Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claim 12 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 12 recites the limitation " wherein the one or more YARA rules ". Claim 12 is dependent on claim 1 and there is no mention of the YARA rules in claim 1. There is insufficient antecedent basis for this limitation in the claim.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-8, 20, and 21 are rejected under 35 U.S.C. 103 as being unpatentable over Tahan et al (US Pub.No. 20080201779) in view of Satish et al (US Pub.No.8464345)
Claim 1. Tahan in view Satish discloses A system, comprising: [one or more processors configured to:] perform disassembly of a plurality of input binaries to generate a set of function signatures; (Tahan Par. (0019) “The functions may be identified and extracted using an appropriate disassembly software application, such as IDA Pro and a dedicated plug-in that scans the output of the IDA Pro application, normalizes the functions, and stores them in a database.)) (Par. (0040) “each incoming file is first disassembled by the IDA Pro program and then functions from statically linked libraries are identified… The dedicated plug-in of the present invention scans the output of the IDA Pro application (i.e. all detected functions), normalizes the functions, and stores them in a database.”)) (Par. (0034) “The malicious executables are stripped of any such segments and a unique signature, which can be later used for detection of suspicious traffic, is generated.”))
Tahan does not teach one or more processors configured to:
However, Satish teaches one or more processors configured to: (Satish Par. (21) “Illustrated are a processor 202 coupled to a chipset 204. Also coupled to the chipset 204 are a memory 206, a storage device 208”)) (Par. (10) “The computer system also comprises a computer processor for executing the computer program modules”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan with Satish because the malware behavior sequences in the cluster describe behaviors of a malware family. The method additionally comprises analyzing the cluster to identify a behavior subsequence common to the malware family and creating a behavioral signature for the malware family using the behavior subsequence. [Satish, para.9]. This motivation applies for the remainder of the claim.
Tahan further teaches determine a ranking of function signatures for the set of function signatures; (Tahan Par. (0058) “the clusters are graded based on the following function: ClusterScore = C s F s + F c T + F l C s ##EQU00002##”)) (Par. (0064) “The cluster with the highest cluster score is then chosen as the one from which the signature is to be generated.”)) (Par. (0066) “the function with the highest entropy is selected”))
automatically select a subset of function signatures for classifying samples, wherein the subset of function signatures is selected based at least in part on the ranking of function signatures; (Tahan Par. (0064)” The cluster with the highest cluster score is then chosen as the one from which the signature is to be generated.”)) (Par. (0065)“ the signature generator of the present invention selects one of the functions of that cluster”)) (Par. (0066) “the function with the highest entropy is selected”))
Satish further teaches and a memory coupled to the one or more processors and configured to provide the one or more processors with instructions. (Satish Par. (21) “Illustrated are a processor 202 coupled to a chipset 204. Also coupled to the chipset 204 are a memory 206, a storage device 208”)) (Par. (10) “The computer system also comprises a computer processor for executing the computer program modules”)).
Claim 2. Tahan in view Satish discloses the system of claim 1, wherein the set of function signatures comprise assembly function signatures. (Tahan Par. (0040) “each incoming file is first disassembled by the IDA Pro program… The dedicated plug-in of the present invention scans the output of the IDA Pro application (i.e. all detected functions), normalizes the functions”)) (Par. (0021) “comparing the binary code of a large number of computer files to the corresponding assembly representation”)).
Claim 3. Tahan in view Satish discloses the system of claim 1, wherein the type of file detected using the subset of function signatures comprises a family of files. (Satish Par. (11)“The malware behavior sequences in the cluster describe behaviors of a malware family.)) (Par. (37) “ a cluster that contains sequences predominantly from malware (called a "malware cluster") is presumed to describe the behaviors of a single malware family, e.g., a set of malware that are related through polymorphisms, a common code base, or another relationship.”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan with Satish because the malware behavior sequences in the cluster describe behaviors of a malware family. The method additionally comprises analyzing the cluster to identify a behavior subsequence common to the malware family and creating a behavioral signature for the malware family using the behavior subsequence. [Satish, para.9].
Claim 4. Tahan in view Satish discloses the system of claim 1, wherein one or more of the function signatures from the subset of function signatures is used to detect a malware family. (Satish Par. (41) “A signature creation module 324 creates behavioral signatures based on the candidate sequences selected by the cluster analysis module 322… The behavioral signature describes the sequence of behaviors that are performed by the malware family represented by the corresponding cluster. Thus, the signature can be used by the security modules 116 of the clients 112 to detect instances of the malware family at the clients.”
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan with Satish because the malware behavior sequences in the cluster describe behaviors of a malware family. The method additionally comprises analyzing the cluster to identify a behavior subsequence common to the malware family and creating a behavioral signature for the malware family using the behavior subsequence. [Satish, para.9].
Claim 5. Tahan in view Satish discloses the system of claim 1, wherein the plurality of input binaries comprise a set of malware binaries (Tahan Par. (0017) “The functions of a computer file which does contain a malware are extracted”)).
Claim 6. Tahan in view Satish discloses the system of claim 1, wherein the one or more processors are further configured to: obtain a plurality of clusters based at least in part on the plurality of input binaries. (Satish Par. (27) “A malware dataset 312 stores samples of known malware. The malware in the dataset 312 can be obtained from the clients 112 and/or from other sources.”)) (Par. (33) “A clustering module 320 clusters the behavior sequences of the software so that similar behavior sequences are clustered together. The clustering module 320 compares each behavior sequence to other behavior sequences and identifies a set of clusters”)) (Par. (46) “The re-clustering can be performed each time new malware is identified, when a specified amount of new malware is identified (e.g., when 50 new malware samples are identified since the last clustering), on a calendar-based schedule, and/or at other times.”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan with Satish because the malware behavior sequences in the cluster describe behaviors of a malware family. The method additionally comprises analyzing the cluster to identify a behavior subsequence common to the malware family and creating a behavioral signature for the malware family using the behavior subsequence. [Satish, para.9].
Claim 7. Tahan in view Satish discloses the system of claim 6, wherein the plurality of clusters are determined based at least in part on performing a similarity clustering with respect to the plurality of input binaries. (Satish Par. (33) “A clustering module 320 clusters the behavior sequences of the software so that similar behavior sequences are clustered together. The clustering module 320 compares each behavior sequence to other behavior sequences and identifies a set of clusters, where each cluster contains a set of similar behavior sequences.”)) (Par. (34) “the clustering module 320 uses edit distance as a measure of similarity (i.e., the distance measure) and clusters together behavior sequences that are identical within a threshold number of edits.”)).
The same motivation to modify with Satish, as in claim 1, applies.
Claim 8. Tahan in view Satish discloses the system of claim 6, wherein at least one function signature is automatically selected as a representative function signature for a particular cluster of the plurality of clusters. (Satish Par.(38) “The cluster analysis module 322 analyzes the malware clusters to identify behavior subsequences useful for detecting malware in the families represented by the clusters… the module 322 identifies one or more subsequences that are common to all of the behavior sequences in that cluster.”) (Par. (41) “A signature creation module 324 creates behavioral signatures based on the candidate sequences selected by the cluster analysis module 322… an embodiment of the signature creation module 324 creates signatures corresponding to all, or a selected subset, of the malware clusters.”))
The same motivation to modify with Satish, as in claim 1, applies.
Claims 20 and 21 are similar to claim 1 therefore they are rejected for the same reasons.
Claim 9 is rejected over Tahan in view of Satish and further in view of Nachenberg et al (US Pub.No. 8239944) and Kephart et al (US Pub.No. 5452442).
Claim 9. Tahan in view Satish discloses the features of Claim 1, Tahan in view Satish does not teach wherein the one or more processors are further configured to: deploy a particular function signature of the subset of function signatures in connection with detecting malware.
However, Nachenberg teaches; wherein the one or more processors are further configured to: deploy a particular function signature of the subset of function signatures in connection with detecting malware; (Nachenberg Par. (6) “a set of malware signatures is generated by a provider of security software and deployed to security software on clients. This set of malware signatures is then used by the security software to detect malware on the clients.”)) (Par. (40) “The security server 110 provides 512 a reduced signature set to the client 150.”)) monitor sample classifications determined using the particular function signature; (Nachenberg Par. (13) “the security server 110 receives signature detection event reports from the clients 150. A signature detection event report identifies the signature in the reduced set 178 that was detected”)) (Par. (26) “the signature detection module 370 monitors the behaviors of the entities on the client 150 to determine whether any of the behaviors satisfy behaviors specified in the malware signatures.”)) (Par. (42) “The security module 116 identifies 612 a signature detection event based on the identification of a malware signature in an entity associated with the client 150.
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Nachenberg because security computer systems and software for counteracting malware typically operate by seeking to identify malware signatures in entities. Malware signatures contain data describing characteristics of malware and can be used to determine whether an entity such as a computer file or a software application contains malware. [Nachenberg, para.6]
Nachenberg does not explicitly teach; and in response to determining that a sample classification determined using the particular function signature is a false positive, automatically disable the particular function signature as a detector of malware in a security system.
However, Kephart teaches; and in response to determining that a sample classification determined using the particular function signature is a false positive, automatically disable the particular function signature as a detector of malware in a security system. (Kephart Par. (93) “The end result is the generation or acceptance of one or more valid virus signatures if the estimated probability of the occurrence of the candidate virus signature is less than a threshold probability, wherein the threshold probability has a value which is low enough to reject signatures which are likely to produce too many false positives during subsequent use of it by a virus scanner, but high enough to permit at least some candidate signatures to be accepted.”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan with Satish in further view Nachenberg with Kephart because When operating in a computer virus signature extraction mode, the step of inputting includes the initial steps of generating at least one instance of the computer virus; and evaluating the at least one instance to identify at least one portion that remains invariant from one instance of the computer virus to another instance of the computer virus. [Kephart, para.18].
Claim 10 is rejected over Tahan in view of Satish and further in view of Thomas et al (US Pub.No. 11157614).
Claim 10. Tahan in view Satish discloses the system of claim 9, wherein a set of samples corresponding to false positive classifications using the particular function signature is added to a goodware dataset (Thomas Par. (29) “The whitelist generation module 212 generates a whitelist containing a list of trusted files. The whitelist generation module 212 may obtain information from the central controller 210 associated with false positives, and in some instances, may add a file determined to be trusted to the whitelist.”)) (Par. (25) “The false positive detection module 208 identify patterns of false positive detection based on data received from the telemetry and usage collection module 206. The false positive detection module 208 may detect a potential false positive in response to a pattern of detections (e.g., over a threshold number) associated with a particular malware definition in which the user declined to quarantine the identified file and indicated that the file is trusted.”)) and the goodware dataset is used to select function signatures for performing sample classifications. (Par. (13) “The anti-malware application 136 may determine if a process is malware based on behaviors indicative of malware, based on static analysis of a file, based on emulation of a program using a sandbox, based on blacklist or whitelists”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Thomas because the false positive analysis system determines a cohort of target devices for distributing an initial release of an update of malware definitions and sends the update exclusively to the target devices. [Thomas, para.3].
Claim 11 is rejected over Tahan in view of Satish and further in view of Zaitsev et al (US Pub.No. 8640245) and Griffin et al (US Pub.No. 8239948).
Claim 11. Tahan in view Satish discloses the system of claim 9, wherein: a particular function signature of the subset of function signatures is deployed in connection with detecting malware; and in response to determining that the particular function signature provided a false positive detection, [a replacement function signature is automatically selected based at least in part on the ranking of function signatures.] (Zaitsev Par. (24) “The AV module 110 scans the user computer 100 for malware objects (for example, executable files that launch malicious processes) … the AV module 110 uses a set of rules 132 from a rule database 130 located on the user side. The rules 132 contain descriptions of known harmful processes.” (Par (26) “The database 130 contains new rules 134 that need to be tested as well as already tested rules 133 that are being used by the AV module 110.”)) (Par. (38) “The analysis module 230 finds the checksums that are present in the data storage 220, but are not found in the black list storage 240. Object corresponding to these checksums are clean and thus a false-positive determination was made by the AV system with respect to these objects.”)) (Par. (39) “Then, the analysis module 230 analyses the rules that triggered the false-positive determination during AV processing.”)) (Par. (45) “As a result of the full analysis, the analysis module 230 generates rules for a database 260.”)) (Par. (46) “The rules database 260 contains numbers of rules 261 and corrected rules 262.”)) (Par. (60) “The rules that do not pass the tests for any reason are deleted from the rules database 260 and are placed into incorrect rules database 270. Incorrect rules 272 can be reviewed and corrected by an expert. Once the rules 272 are corrected, they can be moved to the rules database 260 for another round of testing.”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Zaitsev because detection of viruses and malware has been a concern throughout the era of the personal computer. With the growth of communication networks such as the Internet and increasing interchange of data, including the rapid growth in the use of e-mail for communications, the infection of computers through communications or file exchanges is an increasingly significant consideration. [Zaitsev, para.5]
Zaitsev does not explicitly teach: a replacement function signature is automatically selected based at least in part on the ranking of function signatures.
However Griffin teaches: a replacement function signature is automatically selected based at least in part on the ranking of function signatures. (Griffin Par. (40) “The signature selection module 430 selects malware signatures that are used to detect malware entities stored in the malware database 320… the signature selection module 430 selects one or more malware signatures for deployment to clients 150 that are used to detect a given malware entity.”)) (Par. (11) “the score assigned to a candidate malware signature represents an "interestingness" or "uniqueness" metric that represents a likelihood that the same features are not present in the goodware. …the highest-scoring candidate signature for a piece of malware is selected for use and deployment to clients 150”)) (Par. (41) “the highest-scoring candidate malware signature from among the candidate malware signatures scoring above the threshold is selected as the malware signature”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Griffin because Malware signatures contain data describing characteristics of known malware and are used to determine whether an entity such as a computer file or a software application contains malware. Typically, a set of malware signatures is generated by a provider of security software and is deployed to security software on a user's computer. This set of malware signatures is then used by the security software to scan the user's computer for malware. [Griffin, para.6]
Claims 12-16 are rejected over Tahan in view of Satish and further in view of Taylor et al (US Pub.No. 12235956).
Claim 12. Tahan in view Satish discloses the system of claim 1, wherein the one or more [YARA] rules are determined based at least in part on the subset of function signatures. (Tahan Par. (0019) “The functions may be identified and extracted using an appropriate disassembly software application, such as IDA Pro”)) (Tahan Par. (0065) “ the signature generator of the present invention selects one of the functions of that cluster”)) (Par. (0066) “the function with the highest entropy is selected”)) (Par. (0067) “The selected function, possibly with its offset, is the malware signature.”))
Tahan does not explicitly teach: wherein the one or more YARA rules are determined
However Taylor teaches: wherein the one or more YARA rules are determined (Taylor Par.(7) “The curated, final set can be used to update and/or generate robust, specific, and accurate malware detection rules for the particular malware family, such as YARA rules.”)) (Par. (114) “The malware rule system 250 can include, in some implementations, a YARA rule generator.”)) (Par. (12) “The rules can include, but are not limited to, YARA rules. YARA rules, for example, can define a number of conditions or variables that contain patterns in a sample of malware. If some or all of the conditions or variables are met, then depending on the particular rule, malware can be detected and/or identified in network traffic or other files”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Taylor for identifying byte sequences in malware files that are unique to a particular malware family and leveraging the family's unique byte sequences (e.g., 3 bytes, 4 bytes, 5 bytes, 8 bytes, 16 bytes) to generate and maintain malware detection rules for that family. [Taylor, para.5]
Claim 13. Tahan in view Satish and Taylor discloses the features of Claim 12, Tahan in view Satish does not teach wherein the one or more YARA rules are deployed at a security platform or security service.
However, Taylor Teaches; wherein the one or more YARA rules are deployed at a security platform or security service. (Taylor Par. (12) “The rules can include, but are not limited to, YARA rules. YARA rules, for example, can define a number of conditions or variables that contain patterns in a sample of malware.)) (Par. (47) “ The updated and/or generated rule(s) can be transmitted from the computer system 102 to the malware rule system 250”)) (Par. (17) “ the malware rule system 250 can sit on an edge of the enterprise's internal network and monitor network traffic or other files before they enter the internal network. The malware rule system 250 can implement one or more malware detection rules described herein to detect and stop malware before it infiltrates the internal network.”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Taylor for identifying byte sequences in malware files that are unique to a particular malware family and leveraging the family's unique byte sequences (e.g., 3 bytes, 4 bytes, 5 bytes, 8 bytes, 16 bytes) to generate and maintain malware detection rules for that family. [Taylor, para.5]
Claim 14. Tahan in view Satish and Taylor discloses the features of Claim 12, Tahan in view Satish does not teach; wherein the one or more YARA rules is deployed at a security platform to detect malware.
However, Taylor teaches; wherein the one or more YARA rules is deployed at a security platform to detect malware. (Taylor Par. (47) “ The updated and/or generated rule(s) can be transmitted from the computer system 102 to the malware rule system 250”)) (Par. (114) “Any of the rules 722A-N can be loaded and executed by the malware rule system 250 for runtime execution.”)) (Par. (116) “The engine 714 can monitor network traffic from systems and/or devices connected to the network(s) 108. By monitoring the network traffic, the engine 714 can execute any of the rules 722A-N and/or look for malicious files before the malicious files infiltrate the internal network 200.”)) (Par. (12) “The rules can include, but are not limited to, YARA rules... If some or all of the conditions or variables are met, then depending on the particular rule, malware can be detected and/or identified in network traffic or other files”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Taylor for identifying byte sequences in malware files that are unique to a particular malware family and leveraging the family's unique byte sequences (e.g., 3 bytes, 4 bytes, 5 bytes, 8 bytes, 16 bytes) to generate and maintain malware detection rules for that family. [Taylor, para.5]
Claim 15. Tahan in view Satish and Taylor discloses the features of Claim 12, Tahan in view Satish does not teach; wherein the one or more YARA rules are updated periodically or in response to a predefined criteria being satisfied.
However, Taylor teaches; wherein the one or more YARA rules are updated periodically or in response to a predefined criteria being satisfied. (Taylor Par. (19) “ The disclosed technology also provides for automatically and routinely, or continuously, identifying new unique sequences for malware families and variants of those sequences.. which consequently results in efficiently updating and generating malware detection rules.”)) (Par. (90) “Whenever new sequences are identified for the particular malware family, those sequences can be added to the byte sequence dictionary, which is then deconflicted”)) (Par. (19) “A running count and log of sequences associated with each malware family can be maintained and continuously updated, which consequently results in efficiently updating and generating malware detection rules.”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Taylor for identifying byte sequences in malware files that are unique to a particular malware family and leveraging the family's unique byte sequences (e.g., 3 bytes, 4 bytes, 5 bytes, 8 bytes, 16 bytes) to generate and maintain malware detection rules for that family. [Taylor, para.5]
Claim 16. Tahan in view Satish and Taylor discloses the features of Claim 12, Tahan in view Satish does not teach; wherein the predefined criteria is a malware detection based on a particular YARA rule is a false positive.
However, Taylor teaches; wherein the predefined criteria is a malware detection based on a particular YARA rule is a false positive. (Taylor Par. (116) “The malware detection engine 714 can operate in runtime. The engine 714 can monitor network traffic from systems and/or devices connected to the network(s) 108. By monitoring the network traffic, the engine 714 can execute any of the rules 722A-N and/or look for malicious files before the malicious files infiltrate the internal network 200. If one or more of the rules 722A-N are triggered by malicious files, the engine 714 can block the malicious files from entering the internal network 200.”)) (Par. (12) “The rules can include, but are not limited to, YARA rules. YARA rules, for example, can define a number of conditions or variables that contain patterns in a sample of malware. If some or all of the conditions or variables are met, then depending on the particular rule, malware can be detected and/or identified in network traffic or other files”)) (Par. (78) “The non-malicious signatures dictionary can also be used to trace down false positives during runtime execution of malware detection rules. As a result, the malware detection rules and other disclosed techniques can be updated accordingly”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Taylor for identifying byte sequences in malware files that are unique to a particular malware family and leveraging the family's unique byte sequences (e.g., 3 bytes, 4 bytes, 5 bytes, 8 bytes, 16 bytes) to generate and maintain malware detection rules for that family. [Taylor, para.5]
Claim 17 is rejected over Tahan in view of Satish and further in view of Taylor and Bogorad et al (US Pub.No. 9171156).
Claim 17. Tahan in view Satish and Taylor discloses the features of Claim 12, Tahan in view Satish does not teach; wherein a particular YARA rule is deployed in production for a security platform in response to determining that a number of sample classifications using a corresponding function signature has satisfied a predefined threshold of true positive classifications.
However, Bogorad teaches; wherein a particular [YARA] rule is deployed in production for a security platform in response to determining that a number of sample classifications using a corresponding function signature has satisfied a predefined threshold of true positive classifications. (Bogorad Par. (46) “Determining that the first malware signature from the set of dormant malware signatures triggers one or more positive malware detection responses may include determining that the first malware signature triggers positive responses at a predetermined rate. If the first malware signature triggers positive responses at a rate equal to or greater than the predetermined rate, update module 108 may reclassify the malware signature as an active malware signature.”)) (Par. (38) “provisioning module 104 may provide set of active malware signatures 123 to a first set of clients”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Bogorad the instant disclosure generally relates to systems and methods for managing malware signatures. For example, a system for managing malware signatures may include a database configured to store a set of active malware signatures and a set of dormant malware signatures. [Bogorad, para.3]
Bogorad does not teach: YARA
However Taylor teaches: YARA (Taylor Par. (47) “The updated and/or generated rule(s) can be transmitted from the computer system 102 to the malware rule system 250”) (Par. (17) “the malware rule system 250 can sit on an edge of the enterprise's internal network and monitor network traffic or other files before they enter the internal network. The malware rule system 250 can implement one or more malware detection rules described herein to detect and stop malware before it infiltrates the internal network.”)) (Par. (12) “The rules can include, but are not limited to, YARA rules.”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Taylor for identifying byte sequences in malware files that are unique to a particular malware family and leveraging the family's unique byte sequences (e.g., 3 bytes, 4 bytes, 5 bytes, 8 bytes, 16 bytes) to generate and maintain malware detection rules for that family. [Taylor, para.5],
Claim 18 is rejected over Tahan in view of Satish and further in view of Taylor and Fan et al (US Pub.No. 8443449).
Claim 18. Tahan in view Satish and Taylor discloses the features of Claim 12, Tahan in view Satish and Taylor does not teach; wherein the one or more processors are further configured to: determine that a subset of [YARA rules] of the one or more [YARA rules] is to be released as a test rule used in testing a classifying samples intercepted by a security entity without impacting a particular sample classification during production.
However, Fan teaches; wherein the one or more processors are further configured to: determine that a subset of [YARA] rules of the one or more [YARA] rules is to be released as a test rule used in testing a classifying samples intercepted by a security entity without impacting a particular sample classification during production. (Fan Par. (30) “a suitable detection engine utilizing the present invention is executing on a client computer… suspicious activity occurs on the client machine and the detection engine detects this suspicious activity.)) (Par. (16) “The anti-malware service 24 is any suitable service that analyzes malware and suspicious files, produces pattern files and heuristics… and delivers these results from an Internet-accessible location back to enterprises for use in preventing malware on end-user computers.”)) (Par. (22) “The action accompanying the trial-run solution may also be an aggressive rule or virus signature that does not include blocking, a pop-up message, or other intrusive warnings for the user… the engine with the trial run will not block or pop-up a message to interrupt the user's actions until the vendor is sure that the trial run accurately detects malware without false positives.”)) (Par. (32) “The feedback option is transparent in that the user does not see a warning message, is not disturbed, and otherwise is not interrupted when the feedback option occurs. In this fashion, the user may continue to work on the client computer without disruption.))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish and Taylor with Fan because most antivirus software--that is detection engines--use specific actions such as blocking, renaming, deleting or displaying pop-up messages when malware is detected. If a great number of false positives are present, these specific actions can be intrusive and burdensome upon a client machine and its user. The present invention defines a new action type--"feedback"--that does not block, delete, etc., when malware is detected. [Fan, para.3]
Fan does not teach: YARA
However Taylor teaches: YARA (Taylor Par. (12) “The rules can include, but are not limited to, YARA rules.”)) (Par. (15) “ the computer system can be configured to perform operations further including: generating, using the returned dictionary for the malware family, one or more malware detection rules for the malware family, and transmitting the one or more malware detection rules for the malware family to the rule engine for execution”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Taylor because the document generally describes systems, methods, and techniques for identifying byte sequences in malware files that are unique to a particular malware family and leveraging the family's unique byte sequences (e.g., 3 bytes, 4 bytes, 5 bytes, 8 bytes, 16 bytes) to generate and maintain malware detection rules for that family [Taylor, para.5].
Claim 19 is rejected over Tahan in view of Satish and further in view of Soeder et al (US Pub.No. 9262296)
Claim 19. Tahan in view Satish discloses the features of Claim 1, Tahan in view Satish does not teach; wherein the plurality of input binaries comprises an input binary for a Windows PE file, or an Executable and Linkable Format (ELF) file.
However, Soeder teaches; wherein the plurality of input binaries comprises an input binary for a Windows PE file, or an Executable and Linkable Format (ELF) file. (Soeder Par. (4) “The structured file can take varying forms including, but not limited to, Portable Executable (PE) format files…Executable and Linkable Format (ELF) files”)) (Par. (2) “Portable Executable (PE) format files are the types of structured files used by the WINDOWS operating system and include executables, object code, DLLs, FON Font files, and other file types.”)) (Par. (10) “Identifying code and data regions in the structured file can include parsing and disassembling the structured file.”)) (Par. (9) “An ELF file, meanwhile, begins with a distinct ELF header which in turn references additional ELF-specific headers and tables.”))
It would have been obvious to a person having ordinary skill in the art before the effective filing date of the invention to modify Tahan in view Satish with Soeder because it can be used to extract features from code within structured format files (e.g., PE format files, etc.) which, in turn, can be used to identify potentially malicious aspects of such code [Soeder, para.14].
ConclusionAny inquiry concerning this communication or earlier communications from the examiner should be directed to ABDULLAHI MOHAMED ABDULLAHI whose telephone number is (571)272-9615. The examiner can normally be reached 7:30 - 5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ali Shayanfar can be reached at (571) 270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ABDULLAHI MOHAMED ABDULLAHI/Examiner, Art Unit 2434
/NOURA ZOUBAIR/Primary Examiner, Art Unit 2434
Prosecution Insights