Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This office action in response to the communication filed on 03/20/2025.
Claims 1-19 have been examined.
Information Disclosure Statement
The information disclosure statement filed 04/06/2026 has been considered.
Claim Objections
Claim 4, 10 and 14 are objected to because of the following informalities: the limitation “section and/or element of the data structure” need further clarification. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Claims 1, 10 and 11 recite “representing a known cyber vulnerability associated with a specific data structure type” it is unclear what constitutes the representation of a known cyber vulnerability that is associated with a data structure. The limitation “generic representation” and “specific data structure type” is unclear what the term “generic” and “specific” represents to ascertain the scope of the claim.
Claims 2, 4, 6, 10, 12, 14 and 16 recite “instantiation of the known cyber in a data structure” it is unclear what constitutes an “instantiation” of a vulnerability in a data structure.
Claims 4-5, 10 and 14-15 The limitations recited in the claims “creating a detected vulnerability map representing an interconnection between the detected portion and at least section and/or element of the data structure, related to the detected portion and applying an omission action based on said map to omit the detected portion and the at least one section and/or element.” It is not clear how the portion and section are interconnected. What is the meaning of applying an omission action on the section and/or element? These claims scope is unclear and ambiguous. The phrase “detected vulnerability map” It is unclear what data structure the map actually is, how the “interconnection” is represented, what level of association is required, or how the map differs from ordinary metadata or references. The phrase “representing an interconnection” The claim does not specify: logical relationship, structural relationship, reference linkage, dependency, or communication path. The limitation “related to the detected portion” is relative term. It is unclear what degree or type of “relatedness” qualifies as “related” to the detected portion.
Dependent claims 2-9, 12-19 are rejected under the same rationale as they do not cure the deficiencies of independent claims 1, 10 and 11.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-19 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. Claims 1, 10 and 11 recite receiving a detection rule, parsing the rule and creating a disarm rule limitations that are actions that could be all performed in the human mind and/or with the help of paper and pencil. The limitation receiving step is mere data gathering. Other than reciting cyber, processor and memory, nothing in the claims preclude the steps for being performed in the human mind. The limitations input and output information to a machine learning model is simply applying machine learning as a tool to improve the abstract idea. This judicial exception is not integrated into a practical application. The computers are recited at a high-level of generality such that it amounts no more than mere instructions to apply the exception using generic computer components. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. Simply implementing the abstract idea on a generic computer environment is not a practical application of the abstract idea and does not take the claim out of the mental process and method of organizing a human activity grouping. The claims are directed to an abstract idea. The claims do not include additional elements that even in combination are sufficient to amount to significantly more than the judicial exception. As discussed above, with respect to integration of the abstract idea into a practical application, the additional element of using edge computing devices, cloud computing devices and machine learning model to perform generating, determining and performing an action step amounts to no more than mere instructions to apply the exception using generic computer components. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept. The claims are not patent eligible. Dependent claims 2-9 and 12-19 also rejected under the same rationale set forth above because they also fail to recite any additional elements/steps that might integrates the abstract idea into a practical application. As such, claims 1-19 are not patent eligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-3, 7-8, 11-13, 16-18 are rejected under 35 U.S.C. 103 as being unpatentable over Girafi (US 2019/0311118) in view of Flesher (US 2009/0055477).
Regarding claim 1,
Girafi discloses a method of mitigating cyber vulnerabilities by at least one processor, the method comprising:
receiving a detection rule, representing a known cyber vulnerability associated with a specific data structure type; (para. [0151, [0194]-[0200], [0208]-[0210], a database or data structure that stores a plurality of file format specifications and/or references to a plurality of file format specifications… para. … a rule associated with input content intended for a defined group of recipients, with which an intended recipient may be associated with. … a rule associated with a characteristic of input content, such as a particular file type, file format, and/or a content type … a rule associated with an identity of a sender of the input content or an identified domain associated with the sender of the input content. … the one or more policies may be hierarchically applied, such as according to a prioritization of policies)
parsing the detection rule, to produce a generic representation of the detection rule; (para. [0195] disarming malicious code according to hierarchical network policies is illustrated in FIG. 12. At operation 1202, as shown, a computing system 200 may configure one or more policies to be applied to input content received into network 110 at any one or more computing elements included therein. As part of operation 1202, one or more policies may be initially configured as a default policy. As part of operation 1202, a system administrator may be provided with functionality (e.g. through a graphical user interface (GUI) or an application program interface (API)) for configuring one or more policies to be applied to input content) and
based on the generic representation and the specific data structure type, [[creating a disarm rule for mitigating the cyber vulnerability]] in incoming data structures of the specific data structure type. (para. [0029], [0195]-[0210] …disarming malicious code includes receiving input content intended for a recipient in a network, determining one or more policies based on a characteristics of the input content, an identity of a sender of the input content, and an identity of the intended recipient, and processing the input content to create modified input content according to the determined one or more policies, wherein the modified input content is configured to disarm or remove any malicious content included in the input content)
Girafi does not explicitly disclose Flesher teaches creating a disarm rule for mitigating the cyber vulnerability in incoming data structures of the specific data structure type. (para. [0021]-[0026], selectively sanitizing sensitive subject matter from a message to produce a sanitized message for retransmission … sanitizes messages for transmission with sensitive subject matter removed or otherwise protected … establishing a computer-based sanitization tool for sanitizing messages based on pre-defined sanitization rules; operating the tool to receive a message relative to a first external system, the first message including sensitive information and clean information relative to an identified recipient; operating the computer-based sanitization tool to identify the sensitive information within the message and to sanitize the message relative to the sensitive information, thereby generating a sanitized message including the clean information; and operating the computer-based sanitization tool for transmission of the sanitized message to the identified recipient … sanitization utility is implemented in conjunction with a recursive parsing tool to enable high resolution analysis of messages for security purposes… resources may include database that has proprietary data structure or format).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings described by Flesher with the teaching of Grafi, and the motivation for such an implementation would be in order to provide a system for sanitized outputs on a recipient-specific basis with the noted rules governing distribution of sensitive information (Abstract, Flesher).
Regarding claim 2,
Grafi in view of Flesher discloses the method of claim 1. Grafi in view of Flesher further discloses wherein said disarm rule comprises an association between (a) an instantiation of the known cyber vulnerability in a data structure of the specific data structure type, and (b) at least one omission action, required for omitting at least one portion of the data structure, wherein said portion comprises the known cyber vulnerability. (Grafi, para. [0014], [0102], [0153], [0167], …disarming malicious content in a computer system having a processor. The method includes accessing input content intended for a recipient of a network, automatically modifying at least a portion of digital values of the input content to render inactive code that is included in the input content intended for malicious purpose, the modified input content being of the same type as the accessed input content, enabling access to the modified input content by the intended recipient, analyzing the input content according to at least one malware detection algorithm configured to detect malicious content, and enabling access to the input content by the intended recipient when no malicious content is detected according to the at least one malware detection algorithm)
Regarding claim 3,
Grafi in view of Flesher discloses the method of claim 1. Grafi in view of Flesher further discloses receiving a target data structure of the specific data structure type; and applying the omission action on the target data structure, to omit the at least one portion of the target data structure that comprises the known cyber vulnerability, thus obtaining a disarmed data structure. (Grafi, para. [0091]–[0093], [0117], [0134], [0146], [0157], input content may be received or accessed by a computing system … input content may include one or more data units having a value representing media content. Media content may include any user-perceptible content including image data, video data, or audio data. In some embodiments, the media content may include content adapted to be presented, i.e. shown and/or played, to a human, such as a user of a computing system. In other embodiments, the media content may not be configured for presentation to a user. The input content may be in the form of a file configured according to any known file type associated with media content or known or suspected to include data elements of media content)
Regarding claim 6,
Grafi in view of Flesher discloses the method of claim 1. Grafi in view of Flesher further discloses comprising creating a reconstruction rule based on the generic representation and the specific data structure type, wherein said reconstruction rule comprises an association between (a) location of an instantiation of the known cyber vulnerability in a data structure of the specific data structure type, and (b) at least one reconstruction action, required for maintaining a predefined functionality of the data structure following omission of the known cyber vulnerability from the data structure. (Grafi, para. [0143]–[0156], [0161], [0188]–[0192], disarming malicious content or aspects of malicious content encoded in one or more data units of input content, based on a file reconstruction technique. In some embodiments, process 600 includes functionality for reconfiguring an input file to create a reconstructed file, wherein the reconstructed file is configured according to a current file format specification. The current file format specification may be a more current file format specification of the file format of a received input file, or of a different file format than the received input file. In the example embodiments, process 600 may be performed in addition to or alternative to any of the disarming techniques detailed above and elsewhere herein)
Regarding claim 7,
Grafi in view of Flesher discloses the method of claim 1. Grafi in view of Flesher further discloses comprising applying the reconstruction action on the disarmed data structure, to maintain the predefined functionality of the target data structure. (Grafi, para. [0153], [0174]–[0181], [0189]–[0192], Disarming Malicious Content while Preserving Printer Driver Functionality… Commonly, input files or input content may include metadata or objects with information indicative of print settings or printer driver settings that recommend or encourage appropriate printing of the input file. Such print settings provide convenience for an end user or intended recipient, but some techniques for addressing potentially malicious instructions may remove or render unusable such printer settings. The example embodiments, however, include functionality for disarming malicious content in input content according to any one or more disarming techniques while preserving valid print settings identified in received input content.
Regarding claim 8,
Grafi in view of Flesher discloses the method of claim 1. Grafi in view of Flesher further discloses wherein the data structure is selected from a list consisting of: a file, a data stream, a string representing an Application Programming Interface (API) request, and a string representing an API response. (Grafi, para. [0064], [0077], [0091], [0118], [0143], Received content or input content according to the disclosed embodiments may include any form of electronic content, including a file, document, an e-mail, etc., or other objects that may be run, processed, opened or executed by an application or operating system of the victim computer or computing device. Malicious content can be embedded among seemingly legitimate received content or input content. A file including embedded or encoded malicious content may be an input file or document that is accessed by a computing system by any number of means, such as by importing locally via an external storage device, downloading or otherwise receiving from a remote webserver, file server, or content server, for example, or from receiving as an e-mail or via e-mail or any other means for accessing or receiving a file or file-like input content. An input file may be a file received or requested by a user of a computing system or other files accessed by processes or other applications executed on a computing system that may not necessarily be received or requested by a user of the computing system. An input file according to the disclosed embodiments may include any file or file-like content, such as an embedded object or script, that is processed, run, opened or executed by an application or operating system of a computing system. Input content may include electronic mail, for example, or streamed content or other content).
Claim 11 recite limitations substantially similar to claim 1, therefore, is also rejected under the same rationale. In addition, Grafi further discloses a system for mitigating cyber vulnerabilities, the system comprising: a non- transitory memory device, wherein modules of instruction code are stored, and at least one processor associated with the memory device, and configured to execute the modules of instruction code, whereupon execution of said modules of instruction code. (Grafi, para. [0014]-[0015], computer system having a processor)
Claim 12-13 and 16-18 recite limitations substantially similar to claims 2-3, 6-8, therefore, are also rejected under the same rationale.
Claim(s) 4-5, 9-10, 14-15 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Girafi (US 2019/0311118) in view of Flesher (US 2009/0055477) in view of Blake et al. “Improving SIEM alert metadata aggregation with a novel kill-chain based classification model” published in 2020, ELSEVIER, hereinafter Blake.
Regarding claim 4,
Grafi in view of Flesher discloses the method of claim 1. Grafi and Flesher further discloses receiving a target data structure of the specific data structure type; applying the detection rule, to detect at least one portion of the target data structure that comprises the instantiation of the known cyber vulnerability; creating a detected vulnerability map representing an interconnection between the detected portion and at least one section and/or element of the data structure, related to the detected portion. (Grafi, para. [0091]–[0093], [0117], [0134], [0146]- [0157], input content may be received or accessed by a computing system … input content may include one or more data units having a value representing media content. Media content may include any user-perceptible content including image data, video data, or audio data. In some embodiments, the media content may include content adapted to be presented, i.e. shown and/or played, to a human, such as a user of a computing system. In other embodiments, the media content may not be configured for presentation to a user. The input content may be in the form of a file configured according to any known file type associated with media content or known or suspected to include data elements of media content…the current version of the specification may be presumed to define a more secure version of a file format and/or may define a file format configurable to prevent attacks based on one or more known vulnerabilities. In some embodiments, the current version of a specification determined in operation 610 may be a current or most updated version of a specification that is known to computing system 200 and/or made accessible to computing system 200. In some embodiments, a current version of a specification may be determined based on one or more unique characteristics of the received input content or a policy of network 110, for example).
Grafi in view of Flesher does not explicitly discloses based on said detected vulnerability map, applying the omission action on the target data structure, to omit the detected portion, thus obtaining a disarmed data structure. However, Blake in analogous art teaches based on said detected vulnerability map, applying the omission action on the target data structure, to omit the detected portion, thus obtaining a disarmed data structure. (Blake, Section 3.2 Security analyst overview, categories are based on a seven level zero based system, with lower categories representing more pressing issues. Category 0 is reserved for known security tests and was omitted from reporting requirements by analysts. However, blind penetration tests conducted by clients were expected to be reported by analysts and would have been considered a category 1 event. Category 1 was reserved from a suspected security breach resulting in unauthorized access. Category 2 was reserved from successful denial of service attacks. Category 3 was reserved from malware or other malicious code detection. Category 4 was reserved for “improper usage” and was seldom defined or implemented in client environments. Category 5 was reserved for scans, probes or attempted but unsuccessful access attempts. Finally, category 6 was reserved from unconfirmed incidents and served as a “catch all” for alerts analysts chose not to escalate to clients)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings described by Blake with the teaching of Grafi and Flescher, and the motivation for such an implementation would be in order to provide a system to apply advanced rule logic, or the ability to represent complex organizational data hierarchies for effective security monitoring solutions (Introduction, Blake).
Regarding claim 5,
Grafi in view of Flesher in view of Blake discloses the method of claim 1. Grafi and Flesher and Blake further discloses wherein the omission action is further selected from: omission of at least one section of the data structure, related to the detected portion; omission of at least one element of the data structure, related to the detected portion; and omission of at least one reference to said section or element. (Grafi, para. [0153], [0167], [0188]–[0193], the reconstructed content includes a reconstructed file and computing system 200 (e.g., as part of operation 1008) may analyze the reconstructed file to verify that the format of the reconstructed file is consistent with a format specification and remains usable by an intended recipient…. the one or more changes to an object included in the input content and/or reconfiguration of a layout or configuration of the input file is configured to disarm or otherwise prevent a malicious attack based on any malicious content that may be included in the input content. The example embodiments thus include functionality for rendering any malicious code in the input content inactive for its intended malicious purpose, whether the malicious code resides in multiple objects within the input content (e.g., thereby exploiting a vulnerability in the layout of the file) or within a single object, such as an image embedded in the input content… the reconstructed content may be forwarded to a recipient computing device. Aspects of operation 1110 may be substantially the same as those described above with respect to operations 310, 410, 510, 710, and 1010, etc.)
Regarding claim 9,
Grafi in view of Flesher discloses the method of claim 1. Grafi in view of Flesher further does not explicitly disclose, however, Blake teaches wherein the detection rule is of a first type of a plurality of detection rule types, and wherein parsing the detection rule, comprises producing the generic representation that has a format common to (i) the first type and (ii) at least one second type of the plurality of detection rule types. (Blake, Section 3.2 Security analyst overview, categories are based on a seven level zero based system, with lower categories representing more pressing issues. Category 0 is reserved for known security tests and was omitted from reporting requirements by analysts. … Category 1 was reserved from a suspected security breach resulting in unauthorized access. Category 2 was reserved from successful denial of service attacks. Category 3 was reserved from malware or other malicious code detection). The same motivation as claim 4 above applies
Regarding claim 10,
Grafi discloses a method of mitigating cyber vulnerabilities by at least one processor, the method comprising:
receiving a target data structure of a specific data structure type; (para. [0151, [0194]-[0200], [0208]-[0210], a database or data structure that stores a plurality of file format specifications and/or references to a plurality of file format specifications… para. … a rule associated with input content intended for a defined group of recipients, with which an intended recipient may be associated with. … a rule associated with a characteristic of input content, such as a particular file type, file format, and/or a content type … a rule associated with an identity of a sender of the input content or an identified domain associated with the sender of the input content. … the one or more policies may be hierarchically applied, such as according to a prioritization of policies)
receiving a detection rule, representing a known cyber vulnerability associated with the specific data structure type; (para. [0151, [0194]-[0200], [0208]-[0210], a database or data structure that stores a plurality of file format specifications and/or references to a plurality of file format specifications… para. … a rule associated with input content intended for a defined group of recipients, with which an intended recipient may be associated with. … a rule associated with a characteristic of input content, such as a particular file type, file format, and/or a content type … a rule associated with an identity of a sender of the input content or an identified domain associated with the sender of the input content. … the one or more policies may be hierarchically applied, such as according to a prioritization of policies)
creating a detected vulnerability map representing [[an interconnection between the detected portion and at least one section and/or element of the data structure, related to the detected portion]]; (para. [0029], [0195]-[0210] …disarming malicious code includes receiving input content intended for a recipient in a network, determining one or more policies based on a characteristics of the input content, an identity of a sender of the input content, and an identity of the intended recipient, and processing the input content to create modified input content according to the determined one or more policies, wherein the modified input content is configured to disarm or remove any malicious content included in the input content)
Girafi does not explicitly disclose Flesher teaches creating a detected vulnerability map representing an interconnection between the detected portion and at least one section and/or element of the data structure, related to the detected portion. (para. [0021]-[0026], selectively sanitizing sensitive subject matter from a message to produce a sanitized message for retransmission … sanitizes messages for transmission with sensitive subject matter removed or otherwise protected … establishing a computer-based sanitization tool for sanitizing messages based on pre-defined sanitization rules; operating the tool to receive a message relative to a first external system, the first message including sensitive information and clean information relative to an identified recipient; operating the computer-based sanitization tool to identify the sensitive information within the message and to sanitize the message relative to the sensitive information, thereby generating a sanitized message including the clean information; and operating the computer-based sanitization tool for transmission of the sanitized message to the identified recipient … sanitization utility is implemented in conjunction with a recursive parsing tool to enable high resolution analysis of messages for security purposes… resources may include database that has proprietary data structure or format).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings described by Flesher with the teaching of Grafi, and the motivation for such an implementation would be in order to provide a system for sanitized outputs on a recipient-specific basis with the noted rules governing distribution of sensitive information (Abstract, Flesher).
Grafi in view of Flesher does not explicitly disclose, however, Blake discloses based on the detection rule, detecting at least one portion of the target data structure that comprises an instantiation of the known cyber vulnerability; based on said detected vulnerability map, applying an omission action on the target data structure, to omit the detected portion and the at least one section and/or element, thus obtaining a disarmed data structure. (Blake, Section 3.2 Security analyst overview, categories are based on a seven level zero based system, with lower categories representing more pressing issues. Category 0 is reserved for known security tests and was omitted from reporting requirements by analysts. However, blind penetration tests conducted by clients were expected to be reported by analysts and would have been considered a category 1 event. Category 1 was reserved from a suspected security breach resulting in unauthorized access. Category 2 was reserved from successful denial of service attacks. Category 3 was reserved from malware or other malicious code detection. Category 4 was reserved for “improper usage” and was seldom defined or implemented in client environments. Category 5 was reserved for scans, probes or attempted but unsuccessful access attempts. Finally, category 6 was reserved from unconfirmed incidents and served as a “catch all” for alerts analysts chose not to escalate to clients)
Claim 14-15 and 19 recite limitations substantially similar to claims 4-5 and 9, therefore, are also rejected under the same rationale.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Batsakis et al. (US 2022/0245091) directed to facilitate enhancement of data model acceleration, including generating data model summaries and performing searches in an accelerated manner.
Charnock et al. (US 2012/0137367) directed to a continuous anomaly detection method and system based on multi-dimensional behavior modeling and heterogeneous information analysis.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Shewaye Gelagay whose telephone number is (571)272-4219. The examiner can normally be reached Monday to Friday 8 A.M. - 4 P.M..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amy C. Johnson can be reached at (571) 272-2238. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHEWAYE GELAGAY/Supervisory Patent Examiner, Art Unit 2436
