DETAILED ACTION
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
2. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
3. Claims 1-20, filed on 3/31/2025, are pending in this office action.
Information Disclosure Statement
4. Initialed and dated copy of Applicant’s IDS form 1449, filed 3/31/2025 and 5/1/2026, are attached to the instant Office Action.
Claim Objections
5. Claim 17 is objected to because of the following informalities: Claim 17 includes an incomplete limitation, line 10 of the claim ending with “the combination of randomly” with no following punctuation. Appropriate correction is required.
Claim Rejections - 35 USC § 103
6. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
7. Claim(s) 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over MacLeod et al. (US Publication 2018/0351969 A1) in view of Anderson et al. (US Publication 2011/0154472 A1)
As per claim 1, MacLeod teaches A method for protecting against minifilter squatting attacks comprising: (see Abstract)
installing an endpoint detection and response system on an endpoint, wherein the endpoint detection and response system includes at least one filesystem minifilter driver; (paragraph 0035, 0037, 0085, a filter manager is installed on a device and intercepts file system events and operation requests, paragraph 0038, 0039, 0082, 0084, the filter manager managing minifilter drivers and providing real-time detection and protection of devices from malware)
and inserting minifilter instance name of the at least one filesystem minifilter driver at a time of loading the at least one filesystem minifilter driver. (paragraph 0038, 0042, 0043, 0086, minifilter drivers are registered in a filter manager when minifilter driver is loaded, the registry containing names and information for access, registering minifilter drivers interpreted as inserting minifilter instance names)
MacLeod does not explicitly indicate inserting a combination of randomly generated characters into a minifilter instance name of the at least one filesystem minifilter driver.
Anderson teaches inserting a combination of randomly generated characters into a minifilter instance name of the at least one filesystem minifilter driver. (paragraphs 0132, 0238, 0243, 0246, 0302, a random number generater is utilized to generate identifiers of filter drivers utilized by an interceptor monitoring data, the randomly generated numbers utilized to generate identifiers interpreted as inserting a combination of randomly generated characters into a minifilter instance name).
It would have been obvious for one of ordinary skill in the art at the time the invention was made to combine MacLeod’s method to provide real-time detection and protection of devices from malware utilizing minifilter drivers with Anderson’s ability to generate identifiers for drivers utilized in data monitoring based on a random number generator. This gives the user the ability to further protect minifilter drivers by assigning identifiers with generated random numbers. The motivation for doing so would be to provide protections from fraudulent and malicious requests and attacks (paragraph 0002, 0003).
As per claim 2, MacLeod teaches detecting, by the at least one minifilter driver, at least one of a creation of a new file, a modification of an existing file, and a usage of a named pipe. (paragraph 0025, 0037, operation requests to detect behavior associated with files)
As per claim 3, MacLeod teaches registering the at least one filesystem minifilter driver with a filter manager of the endpoint device with minifilter instance name with the combination of randomly generated characters, wherein the filter manager is configured to intercept requests destined for the filesystem and pass intercepted requests to loaded filesystem minifilter drivers including the at least one filesystem minifilter driver. (paragraph 0038, 0039, 0085, registering with filter manager to intercept file operation requests)
As per claim 4, MacLeod and Anderson is taught as per claim 1. Anderson additionally teaches generating the combination of randomly generated characters using an operating system function at the start of loading the at least one filesystem minifilter driver. (paragraph 0132, 0145, 049, operating system tasks for drivers, loading)
As per claim 5, MacLeod and Anderson is taught as per claim 1. Anderson additionally teaches appending the at least one filesystem minifilter driver with a randomly generated fractional to an assigned integer altitude at a time of loading the at least one filesystem minifilter driver. (paragraph 0204, randomly distributed, paragraph 0244, 0245, 0246, random number)
As per claim 6, MacLeod and Anderson is taught as per claim 1. Anderson additionally teaches the randomly generated fractional and the combination of randomly generated characters include the same sequence of numbers generated by an operating system function. (paragraph 0244, 0245, 0246, random number assignment)
As per claim 7, MacLeod and Anderson is taught as per claim 1. Anderson additionally teaches inserting a different combination of randomly generated characters into the minifilter instance name of the at least one filesystem minifilter driver at a second time of loading the at least one filesystem minifilter driver. (paragraph 0244, 0245, 0246, random number)
As per claim 8, MacLeod and Anderson is taught as per claim 1. Anderson additionally teaches providing the minifilter instance name of the at least one minifilter with the combination of randomly generated characters to a remote threat management system managing the endpoint detection and response system of the endpoint device. (paragraph 0214, forward packets)
As per claim 9, MacLeod and Anderson is taught as per claim 8. Anderson additionally teaches maintaining, by the remote threat management system, a list of current minifilter instance names with the combination of randomly generated characters from a plurality of endpoint devices managed by the endpoint detection and response system. (paragraph 0212, 0286, index, catalog)
As per claim 10, MacLeod teaches A computer system, comprising: (see Abstract)
a threat management computer system including a centralized endpoint detection and response (EDR) system configured to monitor a plurality of endpoints for threats; (paragraph 0035, 0037, 0085, a filter manager is installed on a device and intercepts file system events and operation requests, paragraph 0038, 0039, 0082, 0084, the filter manager managing minifilter drivers and providing real-time detection and protection of devices from malware)
and an endpoint device monitored by the centralized threat management computer system, the an endpoint device including a localized EDR system in communication with the centralized EDR system, the an endpoint device including a filter manager, wherein the localized EDR system includes at least one filesystem minifilter driver managed by the filter manager, (paragraph 0049, 0071, a client device communicates with a server containing the filter manager, paragraph 0038, 0042, 0043, 0086, minifilter drivers are registered in a filter manager when minifilter driver is loaded in client device/managed nodes, the registry containing names and information for access, registering minifilter drivers interpreted as inserting minifilter instance names)
MacLeod does not explicitly indicate the at least one filesystem minifilter driver including a combination of randomly generated characters inserted into a filesystem minifilter driver instance name.
Anderson teaches the at least one filesystem minifilter driver including a combination of randomly generated characters inserted into a filesystem minifilter driver instance name (paragraphs 0132, 0238, 0243, 0246, 0302, a random number generater is utilized to generate identifiers of filter drivers utilized by an interceptor monitoring data, the randomly generated numbers utilized to generate identifiers interpreted as inserting a combination of randomly generated characters into a minifilter instance name).
It would have been obvious for one of ordinary skill in the art at the time the invention was made to combine MacLeod’s method to provide real-time detection and protection of devices from malware utilizing minifilter drivers with Anderson’s ability to generate identifiers for drivers utilized in data monitoring based on a random number generator. This gives the user the ability to further protect minifilter drivers by assigning identifiers with generated random numbers. The motivation for doing so would be to provide protections from fraudulent and malicious requests and attacks (paragraph 0002, 0003).
As per claim 11, MacLeod teaches the inserted combination of randomly generated characters is randomly generated and inserted at the time of loading of the at least one filesystem minifilter driver. (paragraph 0038, 0042, 0043, 0086, minifilter drivers registered when minifilter driver is loaded)
As per claim 12, MacLeod teaches the at least one minifilter driver is configured to detect at least one of a creation of a new file, a modification of an existing file, and a usage of a named pipe. (paragraph 0025, 0037, operation requests to detect behavior associated with files)
As per claim 13, MacLeod and Anderson is taught as per claim 10. Anderson additionally teaches the at least one filesystem minifilter driver includes an appended randomly generated fractional to an assigned integer altitude. (paragraph 0204, randomly distributed, paragraph 0244, 0245, 0246, random number)
As per claim 14, MacLeod and Anderson is taught as per claim 13. Anderson additionally teaches the randomly generated fractional and the combination of randomly generated characters include the same sequence of numbers generated by an operating system function. (paragraph 0244, 0245, 0246, random number assignment)
As per claim 15, MacLeod teaches a second endpoint device monitored by the centralized threat management computer system, the second endpoint device including a second localized EDR system in communication with the centralized EDR system, the second endpoint device including a second filter manager, wherein the second localized EDR system includes at least one second endpoint filesystem minifilter driver managed by the second filter manager, the at least one second endpoint filesystem minifilter driver including a different inserted combination of randomly generated characters into the filesystem minifilter driver instance name, wherein the different inserted combination of randomly generated characters to the filesystem minifilter driver instance name of the second endpoint device is a different set of characters than the inserted combination of randomly generated characters to the filesystem minifilter driver instance name of the endpoint device. (paragraph 0038, 0039, 0085, registering with filter manager to intercept file operation requests)
As per claim 16, MacLeod and Anderson is taught as per claim 15. Anderson additionally teaches the threat management computer system includes a system configured to maintain current filesystem minifilter driver instance names with the combination of randomly generated characters from a plurality of endpoint devices managed by the centralized EDR system including the endpoint device and the second endpoint device. (paragraph 0212, 0286, index, catalog)
As per claim 17, MacLeod teaches A method for protecting against filesystem minifilter driver squatting attacks comprising: (see Abstract)
installing an endpoint detection and response system on an endpoint device, wherein the endpoint detection and response system includes at least one filesystem minifilter driver; (paragraph 0038, install filter manager when minifilter driver is loaded, paragraph 0049, 0071, a client device communicates with a server containing the filter manager)
inserting a minifilter instance name of the at least one filesystem minifilter driver at a time of loading the at least one filesystem minifilter driver; (paragraph 0038, 0042, 0043, 0086, minifilter drivers are registered in a filter manager when minifilter driver is loaded in client device/managed nodes, the registry containing names and information for access, registering minifilter drivers interpreted as inserting minifilter instance names)
registering the at least one filesystem minifilter driver with a filter manager of the endpoint device with minifilter instance name appended by the combination of randomly (paragraph 0038, 0039, 0085, registering with filter manager to intercept file operation requests)
intercepting a request, by the filter manager, destined for the filesystem; (paragraph 0035, 0037, 0085, a filter manager is installed on a device and intercepts file system events and operation requests)
passing, by the filter manager, the intercepted request to the loaded filesystem minifilter driver; (paragraph 0025, 0037, operation requests to detect behavior associated with files)
and detecting, by the at least one minifilter driver, at least one of a creation of a new file, a modification of an existing file, and a usage of a named pipe. (paragraph 0025, 0037, operation requests to detect behavior associated with files)
MacLeod does not explicitly indicate generating a combination of random characters using an operating system function at the start of loading the at least one filesystem minifilter driver… inserting a combination of randomly generated characters into a minifilter instance name of the at least one filesystem minifilter driver.
Anderson teaches generating a combination of random characters using an operating system function at the start of loading the at least one filesystem minifilter driver… inserting a combination of randomly generated characters into a minifilter instance name of the at least one filesystem minifilter driver (paragraphs 0132, 0238, 0243, 0246, 0302, a random number generater is utilized to generate identifiers of filter drivers utilized by an interceptor monitoring data, the randomly generated numbers utilized to generate identifiers interpreted as inserting a combination of randomly generated characters into a minifilter instance name).
It would have been obvious for one of ordinary skill in the art at the time the invention was made to combine MacLeod’s method to provide real-time detection and protection of devices from malware utilizing minifilter drivers with Anderson’s ability to generate identifiers for drivers utilized in data monitoring based on a random number generator. This gives the user the ability to further protect minifilter drivers by assigning identifiers with generated random numbers. The motivation for doing so would be to provide protections from fraudulent and malicious requests and attacks (paragraph 0002, 0003).
As per claim 18, MacLeod and Anderson is taught as per claim 17. Anderson additionally teaches appending the at least one filesystem minifilter driver with a randomly generated fractional to an assigned integer altitude at a time of loading the at least one filesystem minifilter driver. (paragraph 0204, randomly distributed, paragraph 0244, 0245, 0246, random number)
As per claim 19, MacLeod and Anderson is taught as per claim 18. Anderson additionally teaches the randomly generated fractional and the combination of randomly generated characters include the same sequence of numbers generated by an operating system function. (paragraph 0244, 0245, 0246, random number assignment)
As per claim 20, MacLeod and Anderson is taught as per claim 1. Anderson additionally teaches inserting a different combination of randomly generated characters into the minifilter instance name of the at least one filesystem minifilter driver at a second time of loading the at least one filesystem minifilter driver. (paragraph 0244, 0245, 0246, random number)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Subramanian (US Publication 2021/0294910 A1)
Strogov (US Publication 2020/0204589 A1)
Kuppusamy (US Publication 2020/0110893 A1)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DANGELINO N GORTAYO whose telephone number is (571)272-7204. The examiner can normally be reached Monday-Friday 7:00am - 3:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Charles Rones can be reached at 571-272-4085. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DANGELINO N GORTAYO/Primary Examiner, Art Unit 2168
Prosecution Insights