McAfee Ireland Holdings Limited

Patent Trials and Appeals Board

Apr 1, 2022

2021001769 (P.T.A.B. Apr. 1, 2022)

UNITED STATES PATENT AND TRADEMARK OFFICE UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www.uspto.gov APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO. 16/113,154 08/27/2018 Lixin LU 359253991140C2- P53658USC2 3765 152506 7590 04/01/2022 Patent Capital Group - McAfee, LLC 4524 Briar Hollow Drive Plano, TX 75093 EXAMINER JACKSON, JENISE E ART UNIT PAPER NUMBER 2439 NOTIFICATION DATE DELIVERY MODE 04/01/2022 ELECTRONIC Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the following e-mail address(es): PAIR_152506@patcapgroup.com eofficeaction@appcoll.com PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE ____________ BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________ Ex parte LIXIN LU Appeal 2021-001769 Application 16/113,154 Technology Center 2400 Before CARL W. WHITEHEAD JR., ERIC S. FRAHM, and DAVID M. KOHUT, Administrative Patent Judges. PER CURIAM DECISION ON APPEAL STATEMENT OF THE CASE Pursuant to 35 U.S.C. § 134(a), Appellant1 appeals from the Examiner’s decision to reject claims 84-103. We have jurisdiction under 35 U.S.C. § 6(b). We AFFIRM. 1 We use the word Appellant to refer to “applicant” as defined in 37 C.F.R. § 1.42(a). Appellant identifies McAfee, LLC, as the real party in interest. Appeal Br. 2. Appeal 2021-001769 Application 16/113,154 2 CLAIMED SUBJECT MATTER Appellant’s Invention The present invention “relates to . . . systems and methods of processing information associated with detecting and handling malware.” Spec. 44, Abstract. Claim 84, reproduced below, is illustrative of argued subject matter. 84. At least one non-transitory computer-readable medium comprising instructions, that, when executed by a processor, are to: execute malware code within a native operating system of the malware code; generate a log of executed logic paths of the malware code that have been executed within the native operating system of the malware code; generate a log of non-executed logic paths of the malware code that have not been executed within the native operating system based on the log of the executed logic paths; identify a latent behavior of the malware code based on the log of the nonexecuted logic paths; and create a malware repair program based on the log of the executed logic paths and the log of the non-executed logic paths, the malware repair program comprising an instruction configured to reverse the latent behavior of the malware code. Appeal Br. 13 (Claims App.). Rejections Claims 84, 87, 88, 91, 92, 95, 96, 98, 101, and 102 are rejected under 35 U.S.C. § 103(a) as being unpatentable over Thomas Appeal 2021-001769 Application 16/113,154 3 (US 2010/0031353 A1; pub. Feb. 4, 2010) and Wenzinger (US 2009/0217258 A1; pub. Aug. 27, 2009). Final Act. 6-10. Claims 85, 86, 93, 94, 99, and 100 are rejected under 35 U.S.C. § 103(a) as being unpatentable over Thomas, Wenzinger, and Peikari (US 2005/0216762 A1; pub. Sept. 29, 2005). Final Act. 10-11. Claims 89, 90, 97, and 103 are rejected under 35 U.S.C. § 103(a) as being unpatentable over Thomas, Wenzinger, and Schloegel (US 2011/0126288 A1; pub. May 26, 2011). Final Act. 12-13. ANALYSIS Because the Briefs and Answer are directed to only claim 84, we address the raised issues with reference to claim 84. See generally Appeal Br.; see also Ans.; and Reply Br. For the following reasons, Appellant’s arguments are not persuasive. We therefore sustain the Examiner’s decision to reject all claims under 35 U.S.C. § 103(a). See supra (“Rejections” section). The dispositive issue is whether Thomas teaches the following argued claim step: “generate a log of non-executed logic paths of the malware code that have not been executed within the native operating system based on the log of the executed logic paths.” See generally Appeal Br.; see also Reply Br. Appellant contends that, because the claimed invention also “executes malware code within a native operating system [(OS)]” as a prior step, the argued step conveys that: the “log of the executed logic paths” includes only paths that were so executed; the “log of non-executed logic paths” includes only paths that were not so executed; and “generate a log of non-executed logic paths . . . based on the log of the executed logic paths” entails specifying of the non-executed logic paths based on specifying of the Appeal 2021-001769 Application 16/113,154 4 executed logic paths. Id. Appellant further contends that Thomas rather teaches logging of results from behavior analysis of logic paths,2 unrelated logging of results from static analysis of logic paths,3 and combining of the logs/results. Id. We agree that the claim restricts the executed logic paths to those executed by the native OS and similarly restricts the non-executed logic paths to those not so executed; i.e., these two sets of logic paths are mutually exclusive. We also agree that the Examiner reads the “log of non-executed logic paths . . . based on the log of the executed logic paths” on a log of non-executed and executed logic paths. See Final Act. 6-7; see also Ans. 4. Specifically, the Examiner reads the claimed “log of non-executed logic paths . . . based on the log of the executed logic paths” on Thomas’s “combine[d] results” (Thomas’s Fig. 4 (step 425)) of: a behavior analysis that executes software on an OS and thereby identifies malicious logic paths; and a static analysis that does not execute software on an OS, but rather detects signatures of malicious code and thereby identifies malicious logic paths. Id.; see also Thomas ¶¶ 55-58. Appellant fails to provide sufficient evidence or argument to show, however, that the claimed “log of non-executed logic paths” includes only non-executed logic paths. For example, Appellant does not provide sufficient evidence to show that their choice of transitional terminology- choosing to recite a “log of” rather than specifying a “log comprised of” (at 2 “Behavior of a program includes what a program does when it is executed.” Thomas ¶ 32. 3 “Static properties include properties of a program that can be determined without executing the program.” Thomas ¶ 29. Appeal 2021-001769 Application 16/113,154 5 least non-executed logic paths) or “log consisting of” (only non-executed logic paths)-would be ordinarily construed as requiring the narrower/closed “consisting of” scope. See Manual of Patent Examining Procedure (MPEP) § 2111.03, Transitional Phrases (Rev. 08.2017, Jan. 2018); see also CIAS, Inc. v. All. Gaming Corp., 504 F.3d 1356, 1361 (Fed. Cir. 2007) (“For patent claims the distinction between ‘comprising’ and ‘consisting’ is established, along with the meaning of ‘comprised of’ as related to ‘comprising,’ not ‘consisting of.’”). We accordingly apply the broader/open “comprised of” scope (as applied by the Examiner). Doing so protects the public’s right to expect that, if Appellant intended the narrower/closed scope for examination, the claim would expressly recite the “consisting of” terminology established for that purpose. See In re Yamamoto, 740 F.2d 1569, 1571 (Fed. Cir. 1984) (“The PTO broadly interprets claims [to] serve[] the public interest by reducing the possibility that claims, finally allowed, will be given broader scope than is justified. [The applicant’s] interests are not impaired since they are not foreclosed from obtaining appropriate coverage for their invention with express claim language.”) (emphasis added). Of course, Appellant may show a clear reason to read the narrower/closed scope into the claim from the Specification. See In re Am. Acad. Of Sci. Tech Ctr., 367 F.3d 1359, 1369 (Fed. Cir. 2004) (“We have cautioned against reading limitations into a claim[,] even if [read from] the only embodiment described, absent clear disclaimer in the [S]pecification.”); In re Dance, 160 F.3d 1339, 1344 (Fed. Cir. 1998) (“[T]he inventor may be his own lexicographer, and may use common words in uncommon ways, provided only that the intended meaning is clear.”). Appellant has, at best, Appeal 2021-001769 Application 16/113,154 6 presented a reason for the disclosed invention to operate as argued; the reason being to perform a behavior analysis and then perform a static analysis on the non-executed logic paths to detect latent malicious code. Appeal Br. 4-6; see also supra nn.3-4. Appellant has not, however, sufficiently shown this feature should be read into the claim. See Am. Acad., 367 F.3d at 1369. Further, Appellant expressly states this feature should not be read into the claim. The Appeal Brief’s “Summary of Claimed Subject Matter” (Appeal Br. 3 (heading)) describes the feature (id. at 4-6) but states: Appellant may refer to or quote from certain portions of the Drawings and Specification to provide contextual information that may help the Board to understand the claims without needing to search the Specification. The Appellant expressly does not intend to “read in” these portions of the Specification into the claims or otherwise intend the claims to be given any special meaning according to this discussion. Id. at 3 (emphasis added). The Summary also states: 37 C.F.R. § 41.37(c)(1)(iii) requires [that] a concise explanation of the subject matter defined in each . . . independent claim[] be provided with reference to the specification by paragraph numbers and to the drawings by reference characters.4 However, Appellant’s compliance with such requirements anywhere in this document should in no way be interpreted as limiting the scope of the pending claims, but simply as non-limiting examples thereof. Id. at n.1 (emphasis added). 4 Despite this requirement, neither Brief includes a citation to the Specification or Drawings. See generally Appeal Br.; see also Reply Br. Appeal 2021-001769 Application 16/113,154 7 Appellant also fails to supply sufficient evidence to show that the disputed claim limitation’s “based on” requires the implicitly recited specifying of non-executed logic paths (i.e., in a log) to be based on the implicitly recited specifying of executed logic paths. And, applying our above determinations, the claim language rather requires: a first log comprised of non-executed logic paths; a second log comprised of executed logic paths; and, because “based on” grammatically modifies “generate,” the first log must be generated based on the second log. In re Hyatt, 708 F.2d 712, 714 (Fed. Cir. 1983) (“A claim must be read in accordance with the precepts of English grammar.”). That is not, as Appellant argues, a requirement to determine the first log’s contents based on the second log’s contents. We add that our search for case law addressing a similar use of “based on” language in a claim returned one pertinent (albeit non-precedential) Federal Circuit decision. The at-issue claim recited an access operation performed by “asking[], on the basis of the access class data [(ACD)], whether the access authorization data [(AAD)] include an access threshold value [(ATV)].” IPCom GmbH & Co. v. HTC Corp., 655 F. App. 831, 834 (Fed. Cir. 2016) (original emphasis and ellipses). This access operation is comparable to the at-hand, disputed claim limitation because there is an action (“asking whether” - “generating”) upon first data having specified contents (“AAD includes an ATV” - “log of non-executed logic paths”) and influenced in an undefined manner by second data having specified contents (“on the basis of the ACD” - “based on the log of executed logic paths”). The court construed “on the basis of the [ACD]” as merely somehow (i.e., in any manner) restricting the act of asking whether the AAD Appeal 2021-001769 Application 16/113,154 8 include an ATV and not as also restricting the implicit determining of whether the AAD include an ATV. Id. at 836 (“[R]equires, in some way, asking whether to look at an ATV based on ACD” and “is satisfied . . . where access is initially determined on the basis of ACD and thereafter is based upon an ATV.”); see also the appealed Board decision, HTC Corp. v. IPCom GmbH & Co., APPEAL 2014-003314, 2015 WL 848138, at *1 (PTAB 2015) (Unpersuaded “that the result of asking whether the [AAD] includes an [ATV] must depend on the [ACD].”) (quoting arguments). Similarly, we construe “based on the log of executed logic paths” as merely somehow restricting the act of generating the log of non-executed logic paths and not as also restricting the implicit specifying of (i.e., determination to log) the non-executed logic paths. In view of the above, we are apprised of no error in the Examiner’s reading of the claimed “log of non-executed logic paths . . . based on the log of the executed logic paths” on Thomas’s “combine[d] results” (Thomas Fig. 4 (step 425)). We add there is no dispute that the combined results: constitute a log of results from analyzing logic paths by static and behavior analyses (see id. steps 410, 415, 420); thus constitute a log comprised of non-executed logic paths; and are generated based on a log of executed logic paths (see id. steps 415, 420). CONCLUSION For the foregoing reasons, we affirm the Examiner’s decision to reject claims 84-103. Appeal 2021-001769 Application 16/113,154 9 DECISION SUMMARY In summary: Claims Rejected 35 U.S.C. § Reference(s)/Basis Affirmed Reversed 84, 87, 88, 91, 92, 95, 96, 98, 101, 102 103(a) Thomas, Wenzinger 84, 87, 88, 91, 92, 95, 96, 98, 101, 102 85, 86, 93, 94, 99, 100 103(a) Thomas, Wenzinger, Peikari 85, 86, 93, 94, 99, 100 89, 90, 97, 103 103(a) Thomas, Wenzinger, Schloegel 89, 90, 97, 103 Overall Outcome 84-103 No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a). See 37 C.F.R. § 1.136(a)(1)(iv). AFFIRMED