DETAILED ACTION
Claims 1-20 are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Choi et al. (US PG Pub No. 2022/0327219 A1) in view of Filachek et al. (US PG Pub No. 2017/0371712 A1).
Regarding claim 1, Choi teaches a method for assigning attribution data to an application by utilizing one or more processors along with allocated memory, the method comprising:
implementing a set of custom instrumentation probes to collect data ([0009], wherein “Certain aspects and features of the present disclosure relate to techniques for generating a time-ordered event data stream that includes kernel-level events captured across different types of computing devices, for example, within an industrial control system”);
instrumenting the system at an operating system level based on implementing an instrumentation probe from said set of custom instrumentation probes ([0009], wherein “detecting kernel-level events in the kernel space of an operating system running on a computing device and transmitting the kernel-level events to a remote server using the user space of the operating system”);
receiving a subset of operating system, network, and application events data corresponding to a system in connection with the set of custom instrumentation probes ([0011], wherein “an events' data may be generated and collected; the events may or may not be filtered using a monitoring condition, the detected kernel-level event may be timestamped, the detected kernel-level event may be encapsulated into a log or a message and transmitted to the user space, and/or certain network data related to the first or second type of computing devices may be collected”)
Choi does not teach generating a chain of responsibility process tree based on instrumenting the system at the operating system level and the collected data; mapping corresponding operating system level process to a direct or indirect parent process that is assigned as an entry point for a logical application among a plurality of logical applications by implementing the chain of responsibility process tree; and assigning, in response to mapping, attribution data to the logical application.
Filachek teaches generating a process tree based on collected data ([0005], wherein a hierarchical process group is created where a parent process spawns child processes), mapping an OS-level process to parent/entry point ([0005], wherein a group identifier is assigned to a parent process (“entry point”) and all child processes spawned from that parent inherent the group identifier), and assigning attribution data to the application ([0006-7], wherein a container is created to store resource usage of the entire hierarchical process group and the group identifier is used to collectively attribute resource consumption to the logical application). The use of the term “chain of responsibility” is viewed by the Examiner as a descriptive term for the for the sequential mapping of child to parent processes already disclosed in Filachek.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the OS-level instrumentations probes of Choi with the process tree attribution mapping of Filachek. One would be motivated to combine these teachings because Choi teaches the mechanism for high-fidelity data collection, while Filachek provides the logic for organizing that data into meaningful application-level attribution. The combination of these known techniques would allow a user to accurately attribute system resources to a logical application regardless of how many subprocesses the application spawns.
Regarding claim 2, Filachek teaches wherein each of said logical applications has different and organizationally unrelated owners and implements dependent processes that carry out operation on behalf of a corresponding owner (Fig 2, wherein each container implements different and organizationally unrelated owners and implements dependent processes that carry out operation on behalf of a corresponding owner).
Regarding claim 3, Filachek teaches wherein the attribution data corresponds to data that identifies an owner of the logical application in a way this is unique to each administration domain ([0014]; [0019-20]).
Regarding claim 4, Filachek teaches when it is determined that a new process is scheduled, the method further comprising: retrieving a tag for a parent process from the chain of responsibility process tree; storing the tag indexed by the new process along with a tag identifier onto a memory; and utilizing the tag identifier by accessing the memory to identify a corresponding application and determining what the system is processing ([0026-27]).
Regarding claim 5, Choi teaches further comprising: detecting a behavior by monitoring the chain of responsibility process tree so that the behavior can be ascribed to a specific party responsible for the behavior; and attributing any file access, network communication, and/or system call to the logical application that is responsible for the behavior ([0036])
Regarding claim 6, Choi teaches further comprising identifying applications among the logical applications that are using cryptography ([0005-6]); automatically instrumenting the identified applications at the operating system level based on implementing the instrumentation probe from said set of custom instrumentation probes; and automatically monitoring activities of the identified applications ([0009]).
Regarding claim 7, Choi teaches further comprising: implementing configurable filtering to reduce amount of data collected that need to be sent for off system processing ([0011]).
Regarding claims 8-20, they are the system and medium claims of claims 1-7 above. Therefore, they are rejected for the same reasons as claims 1-7 above.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ERIC C WAI whose telephone number is (571)270-1012. The examiner can normally be reached Monday - Friday 9-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Aimee Li can be reached at (571) 272-4169. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Eric C Wai/Primary Examiner, Art Unit 2195
Prosecution Insights