DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is in response to Amendment filed 04/06/2026.
Claims 1-5, 10-15 and 20 have been amended, and no claim has been canceled or added. Currently, claims 1-20 are pending.
Specification
The disclosure is objected to because of the following informalities:
Regarding paragraph [0001] of the Specification, U.S. Patent Application No. 18/362,956 has been patented, its information should be supplemented with its patent information (e.g., Patent No.).
Appropriate correction is required.
Response to Arguments
Applicant's arguments filed 04/06/20 have been fully considered but they are not fully persuasive.
In view of amendments to independent claims 1 and 11, and Applicant’s arguments (see Remarks, pages 7-9) with respect to Claim Rejections Under 35 U.S.C. § 101 for being directed to an abstract idea without significantly more that the present claims provide an improvement to how the malicious code detection system operates by automatically comparing differences against a registry of element comparison and updating rules based on verification device feedback, the 101 rejection of claims 1-20 has been withdrawn.
Regarding Applicant’s arguments (see Remarks, pages 10-11) that Chinthagunti and Jang, separately and in combination, fail to disclose comparing the difference against a registry of element comparisons and sending the signal to a verification device, the signal, when received by the verification device is configured to cause a user interface of the verification device to display the signal, Examiner respectfully disagrees.
Chinthagunti teaches comparing each of the current differences to previous events or notifications that indicates previous differences between the baseline metadata 114(1) and the current metadata 114(2), or comparing each difference against the previous set of differences (see [column 14, lines 35-55]), wherein the previous set of differences and/or any storage/repository for storing the previous set of differences as disclosed can be interpreted as equivalent to a registry of element comparisons as broadly recited.
In addition, Chinthagunti teaches generating, sending and presenting notification (i.e., signal) regarding the comparison result information to different entities associated with the source process for reviewing (see [column 13, lines 1-22] and [column 14, lines 28-34]), wherein each entity/user as disclosed must be associated with a computer/device, which can be interpreted as a verification device as broadly recited.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 2-4 and 12-14 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Regarding claims 2 and 12, the limitation “each sample associated with an element of the structured data” appears to raise new matter issue, which is not supported by the specification. The specification discloses the structured data is associated with one or more attributes (see [0024]) and deconstructing each sample of structured data into any number of data elements corresponding to the structured data (see [0025]), which suggests that each sample is associated with an instance or version of the structured data rather than an element of the structured data as recited.
Regarding claims 3 and 13, the limitation “identifying a hash corresponding to the structured data” appears to raise new matter issue, which is not supported by the specification. The specification only mentions identifying a hash of each element or sub-element within the structured data (see [0007], [0011], [0028], [0030], [0032] and [0036]).
Regarding claims 4 and 14, the limitation “wherein obtaining the plurality of samples of the structured data is based on the hash” appears to raise new matter issue, which is not supported by the specification (see discussion in rejection of claims 2-3 and 12-13).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 (effective filing date 10/23/2017) are rejected under 35 U.S.C. 103 as being unpatentable over Chinthagunti (U.S. Patent No. 10,324,923, effectively filed date 11/10/2014), and further in view of Jang et al. (U.S. Publication No. 2009/0133126, Publication date 05/21/2009).
As to claim 1, Chinthagunti teaches:
“A computer-implemented method executed by data processing hardware that causes the data processing hardware to perform operations comprising” (see Chinthagunti, Abstract and Fig. 1):
“obtaining structured data” (see Chinthagunti, [column 4, lines 1-20] for generating/obtaining metadata 114 that describes the data 106, wherein the metadata as disclosed can be interpreted as structured data as recited; also see [column 4, lines 43-48] for generating/obtaining metadata 114(2), wherein metadata 114(2) can be interpreted as structured data as recited;
“obtaining standard data corresponding to the structured data” (see Chinthagunti, [column 4, lines 20-28] for generating/obtaining metadata 114(1) wherein metadata 114(1) or baseline metadata can be interpreted as standard data as recited);
“comparing the structured data to the standard data” (see Chinthagunti, [column 4, lines 61-67] for comparing the metadata 114(1) (i.e., the standard data) to the metadata 114(2) (i.e., the structured data) to identify differences between the metadata 114(1) and the metadata 114(2));
“based on comparing the structured data to the standard data, identifying a difference between the structured data and the standard data” (see Chinthagunti, [column 4, lines 61-67] for comparing the metadata 114(1) (i.e., the standard data) to the metadata 114(2) (i.e., the structured data) to identify differences between the metadata 114(1) and the metadata 114(2));
“comparing the difference against a registry of element comparisons” (see Chinthagunti, [column 14, lines 35-55] for comparing each of the current differences to the previous set of differences, wherein the previous set of references or any storage/repository for storing the previous set of differences as disclosed can be interpreted as equivalent to a registry of element comparisons as recited);
“determining, based on at least one rule and comparing the difference against the registry of element comparisons, that the difference between the structured data and the standard data is unexpected” (see Chinthagunti, [column 8, lines 34-56] and [column 12, lines 57-61] for determining whether the difference is acceptable/unacceptable or expected/unexpected based on exceptions wherein each exception as disclosed can be interpreted as a rule as recited; also see [column 13, lines 63-67] and [column 14, lines 35-56] for using a classifier to determine whether differences between metadata 114(1) and metadata 114(2) are acceptable/unacceptable (i.e., expected/unexpected), the classifier or machine learning process as disclosed (e.g., if a current difference is not included in the previous set of difference(s) or is not described in the exception information, the machine learning process may classify the current difference as an aberration to be further investigates) can be interpreted as equivalent to a rule as recited; and wherein the exception information describing any number of exceptions that correspond to expected behavior characteristics of data as disclosed can be interpreted as rule(s) as recited (see [column 8, lines 34-60] and [column 11, lines 39-45]);
“based on determining that the difference between the structured data and the standard data is unexpected, generating a signal indicating that the difference between the structured data and the standard data is [unexpected]” (see Chinthagunti, [column 13, lines 8-22] for generating a notification if one or more differences between the metadata 114(1) and the metadata 114(2) are not described in the exception information (i.e., the difference(s) are unexpected);
“sending the signal to a verification device, the signal, when received by the verification device, is configured to cause a user interface of the verification device to display the signal” (see Chinthagunti, [column 13, lines 1-22] and [column 14, lines 28-34] for generating, sending and presenting notification (i.e., signal) regarding the comparison result information to different entities associated with the source process for reviewing, wherein each entity/user as disclosed must be associated with a computer/device, which can be interpreted as a verification device as broadly recited);
“obtaining, from the verification device, an indication that the structured data is not [unexpected]” (see Chinthagunti, [column 14, lines 17-34] wherein the difference(s) may be manually analyzed to determine whether the difference(s) are significant (i.e., indicating a potential problem or unexpected) or not (i.e., indicating the differences are acceptable or expected); and the acceptable or expected differences can be incorporated into training dataset to train a classifier, wherein any device used by an entity/user for reviewing can be interpreted as a verification device as recited); and
“updating the at least one rule based on the indication” (see Chinthagunti, [column 14, lines 17-56] for incorporating the acceptable or expected difference(s), which are manually determined/indicated, into training dataset to train the classifier (e.g., updating the rule used by the classifier or the machine learning method; also see [column 8, lines 51-53] wherein exception information (i.e., rule(s)) can be vary based on the preferences of individual(s); also see [column 11, lines 40-45] wherein exception information can be determined manually (i.e., updating by user input/indication)).
Thus, Chinthagunti teaches identifying unexpected differences between structured data and standard data (see [column 12, line 53 to column 13, line 22]).
However, Chinthagunti does not explicitly teach the difference(s) or unexpected difference(s) is a result of malicious code.
On the other hand, Jang et al. explicitly teaches the difference(s) or unexpected difference(s) is a result of malicious code (see Jang et al., [0041]-[0042] for determining malicious DDL (i.e., malicious code) based on difference(s) between explicit DDL (i.e. structured data) and standard data from the profiling DB).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate Jang et al.’s teaching to Chinthagunti’s system by applying Chinthagunti’s method/process of identifying differences between structured data and standard data into any different types of data in a system including executable code as disclosed by Jang et al. to identify malicious code by determining differences caused by malicious code. Ordinarily skilled artisan would have been motivated to do so to provide Chinthagunti’s system with an effective way to identify differences/issues caused by malicious code. In addition, both of the references (Chinthagunti and Jang et al.) teach features that are directed to analogous art and they are directed to the same field of endeavor, such as, a system for identifying issues/problems in a system by comparing data to baseline/known data to identify differences or unexpected differences. This close relation between both of the references highly suggests an expectation of success when combined.
As to claim 11, Chinthagunti teaches:
“A system” (see Chinthagunti, Abstract and Fig. 1) comprising:
“data processing hardware” (see Chinthagunti, Fig. 5 for processor(s) 502); and
“memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising” (see Chinthagunti, Fig. 5 for memory 510):
“obtaining structured data” (see Chinthagunti, [column 4, lines 1-20] for generating/obtaining metadata 114 that describes the data 106, wherein the metadata as disclosed can be interpreted as structured data as recited; also see [column 4, lines 43-48] for generating/obtaining metadata 114(2), wherein metadata 114(2) can be interpreted as structured data as recited;
“obtaining standard data corresponding to the structured data” (see Chinthagunti, [column 4, lines 20-28] for generating/obtaining metadata 114(1) wherein metadata 114(1) or baseline metadata can be interpreted as standard data as recited);
“comparing the structured data to the standard data” (see Chinthagunti, [column 4, lines 61-67] for comparing the metadata 114(1) (i.e., the standard data) to the metadata 114(2) (i.e., the structured data) to identify differences between the metadata 114(1) and the metadata 114(2));
“based on comparing the structured data to the standard data, identifying a difference between the structured data and the standard data” (see Chinthagunti, [column 4, lines 61-67] for comparing the metadata 114(1) (i.e., the standard data) to the metadata 114(2) (i.e., the structured data) to identify differences between the metadata 114(1) and the metadata 114(2));
“comparing the difference against a registry of element comparisons” (see Chinthagunti, [column 14, lines 35-55] for comparing each of the current differences to the previous set of differences, wherein the previous set of references or any storage/repository for storing the previous set of differences as disclosed can be interpreted as equivalent to a registry of element comparisons as recited);
“determining, based on at least one rule and comparing the difference against the registry of element comparisons, that the difference between the structured data and the standard data is unexpected” (see Chinthagunti, [column 8, lines 34-56] and [column 12, lines 57-61] for determining whether the difference is acceptable/unacceptable or expected/unexpected based on exceptions wherein each exception as disclosed can be interpreted as a rule as recited; also see [column 13, lines 63-67] and [column 14, lines 35-56] for using a classifier to determine whether differences between metadata 114(1) and metadata 114(2) are acceptable/unacceptable (i.e., expected/unexpected), the classifier or machine learning process as disclosed (e.g., if a current difference is not included in the previous set of difference(s) or is not described in the exception information, the machine learning process may classify the current difference as an aberration to be further investigates) can be interpreted as equivalent to a rule as recited; and wherein the exception information describing any number of exceptions that correspond to expected behavior characteristics of data as disclosed can be interpreted as rule(s) as recited (see [column 8, lines 34-60] and [column 11, lines 39-45]);
“based on determining that the difference between the structured data and the standard data is unexpected, generating a signal indicating that the difference between the structured data and the standard data is [unexpected]” (see Chinthagunti, [column 13, lines 8-22] for generating a notification if one or more differences between the metadata 114(1) and the metadata 114(2) are not described in the exception information (i.e., the difference(s) are unexpected);
“sending the signal to a verification device, the signal, when received by the verification device, is configured to cause a user interface of the verification device to display the signal” (see Chinthagunti, [column 13, lines 1-22] and [column 14, lines 28-34] for generating, sending and presenting notification (i.e., signal) regarding the comparison result information to different entities associated with the source process for reviewing, wherein each entity/user as disclosed must be associated with a computer/device, which can be interpreted as a verification device as broadly recited);
“obtaining, from the verification device, an indication that the structured data is not [unexpected]” (see Chinthagunti, [column 14, lines 17-34] wherein the difference(s) may be manually analyzed to determine whether the difference(s) are significant (i.e., indicating a potential problem or unexpected) or not (i.e., indicating the differences are acceptable or expected); and the acceptable or expected differences can be incorporated into training dataset to train a classifier, wherein any device used by an entity/user for reviewing can be interpreted as a verification device as recited); and
“updating the at least one rule based on the indication” (see Chinthagunti, [column 14, lines 17-56] for incorporating the acceptable or expected difference(s), which are manually determined/indicated, into training dataset to train the classifier (e.g., updating the rule used by the classifier or the machine learning method; also see [column 8, lines 51-53] wherein exception information (i.e., rule(s)) can be vary based on the preferences of individual(s); also see [column 11, lines 40-45] wherein exception information can be determined manually (i.e., updating by user input/indication)).
Thus, Chinthagunti teaches identifying unexpected differences between structured data and standard data (see [column 12, line 53 to column 13, line 22]).
However, Chinthagunti does not explicitly teach the difference(s) or unexpected difference(s) is a result of malicious code.
On the other hand, Jang et al. explicitly teaches the difference(s) or unexpected difference(s) is a result of malicious code (see Jang et al., [0041]-[0042] for determining malicious DDL (i.e., malicious code) based on difference(s) between explicit DDL (i.e. structured data) and standard data from the profiling DB).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate Jang et al.’s teaching to Chinthagunti’s system by applying Chinthagunti’s method/process of identifying differences between structured data and standard data into any different types of data in a system including executable code as disclosed by Jang et al. to identify malicious code by determining differences caused by malicious code. Ordinarily skilled artisan would have been motivated to do so to provide Chinthagunti’s system with an effective way to identify differences/issues caused by malicious code. In addition, both of the references (Chinthagunti and Jang et al.) teach features that are directed to analogous art and they are directed to the same field of endeavor, such as, a system for identifying issues/problems in a system by comparing data to baseline/known data to identify differences or unexpected differences. This close relation between both of the references highly suggests an expectation of success when combined.
As to claims 2 and 12, these claims are rejected based on the same arguments as above to reject claims 1 and 11 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein obtaining the structured data comprises obtaining a plurality of samples of the structured data, each sample associated with an element of structured data” (see Chinthagunti et al., Fig. 3 and [column 3, line 66 to column 4, line 20] for generating/obtaining metadata (i.e., structured data) including obtaining different types of data/metadata).
As to claims 3 and 13, these claims are rejected based on the same arguments as above to reject claims 2 and 12 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein the operations further comprise identifying a hash corresponding to the structured data” (see Chinthagunti, Fig. 3 and [column 7, line 60 to column 8, line 15] wherein metadata is associated with different characteristics/attributes/elements, wherein each name/identifier associated with each characteristic/attribute/element (e.g., source name, table name, column name, etc.) can be interpreted as equivalent to a hash as recited).
As to claims 4 and 14, these claims are rejected based on the same arguments as above to reject claims 3 and 13 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein obtaining the plurality of samples of the structured data is based on the hash” (see Chinthagunti, [column 14, lines 35-56] for obtaining previous set of previous difference(s) (i.e., instances of activity) between the current metadata (i.e., structured data) and baseline metadata (i.e., standard data), wherein accessing data must be based on its identifier/location).
As to claims 5 and 15, these claims are rejected based on the same arguments as above to reject claims 2 and 12 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein each sample of the plurality of samples of the structured data is sourced from a different user device” (see Chinthagunti, [column 4, line 61 to column 5, line 14] wherein the data/metadata differences generated from comparison (i.e., instance of activity) are from source process on the host device(s)).
As to claims 6 and 16, these claims are rejected based on the same arguments as above to reject claims 1 and 11 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein the structured data comprises binary data” (see Chinthagunti, Fig. 3; also see Jang et al., [0034] for a portable executable (PE) file in a binary file format).
As to claims 7 and 17, these claims are rejected based on the same arguments as above to reject claims 1 and 11 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein the structured data comprises at least one of creator information, version information, or data type” (see Chinthagunti, Fig. 3 for source name (i.e., creator information); also see Jang et al., [0042] for VERSONINFO denotes information on a company manufacturing a DDL (i.e., creator information)).
As to claims 8 and 18, these claims are rejected based on the same arguments as above to reject claims 1 and 11 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein determining that the difference between the structured data and the standard data is unexpected comprises determining that the difference between the structured data and the standard data satisfies a tolerance threshold” (see Chinthagunti, [column 14, lines 25-56] if a current difference is not included in the previous set of difference(s) and is not described in the exception information, the machine learning process may classify the current difference as an aberration to be further investigated; also see [column 8, lines 34-53] for exception information that can be set by individual(s) (e.g., range of values, number of distinct value, etc.) to identify differences as acceptable/unacceptable or expected/unexpected).
As to claims 9 and 19, these claims are rejected based on the same arguments as above to reject claims 8 and 18 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein the operations further comprise adjusting the tolerance threshold based on the indication” (see Chinthagunti, [column 14, lines 17-56] for incorporating the acceptable or expected difference(s), which are manually determined/indicated, into training dataset to train the classifier (e.g., updating the rule used by the classifier or the machine learning method; also see [column 8, lines 51-53] wherein exception information (i.e., rule(s) or threshold number/value) can be vary based on the preferences of individual(s); also see [column 11, lines 40-45] wherein exception information can be determined manually (i.e., updating by user input/indication)).
As to claims 10 and 20, these claims are rejected based on the same arguments as above to reject claims 1 and 11 respectively, and are similarly rejected including the following:
Chinthagunti as modified by Jang et al. teaches:
“wherein the operations further comprise storing the difference between the structured data and the standard data at the registry of element comparisons” (see Chinthagunti, [column 13, lines 23-29] for storing the comparison results information (e.g., difference(s) between current metadata and baseline metadata) in a database (e.g., a registry); also see [column 14, lines 13-56] for using differences between metadata in training dataset and machine learning process).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PHUONG THAO CAO whose telephone number is (571)272-2735. The examiner can normally be reached Monday - Friday: 9:00 am - 6:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amy Ng can be reached at 571-270-1698. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Phuong Thao Cao/Primary Examiner, Art Unit 2164
Prosecution Insights