DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This office action is in response to the Information Disclosure Statement (IDS) filed on May 20, 2025, in which claim 4 was canceled and claims 1-3 and 5-21 are presented for further examination.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after allowance or after an Office action under Ex Parte Quayle, 25 USPQ 74, 453 O.G. 213 (Comm'r Pat. 1935). Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, prosecution in this application has been reopened pursuant to 37 CFR 1.114. Applicant's submission filed on May 20, 2026 has been entered.
Information Disclosure Statement
The information disclosure statement filed on May 20, 2025 complies with the provisions of 37 CFR 1.97, 1.98 and MPEP § 609. It has been placed in the application file, but the information referred to therein has not been considered as to the merits.
Response to Arguments
Applicant’s arguments with respect to claims 1-3 and 5-21 have been considered but are moot because the new ground necessitated by Applicant’s provided Information Disclosure Statement (IDS).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3 and 5-21 are rejected under 35 U.S.C. 103 as being unpatentable over Harang U.S. 2020/0250309 A1 in view of Kim US 2023/0306113.
As to claim 1, Harang teaches a computer-implemented method for detecting a malware file, the method comprising:
obtaining a set of files, each file being associated with an initial label indicating a classification of the file(par., 40, 47, to receive and evaluate the output of the neural network 112 and produce a maliciousness classification for the file to indicate whether the file is malicious or benign (e.g., classify the file as benign or malicious, classify the file as a type of malware, etc.).); and
generating a file embedding vector corresponding to each file in the set of files based on processing the file using a file encoder (par.30-32, 26, generate a hash value for each n-gram from the sets of three-, four-, and five-grams 244-246).
However, Kim discloses the claimed generating a file embedding vector corresponding to each file in the set of files based on processing the file using a file encoder (see [0502] As a fourth step, a profiling process for identifying and labeling an attack technique (TTP) will be described as follows.
[0503] An example of vectorizing through extraction of a feature of disassembled code including opcode and ASM code of input binary data based on an previously analyzed attack code or malware has been described above.
[0504] The vectorized data is classified as a specific attack technique after being learned through machine learning modeling, and the classified data is labeled in a profiling process for classified code.
[0505] Labeling may be largely performed in two parts. One is to attach a unique index to an attack identifier defined in a standardized model, and the other is to write information about a user creating attack code.
[0506] Labeling is assigned according to an attack identifier (T-ID) reflected in a standardized model, for example, MITRE ATT&CK, so that accurate information may be delivered to the user without additional work.
[0507] In addition, labeling is assigned to distinguish not only an attack identifier but also an attacker implementing the attack identifier. Therefore, labeling may be provided so that it is possible to identify not only an attack identifier, but also an attacker and an implementation method accordingly.
[0508] In an embodiment, advanced profiling is possible based on data learned from a data set of disassembled code (opcode, ASM code, or a combination thereof) previously classified. In an embodiment, data of the static analysis, dynamic analysis, or correlation analysis disclosed above may be utilized as reference data for performing labeling. Therefore, even when a data set has not been previously analyzed, profiling data may be obtained significantly rapidly and efficiently by considering results of static, dynamic, and correlation analysis together.
[0509] The process of learning code having a pattern similar to that of the malware and classifying the learned data in the third step and the profiling process of the classified data in the fourth step may be performed together by an algorithm in machine learning);
clustering the set of files based on a similarity measure between the file embedding vectors corresponding to the set of files into a plurality of the similarity measure being independent of the labels associated with the files, wherein clustering the set of files comprises, for a first cluster in the plurality of clusters (see [0678] The cyber threat information processing apparatus according to the embodiments may determine similarity between one or more opcode-and-ASM code combinations for each function based on characteristic information of one or more executable files analyzed for each user, and perform clustering for generating N clusters (here, N is an integer greater than or equal to 0) which are clusters of similar opcode-and-ASM code combinations;
[0502] As a fourth step, a profiling process for identifying and labeling an attack technique (TTP) will be described as follows.
[0503] An example of vectorizing through extraction of a feature of disassembled code including opcode and ASM code of input binary data based on an previously analyzed attack code or malware has been described above.
[0504] The vectorized data is classified as a specific attack technique after being learned through machine learning modeling, and the classified data is labeled in a profiling process for classified code.
[0505] Labeling may be largely performed in two parts. One is to attach a unique index to an attack identifier defined in a standardized model, and the other is to write information about a user creating attack code.
[0506] Labeling is assigned according to an attack identifier (T-ID) reflected in a standardized model, for example, MITRE ATT&CK, so that accurate information may be delivered to the user without additional work.
[0507] In addition, labeling is assigned to distinguish not only an attack identifier but also an attacker implementing the attack identifier. Therefore, labeling may be provided so that it is possible to identify not only an attack identifier, but also an attacker and an implementation method accordingly.
[0508] In an embodiment, advanced profiling is possible based on data learned from a data set of disassembled code (opcode, ASM code, or a combination thereof) previously classified. In an embodiment, data of the static analysis, dynamic analysis, or correlation analysis disclosed above may be utilized as reference data for performing labeling. Therefore, even when a data set has not been previously analyzed, profiling data may be obtained significantly rapidly and efficiently by considering results of static, dynamic, and correlation analysis together.
[0509] The process of learning code having a pattern similar to that of the malware and classifying the learned data in the third step and the profiling process of the classified data in the fourth step may be performed together by an algorithm in machine learning);
determining a number of occurrences of each initial label in the first cluster (see [0107], determines a type of malware and a risk level of the malware based on the analysis information or the prediction information. In addition, the embodiment creates profiling information for the malware. Therefore, it is possible to save a result of performing self-analysis on the file or a result of performing additional and predictive analysis through file analysis. The generated profiling information includes an attack technique for malware or labeling for an attacker; [0142] As a result of the comparison, when a predefined risk level is exceeded, it may be determined that the input file includes malware, and the hash value of the file may be stored in a database and used for static analysis later.
[0143] Depending on the malware, a first process, which is a subject of activity, may generate dangerous activity in a system. However, depending on the case, the activity of the first process may additionally create a second process, which is a child process, and the second process may perform malicious activity on the system.
[0144] In this case, an embodiment of the dynamic analysis may store events occurring due to activity of the initial first process in the execution system, and additionally extract or check the second process, which is a child process, to store an event of malicious activity according to the second process. As such, in this example, the dynamic analysis may determine whether an identified file includes malware by comprehensively analyzing event information of the initial first process and the second and third processes to be connected thereto.
[0145] Depending on the execution result of the input file, when there is no unknown malware characteristic, detection is difficult even when characteristics of malware are included. In this case, another embodiment of the dynamic analysis may detect malicious activity of the running process by monitoring and analyzing a network process that communicates with the outside when the identified file is executed.
[0146] For example, when the identified file is executed, it is possible to monitor a network event that communicates with the outside. According to file execution, a process ID creating a local address object is stored. In addition, when a network event related to file execution occurs, local address object information may be extracted from interior router protocol (IRP) information of the corresponding network event.
[0147] The dynamic analysis may be performed to determine malicious activity by comparing a local address object generated by the process ID with local address objects related to the network event. For example, it is possible to determine whether malicious activity is performed by checking a pattern of packets transmitted and received according to the network event or a command and control (C&C) server that triggers packet transmission);
determining, based on the number of occurrences of each initial label in the first cluster, that the first cluster fails to satisfy a label purity threshold (see [0086], and [0107], determines a type of malware and a risk level of the malware based on the analysis information or the prediction information, creates profiling information for the malware. Therefore, it is possible to save a result of performing self-analysis on the file or a result of performing additional and predictive analysis through file analysis, wherein the generated profiling information includes an attack technique for malware or labeling for an attacker, wherein malicious activity analysis information related to the input file may include static analysis information for analyzing information about the file itself or dynamic analysis information for determining whether malicious activity is performed by executing information obtained from the input file; [0142] As a result of the comparison, when a predefined risk level is exceeded, it may be determined that the input file includes malware, and the hash value of the file may be stored in a database and used for static analysis later.
[0143] Depending on the malware, a first process, which is a subject of activity, may generate dangerous activity in a system. However, depending on the case, the activity of the first process may additionally create a second process, which is a child process, and the second process may perform malicious activity on the system.
[0144] In this case, an embodiment of the dynamic analysis may store events occurring due to activity of the initial first process in the execution system, and additionally extract or check the second process, which is a child process, to store an event of malicious activity according to the second process. As such, in this example, the dynamic analysis may determine whether an identified file includes malware by comprehensively analyzing event information of the initial first process and the second and third processes to be connected thereto.
[0145] Depending on the execution result of the input file, when there is no unknown malware characteristic, detection is difficult even when characteristics of malware are included. In this case, another embodiment of the dynamic analysis may detect malicious activity of the running process by monitoring and analyzing a network process that communicates with the outside when the identified file is executed.
[0147] The dynamic analysis may be performed to determine malicious activity by comparing a local address object generated by the process ID with local address objects related to the network event. For example, it is possible to determine whether malicious activity is performed by checking a pattern of packets transmitted and received according to the network event or a command and control (C&C) server that triggers packet transmission; 0302] The static analysis module 15100 of the analysis framework 15000 may compare the hash value of the input file with a hash value previously stored for the malware in the database 2200 to determine whether the input file is malware. In addition, the analyzed information on the malware of the input file may be stored in the database 2200.
[0303] When the input file is mobile data, the static analysis module 15100 of the analysis framework 15000 may extract code information of the suspicious mobile malware from the input file. The code information of the suspicious malware may include hash information, code size information, file header information, identifiable string information included in the code, operating platform information, etc.
[0304] The static analysis module 15100 of the analysis framework 15000 may detect whether there is malware in the file based on the analyzed analysis information. In addition, static analysis information related to the detected malware may be stored in the database); and
splitting files that belong to the first cluster into two or more subclusters (see [0232] The prediction information of the malware generated in this way may be divided into risk level prediction information for predicting a risk level thereof, and prediction information for predicting each of an attacker, an attack group, a similarity, a spread degree, etc. or comprehensive prediction information of malware comprehensively indicating the prediction information, and stored in a database);
identifying a mismatch between initial labels associated with one or more files that belong to a given cluster in the plurality of clusters (see [0007]-[0008], [0014], identifying different attackers creating malware that performs significantly similar malicious activity and predicting a cyber threat attack occurring in the future, characteristic information thereof can be sufficiently secured, and thus it is possible to distinguish whether code is malicious or a type of malware. However, in the case of advanced persistent threat (APT) attacks, which are made in relatively small numbers and attack precisely, since training data does not match in many cases, and targeted attacks make up the majority, even when the existing technology is advanced, there are limitations, describing malware, attack code, or cyber threats have differed depending on the position or analysis perspective of an analyst. For example, a method of describing malware and attack activity has not been standardized worldwide, and thus there has been a problem in that, even when the same incident or the same malware is detected, explanations of experts in the field are different, and thus confusion had occurred. Even a malware detection name has not been unified, and thus, for the same malicious file, it has been impossible to identify an attack performed correctly, or attacks have been differently organized. Therefore, there has been a problem in that identified attack techniques cannot be described in a normalized and standardized manner; [0233] When the analysis information and the prediction information of the cyber threat information described above are used, it is possible to identify a type of malware related to an input file and determine a risk level therefor.
[0234] In addition, profiling information including a record of malware related to the input file may be created and stored, and analysis information, prediction information, a risk level, or profiling information related to the stored malware may be further processed so that the user may easily refer to the information);
modifying the initial labels associated with the one or more files in the given cluster based on a distribution of initial labels associated with remaining files in the given cluster to generate a modified label for each of the one or more files in the given cluster (see [0361] , correlation analysis module continuously and accumulatively stores analysis information for a received file or malware, updates related correlation analysis information again whenever a new file or malware is analyzed later, and stores the correlation analysis information in the database; [0365], intelligence platform stores static analysis information, dynamic analysis information, in-depth analysis information, and correlation analysis information in the database in a standardized format to update or reproduce cyber threat information); and
training a machine learning model on a training dataset, the machine learning model being configured to process a new file to generate a new classification of the new file, the training dataset comprising the set of files and the modified labels for each of the one or more files in the given cluster (see [0372] The prediction framework uses analysis information generated by the previously exemplified analysis framework (not illustrated). The prediction framework may process a data set according to various types of analysis information into an AI-based training data set, and the AI engine may perform AI analysis based on the processed training data set.
[0373] Through execution of the prediction framework and the AI engine, various types of prediction information related to the attack activity may be generated.
[0374] In this example, the first information prediction module may generate prediction information of a malware creator through AI learning. The second information prediction module may generate prediction information of malware tactic, and the third information prediction module may generate prediction information of a malware attack group. Further, an example in which the fourth information prediction module generates malware similarity prediction information, and the fifth information prediction module generates malware spread degree prediction information; [0430] Most AI engines use a data set learned based on various characteristic information of malware to identify the malware. Then, whether the malware is malicious is determined. However, in this way, it is difficult to describe a reason why the malware is malware. However, as illustrated, when the standardized tactic (TTP) identifier is matched, it is possible to identify a type of threat included in the malware. Accordingly, the embodiment may accurately deliver cyber threat information to a security administrator and enable the security administrator to systematically manage cyber threat information over the long term; [0682] The cyber threat information processing apparatus receives an executable file analysis request signal (also referred to as a file analysis request signal) requesting analysis of an executable file (new executable file “ABC.exe”) from a user (user A) (3810). The cyber threat information processing apparatus according to the embodiments may perform executable file analysis described with reference to FIGS. 1 to 37 to determine whether the corresponding executable file is malware, identify an attack technique and an attacker, and perform profiling (for example, 3720 of FIG. 37). A file analysis operation of the cyber threat information processing apparatus is the same as that described with reference to FIGS. 1 to 37, and thus a detailed description thereof will be omitted.
[0683] The cyber threat information processing apparatus according to the embodiments performs clustering based on characteristic information of a new executable file (for example, “ABC exe” in the figure) (3820). Clustering according to embodiments is performed based on similarity determination of opcode-and-ASM code combinations for each function according to a result of analyzing executable files requested by user A and a new executable file. As described with reference to FIG. 37, the cyber threat information processing apparatus may generate one or more clusters by determining similarity between opcode-and-ASM code combinations for each function of pre-analyzed executable files at the request of user A. As described above, a method of determining similarity of opcode-and-ASM code combinations for each function is performed in the same manner as analyzing similarity with malware based on a data set for each function in the disassembled code described with reference to FIGS. 1 to 36. In addition, the cyber threat information processing apparatus performs clustering on an opcode-and-ASM code combination for each function of a new executable file (for example, “ABC exe”), and determines a cluster to which an opcode-and-ASM code combination for each function of a new file belongs. For example, the cyber threat information processing apparatus may determine similarity between an opcode-and-ASM code combination for each function of a new executable file and each of at least one opcode-and-ASM code combination included in each cluster. That is, the cyber threat information processing apparatus determines similarity with the opcode-and-ASM code combination for each function of each new executable file for all opcode-and-ASM code combinations included in one cluster.)
Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Harang with the processing cyber thread information disclosed by Kim, in order to predict the attack technique of a specific attacker in future, and accurately identify a cyber attack implementation process.
As to claim 2, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein the modifying comprises assigning a same label to all the files belonging to the given cluster (see [0507] In addition, labeling is assigned to distinguish not only an attack identifier but also an attacker implementing the attack identifier).
As to claim 3, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein the same label corresponds to a label that has a majority occurrence in the given cluster (see [0570] Labeling is performed by classifying input data according to a classification result of the classification model (e) or a selection (f) result of the existing stored pattern (g).)
As to claim 5, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein each subcluster in the two or more subclusters have a smaller size than the first cluster (see [0506], Labeling may be largely performed in two parts. One is to attach a unique index to an attack identifier defined in a standardized model, and the other is to write information about a user creating attack code.
[0506] Labeling is assigned according to an attack identifier (T-ID) reflected in a standardized model, for example, MITRE ATT&CK, so that accurate information may be delivered to the user without additional work.
[0507] In addition, labeling is assigned to distinguish not only an attack identifier but also an attacker implementing the attack identifier. Therefore, labeling may be provided so that it is possible to identify not only an attack identifier, but also an attacker and an implementation method accordingly.
[0508] In an embodiment, advanced profiling is possible based on data learned from a data set of disassembled code (opcode, ASM code, or a combination thereof) previously classified. In an embodiment, data of the static analysis, dynamic analysis, or correlation analysis disclosed above may be utilized as reference data for performing labeling. Therefore, even when a data set has not been previously analyzed, profiling data may be obtained significantly rapidly and efficiently by considering results of static, dynamic, and correlation analysis together [0016], performing clustering based on the extracted opcode-and-ASM code combination for each function to generate at least one cluster of the first user, and determining similarity between the extracted opcode-and-ASM code combination for each function and an opcode-and-ASM code combination for each function included in a cluster of a second user, and providing information related to the executable file to the second user when the similarity between the extracted opcode-and-ASM code combination for each function and at least one opcode-and-ASM code combination for each function included in the cluster of the second user is greater than a preset threshold value).
As to claim 6, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein splitting the files that belong to the first cluster into two or more subclusters narrowing comprises modifying a threshold associated with the similarity measure (see [0016], performing clustering based on the extracted opcode-and-ASM code combination for each function to generate at least one cluster of the first user, and determining similarity between the extracted opcode-and-ASM code combination for each function and an opcode-and-ASM code combination for each function included in a cluster of a second user, and providing information related to the executable file to the second user when the similarity between the extracted opcode-and-ASM code combination for each function and at least one opcode-and-ASM code combination for each function included in the cluster of the second user is greater than a preset threshold value).
As to claim 7, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein the file encoder trained model is an encoder model associated with a trained autoencoder model (see [0544], There are methods such as voting, bagging, and boosting as a method of combining learning results of several classification nodes of an ensemble machine learning model. An ensemble machine learning model that properly combines these methods may contribute to increasing classification accuracy of training data.) (see Kim, [0038] In some implementations, the neural network 112 can be a narrow and deep neural network. For example, in some implementations, the narrow and deep neural network can include a 64-node width and a 4 or 5 layer depth. As another example, in some implementations, the narrow and deep neural network can include no more than 128 inputs and at least 6 layers. As another example, in some implementations, the narrow and deep neural network can include a number of inputs corresponding to a block size of a feature vector (e.g. feature vector 247) to be input (e.g., 128 input nodes to receive an input vector of block size 128, 512 input nodes to receive an input vector of block size 512, etc.). In other implementations, the neural network can have any other suitable number of input nodes (e.g., 16, 32, 256, etc.) and/or any other suitable number of layers (e.g., 6, 7, 8, 9, 10, etc.).
[0039] Advantageously, this can enhance an implementation scalability of the neural network 112 and reduce the chance that the neural network is prone to overfitting. Specifically, the width of the neural network can be proportional to a size and complexity of a feature space (e.g., of feature vector 247). In particular, a width of a neural network to which an input vector can be provided can be proportional to a size of a feature space of the input vector. Advantageously, implementing such a narrow neural network can reduce or limit a size of a feature space of an input vector (e.g., feature vector 247), to thereby increase a scalability of the neural network 112 and reduce overfitting of the neural network 112. Moreover, the depth of the neural network 112 can increase the analysis of interactions between different features. For example, having a deep neural network 112 increases the analysis and/or examination of interactions between features. This allows the neural network 112 to better identify maliciousness based on the interactions of features (e.g., based on the interaction and/or presence of multiple scripts or macros). In some implementations, for example, the feature vector 247 can be provided such that the neural network 112 detects an interaction between a script from the set of scripts and at least one other script from the set of scripts, where the output is based at least in part on the interaction).
As to claim 8, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein generating the file embedding vector corresponding to each file obtaining features from the files further comprises processing outputs from the trained encoder model using an another trained model, wherein the another trained model has one of the following architectures: a convolutional neural network architecture, a transformer architecture (see [0544], There are methods such as voting, bagging, and boosting as a method of combining learning results of several classification nodes of an ensemble machine learning model. An ensemble machine learning model that properly combines these methods may contribute to increasing classification accuracy of training data.) (see Harang, [0038] In some implementations, the neural network 112 can be a narrow and deep neural network. For example, in some implementations, the narrow and deep neural network can include a 64-node width and a 4 or 5 layer depth. As another example, in some implementations, the narrow and deep neural network can include no more than 128 inputs and at least 6 layers. As another example, in some implementations, the narrow and deep neural network can include a number of inputs corresponding to a block size of a feature vector (e.g. feature vector 247) to be input (e.g., 128 input nodes to receive an input vector of block size 128, 512 input nodes to receive an input vector of block size 512, etc.). In other implementations, the neural network can have any other suitable number of input nodes (e.g., 16, 32, 256, etc.) and/or any other suitable number of layers (e.g., 6, 7, 8, 9, 10, etc.).
[0039] Advantageously, this can enhance an implementation scalability of the neural network 112 and reduce the chance that the neural network is prone to overfitting. Specifically, the width of the neural network can be proportional to a size and complexity of a feature space (e.g., of feature vector 247). In particular, a width of a neural network to which an input vector can be provided can be proportional to a size of a feature space of the input vector. Advantageously, implementing such a narrow neural network can reduce or limit a size of a feature space of an input vector (e.g., feature vector 247), to thereby increase a scalability of the neural network 112 and reduce overfitting of the neural network 112. Moreover, the depth of the neural network 112 can increase the analysis of interactions between different features. For example, having a deep neural network 112 increases the analysis and/or examination of interactions between features. This allows the neural network 112 to better identify maliciousness based on the interactions of features (e.g., based on the interaction and/or presence of multiple scripts or macros). In some implementations, for example, the feature vector 247 can be provided such that the neural network 112 detects an interaction between a script from the set of scripts and at least one other script from the set of scripts, where the output is based at least in part on the interaction.)
As to claim 9, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein clustering the set of files comprises applying a dimensionality reduction technique relying on either principal component analysis, or t-distributed stochastic neighbor embedding (t-SNE) (see [0016] In accordance with an aspect of the present invention, the above and other objects can be accomplished by the provision of a cyber threat information processing method including receiving input of a first user request signal for requesting analysis of an executable file, extracting an opcode-and-ASM code combination for each function of the executable file by analyzing the executable file according to the first user request signal, performing clustering based on the extracted opcode-and-ASM code combination for each function to generate at least one cluster of the first user, and determining similarity between the extracted opcode-and-ASM code combination for each function and an opcode-and-ASM code combination for each function included in a cluster of a second user, and providing information related to the executable file to the second user when the similarity between the extracted opcode-and-ASM code combination for each function and at least one opcode-and-ASM code combination for each function included in the cluster of the second user is greater than a preset threshold value.)
As to claim 10, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein clustering the set of files comprises applying on the features one of the following: K-means clustering, hierarchical clustering or density-based spatial clustering of applications with noise (DBSCAN) (see [0016]).
As to claim 11, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein clustering the set of files comprises determining an HNSW graph, wherein each nodes of the HNSW graph correspond to features associated with only one file, and wherein the HNSW graph is determined iteratively, adding nodes one by one, and wherein clustering the files further comprises obtaining a similarity matrix associated with the HNSW graph, and processing the similarity matrix to identity clusters (see fig.28, Euclidean distance matrix, which may represent similarity between two data sets.)
As to claim 12, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein obtaining the similarity matrix comprises determining pairwise distances between all nodes in the HNSW graph, and wherein the distances are either Euclidean distances or cosine similarity distances (see FIG. 28 is a diagram illustrating a result of identifying an attack identifier according to an embodiment, which illustrates a Euclidean distance matrix, which may represent similarity between two data sets).
As to claim 13, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein the set of files are binary files (see [0124], analyze the file itself, and it is possible to obtain information about whether there is a weak item based on coding, a problem with a call structure of an interface or function, or a binary structure of a file).
As to claim 17, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein the binary files are executable files that comprise compiled code (see [0124], static analysis is to analyze the file itself, and it is possible to obtain information about whether there is a weak item based on coding, a problem with a call structure of an interface or function, or a binary structure of a file.)
As to claim 18, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed wherein the new classification of the new file comprises a malware classification or a non-malware classification (see [0430] and [0661]-[0064], malware).
As to claim 19, the combination of : the combination Harang and Kim discloses the invention as claimed. In addition, Kim discloses the claimed refraining from executing the new file when the new classification of the new file is the malware classification(see [0430] malware).
As to claims 14-15 and 20, claims 14-15 and 20 are computer readable medium having instructions for executing the method of claims 1-3, 5-13 and 17-19 above. They are rejected under the same rationale.
As to claims 16 and 21, claims 16 and 21 are system for performing the method of claims 1-3, 5-13 and 17-19 above. They are rejected under the same rationale.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
2023/0141853 (involved in obtaining (1404) a sequence of n-grams of a textual unit. An embedding layer is used (1408) to obtain an ordered set of embedding vectors for the sequence of n-grams. A deep network i.e. trained convolutional neural network, is used (1412) to obtain encoded vector that is based on the ordered set. A classifier is used (1416) for obtaining a language prediction for the textual unit that is based on an encoded vector. A component vector is selected from among a set of component vectors based on a hash value. An embedding vector is obtained for the n-gram that is based on the component vectors.)
2017/0300691 (involved in normalizing the code segments to improve matching accuracy by reducing waterfall fouling caused by minor changes to the executable code. The device is capable of filtering known-good code segments to improve performance, thus allowing automated or semi-automated analysis of emerging threats and reducing total calculation time by reducing problem space for calculation of similarity values.)
2018/0285773 (involved in receiving an electronic request to label a transaction associated with a user, where the electronic request includes a descriptive string describing the transaction. A set of grams is extracted from the descriptive string. A set of features is generated for the transaction based on the set of grams. Determination is made a label for the transaction receives a set of features as input through a machine-learning model. The label is provided in response to the electronic request. A preliminary grouping that is bound to substring of the descriptive string in an associative array is identified)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JEAN M CORRIELUS whose telephone number is (571)272-4032. The examiner can normally be reached Monday-Friday 6:30a-10p(Midflex).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ann J Lo can be reached at (571)272-9767. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JEAN M CORRIELUS/Primary Examiner, Art Unit 2159 June 12, 2026
Prosecution Insights