DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1 – 20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Kraemer, publication number: US 2017/0270296.
As per claims 1 and 20, Kraemer teaches a reverse shell detection method, comprising:
obtaining a first shell command (Command shell, [0083]);
performing syntax analysis on the first shell command to obtain a command execution intention for the first shell command (analyze syntax to detect nature of initiated command, [0085-0086]);
determining a command execution path corresponding to the first shell command based on the command execution intention (determining if there is a connection to an external server, [0014][0045][0107]); and
in response to at least one node in the command execution path satisfying a first predetermined condition, determining whether the first shell command is a reverse shell intrusion command (Tracking API calls, [0085], remediating reverse command shell, [0091]).
As per claim 2, Kraemer teaches wherein the first shell command is generated by a first server, and the first shell command is configured to cause the first server to access a second server (Remote network connection, [0017][0030]).
As per claim 3, Kraemer teaches wherein performing the syntax analysis on the first shell command to obtain the command execution intention for the first shell command comprises:
performing semantic parsing on the first shell command to obtain at least one command element in the first shell command; and
performing intention analysis on the at least one command element to obtain the command execution intention (Analyzing command to detect nature of command, [0085-0086]).
As per claim 4, Kraemer teaches wherein performing the intention analysis on the at least one command element to obtain the command execution intention comprises:
determining a first code language of the first shell command;
obtaining an intention tag library corresponding to the first code language based on the first code language, wherein the intention tag library comprises a function attribute of at least a portion of basic commands in the first code language; and
parsing the at least one command element based on the intention tag library to obtain a command execution intention for each of the command elements (Command line interpretation, [0025][0085]).
As per claim 5, Kraemer teaches wherein parsing the at least one command element based on the intention tag library to obtain the command execution intention for each of the command elements comprises:
obtaining a basic command and an execution object of the basic command in one of the command elements; and
obtaining the command execution intention for each of the command elements based on a function attribute of the basic command and the execution object of the basic command (Analyzing API calls, [0084-0085]).
As per claim 6, Kraemer teaches wherein obtaining the command execution intention for each of the command elements comprises:
determining at least one of pipe information, file information, network interaction information, input information, output information, or a command executor in each of the command elements (API calls to read file, [0085-0086]).
As per claim 7, Kraemer teaches wherein determining the command execution path corresponding to the first shell command based on the command execution intention comprises:
obtaining, based on the command execution intention, target command elements that satisfy a second predetermined condition and a connection relationship between the target command elements in the at least one command element; and
determining a command execution path between the target command elements based on the connection relationship (Determining reverse shell, [0091], tracking pipe, [0018][0109]).
As per claim 8, Kraemer teaches wherein the second predetermined condition comprises: at least one of network interaction, a command executor, or a pipe being present in a node corresponding to the command element (Tracking pipe, [0018][0109]).
As per claim 9, Kraemer teaches wherein before determining a detection result of the first shell command in response to the at least one node in the command execution path satisfying the first predetermined condition, the method further comprises:
determining that the command execution path is a closed-loop path;
wherein the command execution path is a closed-loop path comprises: the first server obtaining a second command from the second server and executing the second command, and sending an execution result to the second server (Determine reverse shell intrusion, [0012][0028][0109]).
As per claim 10, Kraemer teaches wherein the first predetermined condition comprises:
a network node being present in the command execution path;
an executor node being present in the command execution path; and
the network node being directly or indirectly connected to the executor node (Remote network connection, [0017][0027][0045]).
Claims 11 – 19 are rejected based on claims 1-9
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to OLUGBENGA O IDOWU whose telephone number is (571)270-1450. The examiner can normally be reached Monday-Friday 8am - 5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung Kim can be reached at 5712723804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/OLUGBENGA O IDOWU/Primary Examiner, Art Unit 2494
Prosecution Insights