Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Claims 1 – 20 posted on 04/29/2025 are presently pending in the application and have been examined below, of which claims 1, 12 and 20 are presented in independent form.
Drawings
The drawings were received on 04/29/2025. These drawings are accepted.
Information Disclosure Statement
The information disclosure statements (IDS) dated 05/28/2025 and 02/24/2026 have been received and considered.
Priority
Acknowledgment is made of applicant’s claim for foreign priority under 35 U.S.C. 119 (a)-(d).
Examiner Notes
Examiner cites particular paragraphs, columns and line numbers in the references as applied to the claims below for the convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant fully consider the references in entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
Claim Rejections - 35 USC § 101, non-statutory
(Directed to a non-statutory subject matter)
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or
composition of matter, or any new and useful improvement thereof, may obtain a patent
therefore, subject to the conditions and requirements of this title.
Claim 20 is rejected under 35 U.S.C. 101 because the claimed invention is directed to a non-statutory subject matter.
Independent claim 20 is directed toward a “computer-readable storage medium”. The specification as originally filed fails to set forth the metes and bounds of what is meant to be encompassed by the term “storage medium” readable by a computer. As such, it would have been reasonable to interpret the term as encompassing signals per se and as such claim 20 can broadly, but reasonably be interpreted to being directed towards signals per se, which is not statutory. See In re Nuijten, 500 F.3d 1346, 1357, 84 USPQ2d 1495, 1503 (Fed. Cir. 2007). One way applicant can overcome this rejection is by instead reciting "non-transitory computer-readable storage medium" in place of “computer-readable storage medium".
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that
form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless – (a)(2) the claimed invention was described in a
patent issued under section 151, or in an application for patent published or deemed
published under section 122(b), in which the patent or application, as the case may be, names
another inventor and was effectively filed before the effective filing date of the claimed
invention
Claims 1 – 20 are rejected under 35 U.S.C. 102(a) (2) as being anticipated by Sternfeld (US 20230023584) (hereafter Sternfeld).
As per claim 1 Sternfeld discloses: A method, comprising: creating a first snapshot of a storage system at a first moment at which a first abnormal operation behavior of one or more abnormal operation behaviors for the storage system is detected (Sternfeld, in para. [0004] discloses creation of plurality of snapshots, i.e., first, second etc. snapshots of data files to detect ransomware); creating a second snapshot of the storage system at a second moment at which it is determined that the storage system meets an attack detection condition, wherein the second moment is after the first moment (Sternfeld, in para. [0007-0008] discloses creation of a number of snapshots within a predefined time window, i.e., at different pre-defined moments, and performing a comparative analysis with previously stored information for ransomware detection based on the predefined conditions [0033]);
and determining, based on a comparison result between the first snapshot and the second snapshot and data content of one or more groups of operation abnormality data generated by the storage system between the first moment and the second moment, whether the storage system is attacked by ransomware, wherein the one or more groups of operation abnormality data is generated by a respective one of the one or more abnormal operation behaviors for the storage system (Sternfeld, in para. [0029, 0033, 0036] and in Fig. 1 discloses ransomware detection module for comparative analysis of snapshots for abnormalities for ransomware detection and performing remediation actions).
As per claim 2 Sternfeld discloses: The method according to claim 1, wherein that the storage system meets the attack detection condition comprises: a duration starting from the first moment reaches a duration threshold (Sternfeld, in para. [0007, 0010] discloses creation of a number of snapshots within a predefined time window, i.e., at different pre-defined moments, for analysis based on pre-defined thresholds) or a quantity of the one or more abnormal operation behaviors for the storage system from the first moment reaches a quantity threshold (Sternfeld, in para. [0058] and in Fig. 4 discloses detection of ransomware-like behavior using the ransomware detection module operating using analysis of various pre-defined thresholds).
As per claim 3 Sternfeld discloses: The method according to claim 1, wherein determining, based on the comparison result between the first snapshot and the second snapshot and the data content of the one or more groups of operation abnormality data generated by the storage system between the first moment and the second moment, whether the storage system is attacked by ransomware comprises: when the comparison result meets a first abnormality condition, and at least one group of detection abnormality data exists in the one or more groups of operation abnormality data, determining that the storage system is attacked by ransomware, wherein the at least one group of detection abnormality data includes a group of operation abnormality data whose data content meets a second abnormality condition (Sternfeld, in para. [0010, 0036, 0043] and in Figs. 2, 4 discloses ransomware detection based on the analysis of different abnormality criteria and event analysis, i.e., different groups of abnormality detection, based on timeframe analysis, using encryption detection, and statistical entropy calculation and analysis).
As per claim 4 Sternfeld discloses: The method according to claim 3, wherein after determining that the storage system is attacked by ransomware, the method further comprises: storing the first snapshot and deleting the second snapshot (Sternfeld, in para. [0004] discloses creation of plurality of snapshots, i.e., first, second etc. snapshots of data files to detect ransom ware including storage, deletion etc.).
As per claim 5 Sternfeld discloses: The method according to claim 3, wherein after determining that the storage system is attacked by ransomware, the method further comprises: outputting an alarm prompt, wherein the alarm prompt indicates that the storage system is attacked by ransomware, and the alarm prompt comprises a tenant name of the detection abnormality data, a storage location of the detection abnormality data, or an infection time of the detection abnormality data (Sternfeld, in para. [0005] discloses detection of ransomware followed by remediation action and appropriate notification, i.e., alarming, where the notification includes details of the detected anomaly).
As per claim 6 Sternfeld discloses: The method according to claim 1, wherein determining, based on the comparison result between the first snapshot and the second snapshot and data content of one or more groups of operation abnormality data generated by the storage system between the first moment and the second moment, whether the storage system is attacked by ransomware comprises: when the comparison result does not meet a first abnormality condition, or the one or more groups of operation abnormality data are all detection normality data, determining that the storage system is not attacked by ransomware, wherein each group of the detection normality data is a group of operation abnormality data whose data content does not meet a second abnormality condition (Sternfeld, in para. [0010, 0036, 0043] and in Figs. 2, 4 discloses ransomware detection based on the analysis of different abnormality criteria and event analysis, i.e., different groups of abnormality detection, based on timeframe analysis, using encryption detection, and statistical entropy calculation and analysis).
As per claim 7 Sternfeld discloses: The method according to claim 6, wherein after determining that the storage system is not attacked by ransomware, the method further comprises: deleting the first snapshot and the second snapshot (Sternfeld, in para. [0004] discloses creation of plurality of snapshots, i.e., first, second etc. snapshots of data files to detect ransom ware including storage, deletion etc.).
As per claim 8 Sternfeld discloses: The method according to claim 3, wherein the comparison result comprises a difference between an entropy value of the second snapshot and an entropy value of the first snapshot, and the first abnormality condition comprises: the difference is greater than a difference threshold (Sternfeld, in para. [0010, 0036, 0043] and in Figs. 2, 4 discloses ransomware detection based on entropy calculations and comparative analysis with stored data including respective thresholds).
As per claim 9 Sternfeld discloses: The method according to claim 8, wherein the method further comprises: invoking a machine learning model to separately determine the entropy value of the first snapshot and the entropy value of the second snapshot (Sternfeld, in para. [0043] and in Figs. 2, 4 discloses ransomware detection including usage of machine learning algorithm).
As per claim 10 Sternfeld discloses: The method according to claim 3, wherein the second abnormality condition is that data content is encrypted (Sternfeld, in para. [0036] discloses ransomware detection based on the analysis of different abnormality criteria and event analysis, including encryption detection and analysis).
As per claim 11 Sternfeld discloses: The method according to claim 1, wherein the method further comprises: obtaining an operation sequence of a plurality of consecutive operations for a group of data in the storage system, wherein the plurality of consecutive operations comprises a read operation, a write operation, a rename operation, a create operation, or a delete operation; and when the operation sequence matches a preset ransomware operation sequence pattern, determining the plurality of consecutive operations as the first abnormal operation behavior, and using one group of data on which the plurality of consecutive operations have been performed as a first group of the one or more groups of operation abnormality data (Sternfeld, in para. [0034] discloses various operations of encryption detection module for ransomware detection based of the analysis of specified features, i.e., pattern).
As per claim 12, claim 12 encompasses same or similar scope as claim 1. Therefore, claim 12 is rejected based on the same reasons set forth above in rejecting claim 1.
As per claims 13 - 19, claims 13 – 19 encompass same or similar scope as claims 2 – 8, respectively. Therefore, claims 13 – 19 are rejected based on the same reasons set forth above in rejecting claims 2 – 8.
As per claim 20, claim 20 encompasses same or similar scope as claim 1. Therefore, claim 20 is rejected based on the same reasons set forth above in rejecting claim 1.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: Armangau US_11755733, Bhagi US_20230153438, Brandwine US_12197578, Chen US_20200034537, Gehman US_20230259625, Revanna US_20230342262, Venier US_20240037223, Yim US_20240143758.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VLADIMIR IVANOVICH GAVRILENKO whose telephone number is (313)446-6530. The examiner can normally be reached on Monday-Friday 7:30-4:30 EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached on (571) 272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/VLADIMIR I GAVRILENKO/Examiner, Art Unit 2431
Prosecution Insights