DETAILED ACTION
This Office action is in response to amendments and remarks filed by Applicant on 05/27/2026.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement PTO-1449
The Information Disclosure Statement submitted by applicant on 03/13/2026 has been considered. The submission is in compliance with the provisions of 37 CFR § 1.97. Form PTO-1449 signed and attached hereto.
Claim Rejections - 35 USC § 101
The present application, as claimed, satisfies the requirements for patent-eligible subject matter under 35 U.S.C. 101.
Response to Amendment
Applicant presents amendments to claims 1, 7, 9, 15, 17 and 20. Claims 3, 6, 11, 14, and 19 are cancelled and 21–22 are introduced new. All amendments have been fully considered.
Applicant’s amendments to claims 7, 15, and 20, are sufficient to overcome the previous rejection under 35 U.S.C. 112(b). The rejection is hereby withdrawn.
Applicant’s amendments to independent claims 1, 9, and 17 are sufficient to overcome the previous reference serving as the basis for the anticipation rejection under 35 U.S.C. 102. The incorporation of subject matter from the canceled claims necessitates the obviousness rejection under 35 U.S.C. 103.
Response to Arguments
Applicant presents arguments with respect to independent claims 1, 9, and 17. All arguments have been fully considered.
As discussed in the previous interview, the proposed amendments would likely overcome the previous references. However, the filed amendments leave out significant subject matter, such as the emulate and cluster limitations, which are concepts that are not found in the primary reference. The amended subject matter provides little more than a selectable list of characteristic behaviors of a well-known malware structure, which is generally understood in the art. Without anything more, the claims do little to distinguish from the previously cited references.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1–2, 7, 9–1, 15, 17–18, 20–22 rejected under 35 U.S.C. 103 as being unpatentable over Chiriac (US 2008/0040710 A1, published Feb. 14, 2008) in view of Marinescu (US 7,640,583 B1, issued Dec. 29, 2009).
Regarding claims 1, 9, and 17, Chiriac discloses: a system, comprising: a processor configured to: receive a sample for inline malware packer detection analysis (files of a computer are inspected for indicators of malware, particularly looking for Microsoft Portable Executable type files, which are prone to be modified by malware packing. Chiriac ¶¶ 39–40.); perform a packer filter to determine that the sample is packed (the file is inspected to determine if the file is packed/compressed/encrypted, which can be determined by entropy analysis for example. Chiriac ¶ 41.); comprising to: perform one or more of the following: A) determine that the sample includes a Microsoft portable executable (PE) file and that the Microsoft Windows PE file is suspicious (the executable computer file is inspected to determine whether the file is a Microsoft Portable Executable type and search for any obvious oddities that are known to be present in malware. Chiriac ¶ 40.), comprising to: determine that the Microsoft Windows PE file is abnormal, wherein an abnormal Microsoft Windows PE file includes a last section of the Microsoft Windows PE file has exec permissions, a first section of the Microsoft Windows PE file has write permissions, an entry point address of the Microsoft Windows PE file is outside of the Microsoft Windows PE file, an import table of the Microsoft Windows PE file is abnormal, or any combination thereof; and in response to a determination that the Microsoft Windows PE file is abnormal, determine that the sample is suspicious; or B) determine that the sample includes an overlay and that the overlay is suspicious, comprising to: determine that the sample includes the overlay; and in the event that the sample include the overlay: determine that an entropy of the overlay exceeds an entropy threshold; and in response to a determination that the entropy of the overlay exceeds the entropy threshold, determine that the sample is suspicious (the file is inspected to see if one or more of the following flags are present to determine whether the file is suspicious, including where the entry point is in the last section of the file and the file has undeclared internal overlays. Chiriac ¶¶ 40–47.); compare the sample with known malware packer clusters to determine whether the sample is associated with a known malware packer (not only are the files inspected to determine if the files have been packed multiple times, which is a flag for malware, specific packers (such as Morphine, MoleBox, Mew) used by malware writers are detected. Chiriac ¶¶ 49–50. Also, common packers (such as UPX, Aspack) with slight modifications are detected. Chiriac ¶ 51.); and a memory coupled to the processor and configured to provide the processor with instructions (Chiriac ¶ 7.).
Chiriac does not disclose: perform a responsive action based on the comparison, comprising to: perform one or more of the following: block the sample; drop the sample; and/or quarantine an endpoint device associated with the sample.
However, Marinescu does disclose: perform a responsive action based on the comparison, comprising to: perform one or more of the following: block the sample; drop the sample; and/or quarantine an endpoint device associated with the sample (the anti-malware program prohibits the file from remaining on the computer and does not allow the file to execute. Marinescu 1:37–39.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the inspection of computer data for malware packed into files taught by Chiriac with remedying the detected malware by blocking the access to the sample based upon the teachings of Marinescu. The motivation being to isolate the malicious code from the system. Marinescu 1:37.
Regarding claims 2, 10, and 18, Chiriac in view of Marinescu discloses the limitations of claims 1, 9, and 17, respectively, wherein the sample includes a Microsoft Windows PE file (files are a computer are inspected for indicators of malware, particularly looking for Microsoft Portable Executable type files, which are prone to be modified by malware packing. Chiriac ¶¶ 39–40.).
Regarding claims 7, 15, and 20, Chiriac in view of Marinescu discloses the limitations of claims 1, 9, and 17, respectively, wherein the performing of the responsive action includes to alert an endpoint user and/or a network/security administrator that the sample was determined to be associated with a known malware packer, identifying a source IP address or uniform resource locator (URL) associated with the sample as malicious (or potentially malicious), or any combination thereof (in response to this analysis a determination is make as to whether or not the file is or should be treated as malware. Chiriac ¶ 56.).
Regarding claim 21, Chiriac in view of Marinescu discloses the limitations of claim 1, wherein the performing of the packer filter to determine that the sample is packed, comprising to: determine that the sample includes a Microsoft portable executable (PE) file and that the Microsoft Windows PE file is suspicious, comprising to: determine that the Microsoft Windows PE file is abnormal, wherein an abnormal Microsoft Windows PE file includes a last section of the Microsoft Windows PE file has exec permissions, a first section of the Microsoft Windows PE file has write permissions, an entry point address of the Microsoft Windows PE file is outside of the Microsoft Windows PE file, an import table of the Microsoft Windows PE file is abnormal, or any combination thereof; and in response to a determination that the Microsoft Windows PE file is abnormal, determine that the sample is suspicious (the file is inspected to see if one or more of the following flags are present to determine whether the file is suspicious, including where the entry point is in the last section of the file. Chiriac ¶¶ 40–47.).
Regarding claim 22, Chiriac in view of Marinescu discloses the limitations of claim 1, wherein the performing of the packer filter to determine that the sample is packed, comprising to: determine that the sample includes an overlay and that the overlay is suspicious, comprising to: determine that the sample includes the overlay; and in the event that the sample include the overlay: determine that an entropy of the overlay exceeds an entropy threshold; and in response to a determination that the entropy of the overlay exceeds the entropy threshold, determine that the sample is suspicious (the file is inspected to see if one or more of the following flags are present to determine whether the file is suspicious, including where the file has undeclared internal overlays. Chiriac ¶¶ 40–47.).
Claim 4–5, 8, 12–13, 16 rejected under 35 U.S.C. 103 as being unpatentable over Chiriac in view of Marinescu in view of Abu (US 2022/0147628 A1, published May 12, 2022).
Regarding claims 4 and 12, Chiriac in view of Marinescu discloses the limitations of claims 1 and 9, respectively. Chiriac in view of Marinescu does not disclose: wherein the performing of the responsive action includes to store the sample.
However, Abu does disclose: wherein the performing of the responsive action includes to store the sample (PE file malware remedial action includes isolating, quarantining, confining, or restraining. Abu ¶ 132.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the inspection of computer data for malware packed into files taught by Chiriac with remedying the detected malware by storing the sample based upon the teachings of Abu. The motivation being to protect computer systems. Abu ¶ 3.
Regarding claim 5 and 13, Chiriac in view of Marinescu discloses the limitations of claims 1 and 9, respectively. Chiriac in view of Marinescu does not disclose: wherein the performing of the responsive action includes to log the sample.
However, Abu does disclose: wherein the performing of the responsive action includes to log the sample (PE file malware remedial action includes reporting. Abu ¶ 132.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the inspection of computer data for malware packed into files taught by Chiriac with remedying the detected malware by logging the sample based upon the teachings of Abu. The motivation being to protect computer systems. Abu ¶ 3.
Regarding claims 8 and 16, Chiriac in view of Marinescu discloses the limitations of claims 1 and 9, respectively. Chiriac in view of Marinescu does not disclose: wherein a security platform of a cloud service includes the system.
However, Abu does disclose: wherein a security platform of a cloud service includes the system (Abu ¶ 76.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the inspection of computer data for malware packed into files taught by Chiriac with the security platform being cloud based upon the teachings of Abu. The motivation being to protect computer systems. Abu ¶ 3.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VANCE LITTLE whose telephone number is (571) 270-0408. The examiner can normally be reached Monday - Friday 9:30am - 5:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung (Jay) Kim can be reached at (571) 272-3804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/VANCE M LITTLE/Primary Examiner, Art Unit 2494
Prosecution Insights