DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to claim(s) 1-2, 5-12 and 15 - 20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1 -2, 5-12 and 15 - 20 are rejected under 35 U.S.C. 103 as being unpatentable over Kraemer, publication number: US 2017/0270296 in view of Boulton, publication number: US 2020/0104490.
As per claims 1 and 20, Kraemer teaches a reverse shell detection method, comprising:
obtaining a first shell command (Command shell, [0083]);
performing syntax analysis on the first shell command to obtain a command execution intention for the first shell command (analyze syntax to detect nature of initiated command, [0085-0086]);
determining a command execution path corresponding to the first shell command based on the command execution intention (determining if there is a connection to an external server, [0014][0045][0107]); and
in response to at least one node in the command execution path satisfying a first predetermined condition, determining whether the first shell command is a reverse shell intrusion command (Tracking API calls, [0085], remediating reverse command shell, [0091]).
Kraemer does not teach performing syntax analysis on a text of a command,
wherein performing the syntax analysis comprises:
performing semantic parsing on the first command to obtain at least one command element in the first shell command; and
performing intention analysis on the at least one command element to obtain the command execution intention
wherein performing the intention analysis on the at least one command element to obtain the command execution intention comprises:
determining a first code language of the first command;
obtaining an intention tag library corresponding to the first code language based on the first code language, wherein the intention tag library comprises a function attribute of at least a portion of basic commands in the first code language; and
parsing the at least one command element based on the intention tag library to obtain a command execution intention for each of the command elements
In an analogous art, Boulton teaches performing syntax analysis on a text of a command (identifying text strings, [0021]),
wherein performing the syntax analysis comprises:
performing semantic parsing on the first command to obtain at least one command element in the first shell command (disassembling code, [0026]); and
performing intention analysis on the at least one command element to obtain the command execution intention (determining security risks, [0027])
wherein performing the intention analysis on the at least one command element to obtain the command execution intention comprises:
determining a first code language of the first command (associating code to a platform, [0023]);
obtaining an intention tag library corresponding to the first code language based on the first code language, wherein the intention tag library comprises a function attribute of at least a portion of basic commands in the first code language (Having access to potentially malicious codes for different software platforms, [0026]); and
parsing the at least one command element based on the intention tag library to obtain a command execution intention for each of the command elements (analyzing components to detect risk, [0027])
Therefore, it would have been obvious to one of ordinary skill in the art, prior to the effective filing date of the claimed invention to modify Kraemer to include platform based malicious intention determination as described in Boulton’s software security system for the advantage of effectively identifying a variety of malicious code.
As per claim 2, the combination teaches wherein the first shell command is generated by a first server, and the first shell command is configured to cause the first server to access a second server (Kraemer: Remote network connection, [0017][0030]).
As per claim 5, the combination teaches wherein parsing the at least one command element based on the intention tag library to obtain the command execution intention for each of the command elements comprises:
obtaining a basic command and an execution object of the basic command in one of the command elements; and
obtaining the command execution intention for each of the command elements based on a function attribute of the basic command and the execution object of the basic command (Kraemer: Analyzing API calls, [0084-0085]).
As per claim 6, the combination teaches wherein obtaining the command execution intention for each of the command elements comprises:
determining at least one of pipe information, file information, network interaction information, input information, output information, or a command executor in each of the command elements (Kraemer: API calls to read file, [0085-0086]).
As per claim 7, the combination teaches wherein determining the command execution path corresponding to the first shell command based on the command execution intention comprises:
obtaining, based on the command execution intention, target command elements that satisfy a second predetermined condition and a connection relationship between the target command elements in the at least one command element; and
determining a command execution path between the target command elements based on the connection relationship (Kraemer: Determining reverse shell, [0091], tracking pipe, [0018][0109]).
As per claim 8, the combination teaches wherein the second predetermined condition comprises: at least one of network interaction, a command executor, or a pipe being present in a node corresponding to the command element (Kraemer: Tracking pipe, [0018][0109]).
As per claim 9, the combination teaches wherein before determining a detection result of the first shell command in response to the at least one node in the command execution path satisfying the first predetermined condition, the method further comprises:
determining that the command execution path is a closed-loop path;
wherein the command execution path is a closed-loop path comprises: the first server obtaining a second command from the second server and executing the second command, and sending an execution result to the second server (Kraemer: Determine reverse shell intrusion, [0012][0028][0109]).
As per claim 10, the combination teaches wherein the first predetermined condition comprises:
a network node being present in the command execution path;
an executor node being present in the command execution path; and
the network node being directly or indirectly connected to the executor node (Kraemer: Remote network connection, [0017][0027][0045]).
Claims 11 –12 and 15-19 are rejected based on claims 1-2 and 5-9
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to OLUGBENGA O IDOWU whose telephone number is (571)270-1450. The examiner can normally be reached Monday-Friday 8am - 5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung Kim can be reached at 5712723804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/OLUGBENGA O IDOWU/Primary Examiner, Art Unit 2494
