DETAILED ACTION
Office Action Summary
Claims 1-10 are pending in the instant application.
Claims 1-10 are rejected under 35 USC § 112.
Claims 1-10 are rejected under 35 USC § 102.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Analysis – 35 USC § 112 (f)
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims 1-10 in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: *** in claim ***.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Since the claim limitation(s) invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, claim(s) 1-10 has/have been interpreted to cover the corresponding structure described in the specification that achieves the claimed function, and equivalents thereof. Please also see the 112, 2nd paragraph, rejection below for further details.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-10 are rejected under 35 USC § 112 b.
Claim limitations “first detection unit configured to detect”, “second detection unit configured to stochastically detect” and “countermeasure detection unit configured to determine” invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. Therefore, the claim is indefinite and is rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-10 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Matsunaga et al. (US Pre-Grant Publication No: 2004/0167893) hereinafter referred to as Matsunaga.
As per claims 1, 9 and 10, Matsunaga teaches a first detection unit configured to detect an abnormal behavior of the information processing apparatus; (Matsunaga, [0224-0225], teaches having different abnormal behavior detection units)
a second detection unit configured to stochastically detect the abnormal behavior of the information processing apparatus; and (Matsunaga, [0224-0225], teaches having different abnormal behavior detection units)
a countermeasure determination unit configured to determine a countermeasure against the abnormal behavior of the information processing apparatus based on results of detections by the first detection unit and the second detection unit. (Matsunaga, figures 14, 19 and 20 along with written description including [0229] teaches using data from multiple detection units to produce an output)
As per claim 2, Matsunaga teaches … wherein the first detection unit is further configured to detect the abnormal behavior of the information processing apparatus based on a startup of a program or a change in setting data. (Matsunaga, [0251])
As per claim 3, Matsunaga teaches … wherein the first detection unit is further configured to detect the abnormal behavior of the information processing apparatus based on a rule, and wherein the second detection unit is further configured to detect the abnormal behavior of the information processing apparatus based on stochastic processing. (Matsunaga, [0224-0225], teaches having different abnormal behavior detection units each having different rules)
As per claim 4, Matsunaga teaches … wherein in a case a program is not started in a normal operation, the first detection unit detects the startup as the abnormal behavior. (Matsunaga, [0224-0225], teaches having different abnormal behavior detection units)
As per claim 5, Matsunaga teaches … wherein the countermeasure determination unit is further configured to determine the countermeasure against the result of the detection by the first detection unit, execute the countermeasure in the information processing apparatus, determine the countermeasure against the result of the detection by the second detection unit, and issue a warning. (Matsunaga, figures 14, 19 and 20 along with written description including [0229]teaches using data from multiple detection units to produce an output)
As per claim 6, Matsunaga teaches … wherein, as the countermeasure against the result of the detection by the first detection unit, the countermeasure determination unit enables at least one of a tamper detection function and an automatic recovery function of at least one of system software and controller software in the information processing apparatus. (Matsunaga, [0251])
As per claim 7, Matsunaga teaches … wherein, in response to the countermeasure determination unit enabling at least one of the tamper detection function and the automatic recovery function, the information processing apparatus restarts. (Matsunaga, [0252])
As per claim 8, Matsunaga teaches … wherein as the countermeasure against the result of the detection by the first detection unit, the countermeasure determination unit shuts down a network that includes the information processing apparatus. (Matsunaga, [0252])
Other Art of Record
Turgeman et al. (US 2014/0344927) abstract teaches “Devices, systems, and methods of detecting user identity, differentiating between users of a computerized service, and detecting a possible attacker. The methods include monitoring of user-side input-unit interactions, in general and in response to an interference introduced to user-interface elements. The monitored interactions are used for detecting an attacker that utilizes a remote access channel; for detecting a malicious automatic script, as well as malicious code injection; to identify a particular hardware assembly; to perform user segmentation or user characterization; to enable a visual login process with implicit two-factor authentication; to enable stochastic cryptography; and to detect that multiple users are utilizing the same subscription account.”
Balabine et al. (US 20150229661) [0116] teaches Change detection is a statistical analysis approach which attempts to identify changes in the probability distribution of a stochastic process or time series. In general the change detection problem implies detecting whether or not one or more changes have occurred and identifying the times of such changes.
Omri Sivan (US 2016/0088015) [0107] teaches “The analysis may utilize one or more methods which may be divided, generally, into systematic methods and stochastic methods. Systematic methods are those which provide a rigid ruleset for determining what constitutes a maliciously-injected node, whereas stochastic methods may include statistical analysis of the data, to deduce, at a high level of confidence, what is a maliciously-injected node. While stochastic methods may also utilize a ruleset, this ruleset may be the result of the statistical analysis, whereas in the systematic methods, the ruleset may be resulting from direct and unambiguous detection of a maliciously-injected node”
Seo et al. (US 9471778) Abstract teaches “Software that automatically creates baselines from time series data of computer system activity, thereby providing immediate value from observed system data. The software performs the following operations: (i) receiving values of one or more attributes of a computing system that correspond to one or more time periods; (ii) determining a first set of statistical thresholds for the received values, wherein the received values include a subset of values that exceed the first set of statistical thresholds; (iii) determining a second set of statistical thresholds for the subset of values that exceed the first set of statistical thresholds; and (iv) determining a baseline pattern for the one or more attributes based, at least in part, on the determined first set of statistical thresholds and the determined second set of statistical thresholds.”
Horesh et al. (US 2017/0339175) [0011] teaches “Aspects of the invention include a method for detection of unintended application behaviors, whereby natural language processing (NLP) techniques and in particular statistical NLP, which relies on stochastic, probabilistic or statistical methods to perform automatic summarization of a chunk of text or perform discourse analysis; or machine-learning-based NLP, which reduces the input data to a feature-vector representation to achieve these same goals, are used to analyze the application, and specifically its GUI, and construct an acceptable (or expected) list of expected operations per-context actions. The system is trained using a known properly functioning application for monitoring operation of the application to construct the list of expected operations. Actions executed by the application in a given context that do not fall within the list are flagged as unexpected (or anomalous). A warning flag is an indication that there is an anomaly encountered while performing the application and may be a dialog box visible to a user enabling the user to respond the unexpected application behavior. The method applies both online, as a means to enforce security/privacy considerations in real time, or offline, as a tool to test applications for security/privacy threats.”
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SIMON P KANAAN whose telephone number is (571)270-3906. The examiner can normally be reached on M-F (7AM-4PM).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Catherine Thiaw can be reached on (571) 272-1183. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SIMON P KANAAN/Primary Examiner, Art Unit 2407
Prosecution Insights