Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Claims 1-11 are pending.
Response to Arguments
Applicant's arguments filed 6/11/2026 have been fully considered but they are not persuasive.
Applicant’s remarks (p. 5, regarding objections to the claims) are persuasive.
Applicant’s remarks (pp. 5-6, regarding rejections under 35 U.S.C. 112) suggest that the claim language is supported by description of sufficient structure with respect to the §112(f) interpretation. Specifically, Applicant asserts that the claimed “unit” is circuitry. The specification describes the cores as circuitry (specification, p. 6, line 10), but is silent regarding the specific units. However, even in the case where the specification points to circuitry, the specification not provide specific hardware or detailed steps such that a skilled artisan could determine the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. Therefore, the Examiner respectfully submits that the rejection should be maintained.
Applicant’s remarks (p. 6, regarding rejections under 35 U.S.C. 112 antecedent basis) are persuasive.
Applicant’s remarks (pp. 7-8) suggest that Sethumadhavan uses an existing process identifier and fails to show that the identifier is assigned by task scheduling units and stored in a memory. The Examiner disagrees. To the extend require by the claims, Sethumadhavan discloses recording the PID (¶64), indicating that the PID is assigned to the task to be monitored by the inventive system. The Examiner respectfully submits that a skilled artisan would reasonably consider the recording of the PID to read on “assigning”. Further, it is noted that the claim language does not require a specific form of “origin or generation of that identifier”, as discussed in the remarks. Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Applicant’s remarks (p. 8) suggest that “Sethumadhavan fails to show or suggest the claimed cooperation between the task scheduling units and the collection unit; namely, the scheduling units assign and store the task identifier, while the collection unit reads that identifier from the first memory unit and forms associations between hardware-block solicitations and the corresponding task identifier”. However, Sethumadhavan teaches that the system (AV engine) comprises the performance sampling unit and performance counter running on the hardware device being monitored (¶49, ¶65). The hardware system assigns process IDs (¶64) and samples micro-architectural metrics (¶¶65-66). Therefore, the Examiner respectfully submits that the reference shows cooperation between the task scheduling units and the collection unit, where a scheduling unit assigns and stores the task identifier and a collection unit reads that identifier from the first memory unit and forms associations between hardware-block solicitations and the corresponding task identifier, to the extent required by the claim language.
Applicant’s remarks (p. 8) suggest that Sethumadhavan determines whether a process is malicious or abnormal based on microarchitectural data, which is different than the claimed determination of the operating state of the computer, in particular, detecting an attack exploiting hardware vulnerabilities at the processor level. The Examiner respectfully disagrees. Sethumadhavan discloses protection against side-channel attacks, which are a processor-level hardware vulnerability (¶45, ¶47, ¶114). The system aims to detect side-channel attacks on a cache, as shared on-chip caches can leak data (¶115), which reveals malicious processes/exploits (¶6). Therefore, the Examiner respectfully submits that the rejection should be maintained.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “task scheduler unit” (set of task scheduler units, the task scheduler set scheduling…) and “monitoring unit” (“monitoring unit determining…”) in claim 1.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim limitation “unit” (“task scheduler unit” (set of task scheduler units, the task scheduler set scheduling…) and “monitoring unit” (“monitoring unit determining…”) in claim 1) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. The specification discloses “task scheduler unit” and “monitoring unit”, but does not provide specific hardware or detailed steps such that a skilled artisan could determine the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. Therefore, the claim is indefinite and is rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph. Claims 2-10 inherit the deficiency.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-3, 5 and 8-11 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by US 2016/0275288 A1 (Sethumadhavan et al.).
Regarding claim 1, Sethumadhavan discloses a system for monitoring operation of a computer, the computer (system 200, ¶49; Fig. 2) comprising hardware blocks (monitoring system that includes different cores, ¶64) comprising a plurality of cores (¶64), and a set of task scheduling units (processor-device comprises multiple cores, ¶64, ¶67; each process comprises a process ID (PID), ¶64) scheduling execution of a task by assigning it an identifier (processor-device comprises multiple cores, ¶64, ¶67; each process comprises a process ID (PID), ¶64), and storing the identifier on a first memory storage unit (process ID recorded to enable associating/correlating the micro-architectural data with the process whose execution resulted in the obtained micro-architectural data, ¶64), the system comprising: a collection unit (micro-architectural performance counters and sampling unit, ¶63) counting a number of queries of each hardware block during execution of a task (the sampling unit 212 may be configured to obtain hardware micro-architectural data (including micro-architectural performance counter data) from the counters of the hardware monitored through data push procedures and/or through data pull procedures, ¶49; hardware-based controller devices include hardware-related performance counters that may be configured to count a variety of events such as cycles, instructions, cache misses, ¶50; micro-architectural data is stored in a database, ¶68), reading the identifier of the executed task in the first memory storage unit, forming an association between a query and the corresponding identifier, and storing each association formed on a second memory storage unit (system is configured for maintaining processes' PID's along with obtained micro-architectural data may enable tracking the behavior of processes as they switch execution to different hardware devices, ¶64); and a monitoring unit determining a state of operation of the computer by detecting an attack exploiting hardware vulnerabilities at the processor level (protection against side-channel attacks, which are a processor-level hardware vulnerability, ¶114; side-channel attacks on a cache, shared on-chip caches can leak tremendous amounts of data, ¶115; inventive system aims to detect malicious processes/exploits, ¶6) based on the stored associations (AV engine 210, including sampling unit used to obtain time-based data of the output of the various hardware performance counters (and/or other output points) monitored for one or more processes, ¶64; the AV engine 210, may be configured to iteratively analyze training input data and the input data's corresponding output ( e.g., a determination of a process type and/or identification of a process corresponding to the input data), ¶69).
Regarding claim 11, the claim is similar in scope to claim 1 and is therefore rejected using a similar rationale.
Regarding claim 2, Sethumadhavan disclose wherein each task is a software task (detection of anomalous program execution processes, ¶44; ¶64) and said collection unit is a physical component (hardware-based micro-architectural data (e.g., data from hardware performance counters) such as processor load density data, ¶47).
Regarding claim 3, Sethumadhavan discloses wherein a hardware block is a main memory (system comprises a hardware block in the form of main memory, ¶95) shared by the cores (monitoring system that includes different cores, ¶64), with the first memory storage unit forming part of the main memory (database 214 is realized, at least in part on the hardware device being monitored, ¶67; AV engine can be configured for allocating one of a processor-device's multiple general purpose cores to execute a software realization of the database 214; a skilled artisan would understand that software executing on the system utilizes main memory1).
Regarding claim 5, Sethumadhavan discloses wherein the first memory storage unit (performance counter) is a memory unit (sampling unit 212 is configured to obtain hardware micro-architectural data/counter data stored in the counters through data push procedures and/or through data pull procedures, ¶63) that is specific to a core (a system being monitored includes multiple processor cores (each with its own set of performance counters), ¶64).
Regarding claim 8, Sethumadhavan discloses wherein each core comprises a performance measurement unit (performance counter, ¶64), the memory unit specific to a core being contained within the performance measurement unit (the system being monitored includes multiple processor cores (each with its own set of performance counters that store performance data), ¶64; the sampling unit 212 may be configured to obtain hardware micro-architectural data (including micro-architectural performance counter data) from the counters of the hardware monitored through data push procedures and/or through data pull procedures, ¶63).
Regarding claim 9, Sethumadhavan discloses wherein each core comprises a performance measurement unit (performance counter; a system being monitored includes multiple processor cores (each with its own set of performance counters), ¶64), said collection unit (sampling unit) being formed by the entire set of performance measurement units (the sampling unit 212 may be configured to obtain hardware micro-architectural data (including micro-architectural performance counter data) from the counters of the hardware monitored through data push procedures and/or through data pull procedures, ¶63).
Regarding claim 10, Sethumadhavan discloses wherein the first memory storage unit (performance counter; a system being monitored includes multiple processor cores (each with its own set of performance counters), ¶64) is distinct from the second memory storage unit (sampling unit; the sampling unit 212 may be configured to obtain hardware micro-architectural data (including micro-architectural performance counter data) from the counters of the hardware monitored through data push procedures and/or through data pull procedures, ¶63).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Sethumadhavan, as applied to claim 1, in view of “A secure exception mode for fault-attack-resistant processing” (Yuce et al.).
Regarding claim 4, Sethumadhavan lacks wherein a hardware block is a debug support unit shared by the cores, with the first memory storage unit forming part of the debug support unit. However, Yuce teaches that it was known to monitor for fault and side-channel attacks (§1, ¶1; §5.3) by monitoring a processor’s operation (p. 391, §3, ¶2) using a debug support unit (§5.3.1; see also §5.3.2, ¶2). Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify wherein a hardware block is a debug support unit shared by the cores, with the memory storage unit forming part of the debug support unit. One of ordinary skill in the art would have been motivated to perform such a modification to utilize a known mechanism (such as for the LEON3 core, Yuce, §5.3.2) to enable monitoring of the processor’s performance, as taught by Yuce.
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Sethumadhavan, as applied to claim 5, in view of US 2014/0040553 A1 (Liang et al.).
Regarding claim 6, Sethumadhavan lacks wherein each core comprises a tightly coupled memory unit, the memory unit specific to a core being the tightly coupled memory unit. However, Liang, in an analogous art (multi-core processing), teaches that it was known for processor cores to utilize tightly-coupled memory (TCM) as low-latency memory that provides a processing core with fast access to data without the unpredictably of other types of memory cache (¶24). Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify Sethumadhavan such that each core comprises a tightly coupled memory unit, the memory unit specific to a core being the tightly coupled memory unit. One of ordinary skill in the art would have been motivated to perform such a modification to utilize low-latency memory that provides a processing core with fast access to data, as taught by Liang.
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Sethumadhavan, as applied to claim 5, in view of US 2011/0179255 A1 (Pathirane et al.).
Regarding claim 7, Sethumadhavan lacks wherein each core comprises a memory management unit, the memory management unit specific to a core being located within the memory management unit. However, Pathirane teaches that it was known to provide a processing core with a memory management unit to control access to its memory (¶43). Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify Sethumadhavan such that each core comprises a memory management unit, the memory management unit specific to a core being located with the memory management unit. One of ordinary skill in the art would have been motivated to perform such a modification to utilize a known architecture to provide a processing core access to memory, as taught by Pathirane.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
“Anomaly detection in real-time multi-threaded processes using hardware performance counters” (Krishnamurthy, Prashanth, Ramesh Karri, and Farshad Khorrami) is cited for teaching using hardware performance counters to count events such as number of instructions retired, number of branches taken, and other low-level processor events of executing applications (§1) and including detecting unexpected changes in a target process (p. 667).
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL J SIMITOSKI whose telephone number is (571)272-3841. The examiner can normally be reached Monday - Friday, 7:00-3:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Michael Simitoski/ Primary Examiner, Art Unit 2493
August 13, 2026
1 For example, “WHISPER: A tool for run-time detection of side-channel attacks” (Mushtaq, Maria, et al.) teaches detecting side-channel attacks (p. 83875, §3) using machine learning (p. 83876, §IV) using a multi-hardware block system (p. 83876, Figure 1) using a shared memory architecture (pp. 83876-83877, IV-A).
Prosecution Insights