DETAILED ACTION
This action is in response to the application filed 11/12/2024. Claims 1-19 are pending and have been fully examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of the Claims
Claims 1-4, 6, 10-12, 15, and 19 are rejected under 35 U.S.C. 102.
Claims 5, 7-8, and 13-14 are rejected under 35 U.S.C. 103.
Claims 9 and 16-18 contain allowable subject matter and are objected to as being dependent upon rejected base claims.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-4, 6, 10-12, 15, and 19 are rejected under 35 U.S.C. 102 (a)(1) and (a)92) as being anticipated by Jain (U.S. PGPub No. 20160306689).
Regarding Claim 1, Jain teaches,
A computer-implemented method for detecting anomalous computing environment behavior, comprising: fusing computer code parameters with hardware performance data associated with at least one device to form a kernel, the computer code parameters being associated with computer code configured for the at least one device (where execution-related values include both software parameters [0064] and hardware performance data [0043], execution related data is described practically as being a vector [0096], therefore a kernel);
inputting the kernel to a trained model configured to detect execution performance anomalies of the at least one device, the trained model having been trained with a plurality of reference data patterns (nexus data (correlation, or indication data of a bug or anomaly [0022]) may be determined by providing execution-related records to a trained computational model [0082]);
and receiving, from the trained model, a detection output based on the kernel, the detection output indicating an anomalous behavior (where the system then receives the result of the computational model [0082]).
Regarding Claim 2, Jain teaches,
The computer-implemented method of claim 1, wherein the trained model detects the anomalous behavior based on the kernel, the anomalous behavior including an execution performance anomaly associated with computer code (the computational model determining nexus data receives execution-related values to detect indications of a bug [0082]).
Regarding Claim 3, Jain teaches,
The computer-implemented method of claim 2, wherein the detection output indicates a particular portion of the computer code precipitating the execution performance anomaly (‘"Nexus data” and “nexus indications” can include description(s), meaningful to programmers, of a nexus. Such description(s) can include ... line numbers...’ [0022]).
Regarding Claim 4, Jain teaches,
The computer-implemented method of claim 1, wherein the computer code is defined by at least two distinct execution points and the hardware performance data is associated with applying the computer code to the at least one device (execution-related features are extracted from execution-related data [0068], where features (including hardware data, [0043]) may be extracted during the particular state of an app[lication] ("software code"), including data representative of an indication of the last function called by the app and the stack trace [0065]).
Regarding Claim 6, Jain teaches,
The computer-implemented method of claim 4, wherein applying the computer code to the at least one device includes executing the computer code on the at least one device (the execution-related data corresponds to a software program being executed [0063]).
Regarding Claim 10, Jain teaches,
The computer-implemented method of claim 1, wherein the hardware performance data includes at least one value measured by a sensor, the at least one value being based on functioning of the at least one device based on the computer code (the hardware performance data may be measured by sensors [0044; 0045; 0051]).
Regarding Claim 11, Jain teaches,
The computer-implemented method of claim 10, wherein the at least one value includes a voltage value, a current value, a heat value, a light value, or a communication interface usage value (the hardware performance data may include a light value and heat value [0043]).
Regarding Claim 12, Jain teaches,
The computer-implemented method of claim 1, wherein the computer code parameters include at least one of one or more instruction cycles, one or more branch jumps, memory usage, or an amount of time (the computer code parameters include, at least, memory usage [0064]).
Regarding Claim 15, Jain teaches,
A computer-implemented method for generating a kernel for a model, comprising: representing computer code as a group of execution paths by: collecting traces associated with the computer code; and tracking symbols representing portions of the computer code (data collected to perform analysis includes collecting trace data as execution-related information [0062]; as well as debug symbols of the software program [0065]);
determining respective scores for the execution paths; selecting execution paths having scores above a threshold (where the execution-related information is thresholded for extraction (distinguishing execution-related data from execution-related features) [0070]);
determining computer code parameters and hardware performance data associated with the selected execution paths (data selected for execution-related features includes data representative of an indication of the last function called by the app and the stack trace ("associated with the selected execution paths") [0065];
and fusing the determined computer code parameters and hardware performance data to form a kernel for inputting to a trained model (where execution-related values include both software parameters [0064] and hardware performance data [0043], execution related data is described practically as being a vector [0096], therefore a kernel).
Regarding Claim 19, Jain teaches,
A computer-implemented method for training a model to predict anomalous computing environment behavior, comprising: generating model training data comprising a plurality of reference data patterns associated with non-anomalous behavior by fusing sets of computer code parameters with respective hardware performance datasets (training data for the computational model may be acquired by an existing data repository, including execution-related data records corresponding to a software program [0078-0079]; where execution-related values include both software parameters [0064] and hardware performance data [0043]);
inputting the model training data to a model to prompt the model to generate a model training output (data is provided to the computational model for training [0078];
receiving the model training output from the model (the in-training model may provide an output [0098]);
and updating the model based on the model training output, thereby training the model to detect execution performance anomalies inconsistent with at least one of the reference data patterns (the in-training model's output may then be evaluated to determine accuracy [0098], and further training data may be continually updated to permit continuous improvement to the accuracy of the computational model [0078]).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 5 is rejected under 35 U.S.C. 103 as being anticipated by Jain in view of Kolar et al. (U.S. PGPub No. 20190253328).
Regarding Claim 5, Jain does not appear to disclose and Kolar teaches,
The computer-implemented method of claim 4, wherein the at least two distinct execution points are represented by two distinct functions (a bug locater is configured to generate a representation of an anomaly as a graph between two function calls [0088]).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify the nexus detection model of Jain to include execution points as represented by functions of Kolar. The resulting combination allows for the hardware and software detection and nexus system of Jain to consider data indicative of commonly occurring paths that lead to device crash [0088].
Claims 7-8 and 13-14 are rejected under 35 U.S.C. 103 as being unpatentable over Jain in view of Lemberg et al. (U.S. PGPub No. 20240176726).
Regarding Claim 7, Jain is relied upon to teach two distinct execution points [Jain, 0065] and the use of executing computer software [0063], however, does not appear to disclose and Lemberg teaches,
The computer-implemented method of claim 4, wherein the hardware performance data is based on a first hardware performance measurement determined when a first portion of the computer code associated with one of the two distinct execution points is executed and a second hardware performance measurement determined when a second portion of the computer code associated with the other of the two distinct execution points is executed (two distinct feature vectors ("kernels") are received for analysis [0074]; where data collected further includes sensor data ("hardware performance data") [0067]).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify the nexus determination model requiring both hardware and software data of Jain to include specified distinct hardware measurements for analysis as recited in Lemberg. The resulting combination of modifying the data collected between two function calls results in data that may be compared to extract fault features [Lemberg; 0074], allowing for only relevant data to be considered [Lemberg; 0006], therefore improving error detection and debugging resulting in a more resilient system that reduces the likelihood of subsequent errors caused by misdiagnosis [Lemberg; 0041].
Regarding Claim 8, Jain does not appear to disclose and Lemberg teaches,
The computer-implemented method of claim 7, wherein the hardware performance data is based on a difference between the first hardware performance measurement and the second hardware performance measurement (where the two distinct feature vectors are compared, where the resulting distance between the two is used to isolate feature vectors with differences great enough to justify a fault feature (therefore, "performance data") [0074]; where, further, data collected may be sensor data [0067]).
The same motivation for Claim 7 also applies to Claim 8.
Regarding Claim 13, Jain does not appear to disclose and Lemberg teaches,
The computer-implemented method of claim 1, wherein the at least one device comprises a virtual device (the computer application may be in a virtualized environment [0026]).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify the nexus detection system of Jain, not explicitly disclosing the application to a virtual device, to include the application of a virtualized environment as recited by Lemberg. The resulting combination of debugging in a virtual environment allows for a testing environment to enable evaluation in a testing environment for determining possible updates to the application including facilitating diagnostic tools [Lemberg; 0027].
Regarding Claim 14, Jain does not appear to disclose and Lemberg teaches,
The computer-implemented method of claim 1, wherein the at least one device comprises a processor of a controller (the user device, under test, may be an embedded system controller [0048]).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify the nexus detection system of Jain, not explicitly disclosing the application to a controller, to include the application of a controller as recited by Lemberg. The resulting combination enables improved resiliency of a subject computer application [Lemberg; 0052], such as on an embedded system controller [Lemberg; 0048 & 0052].
Allowable Subject Matter
Claims 9 and 16-18 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
The following is a statement of reasons for the indication of allowable subject matter:
Regarding Claim 9, Jain discloses collecting hardware performance data [0043-0045; 0051], and at least two distinct execution points [0065]. The prior art of record does not disclose at least one hardware performance measurement determined when a portion of the computer code is executed between the two distinct execution points [emphasis added].
Regarding Claim 16, Kolar discloses evaluating a system between function calls [0088]. The prior art of record does not disclose wherein the selected execution paths are associated with respective sequences of functions [emphasis added].
Regarding Claim 17 the prior art of record does not disclose tracking the symbols includes determining at least one of a number of calls or a standard deviation associated with each of the symbols.
Regarding Claim 18, the prior art of record does not disclose the respective scores are based on runtimes associated with the execution paths.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Ganz (U.S. Patent No. 12386978) discloses using machine learning to detect vulnerabilities to malicious inputs in source code [abstract], and considers computing resources such as memory usage and power consumption [Col. 3, 10-13].
De Lima Junior (U.S. PGPub No. 20190354680) discloses identifying malicious code executing subject code of a software enclave [Abstract] via capturing performance data [0026] and detecting anomalies accordingly [0050].
White et al. (U.S. PGPub No. 20240281359) discloses obtaining hardware-level data in accordance with the execution of an application and using a machine learning model to predictively detect anomalous behavior based on both application-level data and hardware-level data [Abstract]. Further, for a virtual device [0014], and considering latency [0040] and memory usage during a granular time-window [0045].
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AUDREY E WHITESELL whose telephone number is (703)756-4767. The examiner can normally be reached 8:30am - 5:00pm MST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bryce Bonzo can be reached at 5712723655. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/A.E.W./Examiner, Art Unit 2113 /BRYCE P BONZO/Supervisory Patent Examiner, Art Unit 2113