Office Action 2: Notice of Allowance (2024-07-01)

CLAIMS:
In the Claims:

This listing of claims will replace all prior versions, and listings, of claims in theapplication:
1\. (Currently amended) A computer-implemented method for detection of a malicious activity by analyzing object behavior in a non-isolated environment, the method comprising:receiving, from a given host of \[\[the\]\]a plurality of hosts of the non- isolated environment, an event flow including data representative of events occurred at the given host;
analyzing a given event sequence of the event flow having been generated for a predetermined period, to generate, for a given event of the given event sequence, a respective internal event, the respective internal event being format-invariant to other events in the event flow;
applying, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event of the given event sequence,the respective internal state marker being indicative of a then current state of the given host during an occurrence of the given event of the given event sequence; and
respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not;
feeding the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity,

Page 3 of 13 the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity using a training set of data comprising: (i) arrays of training internal state markers associated with training event sequences; and (ii) a respective label assigned to each of the training event sequences, the respective label for a given training event sequence being indicative of whether the given training event sequence is associated with the malicious activity or not; and
in response to the prediction outcome exceeding a predetermined threshold value, determining the given event sequence having been occurred at the given host as being associated with the malicious activity;
generating a report including the prediction outcome for presentation thereof to a user.

2\. (Original) The method of claim 1, prior to applying the plurality of signature-based rules, further comprising storing the respective internal event in a pipeline of internal events.

3\. (Original) The method of claim 1, wherein the determining the at least one internal state marker comprises detecting one of malicious activity and object in one of the given host of the plurality of hosts and a network thereof.

4\. (Original) The method of claim 3, wherein the at least one internal state marker is valid for a predetermined period.

5\. (Original) The method of claim 3, wherein the at least one internal state marker has been pre- assigned with a respective weight value.

6\. (Currently amended) The method of claim 1, wherein at least one internal state indicated by the at least one internal state marker comprises at least one of: a set of flags indicative of \[\[a\]\]thethen current state of the given host, file paths, a registry, processes, signatures, mutexes, synchronization objects, and counters.
7\. (Original) The method of claim 6, wherein the at least one internal state is valid for a predetermined period.

8\. (Original) The method of claim 1, wherein the trained MLA comprises at least one of: a linear model, a classifier, and a neural network.

9\. (Original) The method of claim 1, wherein the report further comprises at least one of: signature markers, information of the given host, contents of environment variables of processes running during occurrences of the given event sequence, information about connected devices, a screenshot, a screen video at a moment of the determining the given event sequence as being associated with the malicious activity, a sequence of user actions executed prior to the given event sequence, an incident graph.

10\. (Currently amended) A system for detecting a malicious activity by analyzing objects behavior in a non-isolated environment, the system comprising: \[\[a\]\]at least one processor communicatively coupled to a plurality of hosts of the non-isolated environment and \[\[a\]\] at least one non-transitory computer-readable memory storing instructions which when executed by the at least one processor, cause the system to:receive, from a given host of the plurality of hosts, an event flow including data representative of events occurred at the given host;
analyze a given event sequence of the event flow having been generated for a predetermined period, to generate, for a given event of the given event sequence, a respective internal event, the respective internal event being format-invariant to other events in the event flow;
apply, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event sequence,
the respective internal state marker being indicative of a then current state of the given host during an occurrence of the given event of the given event sequence; and

Page 5 of 13 respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not;
feed the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity,the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity using a training set of data comprising: (i) arrays of training internal state markers associated with training event sequences; and (ii) a respective label assigned to each of the training event sequences, the respective label for a given training event sequence being indicative of whether the given training event sequence is associated with the malicious activity or not; and
in response to the prediction outcome exceeding a predetermined threshold value, determine the given event sequence having been occurred at the given host as being associated with the malicious activity;
generate a report including the prediction outcome for presentation thereof to a user.

OFFICE ACTION:
DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
EXAMINER'S AMENDMENT
An examiner’s amendment to the record appears below. Should the changes and/or additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the payment of the issue fee.
Authorization for this examiner’s amendment was given in an interview with Amber Beckley on 6/24/24.
The application has been amended as follows:
4. (currently amended) The method of claim 3, wherein the at least one internal state marker is valid for the
7. (currently amended) The method of claim 6, wherein the at least one internal state is valid for the
Reasons for Allowance
Claims 1-10 are allowed.
The following is an examiner’s statement of reasons for allowance: The primary reason for allowance is that the prior art of record fails to teach or render obvious the following subject matter in combination with other elements of the independent claims as well as Applicant’s arguments of record as to the distinguishing claim features over the applied prior art: “applying, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event of the given event sequence, the respective internal state marker being indicative of a then current state of the given host during an occurrence of the given event of the given event sequence; and respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not; feeding, the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity, the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity using a training set of data comprising: (i) arrays of training internal state markers associated with training event sequences; and (ii) a respective label assigned to each of the training event sequences, the respective label for a given training event sequence being indicative of whether the given training event sequence is associated with the malicious activity or not.”
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee.  Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion

APPLICANT REBUTTAL: REMARKS
By the present amendments, claims 1, 6, and 10 have been amended. No claims have been cancelled; and no new claims have been added.
The claims have additionally been amended for clarity.
No new subject matter has been introduced via the present amendments. Support therefor can be found at least on paragraphs [044] to [046] of the present application as filed.
After the entry of the present amendments, claims 1 to 10 will remain pending in the application.
With Re
g
ard to the Claim Rejections under 35 U.S.C.
In the present Office Action, the Examiner has rejected claims 1 to 10 under 35 U.S. C. 102 as being anticipated by U.S. Patent No.: 9,654,485-B1 to Neumann (hereinafter "Neumann").
The Applicant respectfully disagrees; however, in order to expedite the prosecution, the Applicant has amended the independent claims.
It is submitted that claims 1 and 10 as amended are novel and non-obvious over the cited reference, as it does not teach, disclose, or even remotely suggest at least the following features:
applying, by the processor, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the
given event of the given event sequence,
the respective internal state marker being indicative of a then current state of the given host during an occurrence of the given event of the given event sequence;
and
respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with
the malicious activity or not;
feeding, by the processor, the respective internal state markers to a trained machine- learning algorithm (MLA) to determine a prediction outcome thereof of whether the given
event sequence is associated with the malicious activity,
the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity using a training set of data comprising: (i) arrays of training internal state markers associated with training event sequences; and (ii) a respective label assigned to each of the training event sequences, the respective label for a given training event sequence being indicative of whether the given training event sequence is associated with the
malicious activity or not; and
The Applicant notes that with respect to the claimed features of "analyzing, by the processor, a given event sequence of the event flow having been generated for a predetermined period to generate, for a given event of the given event sequence, a respective internal event, the respective internal event being format-invariant to other events in the event flow" and "applying, by the processor, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the given event sequence, respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with the malicious activity or not," the Examiner refers to col. 24, lines 52-61 and col. 15, lines 21 to 57 of Neumann. Also, with respect to the claimed feature of 'feeding, by the processor, the respective internal state markers to a trained machine-learning algorithm (MLA) to determine a prediction outcome thereof of whether the given event sequence is associated with the malicious activity, the trained MLA having been trained to determine whether the given event sequence is associated with the malicious
activity based on the respective internal state markers of the given host associated therewith," the Examiner refers to col. 15, lines 21-57 and col. 25, lines 8-12 of Neumann.
The identified passages of Neumann, as well as, others, providing more context to the teachings thereof, are reproduced below for the ease of reference.
Neumann discloses (emphasis added):
[Abstarct] An analytics-based security monitoring system includes instructions that may be executed by a computing system to receive
data in the form of event lo
g
s from one or more network devices transferred through a computing environment, detect a plurality of behavioral characteristics from the received event lo
g
s, identify behavioral fragments composed of related behavioral characteristics, and identify an attack by correlating the behavioral fragments against patterns of known malicious attacks.
The analytics-based security monitoring system may then perform a learning process to enhance further detection of
attacks and perform one or more remedial actions when an attack is identified.
[...]
[Col. 9, lines 20 to 61] In this description, the term "behavior" generally refers to any low level activity in the computing environment 110, which may be captured as an event during processing within or in communications from a network device.
"Behavioral characteristic" generally refers to any activity in the computing environment 110 that may be categorized according to a specified criteria associated with expected or unexpected use of the computing
environment 110.
[...]
Each behavioral characteristic may represent an action conducted in the computing environment having a plurality of network devices, such as within a proprietary or private network of an enterprise or other organization, which action is associated with expected or unexpected use of the computing environment 110. The event data may be collected and stored in event lo
g
s
by a background process running "behind the scenes" on each of the one or more computer nodes 112 or by a foregoing process on one or more of the computing nodes 112 (e.g., a device that sniffs or otherwise monitors network traffic). The background process may run
without interfering with routine, "foreground" operations and, in some embodiments, without being apparent to the end users or requiring end user interaction during operation. In some embodiments, the background process may be deployed to run during a forensic investigation of a previously detected attack, and in other embodiments the background process may be deployed to run during
normal run-time to continuously monitor runtime behavior for an attack.
[...]
[Col. 15, lines 21 to 57]
A behavioral characteristic correlation module 218 correlates multiple behavioral characteristics 116 with one another using at least one of multiple correlation profiles 122 stored in the data source 106. The behavioral characteristic correlation module 218 may use one or more functions, such as a hi
g
her order function, a heuristic function, a schedule, a profile, and/or a probability distribution function, either singularly or in combination to determine correlations among multiple behavioral characteristics.
Each correlation profile 120 generally includes information associated with a set of behavioral characteristics that form a behavior pattern. When associated behavioral characteristics in the normalized data are observed (e.g., detected) with a relatively high degree of relevance to each other as indicated by the behavioral characteristic pattern, they may provide evidence of an attack or at least a portion of an attack. The behavioral pattern of each correlation profile 120 may include any combination of behavioral characteristics that may be related to one another, such as those behavioral characteristics that occur during or close to the same time frame, behavioral characteristics that originate from the same computing node, behavioral characteristics that originate from multiple computing nodes that are owned by the same user or accessed using the same user credentials, behavioral characteristics that access or manipulate the same element of data,
and the like.
An attack identification module 219 receives the determined behavioral fragments from the behavioral fragment detection module 218 and correlates those fragments with a plurality of attack patterns of known attacks previously detected and analyzed,
as stored in the attack profiles repository 122.
The attack identification module 219 may use, depending on the embodiment, one or more functions, Such as a hi
g
her order function, a heuristic function, a schedule, a profile, blacklists, whitelists, and/or a probability distribution function,
either
singularly or in combination in identifying and verifying an attack.
[Col. 24, lines 52 to 61] In step 506, the security monitoring framework 104 detects behavioral characteristics from the received event logs. In one embodiment, the security monitoring framework 104 detects the behavioral characteristics using independently deployable modules that are each configured for detecting a separate behavioral characteristic. For example,
one module may be configured for detecting a spiderin
g
event, a second module may be configured to detect a hopping event, while a third module may be configured to detect an account probing
event.
[ ... ]
[Col. 25, lines 8 to 12] In step 508,
the security monitoring framework 104 correlates the detected behavioral characteristics with a correlation profile 120 stored in the data source
106 to identify a set of related behavioral characteristics called behavioral fragments.
Overall, the method of Neumann is directed to identifying a malicious attack in a given computer environment by (i) analyzing preliminarily generated event logs from the given computer environment to identify behavioral patterns of events therein; and (ii) determining a
correlation of the so identified behavioral
p
atterns with behavioral
p
atterns of known malicious attacks.
To do so, the method ofNeumann includes using at least one of
a hi
g
her order function, a heuristic function, a schedule, a
p
rofile, and/or a
p
robabilit
y
distribution function,
In sharp contrast, the presently claimed subject-matter is directed to analyzing certain internal states markers of the given
host, each of which has been caused by the occurrence of a res
p
ective event of a given event se
q
uence.
To do so, the presently claimed subject-matter is directed to generating, for each event in the given event sequence, a respective internal event which is format-invariant to the events in the given event sequence.
It is respectfully submitted that the person of ordinary skill in the art would understand that the term "internal event" refers to an event as defined in the field of Unified Model Language state machine, that is,
the event which is re
p
resentative of a state change of the given host in
res
p
onse to the res
p
ective event of the given event se
q
uence
,
which Neumann also fails to disclose.
Further, using these internal events, the respective internal state markers of the given host can be identified that are indictive of certain internal states of the given host during the occurrence of the respective event. Finally, these internal state markers are used for determining the presence of the malicious activity.
To do so,
unlike in the method of Neumann
,
the
p
resentl
y
claimed subject-matter uses an MLA that has been s
p
ecifically trained to determine whether a given array of internal state markers is indicative of the malicious activity based on (1) arrays of training internal states markers of training hosts and (2) labels
representative of whether a given array of training internal states markers is associated with the malicious activity.
Thus, it is respectfully submitted that the claims as amended are novel and non-obvious in view of Neumann, as Neumann fails to teach, disclose, or suggest at least the following feature of the independent claims 1 and 10, and, as such, do not render obvious the subject-matter thereof:
applying, by the processor, to the respective internal event, a plurality of signature-based rules to determine at least one internal state marker of the given host associated with the
given event of the given event sequence,
the respective internal state marker being indicative of a then current state of the given host during an occurrence of the given event of the given event sequence;
and
respective internal state markers associated with the each one of the given event sequence being indicative of whether the given event sequence is associated with
the malicious activity or not;
feeding, by the processor, the respective internal state markers to a trained machine- learning algorithm (MLA) to determine a prediction outcome thereof of whether the given
event sequence is associated with the malicious activity,
the trained MLA having been trained to determine whether the given event sequence is associated with the malicious activity using a training set of data comprising: (i) arrays of training internal state markers associated with training event sequences; and (ii) a respective label assigned to each of the training event sequences, the respective label for a given training event sequence being indicative of whether the given training event sequence is associated with the
malicious activity or not; and
Pending claims 2 to 9 recite additional features of the currently claimed subject-matter and are therefore believed to be novel and patentable over Neumann at least for the reasons discussed above with respect to claim 1 and for the additional features recited therein.
In view of the foregoing, the Applicant respectfully requests that the rejections under 35 U.S.C. 102 be withdrawn.
Conclusions