Prosecution Insights
Last updated: April 18, 2026
Application No. 17/932,649

INSTANT DETECTION OF A HOMOGLYPH ATTACK WHEN REVIEWING CODE IN AN AUGMENTED REALITY DISPLAY

Non-Final OA §103
Filed
Sep 15, 2022
Examiner
KANAAN, SIMON P
Art Unit
2407
Tech Center
2400 — Computer Networks
Assignee
International Business Machines Corporation
OA Round
1 (Non-Final)
83%
Grant Probability
Favorable
1-2
OA Rounds
3y 2m
To Grant
99%
With Interview

Examiner Intelligence

Grants 83% — above average
83%
Career Allow Rate
536 granted / 649 resolved
+24.6% vs TC avg
Strong +16% interview lift
Without
With
+16.0%
Interview Lift
resolved cases with interview
Typical timeline
3y 2m
Avg Prosecution
14 currently pending
Career history
663
Total Applications
across all art units

Statute-Specific Performance

§101
12.1%
-27.9% vs TC avg
§103
39.6%
-0.4% vs TC avg
§102
25.0%
-15.0% vs TC avg
§112
12.9%
-27.1% vs TC avg
Black line = Tech Center average estimate • Based on career data from 649 resolved cases

Office Action

§103
DETAILED ACTION Office Action Summary Claims 1-20 are pending in the instant application. Claims 1-20 are rejected under 35 USC § 103 . Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the invention was made. Claims 1-20 rejected under 35 U.S.C. 103 as being unpatentable over Brown et al. (US Patent No: 10,943,067 ) hereinafter referred to as Brown in view of Gribetz et al. (US Pre-Grant Publication No: 2014/0184496 ) hereinafter referred to as Gribetz . As per claims 1, 8 and 15, Brown teaches … determining whether a line of code of source code includes a non-coding script character in a non-coding script that is a homoglyph of a coding script character in a coding script as indicated in a homoglyph pair, wherein valid statements in a computer language in which the source code is written are formed from characters in the coding script and not from characters in the non-coding script; and ( Brown , column 2, lines 45-56 teach “ As one skilled in the art will appreciate in light of this disclosure, certain embodiments may be capable of achieving certain advantages, including some or all of the following: (1) improving computer security by enabling a computer to detect or intercept homograph atta cks that would otherwise deceive human users, (2) enabling homograph atta ck recognition to be performed server-side, thereby reducing computational requirements for client devices, (3) enhancing user interfaces by providing elements that inform users when homograph atta cks may be occurring, (4) sanitizing data corpuses to remove homographic data” and column 4, lines 60 through column 5 line 2, teach es “ (23) The data processing applications 221 are executed to perform a data processing function with respect to a data corpus. For example, a data processing application 221 may be training a machine learning model, indexing network pages for a search engine, performing plagiarism detection, sanitizing source code repositories, or performing other functions. The homograph recognition engine 218 may be used to sanitize the data corpus to remove homographic strings or to replace them with the strings that they appear to be before the data corpus is processed. ”) But, Brown does not teach in response to determining that the line of code includes the non-coding script character in the homoglyph pair, transmitting information on the homoglyph pair to cause the augmented reality display to render information on indication of the homoglyph. However, Gribetz teaches in response to determining that the line of code includes the non-coding script character in the homoglyph pair, transmitting information on the homoglyph pair to cause the augmented reality display to render information on indication of the homoglyph . ([0444], teaches “In one implementation, a statistical significance test may be performed upon the degree of homographic intrusion detected by the taction detector. An apparatus configured to perform a measure of the degree of homographic intrusion may, in some implementations, be referred to as a homography intrusion estimator or a homographic-intrusion estimator. In an implementation where such an estimator is thresholded, used as a trigger for another action, and/or the like, the apparatus may be referred to as a homography intrusion detector. In one implementation, detection and estimation theory, such as Neyman-Pearson theory, or the like, may be applied to a homography intrusion detector 401 depicted in FIG. 1AA.” And [0404] teaches “In accordance with an option, the sensing and display apparatus 1300 is configured to: (A) display an image to the user (e.g., to operate as a monitor and/or a display device) in the first augmediated-reality space 1000 and/or in the second augmediated-reality space 1002; (B) to intake (e.g., to operate as a camera) an image of the environment in the first augmediated-reality space 1000 and/or in the second augmediated-reality space 1002; and (C) to process (e.g., augmen t, analyze, modify, and/or the like) the image displayed to the user in the first augmediated-reality space 1000 and/or in the second augmediated-reality space 1002. To augmen t the image includes, in one implementation, overlaying computer-generated information (e.g., data and/or images) on top of the image of the normal world (e.g., the original scene in the first augmediated-reality space 1000 of FIG. 1B) the sensing and display apparatus. The sensing and display apparatus 1300 is configured to augmen t and mediate the reality the user perceives in the first augmediated-reality space 1000 and/or the second augmediated-reality space 1002.” ) It would have been obvious to one having ordinary skill in the art, before the effective filing of the claimed invention to modify the invention of Brown with the method of Gribetz because using a augmented reality display to interact with reality is well known in the art, this is substituting displaying results using one type of display for another . As per claims 2, 9 and 16, Brown in view of Gribetz teaches … wherein the information to render in the augmented reality display on the homoglyph includes: the non-coding script character and the coding script character in the homoglyph pair; and an indicator of a homoglyph attack. ( Gribetz , [0348] teaches “ In another example, in one implementation, effector signals and/or other computer-generated sensory phenomena may include a flash, strobe, and/or the like for alert ing, warning, blinding, disabling, disorienting, and/or the like.”) As per claims 3, 10 and 17, Brown in view of Gribetz teaches … wherein the information to render in the augmented reality display on the homoglyph includes a highlighting of a program statement in the line of code including the non-coding script character in the homoglyph pair. ( Gribetz , [0476], teaches “the selected object or point-of-interest may be highli ghted in the virtual space”) As per claims 4 and 11, Brown in view of Gribetz teaches … wherein the line of code comprises new code to add to the source code, wherein the operations further comprise: storing the line of code in a source code repository in response to determining that the line of code does not include a non-coding script character that is a homoglyph of a coding script character in the homoglyph pair. ( Gribetz , [0366], teaches The processing apparatus 908 may include a non-transitory machine-readable storage medium 909, hereafter referred to as the memor y assembly 909. The memor y assembly 909 is configured to store data and executable programs (programmed instructions) in a format readable by the processing apparatus 908. Examples of the memor y assembly 909 may include computer readable and/or computer writable media, magnetic media such as magnetic disks, cards, tapes, and drums, punched cards and paper tapes, optical disks, barcodes and magnetic ink characters, and/or the like. Examples of machine-readable technologies include magnetic recording, processing waveforms, barcodes, and/or the like. In one implementation, optical character recognition (OCR) can be used to allow the processing apparatus 908 to read information, such as information that is readable by humans. Any information retrievable by any form of energy can be machine-readable.”, also anything displayed is stored even if temporarily) As per claims 5, 12 and 18, Brown in view of Gribetz teaches … wherein the transmitting information on the homoglyph pair causes the augmented reality display to render controls to enable the reviewer to replace the non-coding script character in the line of code with the coding script character in the homoglyph pair to form a modified line of code and to store the modified line of code in a source code repository. ( Gribetz , [0404] teaches “In accordance with an option, the sensing and display apparatus 1300 is configured to: (A) display an image to the user (e.g., to operate as a monitor and/or a display device) in the first augmediated-reality space 1000 and/or in the second augmediated-reality space 1002; (B) to intake (e.g., to operate as a camera) an image of the environment in the first augmediated-reality space 1000 and/or in the second augmediated-reality space 1002; and (C) to process (e.g., augmen t, analyze, modify, and/or the like) the image displayed to the user in the first augmediated-reality space 1000 and/or in the second augmediated-reality space 1002. To augmen t the image includes, in one implementation, overlaying computer-generated information (e.g., data and/or images) on top of the image of the normal world (e.g., the original scene in the first augmediated-reality space 1000 of FIG. 1B) the sensing and display apparatus. The sensing and display apparatus 1300 is configured to augmen t and mediate the reality the user perceives in the first augmediated-reality space 1000 and/or the second augmediated-reality space 1002.”) As per claims 6, 13 and 19, Brown in view of Gribetz teaches … wherein the operations further comprise: analyzing a homoglyph attack report to determine an indicated homoglyph pair of a non-coding script character and a coding script character where the non-coding script character was used in a homoglyph attack; and generating a homoglyph pattern in a homoglyph pattern repository to include the homoglyph pair determined from the homoglyph attack report, wherein the determining whether the line of code includes a non-coding script character that is a coding script character in a homoglyph pair comprises determining whether a homoglyph pattern in a homoglyph pattern repository includes the homoglyph pair indicating the non-coding script character in the line of code. ( Gribetz , [0429], “In accordance with an option, the sensing and display apparatus 1300 may be configured to operate in a multiplexed manner, and/or may be configured to execute multiplexing. For example, the digital eye glass 180 and the digital eye glass 190 may be configured to cooperate, such as by time-division multiplexing, and thereby alternately illuminating the scene to sense and/or understand the objects located in the first augmediated-reality space 1000. The multiplexing may be effectuated, for example, by using code-division multiplexing (e.g., using different spreading sequences or spread spectrum or spread spatialization pattern s),) As per claims 7, 14 and 20, Brown in view of Gribetz teaches … wherein the operations further comprise: generating a data structure in response to receiving the line of code indicating a reviewer identifier, a file identifier including the line of code, a version identifier indicating a version of the source code, the line of code being reviewed, a location in the line of code including the non-coding script character, and a homoglyph pair indicating the non-coding script and the coding script character in response to determining that the non-coding script character is a homoglyph of the coding script character, and a fix suggestion to replace the non-coding script character with the coding script character in the homoglyph pair. (Brown, column 2, lines 45-56 teach “ As one skilled in the art will appreciate in light of this disclosure, certain embodiments may be capable of achieving certain advantages, including some or all of the following: (1) improving computer security by enabling a computer to detect or intercept homograph atta cks that would otherwise deceive human users, (2) enabling homograph atta ck recognition to be performed server-side, thereby reducing computational requirements for client devices, (3) enhancing user interfaces by providing elements that inform users when homograph atta cks may be occurring, (4) sanitizing data corpuses to remove homographic data” and column 4, lines 60 through column 5 line 2, teaches “(23) The data processing applications 221 are executed to perform a data processing function with respect to a data corpus. For example, a data processing application 221 may be training a machine learning model, indexing network pages for a search engine, performing plagiarism detection, sanitizing source code repositories, or performing other functions. The homograph recognition engine 218 may be used to sanitize the data corpus to remove homographic strings or to replace them with the strings that they appear to be before the data corpus is processed.” AND Gribetz, [0991], teaches “Operation (a) includes once an application at a leaf of the file structure tree has a notification, its icon propagates to the level of the tree (e.g., 4-ary tree) of icons that is currently in view, squeezes to the center of the four icons with a red hue and a number appears on top of the traditional logo in the same scale, indicating the number of unread messages.”) Other Art of Record Ghosh et al. (US 20180268130) teaches “[0172] When the instruction, i.sub.x86.sup.HG, is interpreted by a generic x86 interpreter, the memory state is transformed from m.sub.x86.sup.1 to m.sub.x86.sup.2. When that same instruction is interpreted by the strata instance, the memory state is transformed from m.sub.x86.sup.1 to m.sub.x86.sup.3. The premise behind Point-ISA is that this homographic behavior of i.sub.x86.sup.HG (which leads to memory states m.sub.x86.sup.2 and m.sub.x86.sup.3) can be differentiated programmatically enabling detection of the replacement attack.” AND “ [0335] FIG. 9E illustrates the workflow for protecting an application via DataMeld. In particular, FIG. 9E shows the workflow for the application protection process via DataMeld. First, the memory references with most instruction coverage are calculated. Subsequently, the variables in source code that correspond to these references are identified. Finally, DataMeld is implemented using Strata. ” Mushtaq (US 11165793) teaches “An Active Vision detection method and system for detecting credential stealing attacks using an automated machine-learning page examination engine is provided that may be used to detect both brand-based and custom credential stealing attacks. The approach employs similarity analysis in a two stage process that may be achieved through supervised or self learning machine learning techniques and is comparable to human analysis. The Active Vision System is capable of self-learning; every new attack detected by the system becomes part of system's long term memory making it incrementally more accurate in future predictions using its past experience.” Pon et al. (US 10862907) teaches “An inventory of Internet-facing assets related to a target domain is generated using network data gathered from network data sources. Using data sources of known threats, such as malware, phishing attempts, scam pages, blacklisted sites, and so on, a network analytic system generates analytical information about domains, sub-domains, and components that are owned, managed, and/or controlled by a target entity. A measure of domain identity threat is generated based on a classification model using the analytical information” Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to FILLIN "Examiner name" \* MERGEFORMAT SIMON P KANAAN whose telephone number is FILLIN "Phone number" \* MERGEFORMAT (571)270-3906 . The examiner can normally be reached on FILLIN "Work schedule?" \* MERGEFORMAT M-F (7AM-4PM) . Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, FILLIN "SPE Name?" \* MERGEFORMAT Catherine Thiaw can be reached on FILLIN "SPE Phone?" \* MERGEFORMAT (571) 272-1183 . The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /SIMON P KANAAN/ Primary Examiner, Art Unit 2407
Read full office action

Prosecution Timeline

Sep 15, 2022
Application Filed
Oct 21, 2023
Response after Non-Final Action
Mar 21, 2026
Non-Final Rejection — §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12596772
DATA PROTECTION AND SECURITY FOR AUTONOMOUS SYSTEMS AND APPLICATIONS
2y 5m to grant Granted Apr 07, 2026
Patent 12585801
PRODUCING MESSAGES
2y 5m to grant Granted Mar 24, 2026
Patent 12578942
CUSTOM CODE ASSISTANT SYSTEM FACILITATING CODE CONVERSION METHODOLOGY
2y 5m to grant Granted Mar 17, 2026
Patent 12574254
SECURE PROGRAMMING SYSTEM AND OPERATING METHOD THEREOF
2y 5m to grant Granted Mar 10, 2026
Patent 12566889
LARGE LANGUAGE MODEL-AGNOSTIC DATA ANONYMIZATION
2y 5m to grant Granted Mar 03, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

1-2
Expected OA Rounds
83%
Grant Probability
99%
With Interview (+16.0%)
3y 2m
Median Time to Grant
Low
PTA Risk
Based on 649 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month