CTNF 18/756,017 CTNF 88083 DETAILED ACTION Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Claims 1-12 are pending in this office action. Claim Rejections - 35 USC § 103 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-21-aia AIA Claim s 1-12 are rejected under 35 U.S.C. 103 as being unpatentable over Maekawa et al US 20210117550A1 in view of Chari et al US20210133324A1 As per claim 1, Maekawa discloses an information processing apparatus comprising: at least one memory storing instructions, and at least one processor configured to execute the instructions to: [0130] “Note that a part or all of the above-described processing procedure is executed by hardware such as a digital signal processor (DSP) or an application specific integrated circuit (ASIC). However, according to the present embodiment, the case where the CPU executes the program according to the program in the ROM has been described”; specify an operation target resource to be operated by the function: [0006]“a variable analysis unit configured to analyze the single route information from the start position to the attack determination position, and derives actual value range information that limits a value range of an actual value from information of a branch condition and a branch result in the program information ”; [0006]“A vulnerability analyzer that evaluates whether a vulnerability of information security exists in an evaluation target program according to some embodiments, includes a single route derivation unit configured to derive single route information that maintains each process of program information in order of processing , the single route information being route information from an attack determination position where determination of existence of vulnerability of the program information is made to a start position of the program information, the single route information being information of a route derived by dividing with a branch in the program information ”: and narrow down, based on the content of the operation of the function on the operation target resource, analysis target parts on which a process flow analysis is performed from the function call parts: [0089] “The variable extraction unit 241 determines whether or not the position indicated by the attack determination position of the attack point information is reached when the single route information is being analyzed . When reaching the location indicated by the attack determination position, the variable extraction unit 241 outputs, to the notification unit 243, an attack point arrival notification indicating the fact of the attack point arrival, and specification information for specifying the single route information under analysis as a notification G”. wherein the inspection target program includes variable definition processing for defining a variable indicating the operation target resource: [0074]“In step S503, the variable analysis unit 240 analyzes the single route information and recognizes the description of the declaration of the variable or the like included in the single route information”; and the at least one processor specifies the operation target resource indicated by the variable defined in the variable definition processing: [0082] In step S507, when reaching a place indicated by the attack determination position information while analyzing the single route information , the variable analysis unit 240 notifies the vulnerability existence determination unit 230 of the fact of reaching the attack point and information for identifying the single route information being analyzed. The notification of the fact of reaching the attack point and the information for identifying the single route information being analyzed may be referred to as notification G. But not explicitly: extract function call parts each indicating a part of an inspection target program from which a function is called: Chari discloses: extract function call parts each indicating a part of an inspection target program from which a function is called: [0069] “Indeed, the differences between call graphs produced from just two runs of the application program may evidence control or data flow anomalies . By applying fuzzers or other tools, by leverage unit testing, and other such known techniques, the mining process ensures that the code is fully exercised so that the “normal” traces of call graphs are obtained. [0070] Using supervised clustering, a training classifier, or the like, the resulting call graphs generated during these multiple traces are clustered so that the system can learn which input options/parameters yield which sub-graphs, etc . Thus, step 406 as shown determines runtime data flow edges and paths, and control flow edges and paths, as well as potentially sensitive flows”; It would have obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to combine the teachings of cited references. One of ordinary skill in the art before the effective filling date of the claimed invention would have been motivated to incorporate the teachings of Chari into teachings of Maekawa for detecting anomalous behavior of an application program. Cloud computing can significantly reduce information technology costs and complexities while improving workload optimization and service delivery. The method also generally improve computing functioning by providing provisioning, detection, monitoring and analysis of attacks as they occur in computing systems more efficiently and without the significant overhead.[Chari 0079]. Asper claim 2, the rejection of claim 1 is incorporated and furthermore Maekawa discloses: wherein the at least one processor extracts the function call parts based on a registration function list in which a function that may perform a sensitive operation on a system including the inspection target program if performed improperly and a function for acquiring an external input are registered in advance. [0093]” At this time, one virtual address area is allocated before and after the area on the virtual memory map . Records of virtual addresses left before and after the allocated area on the virtual memory map are allocated with null flag information. By allocating the virtual addresses before and after the reserved virtual address with the null flag to be recognizable, when there is an access to a virtual address that deviates from the virtual address associated with the variable or the like, the determination of the deviated virtual address can be made .”; Asper claim 3, the rejection of claim 1 is incorporated and furthermore Maekawa discloses: wherein the at least one processor specifies the operation target resource based on an argument information list in which an argument number indicating the operation target resource is defined for each of the functions and a corresponding resource list indicating the type of the resource that corresponds to the function used in the variable definition processing: [0111] “When the variable or the like according to the present embodiment is a variable, a variable table is used as the variable-or-the-like table . The variable table has a record having a variable name of a variable, a head virtual address, and a variable type. Further, in the virtual memory map, the same amount of memory area amount as the variable type is secured. In FIG. 7B, since the variable name of the variable is “cData” and the type of the variable is “char”, the memory area amount of 1 byte is secured. When the variable name of the variable is “cData” and the head virtual address is “0x0001”, null flags are set to the virtual addresses “0x0000” and “0x0002”; Asper claim 4, the rejection of claim 1 is incorporated and furthermore Maekawa discloses: wherein the at least one processor narrows down the analysis target parts using a narrowing rule regarding the content of the operation of the function on the operation target resource: [0133] However, in the vulnerability analyzer 1000 according to the present embodiment, since the vulnerability is confirmed for the route between the attack determination position and the start position, this allows to exclude the route on the flow including the program processing of an evaluation target that does not need to be confirmed . As a result, an efficient vulnerability evaluation means without a great waste of calculation resources and calculation time can be provided” [0161]“In other words, an efficient analysis means can be provided since the analysis can be performed as excluding a route that does not reach the attack determination position and does not need to be confirmed”. Asper claim 5, the rejection of claim 4 is incorporated and furthermore Maekawa discloses: wherein the narrowing rule includes at least one of a rule for making the function call parts the target of the process flow analysis or a rule for excluding the function call parts from the target of the process flow analysis: [0161]“In other words, an efficient analysis means can be provided since the analysis can be performed as excluding a route that does not reach the attack determination position and does not need to be confirmed”. Asper claim 6, the rejection of claim 1 is incorporated and furthermore Maekawa discloses: wherein the at least one processor narrows down the analysis target parts further based on resource identification information for identifying the operation target resource [0008]“The input variable information may be variable information including a variable which is used by the evaluation target program to maintain information input from outside of the program, and the variable information may be information including a variable, a direct address value in a memory, a union, a structure, and an array”; Asper claim 7, the rejection of claim 6 is incorporated and furthermore Maekawa does not explicitly disclose: wherein the at least one processor narrows down the analysis target parts in accordance with a level of confidentiality of the operation target resource indicated by the resource identification information. Chari discloses: wherein the at least one processor narrows down the analysis target parts in accordance with a level of confidentiality of the operation target resource indicated by the resource identification information: [0063]“As will be seen, such training leads to development of a baseline “provenance” graph, which is evaluated to determine “sensitive” control or data flows for the application in its “normal” operation. This basic process is then enhanced by analyzing log data collected during runtime execution of the application program against one or more security , compliance or other policies to assign a set of confidence values to the control and data flows that are depicted in the baseline provenance graph”; It would have obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to combine the teachings of cited references. One of ordinary skill in the art before the effective filling date of the claimed invention would have been motivated to incorporate the teachings of Chari into teachings of Maekawa for detecting anomalous behavior of an application program. Cloud computing can significantly reduce information technology costs and complexities while improving workload optimization and service delivery. The method also generally improve computing functioning by providing provisioning, detection, monitoring and analysis of attacks as they occur in computing systems more efficiently and without the significant overhead.[Chari 0079]. Asper claim 8, the rejection of claim 1 is incorporated and furthermore Maekawa discloses: wherein the at least one processor further performs an analysis on a process flow having the analysis target part narrowed down in the narrowing of the analysis target parts as a starting point or an end point [0061] “FIG. 2 illustrates an example of the single route derivation unit 100 . The single route derivation unit 100 has function to read program information, analyze the program information, generate all pieces of single route information, which is a route from an attack determination position to a start position and is a route that is derived by being divided by branches in the program information, and maintain the information”; Asper claim 9, the rejection of claim 1 is incorporated and furthermore Maekawa discloses: wherein the at least one processor: further perform an analysis on a process flow having the function call part extracted in the extraction of the function call part as a starting point or an end point: [0061] “analyze the program information, generate all pieces of single route information, which is a route from an attack determination position to a start position and is a route that is derived by being divided by branches in the program information, and maintain the information”; [0160] The program information of the vulnerability analyzer 1000 according to an eighth aspect of the disclosure is information including a processing logic and a procedure of a function realized by a program including a program source code or a control flow graph”; specify a process flow that may include a fraudulent function: [0083] Through the notification G, the vulnerability existence determination unit 230 can recognize that the process has reached a position where the vulnerability can be determined in the program flow in the single route information. Further, the vulnerability existence determination unit 230 can recognize that the preparation for determining the vulnerability has been completed in the single route information. and narrow down the analysis target parts from the function call parts further based on the process flow that may include the fraudulent function. [0133]”However, in the vulnerability analyzer 1000 according to the present embodiment, since the vulnerability is confirmed for the route between the attack determination position and the start position, this allows to exclude the route on the flow including the program processing of an evaluation target that does not need to be confirmed. As a result, an efficient vulnerability evaluation means without a great waste of calculation resources and calculation time can be provided”; Asper claim 10, the rejection of claim 8 is incorporated and furthermore Maekawa discloses: wherein the at least one processor further notifies the user of a result of the analysis. [0101]“ The single route information specification information, the limited input actual value information , and the fact that vulnerability exists , which are included in the notification G notified from the variable analysis unit 240 , are output as the analysis result regarding the single route information ”; Claim 11 is the method claim corresponding to apparatus claim 1 and rejected under the same rational set forth in connection with the rejection of claim 1 above. Claim 12 is the non-transitory computer readable medium claim corresponding to apparatus claim 1 and rejected under the same rational set forth in connection with the rejection of claim 1 above. Pertinent arts : US20230185568A1: a special purpose computer system in which indirect function call target identifier in data processing system enables accurate identification of indirect function call targets for improved fuzz testing, vulnerability detection, and exploitation discovery to increase security of software. US20210089400A1: The processor is further configured to execute one or more program instructions associated with an application, reach control flow transfer for the one or more program instructions, unwind a call stack associated with the one or more program instructions in response to a failure to meet a target control flow, identify an offending function call, and rewrite the offending function call. The rewritten function call includes a memory operation boundary check. Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRAHIM BOURZIK whose telephone number is (571)270-7155. The examiner can normally be reached Monday-Friday (8-4:30). Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Wei Y Mui can be reached at 571-270-2738. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /BRAHIM BOURZIK/Examiner, Art Unit 2191 /WEI Y MUI/Supervisory Patent Examiner, Art Unit 2191 Application/Control Number: 18/756,017 Page 2 Art Unit: 2191 Application/Control Number: 18/756,017 Page 3 Art Unit: 2191 Application/Control Number: 18/756,017 Page 4 Art Unit: 2191 Application/Control Number: 18/756,017 Page 5 Art Unit: 2191 Application/Control Number: 18/756,017 Page 6 Art Unit: 2191 Application/Control Number: 18/756,017 Page 7 Art Unit: 2191 Application/Control Number: 18/756,017 Page 8 Art Unit: 2191 Application/Control Number: 18/756,017 Page 9 Art Unit: 2191 Application/Control Number: 18/756,017 Page 10 Art Unit: 2191 Application/Control Number: 18/756,017 Page 11 Art Unit: 2191 Application/Control Number: 18/756,017 Page 12 Art Unit: 2191
Prosecution Insights