DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 12-33 have been submitted for examination and are pending further prosecution by the United States Patent & Trademark Office.
Allowable Subject Matter
Claims 20 and 30 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim Objections
The following claims are objected to because of informalities and improper dependency. It is suggested Applicants amend these claims as follows:
-- 18. (New) The method according to claim 16, further comprising replacing at least one of the external dependencies by a stub implementation of the at least one of the external dependencies . --
-- 28. (New) The computer-accessible medium according to claim 26, wherein the computer is further configured to replace at least one of the external dependencies by a stub implementation of the at least one of the external dependencies . --
-- 29. (New) The computer-accessible medium according to claim 24 [[22]], wherein the computer is further configured to, after selecting the sample program and before compiling the sample program, identify an entry point of the sample program that will lead to the calling of the target function, wherein the compiling of the sample program is performed starting from the entry point. --
-- 31. (New) The computer-accessible medium according to claim 24 [[22]], wherein the bit code is a LLVM bit code. --
-- 32. (New) The computer-accessible medium according to claim 24 [[22]], wherein the computer is further configured to:
reverting the fuzzing harness back to a source code file yielding a harness source;
reviewing and modifying the harness source; and
compiling the modified harness source to generate a modified fuzzing harness. --
Claims 30 and 33 are additionally objected to due to their dependence on objected parent claims.
Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 12, 16, 21-24, 26 and 31-33 are rejected under 35 U.S.C. 103 as being unpatentable over "FUDGE: Fuzz Driver Generation at Scale" - hereinafter "Babić" cited in the IDS dated 12/27/24, in view of "FuzzGen: Automatic Fuzzer Generation" - hereinafter "Ispoglou" cited in the IDS dated 12/27/24, and in view of WO 2019101341 A1 - hereinafter "Dore".
With respect to claim 12, Babić teaches,
A method for generating a fuzzing harness, the method comprising:
providing software source code; - "We will consider the FreeImage library as our target library in our running example. The Slicer module scans the whole code repository looking for usages of this library, to extract code snippets. It processes each C++ source file in the codebase through a custom Clang frontend action, an extension mechanism of the LLVM compiler framework [21]." (page 977, column 1, paragraph 2)
selecting a target function to be fuzzed from the software source code; - "We will consider the FreeImage library as our target library (target function) in our running example. The Slicer module scans the whole code repository looking for usages of this library, to extract code snippets." (page 977, column 1, paragraph 2) "Suppose the Slicer module encounters the function shown in Listing 2." (page 977, column 1, paragraph 2) "On the other hand, Fudge has a broader goal: providing a tool to both discover the functions to fuzz as well as expose fuzz targets for those functions." (page 984, column 2, paragraph 1)
selecting a sample program from the software source code that calls the target function; - "Suppose the Slicer module encounters the function shown in Listing 2. This is a function inside the Ogre 3D graphics engine library [25], slightly modified for brevity, that calls into the FreeImage library." (page 977, column 1, paragraph 2) "The slicer analyzes the abstract syntax tree (AST) of this function to determine the relevant statements that should be extracted." (page 977, column 1, paragraph 3)
Babić does not explicitly teach compiling the sample program to generate a bit code;
However, in the analogous field of fuzzing, Ispoglou teaches:
"To synthesize customized fuzzer stubs for a library, FuzzGen requires both the library and code that exercises the library (referred to as library consumer)." (page 2275, column 2, paragraph 2)
"FuzzGen starts with a target library and performs a whole system analysis to discover all consumers of the library. The library and all consumers (sample program) are then compiled to LLVM bitcode as our passes work on top of LLVM IR." (page 2278, column 2, paragraph 3)
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić with Ispoglou's teachings because doing so would provide Babić's system with the ability to discover previously unknown vulnerabilities in code, as suggested by Ispoglou (page 2283, column 2, paragraph 4).
Babić does not explicitly teach slicing the target function from the bit code based on the target function.
However, in the analogous field of compilation, Dore teaches:
"In this approach, the application may be sliced into two or more parts at source, or bitcode, level using a rewriting tool. This slicing may be carried out at a function level, such that the rewriting process transfer certain functions from the initial program to another program and the initial program is modified to be able to transfer state to the other program." (page 18:25-28)
Note that the limitation to obtain the fuzzing harness recites an intended use and, therefore, does not limit interpretation of the slicing operation. Since Dore teaches slicing application bitcode at a function level, the slicing can be for the same purpose as the recited intended use.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić and Ispoglou with Dore's teachings because doing so would provide Babić/Ispoglou's system with the ability to improve software security, as suggested by Dore (Abstract).
With respect to claims 16 and 26, Babić teaches,
selecting the target function and selecting the sample program, identifying external dependencies of the target function, and further slicing the target function based on the external dependencies. - "The slicer analyzes the abstract syntax tree (AST) of this function to determine the relevant statements that should be extracted. A function is considered for slicing only if there is at least one call to the target library that might be a parsing API, e.g., the API receives a byte buffer argument. The FreeImage_OpenMemory call has the signature (uint8_t* data, uint32_t size_in_bytes), so the slicer processes this function. The slicer algorithm first selects all FreeImage calls as statements of interest. Then it collects dependent statements by following control and data-flow dependencies. In our example, it ends up collecting the statements highlighted in Listing 2 for inclusion in the output code snippet." (page 977, column 1, paragraph 3)
With respect to claims 21 and 31, Babić does not explicitly teach,
wherein the bit code is a LLVM bit code.
However, in the analogous field of fuzzing, Ispoglou teaches:
"FuzzGen starts with a target library and performs a whole system analysis to discover all consumers of the library. The library and all consumers (sample program) are then compiled to LLVM bitcode as our passes work on top of LLVM IR." (page 2278, column 2, paragraph 3)
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić with Ispoglou's teachings because doing so would provide Babić's system with the ability to discover previously unknown vulnerabilities in code, as suggested by Ispoglou (page 2283, column 2, paragraph 4).
With respect to claims 22 and 32, Babić teaches,
reverting the fuzzing harness back to a source code file yielding a harness source; reviewing and modifying the harness source; - "In this paper, we present Fudge — a system for accelerating fuzz target creation. Fudge helps developers create fuzz targets for libraries quickly and easily by providing automatically synthesized candidate fuzz targets. These automatically-generated targets typically only need cosmetic modifications and small fix-ups before adoption. For example, the target in Listing 1 was generated by Fudge." (page 976, column 1, paragraph 3)
Babić does not explicitly teach and compiling the modified harness source to generate a modified fuzzing harness.
However, in the analogous field of fuzzing, Ispoglou teaches:
"FuzzGen starts with a target library and performs a whole system analysis to discover all consumers of the library. The library and all consumers are then compiled to LLVM bitcode as our passes work on top of LLVM IR." (page 2278, column 2, paragraph 3)
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić with Ispoglou's teachings because doing so would provide Babić's system with the ability to discover previously unknown vulnerabilities in code, as suggested by Ispoglou (page 2283, column 2, paragraph 4).
With respect to claims 23 and 33, Babić teaches,
fuzzing the target function using the fuzzing harness. - "Candidate targets view. The candidates view lets users browse the list of promising candidates that were built and executed successfully. Targets are presented similarly as shown in Figure 2." (page 980, column 2, paragraph 2; Fig. 2)
With respect to claim 24, Babić teaches,
A non-transitory computer-accessible medium which includes computer software that comprises instructions which, when executed by a computer, cause the computer to perform the procedures comprising:
The limitations from claim 24 are rejected using the mapping from analogous claim 1.
Claims 13-15 and 25 are rejected under 35 U.S.C. 103 as being unpatentable over Babić, Ispoglou and Dore, in view of EP 4006733 A1 - hereinafter "Moukahal".
With respect to claim 13, Babić does not explicitly teach,
wherein the software source code is code of software for a vehicle.
However, in the analogous field of fuzz testing, Moukahal teaches:
"The present invention relates to methods of fuzzy testing a software system, and systems and computer programs for carrying out such methods." [0001]
"The following discussion shall focus on the "software system" being a software system for controlling (at least in part) operation of a vehicle, such as a software system controlling driving for an autonomous vehicle." [0004]
"At step 1, the framework calculates a security vulnerability value of each component using the source code of the software system and assigns weights (w) to vulnerable functions." [0083]
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić, Ispoglou and Dore with Moukahal's teachings because doing so would provide Babić/Ispoglou/Dore's system with the ability to improve testing of vehicle software systems, as suggested by Moukahal [0034].
With respect to claim 14, Babić does not explicitly teach,
wherein the vehicle is provided with an advanced driver assistance system.
However, in the analogous field of fuzz testing, Moukahal teaches:
"To evaluate the efficiency and performance of the framework set out in section 2.1 above, an example of its application to an automotive system, OpenPilot [74], it set out below, with compares the framework to two other fuzzing methodologies: AFL and Mutation-based fuzzer." [0114]
"OpenPilot is an open-source, driving, and safety assistant system developed by comma.ai [75]. It offers SAE Level 2 driving assistance capabilities fulfilling the functions of Adaptive Cruise Control (ACC), Automated Lane Centering (ALC), Forward Collision Warning (FCW), and Lane Departure Warning (LDW)." [0115]
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić, Ispoglou and Dore with Moukahal's teachings because doing so would provide Babić/Ispoglou/Dore's system with the ability to improve testing of vehicle software systems, as suggested by Moukahal [0034].
With respect to claim 15, Babić does not explicitly teach,
wherein the vehicle is an autonomous vehicle.
However, in the analogous field of fuzz testing, Moukahal teaches:
"The following discussion shall focus on the "software system" being a software system for controlling (at least in part) operation of a vehicle, such as a software system controlling driving for an autonomous vehicle." [0004]
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić, Ispoglou and Dore with Moukahal's teachings because doing so would provide Babić/Ispoglou/Dore's system with the ability to improve testing of vehicle software systems, as suggested by Moukahal [0034].
With respect to claim 25, Babić does not explicitly teach,
wherein the software source code is code of software for a vehicle, wherein the vehicle is provided with an advanced driver assistance system, and wherein the vehicle is an autonomous vehicle.
However, in the analogous field of fuzz testing, Moukahal teaches:
"The present invention relates to methods of fuzzy testing a software system, and systems and computer programs for carrying out such methods." [0001]
"The following discussion shall focus on the "software system" being a software system for controlling (at least in part) operation of a vehicle, such as a software system controlling driving for an autonomous vehicle." [0004]
"At step 1, the framework calculates a security vulnerability value of each component using the source code of the software system and assigns weights (w) to vulnerable functions." [0083]
"To evaluate the efficiency and performance of the framework set out in section 2.1 above, an example of its application to an automotive system, OpenPilot [74], it set out below, with compares the framework to two other fuzzing methodologies: AFL and Mutation-based fuzzer." [0114]
"OpenPilot is an open-source, driving, and safety assistant system developed by comma.ai [75]. It offers SAE Level 2 driving assistance capabilities fulfilling the functions of Adaptive Cruise Control (ACC), Automated Lane Centering (ALC), Forward Collision Warning (FCW), and Lane Departure Warning (LDW)." [0115]
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić, Ispoglou and Dore with Moukahal's teachings because doing so would provide Babić/Ispoglou/Dore's system with the ability to improve testing of vehicle software systems, as suggested by Moukahal [0034].
Claims 17 and 27 are rejected under 35 U.S.C. 103 as being unpatentable over Babić, Ispoglou and Dore, in view of US 20150121349 A1 - hereinafter "Abadi".
With respect to claims 17 and 27, Babić does not explicitly teach,
modelling a dataflow of at least one of the external dependencies.
However, in the analogous field of dependency analysis, Abadi teaches:
"Then, as shown at 104, a data dependence model, such as a control and data flow representation graph, defining dependencies among the portions and based on the variable usage analysis, is constructed." [0051]
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić, Ispoglou and Dore with Abadi's teachings because doing so would provide Babić/Ispoglou/Dore's system with a more efficient method and system for identifying unnecessary variables in code, as suggested by Abadi [0035-0036].
Claims 18 and 28 are rejected under 35 U.S.C. 103 as being unpatentable over Babić, Ispoglou and Dore, in view of EP 0686916 A1 - hereinafter "McKeeman".
With respect to claims 18 and 28, Babić does not explicitly teach,
replacing at least one of the external dependencies by a stub implementation of the at least one of the external dependencies
However, in the analogous field of dependency analysis, McKeeman teaches:
"The generator may automatically perform this selective passive stub generation of external dependencies if a filter list of known routines is provided as an input to the generator." (col. 14:52-55)
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić, Ispoglou and Dore with McKeeman's teachings because doing so would provide Babić/Ispoglou/Dore's system with the ability to facilitate software debugging, as suggested by McKeeman (col. 1:3-8).
Claims 19 and 29 are rejected under 35 U.S.C. 103 as being unpatentable over Babić, Ispoglou and Dore, in view of KR 20070083024 A - hereinafter "Lee".
With respect to claims 19 and 29, Babić does not explicitly teach,
after selecting the sample program and before compiling the sample program, identifying an entry point of the sample program that will lead to the calling of the target function, wherein the compiling of the sample program is performed starting from the entry point.
However, in the analogous field of software compilation, Lee teaches:
"Referring to FIG. 4, when the JIT compiler starts compiling a method boo, first, an instruction of the method boo is read (S410). At this time, it is determined whether the corresponding command is the last command of the method boo (S420)." (page 5)
"If the command is the last command of the method boo, after step S460 is performed, the compilation of the method boo is completed. Otherwise, steps S430, S440, and S450 are performed. The operation in step S460 will be described later." (page 5)
"If the current command is not the last command of the method boo in step S420, the JIT compiler compiles the current command (S430), and checks whether the compiled command is a call to the method foo (S440)." (page 5)
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to implement Babić, Ispoglou and Dore with Lee's teachings because doing so would provide Babić/Ispoglou/Dore's system with the ability to minimize system overhead when calling methods, as suggested by Lee (page 3).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. US 10599558 B1 discloses systems and methods for using fuzz-testing to identify software bugs in computer programs and the inputs used to trigger the software bugs.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GEOFFREY R ST LEGER whose telephone number is (571)270-7720. The examiner can normally be reached M-F (IFP) ~9:00-5:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hyung S Sough can be reached at 571-272-6799. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/GEOFFREY R ST LEGER/Primary Examiner, Art Unit 2192
