DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA and is in response to communications filed on 3/26/2026 in which claims 1-20 are presented for examination.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 7-9 and 14-15, 16-20 are rejected under 35 U.S.C. 103 as being unpatentable over Vittal et al. US 10303797 B1 (hereinafter referred to as “Vittal”) in view of Saxe et al. US 20190236273 A1 (hereinafter referred to as “Saxe”) and further in view of Puttagunta et al. US 20250315447 A1 (hereinafter referred to as “Puttagunta”).
As per claim 1, Vittal teaches:
A computer-implemented method for determining a subset of files from a set of files, wherein the method comprises:
obtaining features from the set of files (Vittal, [0056] – Generate clusters of similar services records by extracting key text features from service records, wherein extraction is interpreted as obtaining and service records are interpreted as types of files), …
clustering the files based on a similarity measure between the features comprising the histogram vector generated for the given file, wherein a cluster of files comprises files that are near duplicates to each other (Vittal, [0060] – The terms in a matrix U measure similarity between individual records to q concepts or groups. The matrix U obtained from singular values is used as an input to a clustering algorithm);
…
training a machine learning model using a training dataset generated from the subset of files to identify malware files included in the training dataset (Vittal, [0063] – Classifies and analyzes clusters to identify new failure modes or categories, wherein analyzing cluster is interpreted as sampling clusters and identifying new failure modes or categories is interpreted as determining subsets. Also, [0064] – Identifies emerging clusters).
Vittal as modified doesn’t explicitly teach clusters and subsets of the clusters of files, however, Puttagunta teaches:
wherein obtaining the features for a given file comprises:
selecting a plurality of groups of bytes according to a sliding window from the given file (Saxe, [0041] – Such n-grams can be defined using a rolling and/or sliding window such that each byte and/or character can be in multiple n-grams of the same size and/or of different sizes);
applying a hash function to the groups of bytes to generate a plurality of hash values (Saxe, [0041] – The feature vector generator can be configured to provide each n-gram as in input to a hash function to define a feature vector based on the representation-grams of varying lengths); and
generating a histogram vector that comprises, for each possible hash value corresponding to the hash function, a number that represents a total count that the possible hash value has been generated by applying the hash function to the groups of bytes (Saxe, [0021] – Defining feature vectors (e.g., histograms) based on lengths of each string from the multiple strings. [0041] – N-gram Histograms can be derived from taking N-gram frequencies over raw bytes and/or strings. For example, 3,4,5, and/or 6-gram representations can be used, and a hash function can be applied to fix the dimensionality of the input feature space);
It would have been obvious for one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify Vittal’s invention in view of Saxe in order to determine bytes of files and use hash functions for specific determinations; this is a advantageous for determining potentially malicious files (Saxe, paragraph [0035]).
Vittal as modified doesn’t explicitly teach clusters and subsets of the clusters of files, however, Puttagunta teaches:
determining, by sampling the clusters of files, a subset of files that comprises a smaller number of files than the set of files (Puttagunta, [0003] – Identifying, within each of the plurality of data clusters, a respective subset of datapoints comprising a threshold amount of information corresponding to a total amount of information of the respective data cluster); and
It would have been obvious for one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify Vittal’s invention in view of Puttagunta in order to determine representative files of a cluster; this is a known technique of filtering and has been used in similar devices. It’s also advantageous for sorting or grouping records in a database (Puttagunta, paragraph [0003]).
As per claim 2, Vittal doesn’t explicitly teach determining representative files of each cluster, however, Puttagunta teaches:
The computer-implemented method of claim 1, wherein determining a subset of files by sampling the clusters of files further comprises determining representative files for the clusters of files (Puttagunta, [0020] – Identify a data cluster for an input data record based on a spatial distance to a representative subset of data records corresponding to the data cluster).
It would have been obvious for one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify Vittal’s invention in view of Puttagunta in order to determine representative files of a cluster; this is advantageous because the system can precisely identify new records that are similar enough to the cluster for adding (Puttagunta, paragraph [0022]).
As per claim 7, Vittal teaches:
The computer-implemented method of claim 1, wherein the set of files comprises at least 100 000 000 files, and wherein the subset of files comprises fewer than 1 000 000 files (Saxe, [0047] – Indication of byte values within a sliding window having that entropy, and can provide a visualization for a frequency at which various bytes appear in file windows having a specific entropy).
Claim 8 is directed to a computer-readable medium performing steps recited in claim 1 with substantially the same limitations. Therefore, the rejection made to claim 1 is applied to claim 8.
Claim 9 is directed to a computer-readable medium performing steps recited in claim 2 with substantially the same limitations. Therefore, the rejection made to claim 2 is applied to claim 9.
Claim 14 is directed to a computer-implemented system performing steps recited in claim 1 with substantially the same limitations. Therefore, the rejection made to claim 1 is applied to claim 14.
Claim 15 is directed to a computer-implemented system performing steps recited in claim 2 with substantially the same limitations. Therefore, the rejection made to claim 2 is applied to claim 15.
As per claim 16, Vittal teaches:
The computer-implemented method of claim 1, wherein the set of files comprise at least one of binary files or source code files (Saxe, [0029] – The OLE2 standard was set forth by Microsoft® and is also known as the Compound File Binary Format or Common Document File Format. These streams can be viewed as sub-files and contain text, Visual Basic for Applications (VBA) macros, JavaScript, formatting objects, images, and even executable binary code).
As per claim 17, Vittal teaches:
The computer-implemented method of claim 1, wherein the machine learning model comprises a neural network or a decision tree model (Saxe, [0034] – Types of machine learning classifiers can be used as alternatives or in addition to DNN and/or XGB classifiers (e.g., a linear support vector machine, a random forest, a decision tree, etc.)).
As per claim 18, Vittal teaches:
The computer-readable medium of claim 8, wherein the set of files comprise at least one of binary files or source code files (Saxe, [0029] – The OLE2 standard was set forth by Microsoft® and is also known as the Compound File Binary Format or Common Document File Format. These streams can be viewed as sub-files and contain text, Visual Basic for Applications (VBA) macros, JavaScript, formatting objects, images, and even executable binary code).
As per claim 19, Vittal teaches:
The computer-readable medium of claim 8, wherein the machine learning model comprises a neural network or a decision tree model (Saxe, [0034] – Types of machine learning classifiers can be used as alternatives or in addition to DNN and/or XGB classifiers (e.g., a linear support vector machine, a random forest, a decision tree, etc.)).
As per claim 20, Vittal teaches:
The computer-implemented system of claim 14, wherein the set of files comprise at least one of binary files or source code files (Saxe, [0029] – The OLE2 standard was set forth by Microsoft® and is also known as the Compound File Binary Format or Common Document File Format. These streams can be viewed as sub-files and contain text, Visual Basic for Applications (VBA) macros, JavaScript, formatting objects, images, and even executable binary code).
Claims 3 and 10 are rejected under 35 U.S.C. 103 as being unpatentable over Vittal in view of Saxe in view of Puttagunta and further in view of Boukhtouta et al. US 20210227014 A1 (hereinafter referred to as “Boukhtouta”).
As per claim 3, Vittal as modified doesn’t teach determining density of a cluster or any other characteristic, and based on the characteristic, splitting or segregating the cluster, however, Boukhtaouta teaches:
The computer-implemented method of claim 1, wherein determining a subset of files further comprises, for a given cluster, determining a density of files within the given cluster from the obtained features, and in the case that the given cluster has a low density, splitting the given cluster into a plurality of clusters (Boukhtouta, [0038] – Identifying the one or more clusters may be performed using a density based clustering algorithm, which may be capable of segregating between high, moderate and low density regions in a data set).
It would have been obvious for one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify Vittal’s invention in view of Boukhtouta in order to determine characteristics of a cluster and splitting the cluster based on the characteristic; this is advantageous because the system can determine the cluster quality and verify the clusters based on the scoring (Puttagunta, paragraph [0022]).
Claim 10 is directed to a computer-readable medium performing steps recited in claim 3 with substantially the same limitations. Therefore, the rejection made to claim 3 is applied to claim 10.
Claims 4 and 11 are rejected under 35 U.S.C. 103 as being unpatentable over Vittal in view of Saxe in view of Puttagunta and further in view of Wang et al. US 20140172870 A1 (hereinafter referred to as “Wang”).
As per claim 4, Vittal teaches:
The computer-implemented method of claim 1, wherein determining a subset of files further comprises, for a given cluster, determining a variance of files within the given cluster from the obtained features, and in the case that the given cluster has a high variance, splitting the given cluster into a plurality of clusters (Wang, [0046] – Compute the data covariance matrix (as in variance maximization 218) or O(n.sup.2d) to compute data similarity matrix (as in cluster separation 220)).
Claim 11 is directed to a computer-readable medium performing steps recited in claim 4 with substantially the same limitations. Therefore, the rejection made to claim 4 is applied to claim 11.
Claims 5 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Vittal in view of Saxe in view of Puttagunta in view of Boukhtaouta and further in view of Zhou et al. US 20250308265 A1 (hereinafter referred to as “Zhou”).
As per claim 5, although Vittal in view of Boukhataouta teaches cluster splitting based on characteristics, Vittal as modified doesn’t explicitly teach an eccentricity characteristic of a cluster, however, Zhou teaches:
The computer-implemented method of claim 1, wherein determining a subset of files further comprises, for a given cluster, determining an elliptic envelope of the given cluster, and in the case that an eccentricity of the ellipse envelope is higher than a threshold, splitting the given cluster into a plurality of clusters (Zhou, [0233] – Corresponding to the first 4 partitions of the dendrogram, automatically discovered the notions of area, eccentricity, brightness, and mean speed without any user supervision. Specifically, SAM module 2 ranks clusters 1-7 in increasing eccentricity. From the SAM module expression table, clusters 2 and 6 were identified as normal growth phenotypes based on large size (module 1), relatively bright lumen (module 3), and low moving speed (module 4) in contrast to clusters 4 and 7, which are the smallest (module 1), darkest (module 3) and exhibit the highest moving speed (module 4) and also have morphodynamics of non-growing organoids.
It would have been obvious for one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify Vittal’s invention in view of Boukhtouta in order to determine characteristics of a cluster and splitting the cluster based on the characteristic; this is advantageous because this enables the system to fully automate discovery and evaluation of the similarity of organoid phenotypes under different treatment conditions. Moreover, the phenotype trajectories can be used to hierarchically cluster conditions analogous to the comparison of transcriptional similarity (Zhou, paragraph [0234]).
Claim 12 is directed to a computer-readable medium performing steps recited in claim 5 with substantially the same limitations. Therefore, the rejection made to claim 5 is applied to claim 12.
Claims 6 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Vittal in view of Saxe in view of Puttagunta in view of Boukhtaouta and further in view of Bose et al. US 20240395412 A1 (hereinafter referred to as “Bose”).
As per claim 6, although Vittal in view of Boukhataouta teaches cluster splitting based on characteristics, Vittal as modified doesn’t teach kurtosis, however, Bose teaches:
The computer-implemented method of claim 1, wherein determining a subset of files further comprises, for a given cluster, determining its kurtosis, and in the case that the kurtosis is low, splitting the given cluster into a plurality of clusters (Bose, [0036] – Identify clusters of observations that have similar mean, variance, skewness, kurtosis, or other higher order cumulants).
It would have been obvious for one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify Vittal’s invention in view of Bose in order to determine kurtosis; this is a simple substation of one cluster characteristic for another and is advantageous to identify kurtosis because this calculates a risk score of the group (Bose, paragraph [0036]).
Claim 13 is directed to a computer-readable medium performing steps recited in claim 6 with substantially the same limitations. Therefore, the rejection made to claim 6 is applied to claim 13.
Response to Arguments
The 101 Judicial Exception rejection has been withdrawn due to the claim amendments and the arguments made in Remarks of 3/26/2026.
Applicant’s arguments with respect to claims have been considered but are generally moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
Wong et al. US 12282453 B2 teaches common and unique fingerprint counts to approximate the distance between the file cluster and the other file cluster (Abstract).
Nissim et al. “ALDOCX: Detection of Unknown Malicious Microsoft Office Documents Using Designated Active Learning Methods Based on New Structural Feature Extraction Methodology”, https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=7762928, pgs. 631-646
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Matthew J. Ellis whose telephone number is (571)270-3443. The examiner can normally be reached on Monday-Friday 8AM-5PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kavita Stanley can be reached at (571) 272-8352. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
June 13, 2026
/MATTHEW J ELLIS/Primary Examiner, Art Unit 2153
Prosecution Insights