DETAILED ACTION
Claims 1-20 are pending in this action.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claim 8 is objected to because of the following informalities: The language appears to be identical to that of claim 7. Appropriate correction is required.
Claim 17 is objected to because of the following informalities: The language appears to be identical to that of claim 16. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claim 11 is rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the enablement requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to enable one skilled in the art to which it pertains, or with which it is most nearly connected, to make and/or use the invention. Examiner was unable to locate a description in the specification as to how the simulacra can or will indicate to ransomware that an endpoint or server is a virtual machine.
Claims 15-17 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the enablement requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to enable one skilled in the art to which it pertains, or with which it is most nearly connected, to make and/or use the invention. Examiner was unable to locate in the specification a section that lays out how any injected simulacra into an operating environment would create a simulation in the operating environment and also how this simulation would engage the ransomware, i.e. would it quarantine the ransomware or would it be simply be set of decoy files or addresses.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-18 and 20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
In claims 1, 18 and 20, it is unclear from the phrase “injecting…at least one simulacra…to trigger an anti-detonation protection feature by the ransomware” if the simulacra or the ransomware is doing the triggering and who the anti-detonation protection feature belongs to. Examiner suggests providing some clarifying language to resolve this indefiniteness. The remaining claims are rejected based on dependency to claims 1 and 18.
In claim 13, the phrase “ransomware would likely generate to counter antiransomware measures” is indefinite since the Examiner is unable to determine what specifically is being generated. Claim 14 is rejected based on dependency to claims 13.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-4, 6, 8-9, 12, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Patton et al. (US Patent No. 10,193,918) [hereinafter “Patton”] in view of Aharoni et al. (US PGPUB No. 2020/0089876) [hereinafter “Aharoni”] in further view of Cohen et al. (WO-2023053101-A1) [hereinafter “Cohen”].
As per claim 1, Patton teaches a computer-implemented method comprising: initiating execution of an executable in an operating environment; continually monitoring characteristics associated with the execution of the executable; first determining, based on the continual monitoring, that the executable has one or more characteristics associated with ransomware (Col. 4, lines 45-49, interception module detects an untrusted processes that are consistent with the start of a ransomware attack); injecting, based on the determining, at least one component into the operating environment to simulate properties in order to entrap ransomware (Col. 5, lines 33-38, “dynamically” creating and injecting in an “on-demand manner” decoy files into the user file directory, i.e. operating environment, to simulate user files and will be used to lure and trap the ransomware away from actual user files see also Col. 4 lines 37-41) and/or to trigger an anti-detonation protection feature by the ransomware (Examiner Note: this is an optional feature that may overcome the current rejection if included as a required feature), the at least one component amplifying ransomware behavior (Col. 5, lines 38-45, behavior analysis module watches to see if the decoy files elicit malicious “ransomware” behavior such as encrypting the files – decoy files are created to mimic “valuable user files” such as spreadsheets, images and video); second determining, based on the continual monitoring and subsequent to the injection of the at least one component which amplified ransomware behavior, that the executable comprises ransomware (Col. 5 lines 55-65 and Col. 6 lines 5-15, determining untrusted process is malicious and ransomware based on process behavior with multiple factors and threshold); and initiating, in response to the second determining, one or more ransomware countermeasures (Col. 6, lines 23-32, remediation module determines countermeasures such as terminating the process).
Patton does not explicitly teach that the component is a simulacra (Examiner Note: “simulacra” is defined in the instant specification as a software executable or process that simulates operating environment properties). Aharoni teaches that the component is a simulacra ([0029], software agents downloaded onto endpoints to generate honeypot files and perform other ransomware security measures).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton with the teachings of Aharoni, the component is a simulacra, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
The combination of Patton and Aharoni does not explicitly teach injecting the simulacra into the operating environment. Cohen teaches injecting the simulacra into the operating environment ([0069], injecting a software agent during runtime to perform security and emulation processes including detecting ransomware threats see [00263]).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton and Aharoni with the teachings of Cohen, injecting the simulacra into the operating environment, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
As per claim 2, the combination of Patton, Aharoni and Cohen teaches the method of claim 1, wherein the at least one simulacra causes at least one system component of the operating environment to be obscured (Cohen; [0069] with [00372], agents can perform various cybersecurity measures during a threat including masking sensitive data and resources in an operating environment).
As per claim 3, the combination of Patton, Aharoni and Cohen teaches the method of claim 1, wherein the at least one simulacra causes an identity type of at least one system component of the operating environment to change (Cohen; [0069] with [00395], agents can mask data and resources by substituting or replacing the type or characters of the sensitive data which includes the indicator/identifier see [00379]).
As per claim 4, the combination of Patton, Aharoni and Cohen teaches the method of claim 1, wherein the at least one simulacra initiates a sandbox environment in which the executable is executed and monitored by a virtual machine (Cohen; Abstract and [00106], creating a virtual barrier like a sandbox to monitor an API invocation by a virtual machine see [0059]).
As per claim 6, the combination of Patton, Aharoni and Cohen teaches the method of claim 1, wherein the at least one simulacra deploys bait files which appear to comprise sensitive information for access by the ransomware (Patton; Col. 5, lines 38-45, behavior analysis module watches to see if the decoy files elicit malicious “ransomware” behavior such as encrypting the files – decoy files are created to mimic “valuable user files” such as spreadsheets, images and video).
As per claim 8, the substance of the claimed invention is identical or substantially similar to that of claim 1. Accordingly, this claim is rejected under the same rationale.
As per claim 9, the combination of Patton, Aharoni and Cohen teaches the method of claim 1 further comprising: collecting information about the ransomware by an entrapment component (Patton; Col. 5, lines 45-55, behavioral analysis module monitors and collects information about how the ransomware interacts with the decoy files).
As per claim 12, the combination of Patton, Aharoni and Cohen teaches the method of claim 1, wherein the at least one simulacra causes files of interest to be hidden from the ransomware (Patton; Col. 2, lines 10-20, using decoy files to hide actual user files from ransomware).
As per claim 18, Patton teaches a computer-implemented method comprising: initiating execution of an executable in an operating environment; continually monitoring characteristics associated with the execution of the executable; first determining, based on the continual monitoring, that the executable has one or more characteristics associated with ransomware (Col. 4, lines 45-49, interception module detects an untrusted processes that are consistent with the start of a ransomware attack), the one or more characteristics associated with ransomware alone not being sufficient to confirm the executable as comprising ransomware (Col. 4, lines 45-67, identifying process that are untrusted that exhibit some behavior that is like ransomware but still requires further analysis by the behavior analysis module Col. 5, lines 38-45); injecting, based on the determining, at least one component into the operating environment to simulate properties in order to entrap ransomware (Col. 5, lines 33-38, “dynamically” creating and injecting in an “on-demand manner” decoy files into the user file directory, i.e. operating environment, to simulate user files and will be used to lure and trap the ransomware away from actual user files see also Col. 4 lines 37-41) and/or to trigger an anti-detonation protection feature by the ransomware (Examiner Note: this is an optional feature that may overcome the current rejection if included as a required feature), the at least one component amplifying ransomware behavior (Col. 5, lines 38-45, behavior analysis module watches to see if the decoy files elicit malicious “ransomware” behavior such as encrypting the files – decoy files are created to mimic “valuable user files” such as spreadsheets, images and video); second determining, based on the continual monitoring and subsequent to the injection of the at least one component which amplified ransomware behavior, that the executable comprises ransomware (Col. 5 lines 55-65 and Col. 6 lines 5-15, determining untrusted process is malicious and ransomware based on process behavior with multiple factors and threshold); and initiating, in response to the second determining, one or more ransomware countermeasures (Col. 6, lines 23-32, remediation module determines countermeasures such as terminating the process).
Patton does not explicitly teach that the component is a simulacra (Examiner Note: “simulacra” is defined in the instant specification as a software executable or process that simulates operating environment properties). Aharoni teaches that the component is a simulacra ([0029], software agents downloaded onto endpoints to generate honeypot files and perform other ransomware security measures).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton with the teachings of Aharoni, the component is a simulacra, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
The combination of Patton and Aharoni does not explicitly teach injecting the simulacra into the operating environment. Cohen teaches injecting the simulacra into the operating environment ([0069], injecting a software agent during runtime to perform security and emulation processes including detecting ransomware threats see [00263]).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton and Aharoni with the teachings of Cohen, injecting the simulacra into the operating environment, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
As per claim 19, the substance of the claimed invention is substantially similar to that of claim 1 with all substantive elements presented. Accordingly, this claim is rejected under the same rationale.
As per claim 20, the substance of the claimed invention is identical or substantially similar to that of claim 1. Accordingly, this claim is rejected under the same rationale.
Claims 5 and 7 are rejected under 35 U.S.C. 103 as being unpatentable over Patton, Aharoni and Cohen in further view of Kolton et al. (US PGPUB No. 2016/0323316) [hereinafter “Kolton”].
As per claim 5, the combination of Patton, Aharoni and Cohen method of claim 1.
The combination of Patton, Aharoni and Cohen does not explicitly teach wherein the at least one simulacra spoofs or changes a location of endpoints forming part of the operating environment. Kolton teaches wherein the at least one simulacra spoofs or changes a location of endpoints forming part of the operating environment ([0057], multi-trap provides decoy endpoints in the operating environment that are also changes periodically see [0070]).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton, Aharoni and Cohen with the teachings of Kolton, wherein the at least one simulacra spoofs or changes a location of endpoints forming part of the operating environment, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
As per claim 7, the combination of Patton, Aharoni and Cohen teaches the method of claim 1 as well as a simulacra. See above rejection.
The combination of Patton, Aharoni and Cohen does not explicitly teach creating fake servers to interact with the ransomware to confirm malicious intent and/or disable the ransomware. Kolton teaches creating fake servers to interact with the ransomware to confirm malicious intent and/or disable the ransomware ([0057], creating decoy servers to entrap ransomware).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton, Aharoni and Cohen with the teachings of Kolton, creating fake servers to interact with the ransomware to confirm malicious intent and/or disable the ransomware, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Patton, Aharoni and Cohen in further view of Monaco et al. (US PGPUB No. 2018/0189512) [hereinafter “Monaco”].
As per claim 10, the combination of Patton, Aharoni and Cohen teaches the method of claim 1 as well as a simulacra. See above rejection.
The combination of Patton, Aharoni and Cohen does not explicitly teach causing ransomware to conclude that a corresponding endpoint or server accessing the executable is not valuable (Examiner Note: in the instant specification at [0067] making not valuable includes hiding user personal files). Monaco teaches causing ransomware to conclude that a corresponding endpoint or server accessing the executable is not valuable ([0074], hiding files including user files into the slack space of a file system).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton, Aharoni and Cohen with the teachings of Monaco, causing ransomware to conclude that a corresponding endpoint or server accessing the executable is not valuable, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
Claims 11 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Patton, Aharoni and Cohen in further view of Annen et al. (US PGPUB No. 2021/0044604) [hereinafter “Annen”].
As per claim 11, the combination of Patton, Aharoni and Cohen teaches the method of claim 1 as well as a simulacra. See above rejection.
The combination of Patton, Aharoni and Cohen does not explicitly teach indicates that the corresponding endpoint or server is a virtual machine. Annen teaches indicates that the corresponding endpoint or server is a virtual machine (Abstract, simulating a file system on a virtual machine for ransomware detection).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton, Aharoni and Cohen with the teachings of Annen, indicates that the corresponding endpoint or server is a virtual machine, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
As per claim 13, the combination of Patton, Aharoni and Cohen teaches the method of claim 1 as well as a simulacra. See rejection above.
The combination of Patton, Aharoni and Cohen does not explicitly teach wherein the at least one simulacra generates artifacts that ransomware would likely generate to counter antiransomware measures. Annen teaches wherein the at least one simulacra generates artifacts that ransomware would likely generate to counter antiransomware measures (Abstract, generating changes on the virtual machines that a ransomware would normally make on a file system see also [0078]).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton, Aharoni and Cohen with the teachings of Annen, wherein the at least one simulacra generates artifacts that ransomware would likely generate to counter antiransomware measures, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
Claim 14 is rejected under 35 U.S.C. 103 as being unpatentable over Patton, Aharoni and Cohen in further view of Annen et al. (US Patent No. 11,349,855) [hereinafter “Annen”].
As per claim 14, the combination of Patton, Aharoni and Cohen teaches the method of claim 13.
The combination of Patton, Aharoni and Cohen does not explicitly teach wherein the generated artifacts comprise a mutex, flag file, or custom file extension. Amit teaches wherein the generated artifacts comprise a mutex (Examiner Note: this optional feature could overcome the current rejection if included as a required feature), flag file (Examiner Note: this optional feature could overcome the current rejection if included as a required feature), or custom file extension (Col. 19, lines 4-20, ransomware creating custom extensions for files).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton, Aharoni and Cohen with the teachings of Amit, wherein the generated artifacts comprise a mutex, flag file, or custom file extension, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
Claims 15-17 are rejected under 35 U.S.C. 103 as being unpatentable over Patton, Aharoni and Cohen in further view of Kraemer et al. (WO-2019051507-A1) [hereinafter “Kraemer”].
As per claim 15, the combination of Patton, Aharoni and Cohen teaches the method of claim 1 as well as a simulacra. See above rejection.
The combination of Patton, Aharoni and Cohen does not explicitly teach simulates a presence of multiple endpoint protection products on each endpoint and/or server forming part of the operating environment wherein attempts to disable such multiple endpoint protection products are monitored. Kraemer teaches simulates a presence of multiple endpoint protection products on each endpoint and/or server forming part of the operating environment (Page 25, lines 24-28, isolating or sandboxing the malicious object, i.e. placing in a virtual environment) wherein attempts to disable such multiple endpoint protection products are monitored (Page 25, lines 24-28, monitoring and logging the entities operations) with (Page 32, lines 25-28, monitoring for disabling of backup services).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton, Aharoni and Cohen with the teachings of Kraemer, simulates a presence of multiple endpoint protection products on each endpoint and/or server forming part of the operating environment wherein attempts to disable such multiple endpoint protection products are monitored, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
As per claim 16, the combination of Patton, Aharoni and Cohen teaches the method of claim 1 as well as a simulacra. See above rejection.
The combination of Patton, Aharoni and Cohen does not explicitly teach simulates a presence of backup software which the ransomware attempts to stop and remove previous backups. Kraemer teaches simulates a presence of backup software which the ransomware attempts to stop and remove previous backups (Page 25, lines 24-28, isolating or sandboxing the malicious object and monitoring and logging the entities operations – file system including backup is considered simulated since the ransomware can fully interact with it) with (Page 32, lines 25-28, monitoring for disabling of backup services).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Patton, Aharoni and Cohen with the teachings of Kraemer, simulates a presence of multiple endpoint protection products on each endpoint and/or server forming part of the operating environment wherein attempts to disable such multiple endpoint protection products are monitored, to provide further dynamic capabilities directly at the endpoint to combat and remediate ransomware.
As per claim 17, the substance of the claimed invention is identical or substantially similar to that of claim 16. Accordingly, this claim is rejected under the same rationale.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Adams et al. (US PGPUB No. 2016/0092682), Patton et al. (US Patent No. 9,734,337), Barak (US PGPUB No. 2017/0308711), Dekel et al. (US PGPUB No. 2017/0324755), Gupta et al. ("Prognosis Negative: Evaluating Real-Time Behavioral Ransomware Detectors," 2021 IEEE European Symposium on Security and Privacy (EuroS&P), Vienna, Austria, 2021, pp. 353-368, doi: 10.1109/EuroSP51992.2021.00032), Yu et al. ("Malware Behavior Detection System with RAG-Enhanced eBPF and Advanced Language Model," 2024 5th International Conference on Smart Grid and Energy Engineering (SGEE), Nanchang, China, 2024, pp. 500-506, doi: 10.1109/SGEE64306.2024.10865871), RithikSarogan et al. ("A Dynamic Malware Detection Algorithm for Enhanced Security in Sandbox Environments," 2025 (ICRISET), CHENNAI, India, 2025, pp. 1-8, doi: 10.1109/ICRISET64803.2025.11252412) and Kumar et al. ("Ransomware Detection and Mitigation Using Sandbox Security," 2025 IEEE International Conference on Blockchain and Distributed Systems Security (ICBDS), Kolhapur, India, 2025, pp. 1-4, doi: 10.1109/ICBDS67396.2025.11377981) all disclose various aspects of the claimed invention including detecting ransomware thru simulation and behavior analysis.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PETER C SHAW whose telephone number is (571)270-7179. The examiner can normally be reached Max Flex.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PETER C SHAW/Primary Examiner, Art Unit 2493 September 28, 2026
Prosecution Insights