DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant submits, on page 10, that the cited reference Crabtree fails to disclose, teach or suggest "determine, in real-time, that a first software application is one of: being loaded, being installed, or has been installed" and "in response to determining, in real-time, that the first software application is one of: being loaded, being installed, or has been installed, identify one or more software components that are associated with the first software application" as claimed.
Respectively, the Examiner disagrees with the above remarks and the distinctions between Crabtree and the claimed invention. Crabtree discloses in real-time, that a first software application is one of: being loaded, being installed, or has been installed in para. [0151] In various aspects, external services 37 may comprise web-enabled services or functionality related to or installed on the hardware device itself. For example, in one aspect where client applications 24 are implemented on a smartphone or other electronic device, client applications 24 may obtain information stored in a server system 32 in the cloud or on an external service 37 deployed on one or more of a particular enterprise's or user's premises where in par. [0137] an advanced cyber decision platform may monitor all information about a network 1801, including deployed software versions to maintain an up-to-date model of the network in real-time. Crabtree also discloses in response to determining, in real-time, that the first software application is one of: being loaded, being installed, or has been installed, identify one or more software components that are associated with the first software application as claimed in para. [0031] and [0032] receive the component identifier for the one or more software components; search one or more databases to identify a source of each software component; search one or more databases to identify a vulnerability of each software component; send the component identifier, source, and vulnerability for each of the one or more software components to a cyber-physical graph engine where send the component identifier, source, and vulnerability for each of the one or more software components to a cyber-physical graph engine corresponds to components that are associated with the first software.
Applicant further submits, on page 11, the cited references also fail to disclose, teach or suggest "wherein the software application is an Artificial Intelligence (AI) algorithm and wherein the current supply chain data comprises real-time supply chain data that comprises at least one of: AI algorithm input prompt data, real-time output data from the AI algorithm and real-time prompt filter data" as recited in claims 3, 12 and 19. Thus, the features of claims 3, 12 and 19 are further distinctions over the cited references.
Applicant’s arguments with respect to amended claim 3 limitations, wherein the first software application is an Artificial Intelligence (AI) algorithm and wherein the current supply chain data comprises real-time supply chain data that comprises at least one of: AI algorithm input prompt data, real-time output data from the AI algorithm, real-time AI algorithm weight data, and real-time prompt filter data, have been considered moot in light of the newly found prior art Evans et al. (US Pub. No. 20240169300 A1), which discloses the currently amended claim limitations. Please see detailed rejection below.
Respectively, Claim 12 recites similar limitations as claim 3, therefore, is rejected based on the same rational as claim 3.
Respectively, Claim 19 is directed to claim 1 that recites similar limitations as claim 19 and is being rejected based on the same rational as claim 1.
The Applicant amended Claims 1-3, 5, 6, 10-12, 14, 15, 19 and 20. No claims have been added or canceled. No new matter has been added by these amendments.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1, 2, 10, 11, and 19 is/are rejected under 35 U.S.C. 102(a)(1) and 102(a)(2) as being anticipated by Crabtree et al. (Pub. No. US 2022/0232040 A1) (hereinafter Crabtree).
Regarding Claim 1(Currently Amended), Crabtree teaches A system, comprising:
a microprocessor; and (Crabtree par. [0032] “a system ”); (par. [0143] “CPU 12 may include one or more processors 13 such as, for example, a processor from one of the Intel, ARM, Qualcomm, and AMD families of microprocessors.”)
a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that, when executed by the microprocessor, cause the microprocessor to: (Crabtree par. [0032] “According to a preferred embodiment, a system for analyzing the cybersecurity threat of software applications from the software supply chain is disclosed, comprising: a computing device comprising a memory and a processor; a software analyzer comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:”)
determine, in real-time, that a first software application is one of: (Crabtree par. [0032] “receive a software application for analysis;”); ([0067] “The system and method comprising analyzing the code and/or operation of a software application to determine components comprising the software”); (par. [0151] “In various aspects, external services 37 may comprise web-enabled services or functionality related to or installed on the hardware device itself. For example, in one aspect where client applications 24 are implemented on a smartphone or other electronic device, client applications 24 may obtain information stored in a server system 32 in the cloud or on an external service 37 deployed on one or more of a particular enterprise's or user's premises.” where in par. [0137] an advanced cyber decision platform may monitor all information about a network 1801, including deployed software versions to maintain an up-to-date model of the network in real-time) (par. [0137] “This information is incorporated into a CPG 1802 to maintain an up-to-date model of the network in real-time.”)
in response to determining, in real-time, that the first software application is one of: (Crabtree par. [0031] “The system and method comprising analyzing the code and/or operation of a software application(e.g. first software application) to determine components comprising the software, identifying the source of such components, determining vulnerabilities associated with those components, compiling a list of such components, creating a directed graph of relationships between the components and their sources, and evaluating the overall threat associated with the software application based its software supply chain vulnerabilities.”
Crabtree par. [0032] “receive a software application(e.g. first software application) for analysis; identify one or more software components comprising the software application(e.g. first software application) and send a component identifier for each software component identified to a reconnaissance engine; a reconnaissance engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to: receive the component identifier for the one or more software components; search one or more databases to identify a source of each software component; search one or more databases to identify a vulnerability of each software component; send the component identifier, source, and vulnerability for each of the one or more software components to a cyber-physical graph engine(where send the component identifier, source, and vulnerability for each of the one or more software components to a cyber-physical graph engine corresponds to components that are associated with the first software);”)
generate current supply chain data, wherein the current supply chain data is associated with the first software application and the identified one or more software components associated with the first software application; and (Crabtree par. [0032] “…receive the component identifier, source, and vulnerability for each of the one or more software components; and construct a cyber-physical graph of a software supply chain for the software application, the cyber-physical graph comprising nodes representing the source and vulnerability of each software component of the software application and edges representing the relationships between the nodes;”)
process the current supply chain data to identify one or more vulnerabilities in the first software application and/or the identified one or more software components associated with the first software application. (par.[0032] “a scoring engine comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to: run one or more graph-processing algorithms on the cyber-physical graph to determine one or more paths of vulnerability in the software supply chain and a probability of occurrence for each path; and generate a cybersecurity score for the software application based on the vulnerabilities in the software supply chain.”); ([0033] “identifying one or more software components comprising the software application;”)
Regarding Claim 10(Currently Amended), claim 10 is a (Crabtree par. [0031] “ a system and method for comprehensive cybersecurity threat assessment of software applications based on the totality of vulnerabilities from all levels of the software supply chain.”)
Regarding Claim 19(Currently Amended), claim 19 is directed to claim 1 that recites similar limitations as claim 19 and is being rejected based on the same rational as claim 1 above. Moreover, a non-transient computer readable medium having stored thereon instructions that cause a processor to execute a method, the method comprising instructions to, is thought on (Crabtree par. [0148] “Because such information and program instructions may be employed to implement one or more systems or methods described herein, at least some network device aspects may include non-transitory machine-readable storage media, which, for example, may be configured or designed to store program instructions, state information, and the like for performing various operations described herein.”)
Regarding Claim 2(Currently Amended), Crabtree teaches The system of claim 1, wherein the identified one or more software components associated with the first software application comprises one or more of: an operating system, a hypervisor, a container, a virtual machine, a library, (Crabtree [0032] [0032] “According to a preferred embodiment, a system for analyzing the cybersecurity threat of software applications(i.e. first software application) from the software supply chain is disclosed, comprising: a computing device comprising a memory and a processor; a software analyzer(e.g. software component) comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to: receive a software application for analysis; identify one or more software components comprising the software application; and send a component identifier for each software component identified to a reconnaissance engine;”) In this embodiment, the software analyzer 2100 comprises a software definition portal 2110, a source code analyzer 2120, a compiler 2130, a compiled code analyzer 2140, and one or more database resources 2150”(where open source libraries are contained in database resources 2150 Fig. 21 par. [0103].) The software definition portal 2110 receives either uncompiled, human-readable source code 2111, or compiled machine-readable binary code 2112 to define the software component of the system under test.
Regarding Claim 11(Currently Amended), claim 11 is the method of claim 10 that recites similar limitations as claim 2, therefore, is rejected based on the same rational as claim 2 outlined above.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 3, 4, 12, 13, 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Crabtree et al. (Pub. No. US 2022/0232040 A1) (hereinafter Crabtree) in view of Evans et al. (US Pub. No. 20240169300 A1)(hereinafter Evans).
Regarding Claim 3(Currently Amended), Crabtree teaches The system of claim 1, outlined above.
While Crabtree discloses predictive statistics functions and machine learning algorithms to allow future trends and outcomes to be rapidly forecast based upon the current system [0081], however, Crabtree fails to explicitly teach wherein the first software application is an Artificial Intelligence (AI) algorithm and wherein the current supply chain data comprises real-time supply chain data that comprises at least one of: AI algorithm input prompt data, real-time output data from the AI algorithm,
However, Evans teaches wherein the first software application is an Artificial Intelligence (AI) algorithm and wherein the current supply chain data comprises real-time supply chain data that comprises at least one of: AI algorithm input prompt data, real-time output data from the AI algorithm, (Evans [0034]“ The core of the supply chain optimizer 150 is presented in greater detail in reference to FIG. 2. The enterprise data systems 170 from various third-party entities who are seeking supply chain optimization (commonly referred to as “clients” or “customers”) provides information regarding the client's existing supply chain to the optimizer 150. This data is initially provided to the data management module 220 for ingestion. The data provided from the enterprise data system(s) 170 is in an unusable form for the downstream optimization module 230. Generally, each client has different outputs of their supply chain data based upon the backend system (or systems) they employ, and due to personalization and customizations to the data format and content. This creates a significant hurdle for the supply chain optimizer 150 ultimate usage of the client's data. The data management module 220 solves these issues through complicated AI-driven data ingestion techniques. The Data Management Module 220 configures connections to data from customer enterprise data systems (EDS) and receives these data in both asynchronous processes (batch data import) and synchronous processes (ongoing/live data feeds).”) (Evans [0036] “The optimization module 230 performs the heavy lifting of the optimization process. It consumes the cleansed, formatted and aggregated data from the data management module 220 and performs the optimization of the supply chain, leveraging AI/ML models, subject to specific constraints. These constraints, models, and other parameters are stored in a parameter and model archive 250. As the models are developed, implemented, and feedback is received—the models may be trained on said feedback. The updated models are then stored, typically in a versioned manner, back in the parameter and model archive 250 for subsequent usage.”)
(Evans [0037] “Output of the optimization module 230 is generally fed to the user feedback module 240 for presentation of the results, and importantly, pushing the recommendations to the enterprise data system 170 of relevance for implementation of the recommendations through a recommendation module 280. The recommendation module 280 may filter results of various hypothetical scenarios that have been optimized for (discussed in significant detail below) and identify scenarios that have statistically significant impact upon service levels, costs, or risks (e.g., freshness of product, reduced stockout risk, etc.). For the purposes of this disclosure, ‘statistically significant’ may refer to a change in the values above 10%, or above 0.2 standard deviations. In contrast, ‘roughly statistically significant’ may be above 5% and 0.1 standard deviations.”)([0038] “This results in a feedback loop, where the resulting impacts of the adopted recommendations are fed back into the system, and the models may be refined based upon the actual impacts measured (vs the modeled/expected impacts). With improved models, and changes in conditions, the process repeats with optimization and output.”)([0039] “In addition to pushing the recommendations to the client, the user feedback model 240 is able to provide analysis of the actual impacts of the supply chain (e.g., cost, service levels, inventory levels per node, changeover events, etc.) versus what is expected based upon the optimized parameters. This enables the client to visualize and react to the optimized conditions, and in some embodiments, engage in modulating possible parameters in order to analyze the possible impacts.”)([0040] “Input from a user via the feedback module 240 may be fed into a hypothetical scenario module 270 which consumes the query by the user for a “what-if” scenario and converts the query into a set of optimization parameters. These parameters are fed into the optimization module 230 for processing to generate outputs regarding the ‘best’ supply chain configurations for the given hypothetical scenario. These outputs are again fed to the user feedback module for presentation to the user, and generation of possible recommendations by the recommendation module 280.”) ([0041] “FIG. 3 provides a more detailed illustration of the hypothetical scenario module 270. Initially a query is received from the feedback module 240. This query may be an alteration of specific optimization inputs or may include a natural language query. For example, a user could select to increase the weight of a carbon cost by 3 times (alteration of the specific optimization input), or could ask the system “what if we increased the cost of carbon emissions by 300 percent?” (a natural language query). Although not illustrated, the what-if input module 310 may include a natural language (NL) processing unit that consumes such NL queries and converts them into specific optimization objectives. Many NL processing techniques are known in the art, and as such, for the sake of brevity, such systems will not be discussed in great detail herein. Suffice it to say, the query may be tokenized, specific named entities that correspond to optimization inputs are identified, and the change indicated by the surrounding language are applied to the optimization input for the what-if scenario.”)([0042] “The query then undergoes three stages of analysis to generate an optimization parameter set. These include defining the variables of the optimization in the variable definer 320, refining the scope of the optimization at the scope refiner 330, and while not directly related to the optimization itself, the presentation definer 340 may take input from the user to provide the display of the resulting optimization. In alternate embodiments, the presentation definer 340 may take the results of the what-if optimization and determine which presentations are best suited for the results.”)([0073] “Future Performance Predictor 450 is a cornerstone of the Orchestrated Intelligent Optimization Module 230 in which future performance of the supply chain for each fixed set of operational parameters is predicted for the supply chain defined in Supply Chain Attributes Definition Module 440. In this module, each fixed set of operational parameters can be viewed as in input feature vector to the prediction module, and the predicted performances for all input feature vectors are then both archived and passed to Optimized Parameters and Sensitivities Computation Module 460 in order to perform constrained optimization on the entire system and to arrive at recommended operational parameters.”)([0107] “When limitations on supply chain resources are in effect (for example, when insufficient raw materials are available to make enough product to satisfy predicted demand) then optimization in Optimized Parameters and Sensitivities Computation Module 460 must incorporate Channel Saliency values to determine how to allocate products to specific channels. The results of this optimization can be parameterized as traditional supply chain planning parameters (for example safety stock and reorder amount) or they can be operated as a real time product routing system, in which the system directly computes and recommends movements of materials through the supply chain in order to satisfy constantly changing constraints in availability of resources, products and materials with simultaneously changing transportation performance and channel demand levels.”)
Crabtree and Evans are analogues in that they are both in the same field of supply chain analysis. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Crabtree to incorporate the teachings of Evans wherein the first software application is an Artificial Intelligence (AI) algorithm and wherein the current supply chain data comprises real-time supply chain data that comprises at least one of: AI algorithm input prompt data, real-time output data from the AI algorithm, real-time channel-sensitive optimization approach. [0106] Evans
Regarding Claim 12(Currently Amended), claim 12 is the method of claim 10 that recites similar limitations as claim 3, therefore, is rejected based on the same rational as claim 3 outlined above.
Regarding Claim 20(Currently Amended), claim 20 is directed to The non-transient computer readable medium of claim 19, that recites similar limitation as claim 3 and is being rejected based on the same rational as claim 3 above. Moreover, non-transient computer readable medium is thought on par. [0148] Crabtree.
Regarding Claim 4(Original), Crabtree in view of Evans teaches The system of claim 3, outlined above.
Crabtree teaches wherein the microprocess readable and executable instructions further cause the microprocessor to: generate, in real-time, based at least on the real-time supply chain data, a real-time vulnerability score; and (Crabtree [0033] “generating a cybersecurity score for the software application based on the vulnerabilities in the software supply chain.”); (Crabtree [0137] “FIG. 17 “Network is monitored in real-time” and FIG. 18 “According to the aspect, an advanced cyber decision platform may monitor all information about a network 1801, including (but not limited to) device telemetry data, log files, connections and network events, deployed software versions, or contextual user activity information. This information is incorporated into a CPG 1802 to maintain an up-to-date model of the network in real-time.
generate, for display in a user interface, the real-time vulnerability score. (Crabtree [0033] “generating a cybersecurity score for the software application based on the vulnerabilities in the software supply chain.”);([0080] “Client access to the system 105 for specific data entry, system control and for interaction with system output such as automated predictive decision making and planning and alternate pathway simulations, occurs through the system's distributed, extensible high bandwidth cloud interface 110 which uses a versatile, robust web application driven interface for both input and display of client-facing information via network 107 and operates a data store 112.”)
Regarding Claim 13(Original), claim 12 is the method of claim 12 that recites similar limitations as claim 4, therefore, is rejected based on the same rational as claim 4 outlined above.
Claim(s) 5, 6, 9, 14, 15, 18, is/are rejected under 35 U.S.C. 103 as being unpatentable over Crabtree et al. (Pub. No. US 2022/0232040 A1) (hereinafter Crabtree) in view of Devarakonda et al. (US 11,694,142 B2).
Regarding Claim 5(Currently Amended), Crabtree teaches The system of claim 1, outlined above.
Crabtree fails to explicitly teach wherein the first software application is an Artificial Intelligence (AI) algorithm and wherein the identified one or more software components associated with the AI algorithm comprises one or more of: an operating system, a hypervisor, a container, a virtual machine, a library, an output application, an Integrated Development Environment (IDE), a compiler, an installer, an interpreter, tuning AI algorithm, a training set filter, an obfuscator, a modification AI algorithm, an initial training set, a fine-tuning training set.
However, Devarakonda teaches wherein the first software application is an Artificial Intelligence (AI) algorithm and wherein the identified one or more software components associated with the AI algorithm comprises one or more of: an operating system, a hypervisor, a container, a virtual machine, a library, an output application, an Integrated Development Environment (IDE), a compiler, an installer, an interpreter, (Devarakonda Col. 8 Ln. 37-38 “The machine-learning algorithms of the machine-learning (ML) application…”); (Col. 11 Ln. 24-30 “With the supply chain training data 304 and the identified features 302, the machine-learning application 218 (e.g., model) is trained by machine-learning application trainer 224. The machine-learning application 218 appraises the value of the features 302 as they correlate to the supply chain training data 304. The result of the training is the machine-learning application 218.”)(227 The software architecture 2804 includes layers such as an operating system 2812, libraries 2810, frameworks 2808, and applications 2806.)
Crabtree and Devarakonda are analogues in that they are both in the same field of supply chain analysis. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Crabtree to incorporate the teachings of Devarakonda wherein the first software application is an Artificial Intelligence (AI) algorithm and wherein the identified one or more software components associated with the AI algorithm comprises one or more of: an operating system, a hypervisor, a container, a virtual machine, a library, an output application, an Integrated Development Environment (IDE), a compiler, an installer, an interpreter, an input application, an input filter, an AI filter algorithm, a vulnerability filter, a weight changing AI algorithm, weights used by the AI algorithm, a backpropagation AI algorithm, a fine-tuning AI algorithm, a training set filter, an obfuscator, a modification AI algorithm, an initial training set, a fine-tuning training set. Doing so would aid by identifying a predicted value impact as the highest predicted value impact from a set of predicted value impacts each associated with an action recommendation for a product in the supply chain. Col. 15 Ln. 29-32 Devarakonda
Regarding Claim 14(Currently Amended), claim 14 is the method of claim 10 that recites similar limitations as claim 5, therefore, is rejected based on the same rational as claim 5 outlined above.
Regarding Claim 6(Currently Amended), Crabtree in view of Devarakonda teaches The system of claim 5, outlined above.
Crabtree fails to explicitly teach wherein the identified one or more software components associated with the AI algorithm comprises at least one of:
However, Devarakonda teaches wherein the identified one or more software components associated with the AI algorithm comprises at least one of: (Devarakonda Col. 11 Ln. 31-33 “When the machine-learning (ML) application 218 is used to perform an assessment, supply chain data 306 is provided as an input to the machine-learning (ML) application 218 and the machine-learning (ML) application 218 generates the assessment 308 as output to the application data model database 226. Note that the supply chain data 306 is different from the supply chain training data 304 and that the supply chain data 306 may be captured in real-time as the supply chain is functioning. Note also that the supply chain data 306 may be utilized as a source of supply chain training data 304.”)
Crabtree and Devarakonda are analogues in that they are both in the same field of supply chain analysis. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Crabtree to incorporate the teachings of Devarakonda wherein the identified one or more software components associated with the AI algorithm comprises at least one of: the input application, the input filter, the AI filter algorithm, the vulnerability filter, the weight changing AI algorithm, the weights used by the AI algorithm, the backpropagation AI algorithm, the fine-tuning AI algorithm, the training set filter, the obfuscator, the modification AI algorithm, the initial training set, the fine-tuning training set, a final training set, and a final fine tuning training set. Doing so would aid to find correlations among the identified features that affect the outcome or assessment. Col. 11 Ln. 16-18 Devarakonda
Regarding Claim 15(Currently Amended), claim 15 is the method of claim 14 that recites similar limitations as claim 6, therefore, is rejected based on the same rational as claim 6 outlined above.
Regarding Claim 9(Original), Crabtree teaches The system of claim 1, outlined above.
Crabtree fails to teach wherein generating the current supply chain data comprises getting real-time supply chain data, getting internal non-real-time supply chain data, and getting external non-real-time supply chain data.
However, Devarakonda teaches wherein generating the current supply chain data comprises getting real-time supply chain data, getting internal non-real-time supply chain data, and getting external non-real-time supply chain data. (Devarakonda Col. 9 Ln. 42-44 “…the supply chain training data 304 may include observed supply chain operational metrics observed in the supply chain 100 and operational plans.”); (Col. 11 Ln. 37-39 “the supply chain data 306 may be captured in real-time as the supply chain is functioning.”); (Col. 12 Ln. 19-21) The supply chain data 306 may be received from various external data sources 202, such as those described above with reference to FIG. 2.”)
Crabtree and Devarakonda are analogues in that they are both in the same field of supply chain analysis. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Crabtree to incorporate the teachings of Devarakonda wherein generating the current supply chain data comprises getting real-time supply chain data, getting internal non-real-time supply chain data, and getting external non-real-time supply chain data. Doing so would aid in resources and recommend prescriptive action for planners in a fast-moving supply chain. Col. 12 Ln. 10-11 Devarakonda
Regarding Claim 18(Original), claim 18 is the method of claim 10 that recites similar limitations as claim 9, therefore, is rejected based on the same rational as claim 9 outlined above.
Claim(s) 7, 8, 16, 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Crabtree et al. (Pub. No. US 2022/0232040 A1) (hereinafter Crabtree) in view of Singh (US 11,816,221 B2).
Regarding Claim 7(Original), Crabtree teaches The system of claim 1, outlined above.
Crabtree fails to teach wherein the microprocess readable and executable instructions further cause the microprocessor to: generate, for display, in a user interface, the identified one or more vulnerabilities, in the first software application and/or the identified one or more software components associated with the first software application.
However, Singh teaches wherein the microprocess readable and executable instructions further cause the microprocessor to: generate, for display, in a user interface, the identified one or more vulnerabilities, in the first software application and/or the identified one or more software components associated with the first software application. (Singh par. [0063] “The microprocessor may also be configured to execute an editing controller application. The editing controller application may include instructions to, following the identifying of the one or more vulnerabilities, mark each identified vulnerability on the display.”); (par. [0066] “The editing controller application may be further configured to display to the user the selected vulnerability based on the received input of the selected edit-option.”)
Crabtree and Singh are analogues in that they are both in the same field of vulnerabilities analysis. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Crabtree to incorporate the teachings of Singh wherein the microprocess readable and executable instructions further cause the microprocessor to: generate, for display, in a user interface, the identified one or more vulnerabilities, in the first software application and/or the identified one or more software components associated with the first software application. Doing so would aid in allowing the input received to be shared and may further be combined and generated as one vulnerability report file. [0067] Singh
Regarding Claim 16(Original), claim 16 is the method of claim 10 that recites similar limitations as claim 7, therefore, is rejected based on the same rational as claim 7 outlined above.
Regarding Claim 8(Original), Crabtree in view of Singh teach The system of claim 7, outlined above.
Crabtree fails to teach wherein the identified one or more vulnerabilities in the first software application and/or the identified one or more software components associated with the first software application can be individually selected by a user to view code associated with the identified one or more vulnerabilities, in the first software application and/or the identified one or more software components associated with the first software application.
However, Singh teaches wherein the identified one or more vulnerabilities in the first software application and/or the identified one or more software components associated with the first software application can be individually selected by a user to view code associated with the identified one or more vulnerabilities, in the first software application and/or the identified one or more software components associated with the first software application. (Singh [0109] “FIG. 3 may display a diagram of a source code vulnerability identification system 300. System 300 may include a UI screen 302, smart glasses 304 and a display 314 that is viewed via the smart glasses 304.”); ([0066] “The editing controller application may be configured to display to a user of the smart glasses device, on the display, a selection of edit-options. The selection may include highlighting, inserting a comment, cross-outs, underline and any other relevant editing tools. The sensors may identify the input of a selected edit-options and the processor may be configured receive the input. The input received may be specific to a selected vulnerability with the scanned application source code. The editing controller application may be further configured to display to the user the selected vulnerability based on the received input of the selected edit-option.”)
Crabtree and Singh are analogues in that they are both in the same field of vulnerabilities analysis. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Crabtree to incorporate the teachings of Singh wherein the identified one or more vulnerabilities in the first software application and/or the identified one or more software components associated with the first software application can be individually selected by a user to view code associated with the identified one or more vulnerabilities, in the first software application and/or the identified one or more software components associated with the first software application. Doing so would aid in identifying of the one or more vulnerabilities, mark each identified vulnerability on the display. [0063] Singh
Regarding Claim 17(Original), claim 17 is the method of claim 16 that recites similar limitations as claim 8, therefore, is rejected based on the same rational as claim 8 outlined above.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MALA BOYD whose telephone number is (571)272-6450. The examiner can normally be reached M-F 7:30-4:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni A. Shiferaw can be reached at (571)272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MALA BOYD/Examiner, Art Unit 2497 /BASSAM A NOAMAN/Primary Examiner, Art Unit 2497
