to a method corresponding to the system in claim 22. Claim 33 is similar in scope to claim 22 and is therefore rejected under similar rationale.
Regarding Claim 34
Claim 34 is directed to a method corresponding to the system in claim 23. Claim 34 is similar in scope to claim 23 and is therefore rejected under similar rationale.
Claims 25 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chen (US 2016/0330226 A1), in view of Filar (NPL “ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships”), and in further view of Sadrieh (US 11,294,756 B1).
Regarding Claim 25
Chen in view of Filar and further in view of Sadrieh discloses or at least suggests the multi-stage anomaly detector of claim 20 further comprising a third stage of anomaly detectors including a neural network anomaly detector to analyze two or more details of how a first process is interacting with other processes or resources on the endpoint computing device. Filar discloses analyzing process creation events in graph form, where nodes represent process names, edges represent actions such as process create/fork/terminate, and metadata includes process IDs, command-line arguments, and timestamps. Filar further discloses analyzing multiple process-interaction details, including time between process creation and termination, parent-child process encoding, process signature information, process elevation information, process integrity information, whether the process is running as system, parent-child user mismatch, process-name entropy, command-line entropy, and TF-IDF command-line arguments (Filar §§4.1–4.2). Sadrieh discloses a neural network anomaly detector because Sadrieh teaches a VAE including a neural network encoder/decoder pair, including LSTM layers, configured to analyze time-series/sequential input data, extract temporal patterns, calculate reconstruction probabilities, and generate anomaly scores (Sadrieh Column 2, Lines 54 - Column 3, Line 64 and Figs. 2–5).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to further modify Chen and Filar’s path anomaly detection system with Sadrieh’s neural network anomaly detector because Chen, Filar, and Sadrieh are analogous art directed to anomaly detection using event data. The motivation to combine would have been to improve detection accuracy by using a neural network to learn temporal/sequential patterns from multiple event features and generate more robust anomaly determinations as taught by Sadrieh.
Claims 26-27 and 36 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chen (US 2016/0330226 -A1), in view of Filar (NPL “ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships”), in view of Sadrieh (US 11,294,756 B1), and in further view of Kukreja (US 2019/0294485 A1).
Regarding Claim 26
In an analogous art, Kukreja discloses an anomaly detector system/method that includes:
The multi-stage anomaly detector of claim 25, wherein the neural network anomaly detector further comprises a recurrent neural network anomaly detector, wherein the analyzer module comprises a controller having one or more threshold parameters, wherein the threshold parameters comprise one or more urgency parameters are configured as one or more static/dynamic thresholds (Kukreja ¶27, 50–54; FIGs. 2, 4–5: discloses a neural-network-based anomaly detector that uses a predictive scoring model to evaluate time-series telemetry data and determine prediction errors. The analyzer module applies both static thresholds and dynamic thresholds to decide when anomalies occur, functioning as a controller with urgency parameters governing sensitivity and timing.), and wherein the urgency parameters are configured to govern a time duration for each of the first, second, third stages of the anomaly detectors, and to establish the thresholds in order to move from one anomaly score of such detectors to another anomaly score of such detectors in a hierarchy configuration (Kukreja ¶38–40, 53–54; FIGs. 3A–3C & 5: discloses a hierarchical anomaly detection framework where anomalies detected at lower “pivot” levels are rolled up through successive layers based on severity and persistence. The system applies time-based thresholds that determine when a prediction error persists long enough to escalate to a higher anomaly stage, effectively governing the time duration and transitions between successive anomaly scores.)
Given the teachings of Kukreja, a person of ordinary skill in the art would have recognized the desirability of modifying the teachings of Chen, Filar and Sadrieh by implementing a hierarchical, time-governed anomaly detection system where progression between detection stages is based on the persistence and severity of anomalies. Kukreja discloses that anomalies detected at lower levels (pivots) are rolled up through successive layers based on severity over a predetermined time period, with escalation occurring when prediction errors exceed threshold differences. It would have been obvious to employ such time-based, threshold-controlled escalation (“urgency parameters”) to govern the duration and transition between successive anomaly detection stages, thereby improving the responsiveness and accuracy of multi-stage anomaly scoring within a hierarchical configuration (Kukreja ¶38–40, 53–54; FIGs. 3A–3C & 5).
Regarding Claim 27
In an analogous art, Kukreja discloses an anomaly detector system/method that includes:
The multi-stage anomaly detector of claim 26, wherein the first anomaly score associated with the first stage of anomaly detectors and the second anomaly score associated with the second stage of the anomaly detectors exceed established thresholds of urgency parameters to be capable of moving and generating the third anomaly score of the third stage of the anomaly detectors (Kukreja ¶27, 37–44, 50–54; FIGs 3A–3C: discloses a hierarchical anomaly detection system in which lower-level anomaly scores (leaf or dimension nodes) that exceed defined thresholds or persist for a set time are rolled up into higher-level aggregate scores, forming a multi-stage escalation chain. The prediction-error thresholds and persistence windows function as urgency parameters governing when a stage advances, producing successive anomaly scores across the hierarchy. Thus, Kukreja teaches that first and second stage anomaly scores trigger generation of a higher-level (third-stage) anomaly score once their threshold conditions are met).
Given the teachings of Kukreja, a person of ordinary skill in the art would have recognized the desirability of modifying the teachings of Chen, Filar and Sadrieh by applying a multi-stage hierarchal anomaly scoring in order to improve localization and escalation of anomalous events. The prediction-error threshold and persistence windows functions as urgency parameters governing when a stage advances, producing successive anomaly scores across the hierarchy. This improves the responsiveness and accuracy of anomaly localization by enabling hierarchal escalation-based on urgency threshold (Kukreja ¶27, 37–44, 50–54; FIGs 3A–3C).
Regarding Claim 36
Claim 36 is directed to a method corresponding to the system in claim 27. Claim 36 is similar in scope to claim 27 and is therefore rejected under similar rationale.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAAD A ABDULLAH whose telephone number is (571) 272-1531. The examiner can normally be reached on Monday - Friday, 8:30am - 5:00pm, EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached on (571) 272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAAD AHMAD ABDULLAH/Examiner, Art Unit 2431
/LYNN D FEILD/Supervisory Patent Examiner, Art Unit 2431
Prosecution Insights