DETAILED ACTION
Response to Amendment
Claims 1-11 are pending.
Response to Arguments
Applicants’ arguments filed 05/18/2026 have been fully considered.
Regarding the rejection of claim 1 under 35 U.S.C. 103 as being unpatentable over Su et al. (CN111783100A) in view of Zhou et al. (CN116361788A) and Crabtree et al. (US20220210200A1), Applicants argue on pages 8-9 that the cited art does not adequately disclose "generating, by
the client computing device, a graph representation of the input source code using the plurality of tokens and the embeddings for each token, wherein the code graph representation, wherein the graph representation comprises an aggregation of sequential flow edges, control flow edges, data flow edges, and poacher flow edges, wherein the poacher flow edges denote data processing vulnerabilities, access control vulnerabilities, and resource management vulnerabilities existing in an external computing environment of the computing device," wherein the generated graph representation is used to identify
code vulnerabilities in an input source code.”
Applicants’ arguments are persuasive. In view of the amended claim language and after further search and consideration, claim 1 is rejected under 35 U.S.C. 103 as being unpatentable over Olson et al. (US20210056211A1) in view of Su and Crabtree as discussed in the rejection below.
As to any argument not specifically addressed, they are the same as those discussed above.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 4, 6-7, 9, 11-12 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Olson et al. (US20210056211A1) in view of Su et al. (CN111783100A) and Crabtree et al. (US20220210200A1).
Regarding claim 1, Olson discloses a method for detecting code vulnerability attacks on a computing device, comprising ([Abstract] shows a method for (of) automatically detecting a security vulnerability in a source code using a machine learning model):
converting, by a client computing device [user device] using a transformer encoder model, an input source code to a plurality of tokens (para [0077] shows the machine learning model optionally comprises a deep neural network architecture, which is used in the nature language processing, called a transformer; para [0097] shows the natural language processing comprises a Byte Pair Encoding (BPE); para [0102] shows using a machine learning (ML) model to perform a ML based analysis on an abstract syntax tree (AST) for detecting a first security vulnerability over a static source code; para [0103] shows flattening the abstract syntax tree (AST) into a sequence of structured tokens, wherein the sequence of structured tokens comprises a semantic structure and a syntactic structure of the source code),
generating, by the client computing device using the transformer encoder model, embeddings for each token of the input source code (para [0078] shows the machine learning model to learn a deep, distributed representation of function-level ASTs along with a learned embedding of AST tokens);
generating, by the client computing device, a graph representation of the input source code using the plurality of tokens and the embeddings for each token (para [0092] shows generating a call graph by integrating the abstract syntax tree (AST) with a control and a dataflow of the source code, wherein the call graph represents calling relationships between subroutines in a computer program),
wherein the graph representation comprises vulnerabilities existing in an external computing environment [client device 106] of the computing device [user device] (Fig 1 and para [0126] shows the system 102 receives an input from the client device 106 through a network 104. The input comprises a source code from a codebase of the client device 106; para [0110] shows the system is communicatively connected a user device for providing the final security vulnerability to a user.)
Olson fails to teach:
the graph representation comprises an aggregation of sequential flow edges, control flow edges, data flow edges, and poacher flow edges, wherein the poacher flow edges denote data processing vulnerabilities, access control vulnerabilities, and resource management vulnerabilities existing in an external computing environment of the computing device; and
executing, by a client computing device, a Graph Convolutional Neural Network (GCN) model;
analyzing, by the GCN model, the graph representation of the input source code and identifying, by the GCN model, any irregularities or patterns in edges of the graph representation that indicate one or more code vulnerabilities of the input source code that could be used to exploit vulnerabilities of the computing device, wherein the edges include at least one poacher flow edge; and
outputting insights and suggested actions, by the GCN model, to a user or system administrator to remediate the vulnerabilities.
However Su, in an analogous art ([Abstract] shows a source code vulnerability detection method for code graph representation learning based on a graph convolution network; [page 5 lines 17-18] shows this method uses abstract syntax tree (AST) as the backbone to explicitly encode the control dependence and data dependence of the program) discloses:
the graph representation comprises an aggregation of sequential flow edges [program dependence], control flow edges, data flow edges, and poacher flow edges [flows related to the vulnerability] ([page 2 lines 23-24] shows all nodes in the function are traversed to obtain the graph structure information of the control flow, the program dependence and the function call related to the vulnerability; [page 4 lines 58-68] shows deep learning models convert various intermediate representations of code into a tiled one-dimensional sequence, and then the automatically learned code vulnerability features are used to train a machine learning classifier for vulnerability detection; Code Property Graph (CPG) is a joint representation of program syntax, control flow and data flow. It combines control flow graphs and program dependency graphs; [page 6 line 6] shows there is no limit to the number of nodes and edges of graph data; [page 12 lines 60-62] shows this method is more suitable for complex vulnerability codes due to serialization), wherein
the poacher flow edges denote data processing vulnerabilities, access control vulnerabilities, and resource management vulnerabilities ([page 2 lines 23-24] shows all nodes in the function are traversed to obtain the graph structure information of the control flow, the program dependence and the function call related to the vulnerability; [page 5 lines 35-37] shows the graph structure information related to the vulnerability of cross-function calling; [page 12 lines 48-49] shows the vulnerability contained in the source file will also cause illegal memory access); and
executing, by a client computing device, a Graph Convolutional Neural Network (GCN) model (page 12 lines 56-63] shows the graph convolutional neural network is more suitable for complex vulnerability codes);
analyzing, by the GCN model, the graph representation of the input source code and identifying, by the GCN model, any irregularities or patterns in edges of the graph representation that indicate one or more code vulnerabilities of the input source code that could be used to exploit vulnerabilities of the computing device, wherein the edges include at least one poacher flow edge ([Abstract] shows extracting graph structure information related to the vulnerability; learning a vector representation for each node using a graph convolution network; [page 4 lines 71-72] shows the vulnerability detection method uses graph database query statements to traverse the code attribute graph, and uses pattern matching to find software vulnerability that conform to a certain pattern).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Olson with the teaching of Su in order to make full use of and learn the structure and attribute information of the vulnerability code, avoid the problems that the traditional deep network is easy to lose code structure information when representing and learning the code and lose long code context information because the code needs to be represented into a fixed length sequence, and is beneficial to reducing false alarm and false negative alarm of vulnerability detection (Su; [Abstract]).
Olson-Su as combined fails to teach outputting insights and suggested actions, by the GCN model, to a user or system administrator to remediate the vulnerabilities.
However, Crabtree discloses outputting insights and suggested actions to a user or system administrator to remediate the vulnerabilities (para [0071] shows vulnerabilities in software; para [0115] shows security appliances 361 to continuously probe existing network infrastructure and issue alerts to any changes which may make a breach more likely 364, suggest solutions to any weaknesses detected 365.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Olson-Su with the teaching of Crabtree in order to thwart or mitigate damage from cyber-attacks (Crabtree; para [0115]).
Regarding claim 2, Olson-Su-Crabtree as applied to claim 1 discloses the GCN model is trained on a dataset of code samples and vulnerabilities to detect code vulnerabilities on the computing device (Olson; para [0105] shows pre-training the machine learning model using an unlabeled source code as an input to predict a subsequent sub-token in the sequence of structured tokens, and training the machine learning model on a labeled source code to predict a presence or an absence of the first security vulnerability.)
Regarding claim 4, Olson-Su-Crabtree as applied to claim 1 discloses the GCN model is configured to continuously monitor the input source code running on the computing device and provide real-time feedback to the user or system administrator about potential vulnerabilities (Olson; [Abstract] shows detecting a security vulnerability in a source code using a machine learning model. Crabtree; para [0115] shows security appliances 361 to continuously probe existing network infrastructure and issue alerts to any changes which may make a breach more likely 364, suggest solutions to any domain controller ticketing weaknesses detected 365.)
Regarding claims 6-7 and 9, claims 6-7 and 9 are directed to a system. The system claims 6-7 and 9 require limitations that are similar to those recited in the method claims 1-2 and 4 to carry out the method steps. And since the references of Olson-Su-Crabtree combined teach the method including limitations required to carry out the method steps, therefore claims 6-7 and 9 would have also been obvious in view of the structures disclosed in Olson-Su-Crabtree combined.
Furthermore, Olson-Su-Crabtree as combined discloses at least one processor of a client computing device; and memory configured to communicate with the at least one processor, wherein the memory stores instructions that, in response to execution by the at least one processor, cause the at least one processor to perform operations (Olson; para [0032-0034]).
Regarding claims 11-12 and 14, claims 11-12 and 14 are directed to a computer readable medium. Claims 11-14 require limitations that are similar to those recited in the method claims 1-2 and 4 to carry out the method steps. And since the references of Olson-Su-Crabtree combined teach the method including limitations required to carry out the method steps, therefore claims 11-12 and 14 would have also been obvious in view of the structures disclosed in Olson-Su-Crabtree combined.
Furthermore, Olson-Su-Crabtree as combined discloses a computer readable medium comprising machine readable instructions executed by a processor of a client computing devices (Olson; para [0032-0034]).
Claims 3, 8 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Olson in view of Su and Crabtree, further in view of Fu et al. (US20240184570A1) and Zhou et al. (CN116361788A).
Regarding claims 3, 8 and 13, Olson-Su-Crabtree as applied to claims 1, 6 and 11 fails to teach the transformer encoder model utilizes a pre-trained RoBERTa-based language model to encode text data and to capture relationships between entities in the input source code.
However, Fu discloses the transformer encoder model utilizes a pre-trained language model to encode text data and to capture relationships between entities in the input source code ([Abstract] shows a neural transformer model predicts a code review given a proposed source code change; para [0001] shows the source code is often inspected to discover errors, to ensure that the source code complies with best practice standards and to discover vulnerabilities; para [0032] shows the neural encoder transformer model is trained through contrastive learning; para [0033] shows the pre-training engine 110 receives each pre-training sample of each pre-training dataset and transforms each pre-training sample into an input embedding sequence that is input into the neural encoder; para [0041] shows the model is trained to learn the relationships between the edits made in a changed code, as presented in the code diff format, and a code review comment.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Olson-Su-Crabtree with the teaching of Fu in order to automate the generation of a code review comment given a proposed source code change (Fu; para [0004]).
Olson-Su-Crabtree-Fu as combined fails to teach a pre-trained RoBERTa-based language mode.
However, Zhou discloses a RoBERTa-based language model ([Abstract] shows a software vulnerability prediction method based on machine learning; [page 3 line 69] shows extracting assembly language semantic features based on the RoBERTa model; [page 5 lines 43-44] shows using the GCN to process the structural features of the program).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Olson-Su-Crabtree-Fu with the teaching of Zhou in order to first extract language semantic features based on the RoBERTa model, then use the GCN to process the structural features of the program (Zhou; [page 3 line 69; page 5 lines 43-44]).
Claims 5, 10 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Olson in view of Su and Crabtree, further in view of Wang et al. (CN113609488A).
Regarding claims 5, 10 and 15, Olson-Su-Crabtree as applied to claims 1, 6 and 11 fails to teach the GCN model utilizes a self-supervised learning algorithm to train the model on a dataset of code samples and vulnerabilities.
However, Wang discloses the model utilizes a self-supervised learning algorithm to train the model on a dataset of code samples and vulnerabilities ([Abstract] shows self-supervised learning which has better interpretability and vulnerability detection effect.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Olson-Su-Crabtree with the teaching of Wang in order to have better interpretability and vulnerability detection effect (Wang; [Abstract]).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TAN DOAN whose telephone number is (571)270-0162. The examiner can normally be reached Monday - Friday 8am - 5pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar Louie can be reached at (571) 270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TAN DOAN/Primary Examiner, Art Unit 2445
Prosecution Insights