DETAILED ACTION
Claims 1-28 are pending and have been examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: device configured to in claims 22-28.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. There does not appear to be a corresponding structure described in the specification.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-28 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 6 recites the limitation " the subset of plurality of files ". There is insufficient antecedent basis for this limitation in the claim.
Claims 20, 27 recite the limitation " the subset of plurality of training files ". There is insufficient antecedent basis for this limitation in the claim.
This is not intended to be a complete list of such indefiniteness issues.
The dependent claims included in the statement of rejection but not specifically addressed in the body of the rejection have inherited the deficiencies of their parent claim and have not resolved the deficiencies. Therefore, they are rejected based on the same rationale as applied to their parent claims above.
Double Patenting
Claims 1-28 are provisionally rejected under the judicially created doctrine of obviousness-type double patenting as being unpatentable over claims of U.S. Patent #s 12443710, 11126720, 9665713, 9292688. Although the conflicting claims are not identical, they are not patentably distinct from each other because
“A method comprising: determining a subset of a plurality of training files that are associated with a first file-type of a plurality of file-types, wherein the plurality of training files are known to be malign or benign; training a first classifier on the subset of the plurality of training files; training a second classifier on the plurality of training files; causing, based on the determining whether a first file associated with the first file-type is malign or benign using the first classifier, access to the first file to be blocked or permitted; and causing, based on the determining whether a second file associated with an unknown file- type is malign or benign using the second classifier, access to the second file to be blocked or permitted” (claim 1, instant application) is analogous to
“A method comprising: determining, based at least on a file structure associated with each of a plurality of training files known to be malign or benign, a subset of the plurality of training files that are associated with a first file-type of a plurality of file-types; training, based on the subset of the plurality of training files, a first classifier to determine whether files of the first file-type are at least malign or benign; training, based on the plurality of training files, a second classifier to determine whether files of the plurality of file-types are at least malign or benign; selecting, based on determining that a first file is associated with the first file-type, the first classifier to determine whether the first file is malign or benign; causing, based on the determining whether the first file is malign or benign, access to the first file to be blocked or permitted; selecting, based on a failure to determine if a second file is associated with the first file-type, the second classifier to determine whether the second file is malign or benign; and causing, based on the determining whether the second file is malign or benign, access to the second file to be blocked or permitted” (claim 1, patent 12443710) and analogous to
“A method comprising: determining at least a first file-type and a second file-type associated with a plurality of files; determining, via a first classifier of a plurality of classifiers that is trained to determine whether files of the first file-type are at least malign or benign, a first classification for a first file of the plurality of files, wherein the first file is of the first file-type; and determining, via a second classifier of the plurality of classifiers that is trained to determine whether files of a plurality of file-types are at least malign or benign and based on a second file of the plurality of files being of the second file-type that is different than the first file-type, a second classification for the second file” (claim 1, patent 11126720) and analogous to
“A computer-implemented method for improved zero-day malware detection comprising: receiving, at a computer that includes one or more processors and memory, a set of training files which are each known to be either malign or benign, wherein the training files comprise one or more types of computer files; partitioning, using the one or more computer processors, the set of training files into a plurality of categories wherein the categories are based on a type of file in each category; and training, using the one or more computer processors, category-specific classifiers that distinguish between malign and benign files in a category of files, wherein the training comprises: selecting one of the plurality of categories of training files, wherein each of the one or more categories corresponds to a type of file; identifying features present in the training files in the selected category of training files, wherein the identifying identifies n-gram features and the n-gram features include n-bytes of code; evaluating the identified features to determine the identified features most effective at distinguishing between malign and benign files; and building a category-specific classifier based on the evaluated features” (claim 1, patent 9665713) analogous to
“A computer-implemented method for improved zero-day malware detection comprising: receiving, at a computer that includes one or more processors and memory, a set of training files which are each known to be either malign or benign, wherein the training files comprise one or more types of computer files; analyzing, using the one or more computer processors, a training file from the set of training files to determine features of the training file, wherein the analyzing determines n-gram features; tagging, using the one or more computer processors, the determined features of the training file with qualified meta-features (QMF) tags, wherein the tagging includes: extracting one of the determined n-gram features from the training file; identifying a location of the extracted n-gram feature in the training file; determining an appropriate QMF tag of the extracted n-gram feature based on the identified location; applying the determined QMF tag to the extracted n-gram feature; and repeating the extracting, identifying, determining and applying for the remaining determined n-gram features of the training file; repeating the analyzing and tagging for remaining training files in the set of training files; and building, using the one or more computer processors, a model identifying n-gram features indicative of a malign file using the QMF-tagged n-gram features, wherein the model is capable of being used to detect malign files” (claim 1, patent 9292688).
This is a provisional obviousness-type double patenting rejection because the conflicting claims of the instant application have not in fact been patented.
The claims of the conflicting patents and/or applications contain every element of claims 1-28 of the instant application and thus anticipate the claims of the instant application. Claims 1-28 of the instant application therefore are not patently distinct from the copending application claims and as such are unpatentable for obvious-type double patenting. A later patent/application claim is not patentably distinct from an earlier claim if the later claim is anticipated by the earlier claim.
“A later patent claim is not patentably distinct from an earlier patent claim if the later claim is obvious over, or anticipated by, the earlier claim. In re Longi, 759 F.2d at 896, 225 USPQ at 651 (affirming a holding of obviousness-type double patenting because the claims at issue were obvious over claims in four prior art patents); In re Berg, 140 F.3d at 1437, 46 USPQ2d at 1233 (Fed. Cir. 1998) (affirming a holding of obviousness-type double patenting where a patent application claim to a genus is anticipated by a patent claim to a species with that genus). “ELI LILLY AND COMPANY v BARR LABORATORIES, INC., United States Court of Appeals for the Federal Circuit, ON PETITION FOR REHEARING EN BANC (DECIDED: May 30, 2001).
“Claim 12 and Claim 13 are generic to the species of invention covered by claim 3 of the patent. Thus, the generic invention is “anticipated” by the species of the patented invention. Cf., Titanium Metals Corp. v. Banner, 778 F.2d 775, 227 USPQ 773 (Fed. Cir. 1985) (holding that an earlier species disclosure in the prior art defeats any generic claim) 4. This court’s predecessor has held that, without a terminal disclaimer, the species claims preclude issuance of the generic claim. In re Van Ornum, 686 F.2d 937, 944, 214 USPQ 761, 767 (CCPA 1982); Schneller, 397 F.2d at 354. Accordingly, absent a terminal disclaimer, claims 12 and 13 were properly rejected under the doctrine of obviousness-type double patenting.” (In re Goodman (CA FC) 29 USPQ2d 2010 (12/3/1993).
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-28 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) training and determining based on data.
This judicial exception is not integrated into a practical application because they are broad enough to cover training and determining in the mind or with pen/paper, other than the generic computer components. Examiner points out that the “classifier” is a decision tree based on “features” (n-grams, or sequences of n consecutive bytes; a good value for n is 4) present in either a binary file or in a system call or execution trace generated by execution of the file (par.18 pf the Specification) and using external attributes, file type or file extension (par.39). A user can be trained to classify executable files (.EXE) as malicious and plain text files (.TXT) as benign.
Regarding Prong One, these steps, as drafted, form a process that under its broadest reasonable interpretation covers performance of the limitation in the mind or with pen/paper but for the recitation of generic computer components. That is, other than reciting “a device”, nothing in the claim element precludes the step from practically being performed in the human mind. For example, but for the “a device” language, the claim encompasses a user learning or being trained to classify data based on short strings and making a determination for new data.
Regarding Prong Two, there are no additional element(s) or a combination of elements in the claim that apply, rely on, or use the judicial exception in a manner that imposes a meaningful limit on the judicial exception, such that it is more than a drafting effort designed to monopolize the exception.
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the claims only use generic computer components, it is noted that claims 1-7 do not require any hardware or computer component. Mere instructions to apply an exception using generic components cannot provide an inventive concept. Additionally, the mere nominal recitation of a generic processor does not take the claim limitation out of the mental processes grouping. Thus, the claims recite a mental process and are not patent eligible.
The claims are directed to well-understood, routine, and conventional activity as evidenced by the “background of the invention” section and the cited references.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-4, 8-11, 15-18, and 22-25 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Radinsky (20120084859).
Regarding claims 1, 8, 15, and 22, Radinsky teaches
A method comprising: / A device comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the device to: / A computer-readable medium storing instructions that, when executed, cause: / A system comprising: a first classifier; a second classifier; and a computing device configured to (abstract, par.96-99):
determining a subset of a plurality of training files that are associated with a first file-type of a plurality of file-types, wherein the plurality of training files are known to be malign or benign (par.34-36, determine files to use for training);
training a first classifier on the subset of the plurality of training files; training a second classifier on the plurality of training files (par.27-35, different classifiers to different known entities/files and to unknown entities/files);
causing, based on the determining whether a first file associated with the first file-type is malign or benign using the first classifier, access to the first file to be blocked or permitted (par. 14-17, 34-37, determine is filetype, extension, etc, use corresponding engine); and
causing, based on the determining whether a second file associated with an unknown file- type is malign or benign using the second classifier, access to the second file to be blocked or permitted (par.86-88, 93-98, determine it is unknown use different engine).
Regarding claims 2, 9, 16, and 23, Radinsky teaches wherein the determining whether the first file associated with the first file-type is malign or benign using the first classifier comprises sending, to the first classifier, the first file, and wherein the determining whether the second file associated with the unknown file-type is malign or benign using the second classifier comprises sending, to the second classifier, the second file (par.32-36).
Regarding claims 3, 10, 17, and 24, Radinsky teaches determining that the first file is associated with the first file-type and determining that the second file is associated with the unknown file- type (par.14-18, 35-38).
Regarding claims 4, 11, 18, and 25, Radinsky teaches wherein determining that the first file is associated with the first file-type comprises determining, based on at least one byte sequence, that an internal structure of the first file matches an expected internal structure associated with the first file-type, and wherein determining that the second file is associated with unknown file-type comprises determining, based on at least one byte sequence, that an internal structure of the second file does not match an expected internal structure associated with the first file-type (par.34-40, 56-64).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 5, 12, 19, and 26 are rejected under 35 U.S.C. 103 as being unpatentable over Radinsky, and further in view of Malanov (20110083187).
Regarding claims 5, 12, 19, and 26, Radinsky does not expressly disclose, however, Malanov teaches wherein determining that the second file is associated with unknown file-type is based on the second file being a truncated file (par.67-71).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Radinsky to determine truncated files and use appropriate classification as taught by Malanov.
One of ordinary skill in the art would have been motivated to perform such a modification to further protect resources from potentially malicious code (Malanov, par.60-75).
Claims 6-7, 13-14, 20-21, and 27-28 are rejected under 35 U.S.C. 103 as being unpatentable over Radinsky, and further in view of Beveridge (20130067579).
Regarding claims 6, 13, 20, and 27, Radinsky does not expressly disclose, however, Beveridge teaches wherein training the first classifier on the subset of the plurality of training files comprises: determining, based on at least one feature from each file of the subset of plurality of files, that the at least one feature is indicative of whether content is malign, wherein the determining that the at least one feature is indicative of whether content is malign comprises comparing entropy of the at least one feature to a threshold; and generating, based on the at least one feature, at least one feature vector representation of each file of the subset of the plurality of training files indicating whether the malign at least one feature is present in each file of the subset of the plurality of training files (abstract, par.30-41, 85-90).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Radinsky to use entropy comparison during classification of suspect files as taught by Beveridge.
One of ordinary skill in the art would have been motivated to perform such a modification to provide additional means of detecting malware (Beveridge, par.39-74).
Regarding claims 7, 14, 21, and 28, Radinsky does not expressly disclose, however, Beveridge teaches wherein training the second classifier on the plurality of training files comprises: determining, based on at least one feature from each file of the plurality of training files, that the at least one feature is indicative of whether content is malign, wherein the determining that the at least one feature is indicative of whether content is malign comprises comparing entropy of the at least one feature to a threshold; and generating, based on the at least one feature, at least one feature vector representation of each file of the plurality of training files indicating whether the malign at least one feature is present in each file of the plurality of training files (abstract, par.30-41, 85-90).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Radinsky to use entropy comparison during classification of suspect files as taught by Beveridge.
One of ordinary skill in the art would have been motivated to perform such a modification to provide additional means of detecting malware (Beveridge, par.39-74).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: the remaining references put forth on the PTO-892 form are directed to malware detection training and malware detection. Stokes (20100192222), Oliver (8375450).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to David García Cervetti whose telephone number is (571)272-5861. The examiner can normally be reached Monday-Friday 8AM-5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, HADI S ARMOUCHE can be reached at (571)270-3618. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/David Garcia Cervetti/Primary Examiner, Art Unit 2409
Prosecution Insights