CTNF 18/985,680 CTNF 85597 DETAILED ACTION The instant application having Application No. 18/985680 filed on December 18, 2024 is presented for examination by the examiner. 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Internet Communications Applicant is encouraged to submit a written authorization for Internet communications (PTO/SB/439, found at http:/www.uspto.gov/sites/default/files/documents/sb0439.pdf) in the instant patent application to authorize the examiner to communicate with the applicant via email. The authorization will allow the examiner to better practice compact prosecution. The written authorization can be submitted via one of the following methods only: (1) Central Fax, which can be found in the Conclusion section of this Office action; (2) regular postal mail; (3) EFS WEB; or (4) the service window on the Alexandria campus. EFS web is the recommended way to submit the form since this allows the form to be entered into the file wrapper within the same day (system dependent). Written authorization submitted via other methods, such as direct fax to the examiner or email, will not be accepted. See MPEP § 502.03. Applicant is also encouraged to contact the Examiner for an Interview, should the Applicant determine that clarifying and further illustrating the distinguishing features of the instant application may further the prosecution. Oath/Declaration The applicant’s oath/declaration has been reviewed by the examiner and is found to conform to the requirements prescribed in 37 C.F.R. 1.63. Drawings The applicant’s drawings submitted are acceptable for examination purposes. Claim Rejections - 35 USC § 101 07-04-01 AIA 07-04 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 15-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. As per claim 15, this issue is raised as the disclosure of the invention does not limit nor exclude signals from the broadest reasonable interpretation of a computer-readable medium. Applicant claims a computer readable storage media having instructions stored thereon which, when executed by a processor, causes the processor to perform method steps. The claimed computer readable storage media can be broadly and reasonably interpreted as a signal. It has been noted that the ordinary and customary meaning of "computer-readable medium" to a person of ordinary skill in the art is broad enough to encompass both non-transitory and transitory media. See Ex Parte Mewherter (Appeal 2012-007692) ( Precedential ). Transitory, propagating signals such as carrier waves are not within any of the four statutory categories (process, machine, manufacture or composition of matter). Therefore, a claim directed to computer instructions embodied in a signal is not statutory under 35 U.S.C. 101. In re Nuijten , 500 F.3d 1346, 1354 (Fed. Cir. 2007). The subject matter of claims permitted within 35 U.S.C. 101 must be a machine, a manufacture, a process, or a composition of matter. "[t]he four categories [of § 101] together describe the exclusive reach of patentable subject matter. If the claim covers material not found in any of the four statutory categories, that claim falls outside the plainly expressed scope of § 101 even if the subject matter is otherwise new and useful.” In re Nuijten , 500 F.3d 1346, 1354 (Fed. Cir. 2007); accord In re Ferguson , 558 F.3d 1359 (Fed. Cir. 2009). The Examiner suggests amending the “computer readable storage media” to be a “non-transitory computer readable storage media” as is current USPTO practice. Claim Rejections - 35 USC § 102 07-07-aia AIA 07-07 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – 07-08-aia AIA (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention. 07-12-aia AIA (a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention. 07-15 AIA Claim s 1-5, 7-10, 12-13, 15-18, and 20 are rejected under 35 U.S.C. 102( a)(1 ) as being anticipated by Dozortsev (US 2003/0177394) . As per claims 1, 7, and 15, Dozortsev discloses A computing apparatus comprising: a computer-readable storage media; a security control engine comprising processor-executable instructions stored on the computer-readable storage media; and a processor coupled to the computer-readable storage media and configured to execute the processor-executable instructions, wherein the processor-executable instructions, when executed by the processor, direct the computing apparatus, to at least (Dozortsev, paragraphs 10-11, teaches monitoring for malicious executable code. Therefore, there must be a memory to store instructions and a processor to execute the instructions. Dozortsev, paragraph 10, also recites an end-user’s PC which would contain a processor and memory.) : detect a request to execute a first file from a client device (Dozortsev, paragraphs 10-11, teaches detecting executable code.) ; parse the first file to determine a first filename pattern (Dozortsev, paragraphs 10-11, teaches detecting the executable codes filename.) ; determine that the first filename pattern indicates potential malicious activity (Dozortsev, paragraphs 10-11, teaches that the filename can indicate that the executable is malicious.) ; determine file activity history associated with the client device (Dozortsev, paragraphs 10-11, teaches checking the behavior of the executable file.) ; and prevent execution of the first file based on the first filename pattern of the first file and the file activity history associated with the client device (Dozortsev, paragraphs 10-11, teaches preventing the executable code from executing if the file is determined to be malicious.) Claims 7 and 15 recite the additional limitation of “a first file comprising a first filename and a first filename string” (Dozortsev, paragraphs 10-11, teaches detecting the executable codes filename. It is inherent that the file contains a filename and a filename string. For example, the file test.exe contains the filename “test” and the filename string of “test.exe”.) As per claim 2, Dozortsev discloses The computing apparatus of claim 1, wherein the processor-executable instructions to determine the file activity history associated with the client device, when executed by the processor, further direct the computing apparatus to: determine a plurality of file interactions performed by the client device within a first time period; determine a plurality of filename patterns associated with the plurality of file interactions; and determine that the plurality of filename patterns lacks the first filename pattern (Dozortsev, paragraphs 43 and claims 12-13, teaches a database containing the usage history of previous executables and their signatures. As the “first time period” is not specifically defined, it can be considered as any time period. Dozortsev, paragraphs 10-11, teaches the signature can include the filename. If there is no history of the “first file”, this would indicate that the “first file” has not previously been executed by the client device.) As per claim 3, Dozortsev discloses The computing apparatus of claim 1, wherein the processor-executable instructions when executed by the processor, further direct the computing apparatus to: receive an indication that the first file is legitimate; determine an execution policy associated with the client device; modify the execution policy for files comprising the first filename pattern; and grant the request to execute the first file for the client device (Dozortsev, paragraph 15, teaches allowing the execution of executable code if its on a list of approved executable codes. Dozortsev, paragraphs 20-28, teaches determining if the executable code is good or bad and building a profile of known good and known bad executable codes. If the executable code is bad it is deleted and prevented from executing. If the executable code is good it is allowed to execute.) As per claim 4, Dozortsev discloses The computing apparatus of claim 1, wherein the processor-executable instructions to, when executed by the processor, further direct the computing apparatus to: receive a second request to execute a second file from the client device; determine a second filename pattern of the second file; determine that the second filename pattern indicates potential malicious activity; and allow execution of the second file based on the file activity history of the client device and the second filename pattern (Dozortsev, paragraphs 10-11, teaches detecting the executable codes filename that can indicate that the executable is malicious. Dozortsev, paragraph 13, teaches treating executables that attempt to send or receive data over a network as potentially malicious and then requesting the user to make a determination of whether the executable is safe to execute or not. Dozortsev, paragraphs 20-28, teaches detecting a potentially malicious executable and then requesting the central computer to determine if the executable is actually malicious or not. Therefore, an executable that is indicated as being potentially malicious can be determined to be a legitimate executable and allowed to execute. Dozortsev, paragraph 43, also teaches using the system over multiple sessions; therefore, the system can detect multiple potentially malicious executables.) As per claim 5, Dozortsev discloses The computing apparatus of claim 1, wherein the processor-executable instructions to prevent execution of the first file based on the first filename pattern of the first file and the file activity history associated with the client device, when executed by the processor, further direct the computing apparatus to: analyze the file activity history associated with the client device to determine whether the client device historically interacts with files comprising the first filename pattern; and block execution of the first file based on the client device historically interacting files lacking the first filename pattern (Dozortsev, paragraphs 10-11, teaches checking the filename to see if the executable code is malicious. Dozortsev, paragraphs 10-11, also teaches checking the behavior of the executable file to determine if the executable code is malicious. Dozortsev, paragraphs 10-11, teaches preventing the executable code from executing if the file is determined to be malicious.) As per claim 8, Dozortsev discloses The method of claim 7, wherein determining, by the security control engine, the file activity history associated with the client first devices comprises: determining, by the security control engine, a plurality of client devices associated with the first client device; determining, by the security control engine, a file activity history associated with the plurality of client devices; and determining, by the security control engine, the first file activity history based on the file activity history associated with the plurality of client devices (Dozortsev, paragraph 15, teaches allowing the execution of executable code if its on a list of approved executable codes. Dozortsev, paragraphs 22-26, teaches determining if the executable code is good or bad and building a profile of known good and known bad executable codes from multiple devices. If the executable code is bad it is deleted and prevented from executing. If the executable code is good it is allowed to execute.) As per claim 9, Dozortsev discloses The method of claim 7, wherein the method further comprises: determining, by the security control engine, that the first file is legitimate; and modifying, by the security control engine, the first execution policy for the first client device responsive to determining that the first file is legitimate, wherein modifying the first execution policy comprises allowing the first client device to execute files comprising the first filename pattern (Dozortsev, paragraph 15, teaches allowing the execution of executable code if its on a list of approved executable codes. Dozortsev, paragraphs 22-26, teaches determining if the executable code is good or bad and building a profile of known good and known bad executable codes. If the executable code is bad it is deleted and prevented from executing. If the executable code is good it is allowed to execute.) As per claim 10, Dozortsev discloses The method of claim 7, wherein: determining, by the security control engine, the first file activity history associated with the first client device comprises: determining, by the security control engine, a plurality of file interactions during which the first client device executed files comprising malicious content; and determining, by the security control engine, the first execution policy for the first client device based on the first file activity history and the first filename pattern comprises: determining, by the security control engine, the first execution policy for the first client device based on the plurality of file interactions involving execution of files comprising malicious content, wherein the first execution policy prevents the first client device from executing files comprising the first filename pattern (Dozortsev, paragraph 15, teaches allowing the execution of executable code if its on a list of approved executable codes. Dozortsev, paragraphs 22-26, teaches determining if the executable code is good or bad and building a profile of known good and known bad executable codes. If the executable code is bad it is deleted and prevented from executing. If the executable code is good it is allowed to execute.) As per claim 12, Dozortsev discloses The method of claim 7, wherein the method further comprises: updating, by the security control engine, the first file activity history to indicate that the first client device submitted the execution request to open the first file comprising the first filename pattern (Dozortsev, paragraphs 22-26, teaches determining if the executable code is good or bad and building a profile of known good and known bad executable codes. This would only be performed after the executable is scanned prior to execution.) As per claim 13, Dozortsev discloses The method of claim 7, wherein the method further comprises: detecting, by the security control engine, a second execution request to open the first file from a second client device; determining, by the security control engine, a second file activity history associated with the second client device; and granting, by the security control engine, the second execution request to open the first file based on the second file activity history and the first filename pattern (Dozortsev, paragraphs 10-11, teaches detecting the executable codes filename and behavior that can indicate that the executable is malicious. Dozortsev, paragraphs 20-28, teaches detecting a potentially malicious executable and then requesting the central computer to determine if the executable is actually malicious or not. Therefore, an executable that is indicated as being potentially malicious can be determined to be a legitimate executable and allowed to execute. Dozortsev, paragraphs 20-28, also teaches using the system for multiple client devices. Dozortsev, paragraphs 22-26, teaches determining if the executable code is good or bad and building a profile of known good and known bad executable codes from multiple devices. If the executable code is bad it is deleted and prevented from executing. If the executable code is good it is allowed to execute. Dozortsev, paragraph 26, also teaches that the profile of good and bad executables can be different for each client computer. Therefore, an executable that is allowed to execute on one client device may be blocked from execution on another client device based on the device profiles.) As per claim 16, Dozortsev discloses The computer readable storage media of claim 15, wherein: the processor-executable instructions to determine, by the security control engine, the file activity history for at least one client device cause the processor to further execute processor-executable instructions stored in the computer readable storage media to: determine, by the security control engine, a plurality of file executions performed by the at least one client device within a first time period; and determine, by the security control engine, that the plurality of file executions performed within the first time period lacks files comprising the first filename pattern; and the processor-executable instructions to block, by the security control engine, execution of the first file based on the execution policy and the file activity history for the at least one client device cause the processor to further execute processor-executable instructions stored in the computer readable storage media to: block, by the security control engine, execution of the first file based on the plurality of file executions performed within the first time period lacking files comprising the first filename pattern (Dozortsev, paragraphs 43 and claims 12-13, teaches a database containing the usage history of previous executables and their signatures. As the “first time period” is not specifically defined, it can be considered as any time period. Dozortsev, paragraphs 10-11, teaches the signature can include the filename. If there is no history of the “first file”, this would indicate that the “first file” has not previously been executed by the client device. Dozortsev, paragraphs 10-11 and 20-28, teaches preventing the executable code from executing if the file is determined to be malicious.) As per claim 17, Dozortsev discloses The computer readable storage media of claim 15, wherein the processor-executable instructions cause the processor to further execute processor-executable instructions stored in the computer readable storage media to: receive, by the security control engine, an indication that the first file is legitimate; and modify, by the security control engine, the execution policy for files comprising the first filename pattern for the at least one client device (Dozortsev, paragraph 15, teaches allowing the execution of executable code if its on a list of approved executable codes. Dozortsev, paragraphs 22-26, teaches determining if the executable code is good or bad and building a profile of known good and known bad executable codes. If the executable code is bad it is deleted and prevented from executing. If the executable code is good it is allowed to execute.) As per claim 18, Dozortsev discloses The computer readable storage media of claim 15, wherein the processor-executable instructions cause the processor to further execute processor-executable instructions stored in the computer readable storage media to: detect, by the security control engine, a request to execute a second file from the at least one client device; determine, by the security control engine, a second filename or second filename string of the second file; determine, by the security control engine, a second execution policy associated with a second filename pattern present in the second filename or the second filename string; and grant, by the security control engine, the request to execute the second file based on the second execution policy and the file activity history for the at least one client device (Dozortsev, paragraphs 10-11, teaches detecting the executable codes filename that can indicate that the executable is malicious. Dozortsev, paragraph 13, teaches treating executables that attempt to send or receive data over a network as potentially malicious and then requesting the user to make a determination of whether the executable is safe to execute or not. Dozortsev, paragraphs 20-28, teaches detecting a potentially malicious executable and then requesting the central computer to determine if the executable is actually malicious or not. Therefore, an executable that is indicated as being potentially malicious can be determined to be a legitimate executable and allowed to execute. Dozortsev, paragraph 43, also teaches using the system over multiple sessions; therefore, the system can detect multiple potentially malicious executables.) As per claim 20, Dozortsev discloses The computer readable storage media of claim 15, wherein: the at least one client device comprises a first client device and a second client device; and the processor-executable instructions to determine, by the security control engine, the file activity history for at least one client device cause the processor to further execute processor-executable instructions stored in the computer readable storage media to: determine, by the security control engine, a first file activity history for a first client device, wherein the first file activity history comprises a plurality of file interactions performed by the first client device for a first plurality of files; determine, by the security control engine, a second file activity history for a second client device, wherein the second file activity history comprises a plurality of file interactions performed by the second client device for a second plurality of files; determine, by the security control engine, a plurality of filename patterns associated with the first plurality of files and the second plurality of files; and determine, by the security control engine, the file activity history for the at least one client device based on the plurality of filename patterns (Dozortsev, paragraph 15, teaches allowing the execution of executable code if its on a list of approved executable codes. Dozortsev, paragraphs 20-28, teaches determining if the executable code is good or bad and building a profile of known good and known bad executable codes from multiple devices. If the executable code is bad it is deleted and prevented from executing. If the executable code is good it is allowed to execute. Dozortsev, paragraphs 20-28, teaches detecting a potentially malicious executable and then requesting the central computer to determine if the executable is actually malicious or not. Therefore, an executable that is indicated as being potentially malicious can be determined to be a legitimate executable and allowed to execute. Dozortsev, paragraph 26, also teaches that the profile of good and bad executables can be different for each client computer. Therefore, an executable that is allowed to execute on one client device may be blocked from execution on another client device based on the device profiles.) Claim Rejections - 35 USC § 103 07-20 AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the invention was made. 07-21-aia AIA Claim s 6, 14, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Dozortsev in view of Hittel (US 9797878) . As per claim 6, 14, and 19, Dozortsev discloses The computing apparatus of claim 1, wherein: the processor-executable instructions to parse the first file to determine a first filename pattern, when executed by the processor, further direct the computing apparatus to: determine at least one of a first filename or a first filename string of the first file; and determine the first filename pattern based on the at least one of the first filename or the first filename string; and the processor-executable instructions to determine that the first filename pattern indicates potential malicious activity (Dozortsev, paragraphs 10-11, teaches that the filename can indicate that the executable is malicious. It is inherent that the file contains a filename and a filename string. For example, the file test.exe contains the filename “test” and the filename string of “test.exe”.) However, Dozortsev does not specifically teach “detect one or more of the following within the at least one of the first filename or the first filename string: a mismatch between a file extension in the first filename indicated in the first filename string and a file type of the first file; hidden characters; bidirectional (Bidi) control characters; Right-To-Left Override (RTLO); non-standard characters; double extensions; or random character string”. Hittel discloses when executed by the processor, further direct the computing apparatus to: detect one or more of the following within the at least one of the first filename or the first filename string: a mismatch between a file extension in the first filename indicated in the first filename string and a file type of the first file; hidden characters; bidirectional (Bidi) control characters; Right-To-Left Override (RTLO); non-standard characters; double extensions; or random character string (Hittel, col. 7 line 30-col. 8 line 11, teaches various file name issues that the invention will determine as malicious such as double extension or wrong file extension.) It would have been obvious to one of ordinary skill in the art before the effective filing date to have combined the teachings of Hittel with the teachings of Dozortsev. Dozortsev teaches using the filename to determine if the file is malicious, but is silent on how this is performed. Hittel teaches various file name issues that will raise a flag that the file is malicious such as a double extension or wrong file extension. Therefore, it would have been obvious for the system of Dozortsev to use the file name issues of Hittel to determine if the file is malicious in order to detect malicious files based on their filenames to improve security against the malicious file issues . 07-21-aia AIA Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Dozortsev in view of Guidry (US 2016/0357958) . As per claim 11, Dozortsev discloses The method of claim 7. However, Dozortsev does not specifically disclose wherein the method further comprises: generating, by the security control engine, a notification indicating that the first file is blocked for the first client device; and transmitting, by the security control engine, the notification to a second client device. Guidry discloses generating, by the security control engine, a notification indicating that the first file is blocked for the first client device; and transmitting, by the security control engine, the notification to a second client device (Guidry, paragraph 72, teaches blocking execution and sending an alert to an administrator.) It would have been obvious to one of ordinary skill in the art before the effective filing date to have combined the teachings of Guidry with the teachings of Dozortsev. Dozortsev teaches using the filename to determine if the file is malicious or not and blocking the malicious files from executing. Guidry teaches sending an alert to an administrator when the execution is blocked. Therefore, it would have been obvious for the system of Dozortsev to send an alert when the malicious file is blocked from execution as in Guidry in order to alert the administrator that an issue has occurred to may need further investigation. Related Prior Art 07-96 AIA The prior art made of record and not relied upon is considered pertinent to applicant's disclosure includes: Kassai (US 2010/0037030) – teaches blocking unauthorized access and notifying the administrator. Singh (US 2011/0107424) – teaches searching for filenames of known malicious files. Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOHN B KING whose telephone number is (571)270-7310. The examiner can normally be reached on Monday-Friday 10AM-6PM EST. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached on 5712728878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /John B King/ Primary Examiner, Art Unit 2498 Application/Control Number: 18/985,680 Page 2 Art Unit: 2498 Application/Control Number: 18/985,680 Page 3 Art Unit: 2498 Application/Control Number: 18/985,680 Page 4 Art Unit: 2498 Application/Control Number: 18/985,680 Page 5 Art Unit: 2498 Application/Control Number: 18/985,680 Page 6 Art Unit: 2498 Application/Control Number: 18/985,680 Page 7 Art Unit: 2498 Application/Control Number: 18/985,680 Page 8 Art Unit: 2498 Application/Control Number: 18/985,680 Page 9 Art Unit: 2498 Application/Control Number: 18/985,680 Page 10 Art Unit: 2498 Application/Control Number: 18/985,680 Page 11 Art Unit: 2498 Application/Control Number: 18/985,680 Page 12 Art Unit: 2498 Application/Control Number: 18/985,680 Page 13 Art Unit: 2498 Application/Control Number: 18/985,680 Page 14 Art Unit: 2498 Application/Control Number: 18/985,680 Page 15 Art Unit: 2498 Application/Control Number: 18/985,680 Page 16 Art Unit: 2498 Application/Control Number: 18/985,680 Page 17 Art Unit: 2498 Application/Control Number: 18/985,680 Page 18 Art Unit: 2498
Prosecution Insights