Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This office action is in response to the communication filed on 6/25/2026.
Response to Arguments
Applicant's arguments filed 6/25/2026 have been fully considered but they are not persuasive.
The applicants’ provided no actual argument regarding the amended claims compared to the teachings of Jung. As such, the arguments/assertions are moot and unpersuasive. The examiner has addressed the amended claims below with regards to Jung.
All objections and rejections not set forth below have been withdrawn.
Claims 1, 4, 8, 11, 15, and 18 have been examined.
Information Disclosure Statement
The information disclosure statements (IDS) submitted are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statements are being considered by the examiner.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1, 4, 8, 11, 15, and 18 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Jung (US Patent Application Publication Number 2020/0201998).
Regarding claims 1, 8, and 15, Jung disclosed a system, comprising: a processor configured to:
monitor changes in a memory during execution of a malware sample in a computing environment to obtain an application programming interface (API) vector comprising a plurality of system API function pointers in the memory during execution of the malware sample in the computing environment (Jung Fig. 9 and Paragraphs 0111-0117 for example); comprising to:
compare an initial snapshot of all of a plurality of pages in the memory associated with a process with a final snapshot of all of the plurality of pages in the memory associated with the process of the malware sample in the computing environment to identify programmatically generated system API function pointers (Jung Fig. 9 and Paragraphs 0111-0117 for example);
order, based on an order in which the programmatically generated system API function pointers are stored in the memory, the programmatically generated system API function pointers to obtain ordered programmatically generated system API function pointers (Jung Fig. 10 and Paragraphs 0127-0133 for example);
identify system API function pointers in the memory prior to the execution of the malware sample to obtain identified system API function pointers (Jung Fig. 10 and Paragraphs 0127-0133 for example);
filter the identified system API function pointers from the ordered programmatically generated system API function pointers to generate the API vector (Jung Fig. 10 and Paragraphs 0127-0133 for example);
detect a dynamic evasion behavior using the API vector (Jung Fig. 10 and Paragraphs 0127-0133 for example; and
perform a signature match of the API vector for automatically detecting malware during execution of the malware sample in the memory, wherein the malware sample was determined to be malicious (Jung Fig. 9 and Paragraphs 0111-0117 for example); and
a data storage coupled to the processor and configured to provide the processor with instructions (Jung Fig. 9 and Paragraphs 0111-0117 for example).
Regarding claims 4, 11, and 18, Jung disclosed that the computing environment comprises a virtual machine instance (Jung Figs. 1 and 9 and Paragraphs 0111-0117 for example).
Conclusion
Claims 1, 4, 8, 11, 15, and 18 have been rejected.
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US 9,165,142 taught a system for malware family identification using profile signatures including an API monitoring engine.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MATTHEW T HENNING whose telephone number is (571)272-3790. The examiner can normally be reached Monday-Friday 9AM-3PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, William Korzuch can be reached at (571)272-7589. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MATTHEW T HENNING/ Primary Examiner, Art Unit 2491
Prosecution Insights