Ex Parte Niemelä

Patent Trial and Appeal Board

May 17, 2017

12587522 (P.T.A.B. May. 17, 2017)

United States Patent and Trademark Office
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O.Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
12/587,522 10/07/2009 Jarno Niemela 060B .0009.U1 (US) 5274
29683 7590 05/18/2017
HARRINGTON & SMITH
4 RESEARCH DRIVE, Suite 202
SHELTON, CT 06484-6212
EXAMINER
KIM, CHRISTY Y
ART UNIT PAPER NUMBER
2158
MAIL DATE DELIVERY MODE
05/18/2017 PAPER
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte JARNO NIEMELA
Appeal 2016-007531
Application 12/587,522
Technology Center 2100
Before CAROLYN D. THOMAS, BRADLEY W. BAUMEISTER, and
JOSEPH P. LENTIVECH, Administrative Patent Judges.
BAUMEISTER, Administrative Patent Judge.
DECISION ON APPEAL
Appellant appeals under 35 U.S.C. § 134(a) from the Examiner’s
rejections of claims 1, 3—9, 12, 13, 15, 17, and 21—23, which constitute all
the claims pending in this application. App. Br. 2.1 Claims 2, 10, 11, 14,
16, and 18—20 have been canceled. Id. We have jurisdiction under
35 U.S.C. § 6(b).
We reverse.
1 Rather than repeat the Examiner’s positions and Appellant’s arguments in
their entirety, we refer to the following documents for their details: the Final
Action mailed January 14, 2015 (“Final Act.”); the Appeal Brief filed
October 26, 2015 (“App. Br.”); the Examiner’s Answer mailed
May 25, 2016 (“Ans.”); and the Reply Brief filed July 25, 2016
(“Reply Br.”).
Appeal 2016-007531
Application 12/587,522
STATEMENT OF THE CASE
Appellant describes the present invention as follows:
A method of controlling a process on a computer system for
backing-up files stored in a primary storage medium, to a
secondary storage medium. The method comprises monitoring a
file system implemented on the computer system in order to
detect write operations made by the file system to said primary
storage medium. Upon detection of a write operation, the
integrity of a file being written is verified and/or changes in the
file identified with respect to a version of the file currently stored
in the primary storage medium and which is being replaced. In
the event that the integrity of a file being written by the file
system is compromised, and/or any identified changes in the file
are suspicious, then the file is identified to the back-up process
such that automatic backup of the file is inhibited.
Abstract.
Independent claim 8, reproduced below with emphasis added, is
illustrative of the claimed subject matter on appeal:
8. A method of controlling a process on a computer system
for backing-up files stored in a primary storage medium, to a
secondary storage medium, the method comprising:
monitoring a file system implemented on the computer
system in order to detect patterns in multiple write operations
made to said primary storage medium that are indicative of the
activity of malware on the computer system and/or of faults in
the computer system;
upon detection of such a pattern, identifying to the back­
up process that- automatic back-up of files associated with the
pattern to said secondary storage medium is to be inhibited; and
subsequently performing copying files from the a back-up
of files including primary storage medium to the secondary
storage medium excepting those files for which back-up is
inhibited.
2
Appeal 2016-007531
Application 12/587,522
Claims 8, 9, 13, and 17 stand rejected under 35 U.S.C. § 103(a) as
unpatentable over Shen (US 6,611,850 Bl; issued Aug. 26, 2003) and Tuvell
(US 2007/0240219 Al; published Oct. 11, 2007). Final Act. 3—13; App.
Br. 9.2
Claims 1, 3—7, 12, 15, 21, and 23 stand rejected under 35 U.S.C.
§ 103(a) as unpatentable over Shen, Chan (US 4,827,478; issued May 2,
1989), and Tuvell. Final Act. 13—23; App. Br. 9.
Claim 22 stands rejected under 35 U.S.C. § 103(a) as unpatentable
over Shen, Chan, Tuvell, and Evans (US 2011/0047618 Al; published
Feb. 24, 2011). Final Act. 23—24; App. Br. 9.
We review the appealed rejections for error based upon the issues
identified by Appellant, and in light of the arguments and evidence produced
thereon. Ex parte Frye, 94 USPQ2d 1072, 1075 (BPAI 2010) (precedential).
FINDINGS AND CONTENTIONS
The Examiner finds that Shen teaches ah of the limitations of
independent claim 8 with the exception of the first limitation, “monitoring a
file system implemented on the computer system in order to detect patterns
in multiple write operations made to said primary storage medium that are
indicative of the activity of malware on the computer system and/or of faults
in the computer system.” Final Act. 2—A. The Examiner relies upon Tuvell
for teaching this limitation (id. (citing Tuvell || 279, 292—295); Ans. 2—3
(citing Tuvell || 102, 280, 294—295)) and sets forth reasoning for why
2 The Final Action sets forth a rejection of claims 10, 11, 14, and 19 (Final
Act. 3—13), but these claims were canceled by Amendment filed on
November, 26, 2014.
3
Appeal 2016-007531
Application 12/587,522
Tuvell’s teachings “would have allowed Shen to utilize various integrity and
malware checks of files prior to backup” (Final Act. 4).
Appellant asserts in relation to Tuvell that
Tuvell does not teach monitoring a file system in order to detect
patterns in multiple write operations, but instead the passages of
Tuvell cited by the Examiner refer to features that are detected
when reviewing the code of a potentially malicious program.
There is clearly a difference between “patterns in multiple write
operations” and reviewing the code of a potentially malicious
program. The [EJxaminer has committed error by consider the
two as being the same.
App. Br. 16.
Appellant further clarifies this argument, as follows:
The Examiner has misinterpreted [Tuvell’s] “procedures” as if
the executable were actually being currently run, which is not
the case. Tuvell teaches examining an executable file to
determine whether it is intended, or capable, of performing
multiple write operations. In contrast, claim 8 requires
“monitoring” actual “write operations made to said primary
storage medium” in order to determine whether they are
indicative of malware or faults in the computer system.
Id. at 16—17.
See also Appellant’s reply:
Tuvell discloses on-write malware scanning of a single file
in paragraph [0102], In a separate embodiment, Tuvell discloses
feature based malware detection which is performed by
analyzing a feature set of an application based on the
application’s code (paragraph [0276]). The on-write malware
scanning is not used in the feature based malware detection.
Instead the feature based malware detection looks only at object
code of selected applications in order to determine their
operation. It is only in the discussion of feature based malware
detection that the malicious procedures of e.g. self-replication
4
Appeal 2016-007531
Application 12/587,522
(paragraph [0280]) and system corruption (paragraph [0292]),
which the Examiner relies on in his arguments, are presented.
Reply Br. 2—3.
ANALYSIS
The portions of Tuvell relied upon by the Examiner indicate that
Appellant’s arguments are persuasive. Tuvell’s on-write malware scanning
framework entails monitoring the operating system files to identify each file
that is changed, and notifying a malware scanning process of the changed
files. Tuvell 1102. TuvelTs feature based malware detection identifies
procedures and functions in saved target application code that is to perform
write operations. Id. ^fl[ 276—285. Tuvell does not “detect patterns in
multiple write operations made to [a] primary storage medium,” as recited in
independent claim 8.
Accordingly, we do not sustain the Examiner’s rejection of that claim,
independent claims 13 and 17, which set forth similar claim language, or of
claim 9, which depends from claim 8.
With respect to the remaining rejections of claims 1, 3—7, 12, 15, and
21—23, the Examiner does not rely on the additionally cited references, Chan
and Evans, to cure the deficiency of the obviousness rejection explained
above. See Final Act. 14—16, 23, 24. Accordingly, we likewise do not
sustain the obviousness rejections of those claims for the reasons set forth
above.
5
Appeal 2016-007531
Application 12/587,522
DECISION
The Examiner’s decision rejecting claims 1, 3—9, 12, 13, 15, 17, and
21—23 is reversed.
REVERSED
6