DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
1. This is a Final Office Action in response to applicant’s amendment filed on August 10, 2026. At this time, claims 1-3, 5, 10, 12-15 have been amended. Claims 16-20 have been cancelled. Claims 21-25 have been added. Therefore, claims 1-15 and 21-25 are pending and addressed below.
Response to Amendments
2. Applicant's amendment is sufficient to overcome the claim objection set forth for claims 1, 10, 13 and 15 in the previous office action.
As to Claims 1-15 and 21-25, Applicants’ amendment of independent Claims 1 and 22 with newly added feature “identify unmodified data fragments of the data object that are unmodified relative to the different versions of the data object; accumulate the modified data fragments into a buffer; decline to add the unmodified data fragments into the buffer; compute a measure based on data in the buffer, the data comprising a segment of the modified data fragments in the buffer “ [Claims 1-15 and 21-25] has necessitated a new ground(s) of rejection in this Office action. Therefore, Applicants’ arguments filed on 08/10/2026 have been fully considered but are moot in view of the new ground(s) of rejection because the arguments do not apply to any of the updated reference(s) being used in the current rejection.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 22, 24 are rejected under 35 U.S.C 103 as being unpatentable over Kharraz, NPL document, title “UNVEIL: a Large-Scale, Automated Approach to Detecting Ransomware “ in view of Amit, US 11349855 B1.
1. Kharraz discloses accumulate the modified data fragments into a buffer; (See Kharraz, pg 760; For every read and write request to a file captured in an I/O trace, UNVEIL computes the entropy of the corresponding data buffer by calculating H(d)= -∑in= 1 (Log2 n)/n. The data buffer is where file data fragment is stored in order to calculate the entropy.)
compute a measure based on a segment of the modified data fragments in the buffer; (See Kharraz, pg 760; The system uses Shannon entropy [30] for this computation. In particular, assuming a uniform random distribution of bytes in a data block d, we have H(d)= -∑in= 1 (Log2 n)/n
; Shannon entropy is the mathematical measure of data randomness)
and determine, based on the measure, whether the data object is a subject of an intermittent encryption attack. (See Kharraz, pg 760; Comparing the entropy of read and write requests to and from the same file offset serves as an excellent indicator of crypto ransomware behavior. We studied different file locker ransomware samples across different ransomware families. Our analysis shows that although these attacks can be very different in their attack strategies (e.g., evasion techniques, key generation, key management, connecting to C&C servers), they can be categorized into three main classes of attacks based on their access requests. See also pg 759: A crypto-style ransomware attack lists the victim’s files and aggressively encrypts any private files it discovers. Access is restricted by withholding the decryption key. Encryption keys can be generated locally by the malware on the victim’s computer, or remotely on C servers, and then delivered to the compromised computer. An attacker can use customized destructive functions, or Windows API functions to delete the original user’s files. The attacker can also overwrite files with the encrypted version,)
Kharraz does not appear to explicitly disclose A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to: identify modified data fragments of a data object that are modified relative to a different version of the data object; identify unmodified data fragments of the data object that are unmodified relative to the different versions of the data object;
decline to add the unmodified data fragments into the buffer;
However, Amit discloses a non-transitory machine-readable storage medium comprising instructions that upon execution cause a (See Amit, par [30]; In some examples, a non-transitory computer-readable medium is disclosed storing instructions that, when executed by a processor, cause the processor to perform any method of this disclosure.) system to: identify modified data fragments of a data object that are modified relative to a different version of the data object; (See Amit, col 19, lines 40-55; par.[ 89] FIG. 10 illustrates a procedure 2000 for detecting entropy or fuzzy hash irregularities according to an embodiment of the disclosure. Procedure 2000 utilizes either the VSS or the target file for this purpose. In step 2002 a write operation is received and is hooked in step 2004. The write operation indicates a change to a file. In step 2006, the requested change is captured from the operation (offset address). In step 2008 the address of the target file and section within the file for which the change is requested is determined from the write operation. According to one technic, in step 2010, the corresponding file within the VSS backup is determined and the corresponding section (corresponding to the change requested within the write operation) is extracted from the corresponding VSS file. If the reply to the next step, using exclusion procedure 2014 is “Y”, the operation is completed in step 2018. If the reply to the next step 2014, is “N”, the Write I/O operation is directed to Audit changes & context from original & changed file 2016 and only then, the operation is completed 2018)
identify unmodified data fragments of the data object that are unmodified relative to the different versions of the data object; (See Amit; par [91]; the changes from the VSS are provided to a content (entropy or fuzzy hash) unit 2010 and the changes from the original source file are provided to a content (entropy or fuzzy hash) unit 2012. Units 2010 & 2012 perform the comparison accordingly. The entropy and/or fuzzy hash are evaluated by units 2010 & 2012 relative to the current change, respectively, or to the entire file. The respective result of the entropy or fuzzy hash check is compared to a threshold internally implicit within the machine learning analyzer 1044. The evaluation also considers prior amendments made to the same file by the same operation issuing process (to account for a case where the changes were gradually made by several write operations). The evaluation result is conveyed to unit 2014, and the further actions depend upon the answer to unit 2014, as described above.)
decline to add the unmodified data fragments into the buffer; (See Amit; par (86). It should be noted that most recent ransomware avoid detection by encrypting only a portion of the file, thereby avoiding failure in an entropy test applied by some prior art protection programs. The system of the disclosure overcomes this limitation by isolating only those amended sections of the file and comparing them with only respective sections of the file before the amendment (while ignoring non-amended sections))
Kharraz and Amit are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz with the teaching of Amit to include modified data because it would have allowed to provide within said system capabilities to detect and terminate ransomware at its very early stage of operation.(See Amit, par [9 ]))
22. As to claim 22, the claim is rejected under the same rationale as claim 1. See the rejection of claim 1 above. a processor; (See Amit, par [30]; In some examples, a non-transitory computer-readable medium is disclosed storing instructions that, when executed by a processor, cause the processor to perform any method of this disclosure.) and a non-transitory storage medium comprising instructions executable on the processor to:(See Amit, par [30]; In some examples, a non-transitory computer-readable medium is disclosed storing instructions that, when executed by a processor, cause the processor to perform any method of this disclosure.)
24. The combination of Kharraz and Amit discloses the system of claim 22, wherein the measure is a first measure derived using a first encryption detection technique, (See Amit, par. [53]: (k) Entropy—calculate Entropy for changed data in the file (for text-oriented source files). Can be calculated with various algorithms of statistical distribution such as Chi-square (Chi{circumflex over ( )}2); ) and the instructions are executable on the processor to: compute a second measure based on the segment of the modified data fragments in the buffer using a second encryption detection technique different from the first encryption detection technique, (See Amit, par [91]; The changes from the VSS are provided to a content (entropy or fuzzy hash) unit 2010 and the changes from the original source file are provided to a content (entropy or fuzzy hash) unit 2012. Units 2010 & 2012 perform the comparison accordingly. The entropy and/or fuzzy hash are evaluated by units 2010 & 2012 relative to the current change, respectively, or to the entire file. The respective result of the entropy or fuzzy hash check is compared to a threshold internally implicit within the machine learning analyzer 1044. The evaluation also considers prior amendments made to the same file by the same operation issuing process (to account for a case where the changes were gradually made by several write operations). The evaluation result is conveyed to unit 2014, and the further actions depend upon the answer to unit 2014, as described above.) wherein the determining of whether the data object is the subject of the intermittent encryption attack is based on the first measure and the second measure. (See Amit, par [60]; the near real-time module 1040 repeatedly analyzes I/O Sequences (separately for each running process) the audit log 1042 to determine whether anomalies within the process exist. Upon completing each repetition, analyzer 1044 issues a risk score & context indicating the probability that the I/O sequence related to a process (within the log) is ransomware. It should be noted that the context and content analyzer evaluate the variety of audit log parameters and issues a global risk score & context at its output.) Kharraz and Amit are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz with the teaching of Amit to include modified data because it would have allowed to provide within said system capabilities to detect and terminate ransomware at its very early stage of operation.(See Amit, par [9 ]))
Claims 2- 3, 23 are rejected under 35 U.S.C 103 as being unpatentable over Kharraz, NPL document, title “UNVEIL: a Large-Scale, Automated Approach to Detecting Ransomware “in view of Amit, US 11349855 B1 in further view of Hittel, US 20200128027 A1.
2. The combination of Kharraz and Amit does not appear to explicitly disclose the non-transitory machine-readable storage medium of claim 1, wherein the buffer has a size greater than a size threshold, and wherein the instructions upon execution cause the system to: detect that modified data fragments have filled the buffer, wherein the computing of the measure is performed responsive to the modified data fragments filling the buffer. However, Hittel discloses wherein the buffer has a size greater than a size threshold, and wherein the instructions upon execution cause the system to: detect that modified data fragments have filled the buffer, wherein the computing of the measure is performed responsive to the modified data fragments filling the buffer. (See Hittel, [0065-0066]; The inspective agent 194 can also assemble the metadata and/or content properties for the files identified by the scanning from the file system lists, the file headers and the payloads. The assembled metadata and/or content properties of the files and/or contents that have been updated within the determined time frame can be identified as current metadata and current content properties. The current metadata and current content properties can be compared to the historical metadata and historical content properties to determine whether or not malware (e.g., malicious activity) is present on the cloud storage 142, 144. …. As an alternative to identifying a pattern of changes that exceeds a predetermined change velocity, a pattern/volume of changes that exceeds a predetermined change volume can be identified to determine whether or not malicious activity is in process. The predetermined change volume can be based on, for example, a number of files that have changes or a cumulative number of changes for each file and/or the entire group of files, where some types of changes have a higher impact on the pattern/volume of changes than other types of changes.)
Kharraz, Amit and Hittel are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz and Amit with the teaching of Hittel to include the volume threshold because it would have been used as a parameter to determine when malware attack occurs.
3.The combination of Kharraz and Amit does not appear to explicitly disclose the non-transitory machine-readable storage medium of claim 1, wherein the identifying of the modified data fragments of the data object that are modified relative to the different version of the data object comprises: comparing first values derived based on portions of the data object to respective second values based on portions of the different version of the data object. However, Hittel discloses wherein the identifying of the modified data fragments of the data object that are modified relative to the different version of the data object comprises: comparing first values derived based on portions of the data object to respective second values based on portions of the different version of the data object. (See Hittel, [0065-0066])) Kharraz, Amit and Hittel are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz and Amit with the teaching of Hittel to include the volume threshold because it would have been used as a parameter to determine when malware attack occurs.
23.The combination of Kharraz and Amit does not appear to explicitly disclose the system of claim 22, wherein the measure is computed based on the segment of the modified data fragments in the buffer within an encryption detection window of a specified size, and wherein the instructions are executable on the processor to: shift the encryption detection window across segments of the modified data fragments in the buffer; and compute respective measures based on the segments of the modified data fragments covered by the encryption detection window at different positions, wherein the determining of whether the data object is the subject of the intermittent encryption attack is based on the respective measures.
However, Hittel discloses shift the encryption detection window across segments of the modified data fragments in the buffer; (See Hittel, [0178] Entropy of Contents of a file or files can be a consideration. A certain level of entropy can indicate encryption and/or compression. For example, MIME files are generally in the 0.73-0.75 range of entropy. Well encrypted files are generally in the 0.97 and above range of entropy. Shannon entropy is a method of calculating entropy for files. Shannon entropy is on a scale of 0-8, which can be converted to the typical 0-1 scaly be simply dividing the Shannon entropy by 8. For example, Shannon entropy gives roshal archive (RAR) compression an entropy of 5.05 (0.6 on 0-1 scale), pretty good privacy (PGP) encryption an entropy of 7.8 (0.97 on 0-1 scale), and TrueCrypt an entropy of 7.99 (0.998 on 0-1 scale). Accordingly, an entropy threshold between simple compression and encryption can be implemented to identify files that have been unintentionally encrypted by ransomware. As an example a threshold, on the 0-1 scale, could be 0.8. If the cloud drive of a user's local drive uses a known (intentional) encryption technique, the system can be set to identify or ignore the intentionally encrypted files, so that they are not identified as attacked files based on entropy.
[0179] For example, if encryption is intentionally implemented, then ransomware calculations will need to be adjusted based on the average entropy of the encryption that is being used. There are various applications that will encrypt files before they are put into the cloud. Boxcryptor, for example, is a popular application for doing this. Windows uses Bitlocker and Mac uses Filevault. These encryption types should be able to be distinguished from ransomware encryption. ) and compute respective measures based on the segments of the modified data fragments covered by the encryption detection window at different positions, wherein the determining of whether the data object is the subject of the intermittent encryption attack is based on the respective measures. (See Hittel, [0127] Further, the agents can determine that the malicious activity is in process by comparing the calculated moving average of velocities of change (within, for example, the time-based window) to n-standard deviations of the moving average of velocities of change. The n- standard deviations can be calculated from the same time-based window as the moving average of velocities of change or they can be calculated from a longer or shorter time-based window, such that the time-based windows for determining the moving average of velocities of change and for determining the n-standard deviations are slightly or significantly different with respect to one another. For example, the time-based window for the moving average of velocity of change could be 10 days and the time-based window for calculating the n-standard deviations could be 1 day, or visa-versa. The n-standard deviations can be used to set upper and lower thresholds, so that a determination can be made that the malicious activity is in process when the thresholds are exceeded by, for example, the calculated moving average of velocities of change, or any other criteria described herein. These upper and lower thresholds can be calculated and implemented in a similar way as Bollinger bands, or any other variation thereof that would be clear to a person of skill in this field of endeavor. For example M-tops and W-bottoms can be derived from the Bollinger bands and can be implemented for identifying malicious activity.)
Kharraz, Amit and Hittel are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz and Amit with the teaching of Hittel to include the volume threshold because it would have been used as a parameter to determine when malware attack occurs.
Claims 4-9, and 14 are rejected under 35 U.S.C 103 as being unpatentable over Kharraz, NPL document, title “UNVEIL: a Large-Scale, Automated Approach to Detecting Ransomware “in view of Amit, US 11349855 B1 in further view of Hittel, US 20200128027 A1 in further view of Linnen, US 20190294507 A1.
4.The combination of Kharraz, AMIT and Hittel does not appear to explicitly disclose the non-transitory machine-readable storage medium of claim 3, wherein the instructions upon execution cause the system to: obtain the second values in parallel using a plurality of instances of a value calculator that calculates the second values based on the portions of the different version of the data object. However, Linnen discloses wherein the instructions upon execution cause the system to: obtain the second values in parallel using a plurality of instances of a value calculator that calculates the second values based on the portions of the different version of the data object. (See Linnen, [0039], [0039] In the example process of FIG. 3, a first entropy indicator is calculated at a first time for a collection of data in block 302. The entropy indicator indicates a level of entropy for the collection of data and may use, for example, at least one of a Shannon entropy, a chi-squared distribution, a histogram of values, and a Monte Carlo Pi approximation to calculate the entropy indicator for the collection of data. In some implementations, the output of such calculation methods may be scored or compared to different threshold values to provide the entropy indicator. [0042], [0042] In block 306, a second entropy indicator for the collection of data is calculated at a second time. The dashed line in FIG. 3 between blocks 304 and 306 can signify a break in the process from when the first entropy indicator was calculated at the first time. The recalculation of the entropy indicator at the second time can be for a current or later version of the collection of data, which may or may not have been modified since the calculation of the first entropy indicator at the first time. In this regard, the recalculation of the entropy indicator can be after a predetermined period of time, may be in response to the collection of data being modified, or may be in response to a request to back up the collection of data)
Kharraz, Amit, Hittel and Linnen are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz, Amit and Hittel with the teaching of Linnen to include a plurality of entropy values because it would have been used as a measure of randomness of data object.
5.The combination of Kharraz, Amit, Hittel and Linnen discloses the non-transitory machine-readable storage medium of claim 3, wherein the identifying of the data fragments of the data object that are modified relative to the different version of the data object comprises: deriving the first values based on data in a window of a specified size. (See Scaife, [0032-0039]; the entropy formula calculates the values based on size. See also Kharraz, pg 760)
Kharraz, Amit, Hittel and Linnen are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz, Amit and Hittel with the teaching of Linnen to include a plurality of entropy values because it would have been used as a measure of randomness of data object.
6. The combination of Kharraz, Amit, Hittel and Linnen discloses the non-transitory machine-readable storage medium of claim 5, wherein the window is a sliding window that is moved with respect to the data object to obtain the portions of the data object on which the first values are derived. (See Kharraz, pg 760: I/O Data Buffer entropy and constructing access patterns)
7. The combination of Kharraz, Amit, Hittel and Linnen discloses the non-transitory machine-readable storage medium of claim 3, wherein the first values comprise the portions of the data object. (See Scaife, [0032-0039] Another type of transformation indicator applicable to some embodiments is a similarity measurement of the file. A similarity measurement indicates the similarity of data in the file after modification to the data that was in the file before modification. Such meaningful changes to file data can be captured through the use of similarity-preserving hash functions [9, 14]. Similarity-preserving hash functions differ from traditional cryptographic hash functions because the hash (or “digest”) produced by the similarity-preserving hash function retains information about the source data. By comparing two “similarity digests,” one created before the file data was modified and one created after the file data was modified, it is possible to determine a similarity measurement that gauges the level of relatedness of the file data across versions of the file.) Kharraz, Amit, Hittel and Linnen are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz, Amit and Hittel with the teaching of Linnen to include a plurality of entropy values because it would have been used as a measure of randomness of data object.
8. The combination of Kharraz, Amit, Hittel and Linnen discloses the non-transitory machine-readable storage medium of claim 3, wherein the first values are derived based on applying a function on the portions of the data object. (See Kharraz, pg 760;the system uses Shannon entropy [30] for this computation. In particular, assuming a uniform random distribution of bytes in a data block d, we have H(d)= -∑in= 1 (Log2 n)/n For each execution, after UNVEIL generates I/O access traces for the sample, it sorts the I/O access requests based on file names and request timestamps. This allows the system to extract the I/O access sequence for each file in a given run, and check which processes accessed each file. The key idea is that after sorting the I/O access requests per file, repetition can be observed in the way I/O requests are generated on behalf of the malicious process. The particular detection criterion used by the system.)
9. The combination of Kharraz, Amit, Hittel and Linnen discloses the non-transitory machine-readable storage medium of claim 3, wherein the instructions upon execution cause the system to: identify a given data fragment of the data object as modified relative to a respective data fragment of the different version of the data object based on the comparing indicating that a first value derived based on a first portion of the data object is different from a second value corresponding to a respective portion of the different version of the data object. (See (See Amit, col 19, lines 40-55; par.[ 89] FIG. 10 illustrates a procedure 2000 for detecting entropy or fuzzy hash irregularities according to an embodiment of the disclosure. Procedure 2000 utilizes either the VSS or the target file for this purpose. In step 2002 a write operation is received and is hooked in step 2004. The write operation indicates a change to a file. In step 2006, the requested change is captured from the operation (offset address). In step 2008 the address of the target file and section within the file for which the change is requested is determined from the write operation. According to one technic, in step 2010, the corresponding file within the VSS backup is determined and the corresponding section (corresponding to the change requested within the write operation) is extracted from the corresponding VSS file. If the reply to the next step, using exclusion procedure 2014 is “Y”, the operation is completed in step 2018. If the reply to the next step 2014, is “N”, the Write I/O operation is directed to Audit changes & context from original & changed file 2016 and only then, the operation is completed 2018))
14. The combination of Kharraz, Amit and Hittel does not appear to explicitly disclose the non-transitory machine-readable storage medium of claim 1, wherein the measure is a first measure derived using a first encryption detection technique, and the instructions upon execution cause the system to: compute a second measure based on the segment of the modified data fragments in the buffer using a second encryption detection technique different from the first encryption detection technique, wherein the determining of whether the data object is the subject of the intermittent encryption attack is based on the first measure and the second measure. However, Linnen discloses wherein the measure is a first measure derived using a first encryption detection technique, and the instructions upon execution cause the system to: compute a second measure based on the segment of the modified data fragments in the buffer using a second encryption detection technique different from the first encryption detection technique, wherein the determining of whether the data object is the subject of the intermittent encryption attack is based on the first measure and the second measure. (See Linnen, [0039] and fig 3 In the example process of FIG. 3, a first entropy indicator is calculated at a first time for a collection of data in block 302. The entropy indicator indicates a level of entropy for the collection of data and may use, for example, at least one of a Shannon entropy, a chi-squared distribution, a histogram of values, and a Monte Carlo Pi approximation to calculate the entropy indicator for the collection of data. In some implementations, the output of such calculation methods may be scored or compared to different threshold values to provide the entropy indicator. [0042], [0042] In block 306, a second entropy indicator for the collection of data is calculated at a second time. The dashed line in FIG. 3 between blocks 304 and 306 can signify a break in the process from when the first entropy indicator was calculated at the first time. The recalculation of the entropy indicator at the second time can be for a current or later version of the collection of data, which may or may not have been modified since the calculation of the first entropy indicator at the first time. In this regard, the recalculation of the entropy indicator can be after a predetermined period of time, may be in response to the collection of data being modified, or may be in response to a request to back up the collection of data) Kharraz, Amit, Hittel and Linnen are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz, Amit and Hittel with the teaching of Linnen to include a plurality of entropy values because it would have been used as a measure of randomness of data object.
Claims 10- 13 are rejected under 35 U.S.C 103 as being unpatentable over Kharraz, NPL document, title “UNVEIL: a Large-Scale, Automated Approach to Detecting Ransomware “in view of Amit, US 11349855 B1 in further view of Patton, US 10229269 B1.
10. The combination of Kharraz and Amit does not appear to explicitly disclose the non-transitory machine-readable storage medium of claim 1, wherein the measure is computed based on the segment of the modified data fragments in the buffer within an encryption detection window of a specified size. However, Patton discloses wherein the measure is computed based on the segment of the modified data fragments in the buffer within an encryption detection window of a specified size. (See Patton, col 7, lines 58-67 to col 8, lines 1- 48; (28) FIG. 4 is a flowchart illustrating an example embodiment of a process for determining if an edited file is encrypted. The encryption analysis module 206 divides 402 at least a portion of the edited file into chunks of predefined size (e.g., 512 bytes). The encryption analysis module 206 similarly divides 404 at least a portion of the original file into chunks. Each chunk of the edited file corresponds to a chunk in the original file (e.g., first 512 bytes of the edited file corresponds to the first 512 bytes of the original file). The encryption analysis module 206 determines 406 which corresponding chunk pairs meet a modification threshold between the original file and the edited file. For example, the encryption analysis module 206 may do a byte-wise comparison between the bytes in each chunk pair, counting the number of differences in bytes between the chunk of the original file and the corresponding chunk of the edited file in the chunk pair. The encryption analysis module 206 then determines whether the number of differences exceeds the modification threshold (e.g., greater than 25% of the bytes are changed). The encryption analysis module 206 calculates 408 one or more entropy parameters representing an entropy measure associated with the file. Here, the encryption analysis module 206 may calculate one or more entropy values for each chunk of a chunk pair meeting the modification threshold. The one or more entropy values may be calculated according to one or more different types of entropy measures such as a Chi-Square entropy, Monte Carlo Pi entropy, and/or Shannon entropy. For each pair of entropy values, an entropy difference is then determined based on a difference between the respective entropies values of each type of each chunk in the chunk pair. For example, a difference of Chi-Square entropy values, a difference of Monte Carlo Pi entropy values, and a difference of Shannon entropy values may be calculated for each chunk pair. The differences may then be averaged across all chunk pairs in a file for each type of entropy measure to generate the entropy parameters. Thus, for a given file, the process may generate, for example, a Chi-Square entropy parameter, a Monte Carlo Pi entropy parameter, and a Shannon entropy parameter. The encryption analysis module 206 applies 410 a machine-learned model to the entropy parameters to detect encryption indicative of ransomware. In one embodiment, the encryption analysis module 206 generates additional parameters that are used together with the entropy parameters as inputs to the machine-learned model for detecting ransomware. Here, the encryption analysis module 206 applies a decision tree representing the machine-learned model to determine if the file has been encrypted. Inputs to the decision tree may include the entropy parameters, a compression percentage, a value indicating whether the new file size is a multiple of a predefined size, and whether the new file has a ransomware file header on a blacklist of known ransomware file headers. Here, the compression percentage represents a ratio size of the edited file to the size of the original file. Furthermore, detecting whether the file size of the new file is a multiple of a predefined size is useful to detect certain custom encryption techniques that are known to generate encrypted data of a particular size.) Kharraz, Amit and Patton are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz and Amit with the teaching of Patton to include a window size because it would have been used as a parameter in the calculation of entropy.
11. The combination of Kharraz, Amit and Patton discloses the non-transitory machine-readable storage medium of claim 10, wherein the encryption detection window has a size that is less than a size of the buffer. (See Patton, col 7, lines 58-67 to col 8, lines 1- 48 and fig 4)
Kharraz, Amit and Patton are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz and Amit with the teaching of Patton to include a window size because it would have been used as a parameter in the calculation of entropy.
12. The combination of Kharraz, Amit and Patton discloses the non-transitory machine-readable storage medium of claim 11, wherein the instructions upon execution cause the system to: shift the encryption detection window across segments of the modified data fragments in the buffer; (See Patton, col 7, lines 58-67 to col 8, lines 1- 48) and compute respective measures based on the segments covered of the modified data fragments by the encryption detection window at different positions, wherein the determining of whether the data object is the subject of the intermittent encryption attack is based on the respective measures. (See Patton, col 7, lines 58-67 to col 8, lines 1- 48; (28) FIG. 4 is a flowchart illustrating an example embodiment of a process for determining if an edited file is encrypted. The encryption analysis module 206 divides 402 at least a portion of the edited file into chunks of predefined size (e.g., 512 bytes). The encryption analysis module 206 similarly divides 404 at least a portion of the original file into chunks. Each chunk of the edited file corresponds to a chunk in the original file (e.g., first 512 bytes of the edited file corresponds to the first 512 bytes of the original file). The encryption analysis module 206 determines 406 which corresponding chunk pairs meet a modification threshold between the original file and the edited file. For example, the encryption analysis module 206 may do a byte-wise comparison between the bytes in each chunk pair, counting the number of differences in bytes between the chunk of the original file and the corresponding chunk of the edited file in the chunk pair. The encryption analysis module 206 then determines whether the number of differences exceeds the modification threshold (e.g., greater than 25% of the bytes are changed). The encryption analysis module 206 calculates 408 one or more entropy parameters representing an entropy measure associated with the file. Here, the encryption analysis module 206 may calculate one or more entropy values for each chunk of a chunk pair meeting the modification threshold. The one or more entropy values may be calculated according to one or more different types of entropy measures such as a Chi-Square entropy, Monte Carlo Pi entropy, and/or Shannon entropy. For each pair of entropy values, an entropy difference is then determined based on a difference between the respective entropies values of each type of each chunk in the chunk pair. For example, a difference of Chi-Square entropy values, a difference of Monte Carlo Pi entropy values, and a difference of Shannon entropy values may be calculated for each chunk pair. The differences may then be averaged across all chunk pairs in a file for each type of entropy measure to generate the entropy parameters. Thus, for a given file, the process may generate, for example, a Chi-Square entropy parameter, a Monte Carlo Pi entropy parameter, and a Shannon entropy parameter. The encryption analysis module 206 applies 410 a machine-learned model to the entropy parameters to detect encryption indicative of ransomware. In one embodiment, the encryption analysis module 206 generates additional parameters that are used together with the entropy parameters as inputs to the machine-learned model for detecting ransomware. Here, the encryption analysis module 206 applies a decision tree representing the machine-learned model to determine if the file has been encrypted. Inputs to the decision tree may include the entropy parameters, a compression percentage, a value indicating whether the new file size is a multiple of a predefined size, and whether the new file has a ransomware file header on a blacklist of known ransomware file headers. Here, the compression percentage represents a ratio size of the edited file to the size of the original file. Furthermore, detecting whether the file size of the new file is a multiple of a predefined size is useful to detect certain custom encryption techniques that are known to generate encrypted data of a particular size.) Kharraz, Amit and Patton are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz and Amit with the teaching of Patton to include a window size because it would have been used as a parameter in the calculation of entropy.
13. The combination of Kharraz, Amit and Patton discloses the non-transitory machine-readable storage medium of claim 12, wherein the instructions upon execution cause the system to: determine whether greater than a threshold amount of the data object based on processing the modified data fragments accumulated in the buffer is encrypted; (See Patton, col 7, lines 58-67 to col 8, lines 1- 48) and indicate that the data object is the subject of the intermittent encryption attack responsive to a determination that greater than the threshold amount of the data object is encrypted. (See Patton, col 7, lines 58-67 to col 8, lines 1- 48) Kharraz, Amit and Patton are analogous art because they are from the same field of endeavor which is ransomware detection. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Kharraz and Amit with the teaching of Patton to include a window size because it would have been used as a parameter in the calculation of entropy.
Allowable Subject Matter
The following is a statement of reasons for the indication of allowable subject matter: As to claim 15, Kharraz, NPL document, title “UNVEIL: a Large-Scale, Automated Approach to Detecting Ransomware “ in view of Amit, US 11349855 B1 discloses compute a measure based on the data fragments accumulated into the buffer; and determine, based on the measure, whether the data object is a subject of an intermittent encryption attack.
The prior arts do not disclose move a sliding window relative to a data object, identify data fragments of the data object that are modified relative to a different version of the data object based on performing a run that covers a plurality of consecutive positions of the sliding window, the plurality of consecutive positions of the sliding window comprising the sliding window at a first position in the run and the sliding window at a last position in the run; accumulate the data fragments into a buffer based on adding, to the buffer, data fragments covered by the sliding window at intermediate positions between the first position and the last position, and declining to add data fragments covered by the sliding window at the first position and the last position to the buffer.
Allowable Subject Matter
Claims 21 and 25 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Wojnowicz, US 20160292418 A1, title “ WAVELET DECOMPOSITION OF SOFTWARE ENTROPY TO IDENTIFY MALWARE. “
Krasser, US 20190026466 A1, title “MALWARE DETECTION USING LOCAL COMPUTATIONAL MODELS “.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOSNEL JEUDY whose telephone number is (571)270-7476. The examiner can normally be reached M-F 10:00-8:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Arani T Taghi can be reached at (571)272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Date: 10/10/2026
/JOSNEL JEUDY/ Primary Examiner, Art Unit 2438
Prosecution Insights