DETAILED ACTION
Claims 1-20 are pending in this action.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Election/Restrictions
Applicant’s election without traverse of claims 1-15 in the reply filed on 5/20/2026 is acknowledged.
Claims 16-20 are withdrawn from further consideration pursuant to 37 CFR 1.142(b) as being drawn to a nonelected invention, there being no allowable generic or linking claim.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 4/16/2026 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement has been considered by the examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1, 6, 7 and 11 are rejected under 35 U.S.C. 103 as being unpatentable over Tevet et al. (US PGPUB No. 2021/0202031) [hereinafter “Tevet”] in view of Eberhardt, III et al. (US PGPUB No. 2013/0198119) [hereinafter “Eberhardt”] in further view of Poornachandran et al. (US PGPUB No. 2012/0167218) [hereinafter “Poornachandran”].
As per claim 1, Tevet teaches a computer-implemented method for identifying malware family relationships (Examiner Note: family relationship is interpreted to include category or type relationships see [0016] and also including malwares sharing the same genes see [0044]) (Abstract and [0003], gene-analysis used for malware classification, i.e. relationship), comprising: extracting assembly-level code implementations from the memory snapshots using targeted disassembly (Abstract, extracting assembly code fragments using a disassembler), wherein each assembly-level code implementation represents a gene corresponding to an implementation of the malicious behavior ([0013], extracted fragments are functions, i.e. behavior, that are matched with known malicious or trusted genes see [0007]); comparing the genes extracted from a first malware sample with genes stored in a gene datastore to identify similar genes ([0007], extracted functions/genes are compared with already known genes from a database); determining a malware family relationship (Examiner Note: family relationship is interpreted to be the same as a category or type relationship see [0016]) between the first malware sample and a second malware sample based on shared characteristics that exhibit similar malicious behavior ([0056], determining malware similarities between two executables).
Tevet does not explicitly teach the similar malicious behavior is determined using similarity metrics. Eberhardt teaches the similar malicious behavior is determined using similarity metrics ([0029] and [0056], using similarity metrics between features to classify malware).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Tevet with the teachings of Eberhardt, the similar malicious behavior is determined using similarity metrics, to efficiently classify large number of code fragments or files as trusted or malware.
The combination of Tevet and Eberhardt does not explicitly teach capturing a plurality of memory snapshots of a malicious executable during dynamic execution, wherein each memory snapshot is triggered by detection of a behavioral anchor corresponding to a malicious behavior. Poornachandran teaches capturing a plurality of memory snapshots of a malicious executable during dynamic execution, wherein each memory snapshot is triggered by detection of a behavioral anchor corresponding to a malicious behavior ([0028], taking a snapshot of the system based on unexpected activity deemed potential malware see [0027]).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Tevet and Eberhardt with the teachings of Poornachandran, capturing a plurality of memory snapshots of a malicious executable during dynamic execution, wherein each memory snapshot is triggered by detection of a behavioral anchor corresponding to a malicious behavior, to efficiently classify large number of code fragments or files as trusted or malware during runtime allowing for a dynamic response.
As per claim 6, the combination of Tevet, Eberhardt and Poornachandran teaches the computer-implemented method of claim 1, wherein capturing the plurality of memory snapshots comprises using a plurality of snapshot triggers (Poornachandran; [0009], taking snapshot of memory based on an unexpected activity, i.e. trigger), each snapshot trigger configured to capture memory regions when predetermined conditions are met (Poornachandran; [0009] and [0012], snapshot taken of RAM memory and boot sectors and examined for virus signatures).
As per claim 7, the combination of Tevet, Eberhardt and Poornachandran teaches the computer-implemented method of claim 6, wherein the predetermined conditions comprise: a memory region being made executable for a first time ([0029]-[0030], launching a browser may trigger abnormal behavior to be monitored); detection of network behavior within code contained in a memory region ([0016], detecting virus behavior based on executing code); and termination of a process associated with the malicious executable (Poornachandran; [0009], terminating the source of the unexpected activity).
As per claim 11, the substance of the claimed invention is identical or substantially similar to that of claim 1. Accordingly, this claim is rejected under the same rationale.
Claims 2, 3, 12 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Tevet, Eberhardt and Poornachandran in further view Wright (US Patent No. 8,776,218).
As per claim 2, the combination of Tevet, Eberhardt and Poornachandran teaches the computer-implemented method of claim 1.
The combination of Tevet, Eberhardt and Poormachandran does not explicitly teaches wherein the behavioral anchor comprises an application programming interface (API) call associated with the malicious behavior. Wright teaches wherein the behavioral anchor comprises an application programming interface (API) call associated with the malicious behavior (Fig. 2 and claim 1 tracking gene relationship between potential malicious behavior including API calls).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Tevet, Eberhardt and Poornachandran with the teachings of Wright, wherein the behavioral anchor comprises an application programming interface (API) call associated with the malicious behavior, to efficiently classify large number of code fragments or files as trusted or malware during runtime allowing for a dynamic response.
As per claim 3, the combination of Tevet, Eberhardt, Poornachandran and Wright teaches computer-implemented method of claim 2, wherein the API call comprises one or more application programming interface calls associated with malicious behaviors (Wright; Fig. 2 and claim 1 tracking gene relationship between potential malicious behavior including one or more API calls).
As per claim 12, the substance of the claimed invention is identical or substantially similar to that of claim 2. Accordingly, this claim is rejected under the same rationale.
As per claim 13, the substance of the claimed invention is identical or substantially similar to that of claim 3. Accordingly, this claim is rejected under the same rationale.
Claims 4, 5 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Tevet, Eberhardt and Poornachandran in further view Shukla et al. (US PGPUB No. 2019/0095183) [hereinafter “Shukla”].
As per claim 4, the combination of Tevet, Eberhardt and Poornachandran teaches computer-implemented method of claim 1.
The combination of Tevet, Eberhardt and Poornawherein does not expliclity teach the targeted disassembly comprises: starting disassembly at an address of the behavioral anchor; applying recursive descent disassembly to identify instructions following the behavioral anchor; identifying a closest API call site prior to the behavioral anchor; and disassembling code between the closest API call site and the behavioral anchor. Shukla teaches the targeted disassembly comprises: starting disassembly at an address of the behavioral anchor ([0050], starting disassembly at one or more entry points of the executable); applying recursive descent disassembly to identify instructions following the behavioral anchor ([0049]-[0050], using recursive disassembly to trace/identify instructions following entry point); identifying a closest API call site prior to the behavioral anchor ([0050], tracing until a validation point or branch and locating API call in trace); and disassembling code between the closest API call site and the behavioral anchor ([0051], disassembling code between points in trace and using to compare with known API calls).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Tevet, Eberhardt and Poornachandran with the teachings of Shukla, the targeted disassembly comprises: starting disassembly at an address of the behavioral anchor; applying recursive descent disassembly to identify instructions following the behavioral anchor; identifying a closest API call site prior to the behavioral anchor; and disassembling code between the closest API call site and the behavioral anchor, to efficiently classify large number of code fragments or files as trusted or malware during runtime allowing for a dynamic response.
As per claim 5, the combination of Tevet, Eberhardt, Pornachandran and Shukla teaches the computer-implemented method of claim 4, wherein the targeted disassembly further comprises applying linear sweep disassembly to identify adjacent functions when recursive descent disassembly fails to cross function boundaries (Shukla; [0050], performing linear sweep algorithm using known control transfers and API calls discovered using monitoring tools and recursive disassembly see [0049]).
As per claim 14, the substance of the claimed invention is identical or substantially similar to that of claim 4. Accordingly, this claim is rejected under the same rationale.
Claims 8, 9 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Tevet, Eberhardt and Poornachandran in further view Morris et al. (EP-2629232-A2) [hereinafter “Morris”].
As per claim 8, the combination of Tevet, Eberhardt and Poornachandran teaches the computer-implemented method of claim 1.
The combination of Tevet, Eberhardt and Poornachandran does not explicitly teach analyzing temporal relationships between the memory snapshots to distinguish between homologous genes and analogous genes. Morris teaches analyzing temporal relationships between the memory snapshots ([0016], malware detection includes “snapshot” of all potential objects tracked over time including creation time, modifications and updates) also ([0069], including temporal data in determining malware) to distinguish between homologous genes ([0017], determining objects that are deemed malware based on parent-child or “ancestry” related relationship) and analogous genes ([0068], also determining malware using behaviour where malware is known to exhibit certain behaviours and detecting such behaviour).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Tevet, Eberhardt and Poornachandran with the teachings of Morris, analyzing temporal relationships between the memory snapshots to distinguish between homologous genes and analogous genes, to efficiently classify large number of code fragments or files as trusted or malware during runtime allowing for a dynamic response.
As per claim 9, the combination of Tevet, Eberhardt, Poornachandran and Morris teaches computer-implemented method of claim 8, wherein homologous genes comprise genes shared by malware samples from the same family due to common ancestry ([0017], determining objects that are deemed malware based on parent-child or “ancestry” related relationship), and analogous genes comprise genes exhibiting the same behavior but originating from different malware families ([0068], also determining malware using behaviour where malware is known to exhibit certain behaviours and detecting such behaviour).
As per claim 15, the substance of the claimed invention is identical or substantially similar to that of claims 8 and 9. Accordingly, this claim is rejected under the same rationale.
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Tevet, Eberhardt, Poornachandran and Morris in further view Howard et al. (WO-2019075338-A1) [hereinafter “Howard”].
As per claim 10, the combination of Tevet, Eberhardt, Poornachandran and Morris teaches the computer-implemented method of claim 9.
The combination of Tevet, Eberhardt, Poornachandran and Mooris does not explicitly teach wherein analyzing temporal relationships comprises identifying stage transitions in multi-stage malware execution by detecting abandoned genes between consecutive memory snapshots. Howard teaches wherein analyzing temporal relationships comprises identifying stage transitions in multi-stage malware execution (Page 27, para. 2, malware families and samples are analyzed for potential new variants, i.e. a new stage in the malware) by detecting abandoned genes between consecutive memory snapshots (Page 25, para. 3, analyzing malicious binaries over a period at specific dates and setting specific periods to account for malware family die-off or stagnation) with (Page 26, para. 2, removing certain features that are irrelevant or are not showing up for training purposes).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Tevet, Eberhardt, Poornachandran and Mooris with the teachings of Howard, wherein analyzing temporal relationships comprises identifying stage transitions in multi-stage malware execution by detecting abandoned genes between consecutive memory snapshots, to efficiently classify large number of code fragments or files as trusted or malware during runtime allowing for a dynamic response.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Tuvell et al. (US PGPUB No. 2007/0240222), Burkhardt et al. (US PGPUB No. 2008/0016572), Sallam (US PGPUB No. 2012/0255012), Zhang et al. ("MANAGE: A Novel Malware Evolution Model based on Digital Genes," 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC), Guilin, China, 2022, pp. 64-70, doi: 10.1109/DSC55868.2022.00016), Meng et al. ("MCSMGS: Malware Classification Model Based on Deep Learning," 2017 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC), Nanjing, China, 2017, pp. 272-275, doi: 10.1109/CyberC.2017.21), Zhao et al. ("Malware Homology Identification Based on a Gene Perspective," in Frontiers of Information Technology & Electronic Engineering, vol. 20, no. 6, pp. 801-815, June 2019, doi: 10.1631/FITEE.1800523) and Javaheri et al. ("A Novel Method for Detecting Future Generations of Targeted and Metamorphic Malware Based on Genetic Algorithm," in IEEE Access, vol. 9, pp. 69951-69970, 2021, doi: 10.1109/ACCESS.2021.3077295) all disclose various aspects of the claimed invention including analyzing and detecting malware using gene and behavior information.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PETER C SHAW whose telephone number is (571)270-7179. The examiner can normally be reached Max Flex.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PETER C SHAW/Primary Examiner, Art Unit 2493 June 5, 2026
Prosecution Insights