DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Examiner’s Suggestion
As to claim 16, line 2, the examiner suggests amending the phrase “cause the one or more processors to based on the received set of calls” to “cause the one or more processors to, based on the received set of calls” for improved readability.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-4, 6, 7, 9, 19, and 21-24 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Russello et al. (hereafter referred to as Russello), U.S. Patent App. Pub. No. 2014/0137184 A1.
As to claim 1, Russello discloses a non-transitory machine readable medium storing instructions, which when executed by one or more processors of a data processing system, cause the one or more processors (¶ [0440]) to:
establish a software entity at the data processing system configured to act as a local monitoring entity for the data processing system, the entity having access to data indicating, for each user space application of a plurality of user space applications, an association between (i) a set of multiple calls by the user space application to one or more software functions and (ii) a specific operation of the user space application (Fig. 15; ¶¶ [0182] through [0185], [0394], and [0433]);
receive, at the local monitoring entity, a set of calls by a given user space application of the plurality of user space applications to one or more software functions (Fig. 15; ¶¶ [0182] through [0185], [0394], and [0433]);
determine the set of calls are characteristic of a specific operation of the given user space application by processing the set of calls based on the data (Fig. 15; ¶¶ [0182] through [0185], [0394], and [0433]); and
perform one or both of generating a report regarding the specific operation and influencing functioning of the given user space application (Fig. 15; ¶¶ [0182] through [0185], [0394], and [0433]).
As to claim 2, the claim is rejected for the same reasons as those given for claim 1 above.
As to claim 3, Russello discloses wherein the instructions further cause the one or more processors to signal the OS kernel to determine the set of calls by the given user space application using a kernel mode hook (¶¶ [0378] and [0392]).
As to claim 4, Russello discloses wherein at least one of the set of calls is determined using an event tracing application (¶¶ [0274] and [0280]).
As to claim 6, Russello discloses wherein the specific operation of the given user space application comprises an application programming interface call of the given user space application (¶¶ [0005] and [0006]).
As to claim 7, Russello discloses wherein said processing the set of calls based on the data comprises processing memory addresses specified by the set of calls (¶¶ [0268], [0319], [0334], and [0337]).
As to claims 9 and 19, the claims are rejected for the same reasons as those given for claim 1 above.
As to claim 21, Russello discloses wherein the instructions further cause the one or more processors to terminate the given user space application (¶ [0322]).
As to claim 22, Russello discloses wherein the specific operation of the user space application comprises one or more of opening a file, copying a file, exfiltrating a file and opening a network connection (¶ [0031]).
As to claims 23 and 24, the claims are rejected for the same reasons as those given for claim 1 above.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 5, 8, and 10-13 are rejected under 35 U.S.C. 103 as being unpatentable over Russello, in view of Yu et al. (hereafter referred to as Yu), U.S. Patent App. Pub. No. 2022/0050895 A1.
As to claim 5, Russello is silent on wherein the instructions further cause the one or more processors to receive an event trace log file from the event tracing application and determine the set of calls from the event trace log file.
However, Yu discloses wherein the instructions further cause the one or more processors to receive an event trace log file from the event tracing application and determine the set of calls from the event trace log file (¶¶ [0003] and [0041]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Yu in order to utilize event tracing which is a standardized means of tracking events.
As to claim 8, Russello is silent on wherein the instructions further cause the one or more processors to learn one or more specific operations and respective associated sets of multiple calls based on user activity at the data processing system.
However, Yu discloses wherein the instructions further cause the one or more processors to learn one or more specific operations and respective associated sets of multiple calls based on user activity at the data processing system (¶¶ [0024], [0041], and [0043]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Yu in order to gain the benefits of machine learning such as pattern recognition.
As to claim 10, Russello is silent on wherein the data comprises a trained machine learning model and wherein the trained machine learning model is implemented by the one or more processors to process the set of calls to determine whether the set of calls are characteristic of the specific operation of the given user space application.
However, Yu discloses wherein the data comprises a trained machine learning model and wherein the trained machine learning model is implemented by the one or more processors to process the set of calls to determine whether the set of calls are characteristic of the specific operation of the given user space application (¶¶ [0024] and [0043]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Yu in order to gain the benefits of machine learning such as pattern recognition.
As to claim 11, the claim is rejected for reasons similar to those given for claim 10 above.
As to claim 12, Russello is silent on wherein the data comprises one or more trained classifiers.
However, Yu discloses wherein the data comprises one or more trained classifiers (¶ [0062]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Yu in order to gain the benefits of machine learning such as pattern recognition.
As to claim 13, Russello is silent on wherein the instructions further cause the one or more processors to detect one or more patterns in the set of calls and compare the one or more pattern to patterns specified in the data.
However, Yu discloses wherein the instructions further cause the one or more processors to detect one or more patterns in the set of calls and compare the one or more pattern to patterns specified in the data (¶¶ [0043], [0058], and [0068]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Yu in order to gain the benefits of machine learning such as pattern recognition.
Claims 14-18 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Russello, in view of ERMEY (hereafter referred to as Ermey), U.S. Patent App. Pub. No. 2023/0289444 A1.
As to claim 14, Russello is silent on wherein the data comprises a library of patterns of calls, each pattern having a corresponding associated specific operation of a particular user space application of the plurality of user space applications.
However, Ermey discloses wherein the data comprises a library of patterns of calls, each pattern having a corresponding associated specific operation of a particular user space application of the plurality of user space applications (¶¶ [0203], [0213], [0220], [0224], [0227] through [0229], [0232], [0235] through [0239], [0241], [0244], [0245], [0249], [0252], and [0254]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Ermey in order to utilize a standardized means for organizing data such as libraries.
As to claim 15, Russello is silent on wherein a given specific operation and an associated patterns of calls are determined using application programming interface probes.
However, Ermey discloses wherein a given specific operation and an associated patterns of calls are determined (¶¶ [0203], [0213], [0220], [0224], [0227] through [0229], [0232], [0235] through [0239], [0241], [0244], [0245], [0249], [0252], and [0254]) using application programming interface probes (¶ [0026]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Ermey in order to utilize a standardized means for communicating data between computers or computer programs.
As to claim 16, Russello is silent on wherein the instructions further cause the one or more processors to based on the received set of calls differing from one of the patterns specified in the data by less than a threshold number of calls, determine the received set of calls as being characteristic of the corresponding associated specific operation of the particular user space application corresponding to that one pattern of the patterns and perform one or both of generating a report of the corresponding associated specific operation and influencing functioning of the particular user space application.
However, Ermey discloses wherein the instructions further cause the one or more processors to based on the received set of calls differing from one of the patterns specified in the data by less than a threshold number of calls (¶¶ [0072] and [0133]), determine the received set of calls as being characteristic of the corresponding associated specific operation of the particular user space application corresponding to that one pattern of the patterns and perform one or both of generating a report of the corresponding associated specific operation and influencing functioning of the particular user space application (¶¶ [0203], [0213], [0220], [0224], [0227] through [0229], [0232], [0235] through [0239], [0241], [0244], [0245], [0249], [0252], and [0254]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Ermey in order to ensure adequate similarity between compared elements before taking appropriate action.
As to claim 17, Russello is silent on wherein the instructions further cause the one or more processors to store the received set of calls as a new pattern in the data indicating an association between (i) the received set of calls and (ii) the specific operation of the particular user space application corresponding to that one pattern.
However, Ermey discloses wherein the instructions further cause the one or more processors to store the received set of calls as a new pattern in the data indicating an association between (i) the received set of calls and (ii) the specific operation of the particular user space application corresponding to that one pattern (¶¶ [0061] and [0127]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Russello in the aforementioned manner as taught by Ermey in order to compare traffic in order to create new ways of handling new traffic patterns.
As to claims 18 and 20, the claims are rejected for reasons similar to those given for claim 17 above.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Brian Whipple whose telephone number is 571-270-1244. The examiner can normally be reached Mondays-Fridays from 9:50 AM to 3:50 PM ET and Saturdays from 9:50 AM to 7:50 PM ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joon Hwang can be reached at 571-272-4036. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Brian Whipple/
Primary Examiner
Art Unit 2447
5/30/26
Prosecution Insights