Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Election/Restrictions
2. NO restrictions warranted at initial time of filing for patent.
Priority
3. Applicant claims domestic priority under 35 USC 119e to provisional application filed on 09/23/2020.
Oath/Declaration
4. Applicant’s Oath was filed on 06/23/2026.
Drawings
5. Applicant’s drawings filed on 04/08/2025 has been inspected and is in compliance with MPEP 608.01.
Specification
6. Applicant’s specification filed on 04/08/2025 has been inspected and is in compliance with MPEP 608.02.
Claim Objections
7. NO objections warranted at initial time of filing for patent.
Remarks
8. Examiner request Applicant review relevant prior art under the conclusion of this office action.
Double Patenting
9. The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 are provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-16 of co-pending Patent Application no. 12,301,590. Although the claims at issue are not identical, they are not patentably distinct from each other because both the co-assigned Applications claims are almostthe same in scope.
Instant Application Claims 1 and associated claims 2-20
Patent No. ‘590 claim 1 and associated claims 2-16
1. A method for reducing traffic to a kernel mode component, the method comprising: logging, by an agent on an endpoint, a plurality of events indicating activities of an operating system on the endpoint; determining, by the agent from the plurality of events utilizing telemetry filters, events of interest, the determining comprising dynamically interpreting the telemetry filters in memory against the plurality of events as the events of interest are occurring; and providing, by the agent, the events of interest to the kernel mode component of the operating system so that traffic to the kernel mode component is significantly reduced and the kernel mode component specifically monitors only the events of interest.
1. A method, comprising: receiving, by an endpoint agent running on an endpoint, an instruction from a controller system to enable a selection of filters, the selection of filters including a custom-built telemetry filter for a kernel-level event tracing facility of the endpoint agent and a custom-built persistence filter for identifying a registry value of interest, the kernel-level event tracing facility configured for logging kernel or application-defined events to a log file as the kernel or application-defined events are occurring, the endpoint agent having a plurality of features, including the kernel-level event tracing facility, an event manager, and a detection engine; streaming, by the endpoint agent, the kernel or application-defined events from the log file to the event manager of the endpoint agent as the kernel or application-defined events are occurring; determining, by the event manager from a plurality of enabled telemetry filters including the custom-built telemetry filter, which ones of the plurality of enabled telemetry filters are applicable to the kernel or application-defined events; applying, by the event manager, a set of telemetry filters to the kernel or application-defined events, the set of telemetry filters determined by the event manager as applicable to the kernel or application-defined events, the applying comprising evaluating the set of telemetry filters in memory, the evaluating producing events of interest which are a subset of the kernel or application-defined events; applying, by a persistence manager, the custom-built persistence filter to a persistence tree, the persistence tree representing registry values in a registry used by an operating system local to the endpoint agent, the applying producing a registry value of interest; providing the registry value of interest to the detection engine for evaluation; and presenting, by the endpoint agent through a user interface, the events of interest and an evaluation result from the detection engine.
The instant application claims 1-20 are directed towards a method and system of logging network events and using telemetry filters against the plurality of events to be further utilized by a kernel component control and process information.
One of ordinary skill in the art would understand from the teachings found in Patented App ‘590 would not be significantly different from those found in the Instant application relates to the same invention. This is a provisional nonstatutory double patenting rejection because the patentably indistinct claims have not in fact been patented. Therefore, it would have been obvious to one of ordinary skill in the art to modify instant Application claims with the additional limitation of so to obtain Patented App ‘590 claims.
Allowance of application claim 1 would result in an unjustified time-wiseextension of the monopoly granted for the invention defined by co-pending Applicationclaim 1. Therefore, the provisional obviousness-type double patenting is appropriatebecause the conflicting claims have not in fact been patented. Application claim 1corresponds to co-pending application claim 1.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
10. Claims 1, 2, 4-9, 11-16, and 18-20 are rejected under 35 U.S.C. 103 as being
unpatentable over U.S. Publication No. 20200287920 hereinafter Mandrychenko in view
of U.S. Publication No. 20210200533 hereinafter Gage.
As per claim 1, Mandrychenko discloses:
A method (para 0007 "According to one embodiment, an agent running on an endpoint device associated with an enterprise network collects network communication metadata from the endpoint device by receiving callbacks from a kernel-level tracing facility implemented within an operating system of the endpoint device.")
for reducing traffic to a kernel mode component (para 0007 “The agent reduces transmission bandwidth and local storage requirements for the collected network communication metadata by performing a time-based data aggregation on the collected network metadata.”)
logging, by an agent on an endpoint, a plurality of events indicating activities of an operating system on the endpoint (para 0089 “At block 536, a new trace session (e.g., a session of a kernel-level tracing facility such as ETW) is created. At block 538, the new ETW session is started so that, at block 540, the agent can start receiving trace events.” Para 0094 “ In the context of the present example, at block 602, an agent running on an endpoint device associated with an enterprise network can collect network communication metadata from the endpoint device by receiving multiple callbacks from a kernel-level tracing facility implemented within an OS of the endpoint device.”) ,
determining, by the agent from the plurality of events utilizing telemetry filters, events of interest, (para 0047 “In an embodiment, as described in further detail below, anomaly detection service 106 can determine existence of the anomalous behavior based on the aggregated network communication metadata by sanitizing the aggregated network communication metadata to remove any illegal or malformed data by using a set of filters and extracting feature vectors from the sanitized data such that the anomaly detection service 106 can detect whether the sanitized data is indicative of existence of the anomalous behavior or is representative of normal traffic using a trained anomaly detection model..”)
and providing, by the agent, the events of interest to the kernel mode component of the operating system so that traffic to the kernel mode component is significantly reduced and the kernel mode component specifically monitors only the events of interest (para 0039 “In order to provide further storage reduction over conventional network traffic analysis approaches, in one embodiment, in addition to collecting network metadata, which excludes the actual packet data, the agent also performs time-based aggregation of the collected network metadata. In this manner, both transmission bandwidth and local storage requirements are reduced, thereby enabling the agent-based approach described herein to be deployed on Internet of Things (IoT) devices having limited resources, for example, in terms of one or more of computational processing, memory, and/or bandwidth.” Para 0094 “In the context of the present example, at block 602, an agent running on an endpoint device associated with an enterprise network can collect network communication metadata from the endpoint device by receiving multiple callbacks from a kernel-level tracing facility implemented within an OS of the endpoint device. The callbacks can be responsive to system calls relating to network events taking place on the endpoint device including receipt or transmission of one or more packets by the endpoint device via a network to which the endpoint device is coupled.”)
Mandrychenko does not disclose:
the determining comprising dynamically interpreting the telemetry filters in memory against the plurality of events as the events of interest are occurring
Gage discloses:
the determining comprising dynamically interpreting the telemetry filters in memory against the plurality of events as the events of interest are occurring
(para 0091"Certain telemetry elements may be obtained within the boundaries of other processes on the system. In these cases, the telemetry collected may be
forwarded to a pipeline using ETW. In these pipelines, ETW will be
the telemetry data source in the primary component." Para 0093 "To monitor
behavior associated with applications (as opposed to I/O or other hardware-level
events), the agent may run as an embedded thread of the application to be
monitored (within the same address space), maintaining visibility to the set of
statically and dynamically loaded library modules, as well as all system
resources, used by the application. The agent, in real time, is aware of the files
that are opened, the privileges asserted, the registry keys and configuration files
accessed, attached devices used and network services requested. As application
requests are made for each resource, the agent dynamically builds a tree
representing the dependent system components, adding more details as the
application continues to run and request additional resources." Para 0094
"Agents may be implemented in the pipelined fashion described above. If
configured as set forth in the '962 application, the agent may receive telemetry
via a sensor module, which may serve as the primary component in a pipeline.
Intermediate components may be program modules configured to react to
specific events (e.g., actuators and intelligent controllers) specified in the
telemetry ingested by the sensor; that is, the sensor may monitor-i.e., receive
as telemetry-specific hardware and application-level events, passing these
through the pipeline where they encounter specialized intermediate pipeline
components that react to particular events. These intermediate components may
be updated as threat levels or institutional policies change. Moreover, more than
one agent may share a particular intermediate component, since its functionality
may be broadly applicable across multiple agents deployed in an endpoint device
or server.")
Therefore, it would have been obvious to one ordinary skill in the art
before the effective filing date of the claimed invention to modify the systems and
methods are described for an agent-based approach that facilitates endpoint
network traffic analysis Mandrychenko to include the determining comprising dynamically interpreting the telemetry filters in memory against the plurality of events as the events of interest are occurring, as taught by Gage.
The motivation would have been to update software across an enterprise
having heterogeneous hardware and software components-approaches that
avoid interruption of running applications without comprising security or
introducing system-level faults (Gage paragraph 0005).
As per claim 2, Mandrychenko in view of Gage discloses:
wherein dynamically interpreting the telemetry filters in memory comprises interpreting an expression tree representing one of the telemetry filters (Gage para 0093 “To monitor behavior associated with applications (as opposed to I/O or other hardware-level events), the agent may run as an embedded thread of the application to be monitored (within the same address space), maintaining visibility to the set of statically and dynamically loaded library modules, as well as all system resources, used by the application. The agent, in real time, is aware of the files that are opened, the privileges asserted, the registry keys and configuration files accessed, attached devices used and network services requested. As application requests are made for each resource, the agent dynamically builds a tree representing the dependent system components, adding more details as the application continues to run and request additional resources.” Though Mandrychenko dynamically interprets the telemetry filters, Gage discloses dynamically interpreting the telemetry filters in memory comprises interpreting an expression tree representing one of the telemetry filters. The motivation would have been to update software across an enterprise having heterogeneous hardware and software components-approaches that avoid interruption of running applications without comprising security or introducing system-level faults (Gage paragraph 0005).).
As per claim 3, Mandrychenko in view of Gage discloses:
The method according to claim 1, wherein dynamically interpreting the telemetry filters in memory comprises compiling an expression tree into byte code and executing the byte code, the expression tree representing one of the telemetry filters.
As per claim 4, Mandrychenko in view of Gage discloses:
The method according to claim 1, wherein the telemetry filters comprise a telemetry filter defined by a type and an action (Mandrychenko para 0047 “Anomaly detection service 106 can determine existence of the anomalous behavior based on the aggregated network communication metadata by sanitizing the aggregated network communication metadata to remove any illegal or malformed data by using a set of filters and extracting feature vectors from the sanitized data such that the anomaly detection service 106 can detect whether the sanitized data is indicative of existence of the anomalous behavior or is representative of normal traffic using a trained anomaly detection model.”).
As per claim 5, Mandrychenko in view of Gage discloses:
The method according to claim 1, wherein the events of interest comprise a kernel event, an application-defined event, or a combination thereof (Mandrychenko para 0042).
As per claim 6, Mandrychenko in view of Gage discloses:
The method according to claim 5, wherein the telemetry filters include a custom-built telemetry filter applicable to the kernel event or the application-defined event and wherein the kernel mode component comprises a driver (Mandrychenko para 0050 “According to an implementation, anomaly detection service 106 can detect sophisticated attacks via supervised and/or unsupervised learning techniques, such as deep learning with feedback. For example, anomaly detection service 106 can enable a user to provide feedback during training in order to improve detection rates of the models.” Para 0051 “Data aggregation module 215 collects network communication metadata by receiving callbacks from a kernel-level tracing facility implemented within the OS of the endpoint device, which may be implemented, for example, in the form of a network tracing API 235 of OS kernel.”).
As per claim 7, Mandrychenko in view of Gage discloses:
The method according to claim 1, wherein the endpoint is one of a plurality of endpoints in a group and wherein the telemetry filters are enabled for the group through a controller system running on a server machine and deployed from the controller system to the endpoint (para 0033 “An endpoint protection system may proactively defend endpoints with one or more of pattern-based anti-malware technology, behavior-based exploit protection, web-filtering, and an application firewall.” Para 0047 “In an embodiment, as described in further detail below, anomaly detection service 106 can determine existence of the anomalous behavior based on the aggregated network communication metadata by sanitizing the aggregated network communication metadata to remove any illegal or malformed data by using a set of filters and extracting feature vectors from the sanitized data such that the anomaly detection service 106 can detect whether the sanitized data is indicative of existence of the anomalous behavior or is representative of normal traffic using a trained anomaly detection model.”).
As per claim 8, the implementation of the system of claim 1 will execute the
system of claim 8. The claim is analyzed with respect to claim 1.
As per claim 9, the claim is analyzed in view of claim 2.
As per claim 11, the claim is analyzed in view of claim 4.
As per claim 12, the claim is analyzed in view of claim 5.
As per claim 13, the claim is analyzed in view of claim 6.
As per claim 14, the claim is analyzed in view of claim 7.
As per claim 15, the implementation of the method of claim 1 will execute
the computer program product comprising a non-transitory computer
readable medium Mandrychenko paragraph 0025 of claim 15. The claim is analyzed with respect to claim 1
As per claim 16, the claim is analyzed in view of claim 2.
As per claim 17, the claim is analyzed in view of claim 4.
As per claim 18, the claim is analyzed in view of claim 5.
As per claim 19, the claim is analyzed in view of claim 6.
As per claim 20, the claim is analyzed in view of claim 7.
11. Claims 3, 10 and 17 are rejected under 35 U.S.C. 103 as being
unpatentable over Mandrychenko in view of Gage, and further in view of U.S. Publication No. 20150309813 hereinafter Patel.
As per claim 3, Mandrychenko in view of Gage discloses:
wherein dynamically interpreting the telemetry filters in memory and compiling a tree, the tree representing one of the telemetry filters
(Gage para 0091, 0093, and 0094, The motivation would have been to update software across an enterprise having heterogeneous hardware and software components-approaches that avoid interruption of running applications without comprising security or introducing system-level faults (Gage paragraph 0005))
Mandrychenko in view of Gage does not disclose:
compiling an expression tree into byte code and executing the byte code
Patel disclose:
compiling an expression tree into byte code and executing the byte code
(para 0096-0104 “ [0096] building and continuously refining a multi-dimensional model representing knowledge and behavior of the application as a network of objects across different dimensions; [0097] using reasoning and learning logic on this model along with information and events received from the components to both refine the multi-dimensional model further as well as drive the components further by sending information and events to them; [0098] again using the information and events received from the components as a result of driving the components to further trigger the entire process until the system stabilizes; [0099] static analyzer component comprising [0100] participating in multi-way coordination and orchestration process with advanced fusion analyzer; [0101] performing analysis on source codes as well as byte codes or binaries; [0102] processing of source code comprising [0103] performing lexical analysis and syntactic analysis of source codes resulting in parse tree and then transforming the parse tree to abstract syntax trees; [0104] performing semantic analysis comprising [0105] ensuring that the program composed of abstract syntax trees from multiple source codes containing types, variables and functions is properly defined and together they express a proper program.”)
Therefore, it would have been obvious to one ordinary skill in the art
before the effective filing date of the claimed invention to modify the systems and
methods are described for an agent-based approach that facilitates endpoint
network traffic analysis Mandrychenko in view Gage to include compiling an expression tree into byte code and executing the byte code, as taught by Gage.
The motivation would have been to properly analyze of applications for determining security and quality issues.
As per claim 10, the claim is analyzed in view of claim 3.
As per claim 17, the claim is analyzed in view of claim 3.
Conclusion
12. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
U.S. Publication No. 20200342134 discloses on paragraph 0036 “The event monitoring portion 120 may monitor the file change event using a file system change notification application program interface (API), a file system change journal, a kernel event, and a kernel file system driver. For example, the event monitoring portion 120 may monitor the file change event using ReadDirectoryChangesW of FindFirstChangeNotification of Windows as the file system change notification API. Also, the event monitoring portion 120 may monitor the file change event using NTFS Change Journals as the file system change journal. Also, the event monitoring portion 120 may monitor the file change event using Event Tracing for Windows of Windows as the kernel event. Also, the event monitoring portion 120 may monitor the file change event using a file system mini-filter of Windows as the kernel file system driver.”
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GARY S GRACIA whose telephone number is (571)270-5192. The examiner can normally be reached Monday-Friday 9am-6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip Chea can be reached at 5712723951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/GARY S GRACIA/Primary Examiner, Art Unit 2499
Prosecution Insights