Notice of Pre-AIA or AIA Status
The present application is being examined under the pre-AIA first to invent provisions.
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicants’ submission filed on 1/12/26 has been entered.
DETAILED ACTION
The instant application having Application No. 17961960 has a total of 20 claims pending in the application, of which claim 9 has been cancelled.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-8 and 10-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims of U.S. Patent No. 11489857 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because each of the limitations of the claims can be met by claims 1-7 in the ‘857 Patent as shown below.
Instant Application
11489857 B2
A method for controlling access to web resources, the method comprising:
Claim 1: wherein the security policy comprises a threshold reputation index score established for the local area network for denying access to the plurality of the Internet resources; and when the calculated reputation index score for the first Internet resource is less than the threshold reputation index score, denying access to the first Internet resource.
receiving a request from a client application for an Internet resource;
a request for the first Internet resource from a client device over the local area network;
Automatically performing in real time, responsive to the request, a predictive security assessment of the internet resource, wherein performing the predictive security assessment comprises
Claim 1: a reputation generating site, using the classifier, a calculated reputation index score for the first internet resource in real-time…. Wherein the security policy comprises a threshold reputation index score established for the local area network for denying access to the plurality of the internet resources
This denotes performing the analysis in real time and denying access to internet resources in real time with a user.
Generating a reputation index for the internet resource based on a plurality of factors for the internet resource, the plurality of factors comprising top-level domain, an age of domain registration, a traffic volume, a detection of malicious code, a domain registration location, and a uniform resource locator (URL) redirection, and an IP address, wherein generating the reputation index for the internet resource comprises:
Claim 1: performing a predictive security assessment of a first Internet resource, by a reputation generating site, based on known facts about the first Internet resource, the performing the predictive security assessment further comprising
Claim 3: wherein the location factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: country of domain registration, country of service hosting and country of an internet protocol address block; and wherein the legitimacy factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: age of a domain registration, popularity rank, internet protocol address, number of hosts, top-level domain; and wherein the behavior factor of the plurality of reputation factors for the associated Internet resource comprises at least one of: plurality of run-time behaviors, script block count, picture count, immediate redirect and response latency.
EN: Claims are similar except for several different aspects of determining risk for a particular webpage. Examiner takes official notice that one of ordinary skill in the art would find it obvious to use various well-known metrics for determining the risk associated with a webpage in order to determine a risk level for the webpage and to protect the user from the dangers of that webpage.
“Processing the plurality of factors for the requested internet resource using a machine learning model to generate the reputation index for the internet resource, the machine learning model trained using a plurality of internet resources having varying degrees of risk to assign weights to each of the plurality of factors”
Claim 1: performing a predictive security assessment of a first Internet resource, by a reputation generating site, based on known facts about the first Internet resource, the performing the predictive security assessment further comprising: accessing, at the reputation generating site, one or more HyperText Markup Language (HTML) documents of the first Internet resource;
EN: Here the predictive security assessment is the machine learning model.
prior to transmission of the request for the Internet resource over the Internet from a local area network, comparing a reputation index for the Internet resource to a threshold value to generate a comparison result,
Claim 1: analyzing, at the reputation generating site, a reputation vector of the first Internet resource, the reputation vector based on the plurality of reputation factors of the one or more HTML documents;
EN: the use of various factors to determine the reputation of a website would be obvious to one of ordinary skill in the art at the time of invention as the various factors described are known issues to consider when determining whether an internet webpage is safe.
allowing or denying the client application access to the Internet resource based on the comparison result.
wherein the security policy comprises a threshold reputation index score established for the local area network for denying access to the plurality of the Internet resources; and when the calculated reputation index score for the first Internet resource is less than the threshold reputation index score, denying access to the first Internet resource.
As shown above, each of the limitations of the instant application are met by the claims of the ‘857 patent, and therefore the claims are rejected under non-statutory obvious type double patenting.
As per claims 2-8 and 10-20, these claims are similarly rejected over claims 1-7 of the ‘857 patent.
Double Patenting
Claims 1-8 and 10-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims of U.S. Patent No. 8438386 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because each of the limitations of the claims can be met by claims 1-7 in the ‘386 Patent as shown below.
Instant Application
8438386 B2.
A method for controlling access to web resources, the method comprising:
Claim 1: the decision transmission allowing or denying access to the Internet resource.
receiving a request from a client application for an Internet resource;
Claim 1: transmitting a request for an Internet resource from an Internet-enabled client application from a client-side device of a local area network
Automatically performing in real time, responsive to the request, a predictive security assessment of the internet resource, wherein performing the predictive security assessment comprises
Claim 1: receiving the request for the internet resource at a security appliance of the local rea network prior to transmission of the request over the internet, determining if a reputation index for the internet resource is at or above a threshold value established for the local rea network… transmitting a decision transmission to the internet enabled client application of the client side device, the decision transmission allowing or denying access to the internet resource
This denotes receiving a request, providing the analysis and denying or allowing access to the result. It would be obvious to one of ordinary skill in the art at the time of inception to do this in real time, as people accessing internet web pages do not want to wait around for long amounts of time to browse a webpage.
Generating a reputation index for the internet resource based on a plurality of factors for the internet resource, the plurality of factors comprising top-level domain, an age of domain registration, a traffic volume, a detection of malicious code, a domain registration location, and a uniform resource locator (URL) redirection, and an IP address, wherein generating the reputation index for the internet resource comprises:
Claim 1: determining if a reputation index for the Internet resource is at or above a threshold value established for the local area network, the reputation index generated from a reputation vector for the Internet resource, the reputation vector comprising a plurality of factors for the Internet resource comprising security history, legitimacy, behavior, associations and location, wherein the location factor of the plurality of factors for the reputation vector comprises two or more of: country of domain registration, country of service hosting and country of an internet protocol address block, wherein the legitimacy factor of the plurality of factors for the reputation vector comprises two or more of: age of a domain registration, popularity rank, internet protocol address, number of hosts, top-level domain, and wherein the behavior factor of the plurality of factors for the reputation vector comprises at least one of: plurality of run-time behaviors, script block count, picture count, immediate redirect and response latency;
EN: the use of various factors to determine the reputation of a website would be obvious to one of ordinary skill in the art at the time of invention as the various factors described are known issues to consider when determining whether an internet webpage is safe.
“Processing the plurality of factors for the requested internet resource using a machine learning model to generate the reputation index for the internet resource, the machine learning model trained using a plurality of internet resources having varying degrees of risk to assign weights to each of the plurality of factors”
Claim 1: determining if a reputation index for the Internet resource is at or above a threshold value established for the local area network
EN: The use of a machine learning model would be obvious to one of ordinary skill in the art at the time of inception, as it is a method to allow the system to make the decision on a website without requiring the consult of a human being and learn from previous uses of the data to improve the analysis of webpages.
“predicting a level of risk for the internet resource using the weights assigned to each of the plurality of factors”
Claim 2: wherein the reputation index for the Internet resource is at or above the threshold value and wherein the decision transmission is access to the Internet resource, the method further comprises transmitting the request for the Internet resource over the Internet to the first server for the Internet resource and receiving the Internet resource at the local area network.
EN: The reputation index here is the level of risk associated with the internet resource.
prior to transmission of the request for the Internet resource over the Internet from a local area network, comparing a reputation index for the Internet resource to a threshold value to generate a comparison result,
Claim 1: the reputation vector comprising a plurality of factors for the Internet resource comprising security history, legitimacy, behavior, associations and location, wherein the location factor of the plurality of factors for the reputation vector comprises two or more of: country of domain registration, country of service hosting and country of an internet protocol address block, wherein the legitimacy factor of the plurality of factors for the reputation vector comprises two or more of: age of a domain registration, popularity rank, internet protocol address, number of hosts, top-level domain, and wherein the behavior factor of the plurality of factors for the reputation vector comprises at least one of: plurality of run-time behaviors, script block count, picture count, immediate redirect and response latency;
EN: the use of various factors to determine the reputation of a website would be obvious to one of ordinary skill in the art at the time of invention as the various factors described are known issues to consider when determining whether an internet webpage is safe.
wherein the security policy comprises a threshold reputation index score established for the local area network for denying access to the plurality of the Internet resources; and when the calculated reputation index score for the first Internet resource is less than the threshold reputation index score, denying access to the first Internet resource.
allowing or denying the client application access to the Internet resource based on the comparison result.
Claim 1: the decision transmission allowing or denying access to the Internet resource.
As shown above, each of the limitations of the instant application are met by the claims of the ‘386 patent, and therefore the claims are rejected under non-statutory obvious type double patenting.
As per claims 2-8 and 10-20, these claims are similarly rejected over claims 1-7 of the ‘386 patent.
Claim Rejections – 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-8 and 10-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1: Claim 1 is a process type claim. Claim 11 is a machine type claim. Therefore, claims 1-20 are directed to either a process, machine, manufacture or composition of matter.
As per claim 1,
2A Prong 1:
“generating a reputation index for the internet resource based on a plurality of factors for the internet resource, the plurality of factors comprising a top-level domain, an age of domain registration, a traffic volume, a detection of malicious code, a domain registration location, and a uniform resource locator (URL) redirection, and an IP address, wherein generating the reputation index for the internet resource comprises” A user mentally or with pencil and paper considers various factors when determining the reputation index for an internet resource
“automatically performing in real-time, responsive to the request, a predictive security assessment of the internet resource, wherein performing the security assessment comprises” The user mentally or with pencil and paper checks out the website in real time once they receive the request.
“Processing the plurality of factors of the requested internet resource … to generate the reputation index for the internet resource… using a plurality of internet resources having varying degrees of risk to assign weights to each of the plurality of factors” The user mentally or with pencil and paper considers previous internet resources and assigns weights to the plurality of factors based upon their impact on risk.
“Predicting a level of risk for the internet resource using the weights assigned to each of the plurality of factors” The user mentally or with pencil and paper assigns a level of risk to the plurality of factors using the weights.
“Prior to transmission of the request for the internet resource … comparing a reputation index for the internet resource to a threshold value to generate a comparison result” The user mentally or with pencil and paper considers the reputation of the website.
“Denying … access… based on the comparison result to thereby protect the client application from a security risk” The user mentally or with pencil and paper decides whether to allow access to the dangerous material or not based upon the analysis.
2A Prong 2: This judicial exception is not integrated into a practical application.
Additional elements:
“internet” “local area network”, “denying the client application access to the internet resource” (mere instructions to apply the exception using a generic computer component);
“using a machine learning model to generate the reputation …the machine learning model trained…” (Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea - see MPEP 2106.05(f) – Examiner’s note: Machine learning model is no more than a generic machine learning model lacking any limitations or other details beyond a generic, off the shelf machine learning model.
“receiving a request from a client application for an internet resource” (Adding insignificant extra-solution activity to the judicial exception - see MPEP 2106.05(g)).
2B: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
Additional elements:
“internet” “local area network”, “denying the client application access to the internet resource” (mere instructions to apply the exception using a generic computer component);
“using a machine learning model to generate the reputation …the machine learning model trained…” (Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea - see MPEP 2106.05(f) – Examiner’s note: Machine learning model is no more than a generic machine learning model lacking any limitations or other details beyond a generic, off the shelf machine learning model.
“receiving a request from a client application for an internet resource” “receiving a request from a client application for an internet resource” (MPEP 2106.05(d)(II) indicate that merely “transmitting and receiving data” is a well‐understood, routine, conventional function when it is claimed in a merely generic manner (as it is in the present claim). Thereby, a conclusion that the claimed receiving step is well-understood, routine, conventional activity is supported under Berkheimer).
As per claims 2-4, 6-8 and 10, these claims contain similar mental steps and sending/receiving of data to claim 1, and are rejected for similar reasons.
As per claim 5, this claim contains similar mental steps, generic computer hardware, and generic machine learning models to claim 1.
As per claim 11,
2A Prong 1:
“generating a reputation index for the internet resource based on a plurality of factors for the internet resource, the plurality of factors comprising a top-level domain, an age of domain registration, a traffic volume, a detection of malicious code, a domain registration location, and a uniform resource locator (URL) redirection, and an IP address, wherein … generating the reputation index …” A user mentally or with pencil and paper considers various factors when determining the reputation index for an internet resource
“automatically performing in real time, responsive to the request, a predictive security assessment of the internet resource, wherein performing the predictive security assessment comprises” The user mentally or with pencil and paper checks out the website in real time once they receive the request.
“Processing the plurality of factors of the requested internet resource … to generate the reputation index for the internet resource… using a plurality of internet resources having varying degrees of risk to assign weights to each of the plurality of factors” The user mentally or with pencil and paper considers previous internet resources and assigns weights to the plurality of factors based upon their impact on risk.
“Predicting a level of risk for the internet resource using the weights assigned to each of the plurality of factors” The user mentally or with pencil and paper assigns a level of risk to the plurality of factors using the weights.
“Prior to transmission of the request for the internet resource … comparing a reputation index for the internet resource to a threshold value to generate a comparison result” The user mentally or with pencil and paper considers the reputation of the website.
“Allowing or denying … access… to thereby enable access by the client application to a non-threatening internet resource when the reputation index does not exceed the threshold while protecting the client application from a security risk when the reputation index exceeds the threshold” The user mentally or with pencil and paper decides whether to allow access to the dangerous material or not based upon the analysis.
2A Prong 2: This judicial exception is not integrated into a practical application.
Additional elements:
“A processor”, “a memory storing instructions executable by the processor for” “internet” “local area network”, “allowing or denying the client application access to the internet resource based on the comparison result” (mere instructions to apply the exception using a generic computer component);
“using a machine learning model … the machine learning model trained…” (Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea - see MPEP 2106.05(f) – Examiner’s note: Machine learning model is no more than a generic machine learning model lacking any limitations or other details beyond a generic, off the shelf machine learning model.
“receiving… a request from a client application for an internet resource” (Adding insignificant extra-solution activity to the judicial exception - see MPEP 2106.05(g)).
2B: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
Additional elements:
“A processor”, “a memory storing instructions executable by the processor for” “internet” “local area network”, “allowing or denying the client application access to the internet resource based on the comparison result” (mere instructions to apply the exception using a generic computer component);
“using a machine learning model … the machine learning model trained…” (Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea - see MPEP 2106.05(f) – Examiner’s note: Machine learning model is no more than a generic machine learning model lacking any limitations or other details beyond a generic, off the shelf machine learning model.
“receiving… a request from a client application for an internet resource” “receiving a request from a client application for an internet resource” (MPEP 2106.05(d)(II) indicate that merely “transmitting and receiving data” is a well‐understood, routine, conventional function when it is claimed in a merely generic manner (as it is in the present claim). Thereby, a conclusion that the claimed receiving step is well-understood, routine, conventional activity is supported under Berkheimer).
As per claims 12-14, 16-20, these claims contain similar mental steps and sending/receiving of data to claim 11, and are rejected for similar reasons.
As per claim 15, this claim contains similar mental steps, generic computer hardware, and generic machine learning models to claim 11.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of pre-AIA 35 U.S.C. 103(a) which forms the basis for all obviousness rejections set forth in this Office action:
(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102, if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 5-12, and 15-20 are rejected under pre-AIA 35 U.S.C. 103(a) as being unpatentable over Dixon et al (US 20060253581 A1) in view of Du et al (“Web Filtering Using Text Classification”), Dandliker et al (US 20080082662 A1) and Flake et al (US 20080005223 A1).
As per claim 1, Dixon discloses, “A method for controlling access to web resources, the method comprising” (pg.10-11, particularly paragraph 0133; EN: Denotes allowing/denying access based upon reputation).
“Receiving a request from a client application for an internet resource” (pg.12, particularly paragraph 0142; EN: this denotes the user making a request for a website).
“automatically performing … responsive to the request” (Pg.10, paragraph 0129; EN: this denote receiving the request, and providing the analysis in response to that request). “a predictive security assessment of the internet resource, wherein preforming the predictive security assessment comprises” (pg.17, particularly paragraph 0187; EN: this denotes looking at multiple factors when generating a website reputation).
“generating a reputation index for the internet resource based on a plurality of factors for the internet resource” (pg.17, particularly paragraph 0187; EN: this denotes looking at multiple factors when generating a website reputation). “the plurality of factors comprising a top-level domain, an age of domain registration” (Pg.23, particularly paragraph 0247; EN: this denotes looking at domain name and how long it has been registered). “… a detection of malicious code” (pg.30, particularly paragraph 0329; EN: this denotes checking the pages for malicious code). “a domain registration location” (pg.16, particularly paragraph 0182; EN: this denotes looking at domain location). “and Uniform resource locator (URL) redirection” (pg.23, particularly paragraph 0247; EN: this denotes looking at redirects). “and an IP address” (pg.20, particularly paragraph 0216; EN: this denotes looking at IP addresses). “Wherein generating the reputation index for the internet resource comprises” (pg.17, particularly paragraph 0187; EN: this denotes looking at multiple factors when generating a website reputation).
“processing the plurality of factors for the requested internet resource” (pg.17, particularly paragraph 0187; EN: this denotes looking at multiple factors when generating a website reputation). “Using a machine learning model to generate the reputation index for the internet resource” (pg.22-23, particularly paragraph 0246; EN: this denotes using machine learning for the reputation determination). “the machine learning model trained using a plurality of internet resources” (pg.22-23, particularly paragraph 0246; EN: this denotes using machine learning for the reputation determination). “… to assign weights to each of the plurality of factors” (Pg.13-14, particularly paragraph 0152; EN: this denotes weighing factors based on their ability to determine the risk of a website).
“Prior to transmission of the request for the internet resource over the internet” (Pg.28, particularly paragraph 0313; EN; this denotes the system working over the internet). “from a local area network” (pg.28, particularly paragraph 0313; EN: this denotes the system operating with local area networks). “comparing a reputation index for the internet resource…” (Pg.10-11, particularly paragraph 0133; EN: this denotes looking at the reputation of the web site and taking actions based upon it).
“denying the client application access to the internet resource based on the … result to thereby protect the client application from a security risk” (pg.10-11, particularly paragraph 0133; EN: Denotes allowing/denying access based upon reputation).
However, Dixon fails to explicitly disclose, “performing, in real-time, responsive to the request, a predictive security assessment of the internet resource” “to a threshold value to generate a comparison result”, “a traffic volume”, “A plurality of internet resources having varying degrees of risk”, and “comparison result”
Du discloses, “performing, in real-time, responsive to the request, a predictive security assessment of the internet resource” (Pg.328, particularly C1 numeral 3 and below; ; EN: this denotes the web filtering happening at the Firewall, where it is done in response to requesting the web page).
Dandliker discloses, “to a threshold value to generate a comparison result”, and “comparison result” (Pg.9, particularly paragraph 0131; EN: this denotes looking at reputation scores and blocking if below a threshold).
“a traffic volume” (Pg.5, particularly paragraph 0074; EN: this denotes looking at traffic volume for reputation purposes).
Flake discloses, “A plurality of internet resources having varying degrees of risk” (Pg. 7, particularly paragraphs 0079-0081; EN: this denotes training based on reputation metrics (i.e. different levels of risks for a particular page) of various websites).
Dixon and Du are analogous art because both involve webpage monitoring.
At the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Du in order to use thresholds to allow machine learning to perform webpage monitoring in real time.
The motivation for thresholds would be to provide “simplicity and high speed because the filtering will remain text-based. Implementation of this system is straight forward and requires few modifications to the HTML parsing component of the original filtering system” (Du, Pg.329, C1, second paragraph) or in the case of Dixon, allow the systems analysis to be performed in real time by the machine learning algorithm as needed by the system.
Therefore at the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Du in order to use thresholds to allow machine learning to perform webpage monitoring in real time.
Dixon and Dandliker are analogous art because both involve webpage monitoring.
At the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Dandliker in order to use thresholds to determine when to block a page and to allow real time monitoring of page reputation. .
The motivation for thresholds would be because “typically, a low reputation score will cause messaging gateway to refuse access to the network resource” (Dandliker, Pg.9-10, paragraph 0131).
The motivation for real time monitoring would be to “repeat steps 202-208 in real time as new information becomes available for the same network resource identifiers” (Dandliker, Pg.7, paragraph 0097) or in the case of Dixon, allow the system to update their response in real time to make sure a webpage is unsafe before blocking.
Therefore at the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Dandliker in order to use thresholds to determine when to block a page and to allow real time monitoring of page reputation.
Dixon and Flake are analogous art because both involve webpage monitoring.
At the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Flake in order to use websites with different reputations to train the machine learning model.
The motivation would be to “make the classification correct for testing data that is near, but not identical to t training data” (Flake, Pg.7, paragraph 0081) or in the case of Dixon, allow the system to have websites of various reputation in order to train the machine learning model to detect malicious websites.
Therefore at the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Flake in order to use websites with different reputations to train the machine learning model.
As per claims 2 and 12, Dixon discloses, “wherein the plurality of factors includes a private internet protocol (IP ) address factor” (Pg.5-6, particularly paragraph 0093; EN: this denotes looking at company IP addresses).
As per claims 5 and 15, Dixon discloses, “training and maintaining the machine learning model representing the plurality of factors for a plurality of internet resources and reputations for the plurality of internet resources and wherein processing the plurality of factors for the internet resources using the machine learning model comprises” (pg.22-23, particularly paragraph 0246; EN: this denotes using machine learning for the reputation determination).
“evaluating, at run-time, the request from the client application for the internet resource according to the machine learning model” (pg.1, particularly paragraph 0007; EN: this denotes real time results based on machine learning).
“updating the local area network including one or more client device capable of running the client application in a real-time feedback loop based on a result of the evaluation of the request”” (pg.28, particularly paragraph 0313; EN: this denotes the system operating with local area networks and being able to communicate information back and forth (i.e. real-time feedback loop) in regards to the request for websites).
As per claims 6 and 16, Dixon discloses, “wherein the reputation index for the internet resource is pre-generated prior to receiving the request from the client application for the internet resource” (pg.10-11, particularly paragraph 0133; EN: Denotes allowing/denying access based upon reputation).
As per claim 7, Dixon discloses, “further comprising providing the reputation index for the internet resource to the local area network prior to receiving the request form the client application for the internet resource” (pg.28, particularly paragraph 0313; EN: this denotes the system operating with local area networks).
As per claims 8 and 18, Dixon discloses, “wherein the reputation index for the internet resource is generated after receiving the request for the internet resource form the client application” (pg.9-10, particularly paragraph 0127; EN: this denotes updating based upon actions from the user).
As per claims 10 and 20, Dixon discloses, “Wherein denying access to the internet resource comprises returning a web page from the local area network to the client application” (pg.11-12, particularly paragraph 0140; EN: this denotes denying access to aspects of web content).
As per claim 11, Dixon discloses, “A system for controlling access to web resources, the system comprising:” (pg.10-11, particularly paragraph 0133; EN: Denotes allowing/denying access based upon reputation).
“a processor” (pg.4, particularly paragraph 0087; EN: this denotes using a processor).
“a memory storing instructions executable by the processor for:” (pg.26, particularly paragraph 0298; EN: this denotes memory used by the system).
“Receiving, by the processor, a request from a client application for an internet resource” (pg.12, particularly paragraph 0142; EN: this denotes the user making a request for a website).
“automatically performing in real-time, responsive to the request” (Pg.10, paragraph 0129; EN: this denote receiving the request, and providing the analysis in response to that request). “a predictive security assessment of the internet resource, wherein preforming the predictive security assessment comprises” (pg.17, particularly paragraph 0187; EN: this denotes looking at multiple factors when generating a website reputation).
“generating a reputation index for the internet resource based on a plurality of factors for the internet resource” (pg.17, particularly paragraph 0187; EN: this denotes looking at multiple factors when generating a website reputation). “the plurality of factors comprising a top-level domain, an age of domain registration” (Pg.23, particularly paragraph 0247; EN: this denotes looking at domain name and how long it has been registered). “… a detection of malicious code” (pg.30, particularly paragraph 0329; EN: this denotes checking the pages for malicious code). “a domain registration location” (pg.16, particularly paragraph 0182; EN: this denotes looking at domain location). “and Uniform resource locator (URL) redirection” (pg.23, particularly paragraph 0247; EN: this denotes looking at redirects). “and an IP address” (pg.20, particularly paragraph 0216; EN: this denotes looking at IP addresses). “Wherein the instructions executable by the processor for generating the reputation index are further executable by the processor for” (pg.17, particularly paragraph 0187; EN: this denotes looking at multiple factors when generating a website reputation).
“processing the plurality of factors for the requested internet resource” (pg.17, particularly paragraph 0187; EN: this denotes looking at multiple factors when generating a website reputation). “Using a machine learning model to generate the reputation index for the internet resource” (pg.22-23, particularly paragraph 0246; EN: this denotes using machine learning for the reputation determination). “the machine learning model trained using a plurality of internet resources” (pg.22-23, particularly paragraph 0246; EN: this denotes using machine learning for the reputation determination). “… to assign weights to each of the plurality of factors” (Pg.13-14, particularly paragraph 0152; EN: this denotes weighing factors based on their ability to determine the risk of a website).
“predicting a level of risk for the internet resource using the weights assigned to each of the plurality of factors” (pg.10-11, particularly paragraph 0133; EN: Denotes allowing/denying access based upon reputation).
“Prior to transmission of the request for the internet resource over the internet” (Pg.28, particularly paragraph 0313; EN; this denotes the system working over the internet). “from a local area network” (pg.28, particularly paragraph 0313; EN: this denotes the system operating with local area networks). “comparing a reputation index for the internet resource…” (Pg.10-11, particularly paragraph 0133; EN: this denotes looking at the reputation of the web site and taking actions based upon it).
“Allowing or denying the client application access to the internet resource based on the … result to thereby enable access by the client application to a non-threatening internet resource when the reputation index… while protecting the client application from a security risk when the reputation index…” (pg.10-11, particularly paragraph 0133; EN: Denotes allowing/denying access based upon reputation).
However, Dixon fails to explicitly disclose, “to a threshold value to generate a comparison result”, “a traffic volume”, “A plurality of internet resources having varying degrees of risk”, “comparison result”, “when the reputation index does not exceed the threshold”, and “… when the reputation index exceeds the threshold”
Dandliker discloses, “to a threshold value to generate a comparison result”, “comparison result”, “when the reputation index does not exceed the threshold”, “… when the reputation index exceeds the threshold” (Pg.9, particularly paragraph 0131; EN: this denotes looking at reputation scores and blocking if below a threshold).
“a traffic volume” (Pg.5, particularly paragraph 0074; EN: this denotes looking at traffic volume for reputation purposes).
Flake discloses, “A plurality of internet resources having varying degrees of risk” (Pg. 7, particularly paragraphs 0079-0081; EN: this denotes training based on reputation metrics (i.e. different levels of risks for a particular page) of various websites).
Dixon and Dandliker are analogous art because both involve webpage monitoring.
At the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Dandliker in order to use thresholds to determine when to block a page and to allow real time monitoring of page reputation. .
The motivation for thresholds would be because “typically, a low reputation score will cause messaging gateway to refuse access to the network resource” (Dandliker, Pg.9-10, paragraph 0131).
The motivation for real time monitoring would be to “repeat steps 202-208 in real time as new information becomes available for the same network resource identifiers” (Dandliker, Pg.7, paragraph 0097) or in the case of Dixon, allow the system to update their response in real time to make sure a webpage is unsafe before blocking.
Therefore at the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Dandliker in order to use thresholds to determine when to block a page and to allow real time monitoring of page reputation.
Dixon and Flake are analogous art because both involve webpage monitoring.
At the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Flake in order to use websites with different reputations to train the machine learning model.
The motivation would be to “make the classification correct for testing data that is near, but not identical to t training data” (Flake, Pg.7, paragraph 0081) or in the case of Dixon, allow the system to have websites of various reputation in order to train the machine learning model to detect malicious websites.
Therefore at the time of invention it would have been obvious to one skilled in the art of webpage monitoring to combine the work of Dixon and Flake in order to use websites with different reputations to train the machine learning model.
As per claim 17, Dixon discloses, “Wherein the processor comprises a first processor” (Pg.4, particularly paragraph 087; EN: this denotes the server which includes a processor ). “coupled between the local area network” (pg.28, particularly paragraph 0313; EN: this denotes it working with local area networks). “and a second processor” (pg.4, particularly paragraph 0085; EN: this denotes the client computers which can be part of a local area network). “and wherein the system further comprises instructions executable by the second processor for providing the reputation index for the internet resource” (pg.25, particularly paragraph 0277; EN: this denotes the use of a server to do the reputation aspects, which will inherently have a processor of some kind). “to the local area network prior to the first processor receiving the request from the client application for the internet resource”: (pg.10-11, particularly paragraph 0133; EN: this denotes the proxy application denying access, which will stop them from accessing or interacting with the web resource).
Claim Rejections - 35 USC § 103
Claims 3 and 13 are rejected under pre-AIA 35 U.S.C. 103(a) as being unpatentable over Dixon et al (US 20060253581 A1) in view of Du et al (“Web Filtering Using Text Classification”), Dandliker et al (US 20080082662 A1) and Flake et al (US 20080005223 A1) and further in view of Pugh et al (US 20080201401 A1).
As per claims 3 and 13, Dixon fails to explicitly disclose, “wherein the plurality of factors includes a government IP address factor.”
Pugh discloses, “wherein the plurality of factors includes a government IP address factor” (pg.4, particularly paragraph 0065; EN: this denotes trusting IP addresses from government authorities over other IP addresses).
Dixon and Pugh analogous art because both involve internet security.
At the time of invention it would have been obvious to one skilled in the art of internet security to combine the work of Dixon and Pugh in order to include government IP addresses as a potential consideration for security purposes.
The motivation for thresholds would be because “The database of non-authenticated IP addresses lists IP addresses that have been identified as fraudulent or potentially insecure … it is preferred that non-authenticated IP addresses be provided to the security server by an organization of assured status and integrity, such as a policy authority or other government authority…” (Pugh, Pg.4, paragraph 0065) or in the case of Dixon, allow the source of IP address information such as governmental sources be a consideration for website reputation.
Therefore at the time of invention it would have been obvious to one skilled in the art of internet security to combine the work of Dixon and Pugh in order to include government IP addresses as a potential consideration for security purposes.
Claim Rejections - 35 USC § 103
Claims 4 and 14 are rejected under pre-AIA 35 U.S.C. 103(a) as being unpatentable over Dixon et al (US 20060253581 A1) in view of Du et al (“Web Filtering Using Text Classification”), Dandliker et al (US 20080082662 A1) and Flake et al (US 20080005223 A1) and further in view of Moshchuk et al (“SpyProxy: Execution-based Detection of Malicious Web Content”) and Lan et al (“Effect of Malicious Traffic on the Network”).
As per claims 4 and 14, Dixon discloses, “wherein the plurality of factors includes a country of service hosting” (pg.23, particularly paragraph 0255; EN: this denotes looking at country off the IP address). “a country of an internet protocol address block, a popularity rank” (Pg.5-6, particularly paragraph 0093; EN: this denotes looking at address blocks, popularity rank, ). “… a plurality of run-time behaviors” (pg.4, particularly paragraph 0086; EN: this denotes looking at behaviors of the site). “
Dandliker discloses, “a number of hosts” (Pg.5, particularly paragraph 0079; EN: this denotes looking at machines (i.e. more than one) hosting a website).
However, Dixon fails to explicitly disclose, “a script block count” “picture count”, “response latency”
Moshchuk discloses, “a script block count” “picture count”, (pg.34, particularly C2, the “web page requested” section; EN: this denotes looking at the number of pictures and javascript when looking at suspicious webpages).
Lan discloses, “response latency” (abstract; EN: this shows that malicious data can lead to increased latency).
Dixon and Moshchuk are analogous art because both involve webpage analysis.
Before the effective filing date it would have been obvious to one skilled in the art of webpage analysis to combine the work of Dixon and Moshchuk in order to include scripts and pictures when analyzing a webpage for security issues.
The motivation for doing so would be because “Active pages include executable content, such as ActiveX, JavaScript, and other code; … Pages that contain active content must be analyzed dynamically” (Moshchuk, Pg.29, C2, third to last paragraph) such as the scripts of the Moshchuk reference, and “It is possible for seemingly passive content to compromise the user’s system if the renderer has security holes. Such flaws have occurred in the past in both JPEG and PNG image libraries” (Moshchuk, Pg.29, second to last paragraph), such as the pictures of the Moshchuk reference, and for the Dixon reference, this denotes additional detail which should be considered for analyzing webpages for safe reputations.
Therefore before the effective filing date it would have been obvious to one skilled in the art of webpage analysis to combine the work of Dixon and Moshchuk in order to include scripts and pictures when analyzing a webpage for security issues.
Dixon and Lan are analogous art because both involve webpage analysis.
Before the effective filing date it would have been obvious to one skilled in the art of webpage analysis to combine the work of Dixon and Moshchuk in order to include latency when analyzing webpages.
The motivation for doing so would be because “Malicious traffic causes an increase in the average DNS latency by 230%, and an increase in the average web patency by 30% even on highly over-provisioned links” (Lan, abstract) or in the case of Dixon, shows that the response time from web pages should be considered when analyzing a website for reputation purposes.
Therefore before the effective filing date it would have been obvious to one skilled in the art of webpage analysis to combine the work of Dixon and Moshchuk in order to include latency when analyzing webpages.
Response to Arguments
In pg.9, Applicant argues in regards to the rejection under U.S.C. 101 of the independent claims,
A claim does not recite a mental process "when it contains limitation(s) that cannot practically be performed in the human mind, for instance when the human mind is not equipped to perform the claim limitation(s)." Charles Kim, Deputy Commission for Patents, August 4, 2025, Memorandum: Reminders on evaluating subject matter eligibility of claims under 35 U.S.C. 101 at 2. Here, for example, the human mind cannot practically perform an automatic predictive security assessment of the Internet resource utilizing a machine learning model to provide a real-time assessment of whether to allow or block a client application request.
In response, the Examiner maintains the rejection as shown above. At no time does the Examiner state that the use of a machine learning model is performed in the human mind. This is part of 2A/2B prong 2, which states that the use of a generic machine learning model is part of the “apply it” aspects of the use of generic computer/machine learning models. Since the machine learning model is generic, with no limitations or details beyond an off the shelf machine learning model, the rejection is maintained as shown above.
In pg.9, the Applicant further argues in regards to the rejection under U.S.C. 101,
Similarly, the claimed invention of the present application represents an improvement in the technical field of network security by protecting a computer system from potentially malicious Internet content while still allowing access to other content. The instant application describes the technological problem in the technical field of Internet cybersecurity risk mitigation. The conventional art as of the filing date of the instant application relied on category or subject matter-based filtering, which could overly restrict access to benign content, or on malware signatures, which could allow access to malicious content "before infections are isolated and signatures are identified and distributed." See, e.g., Application at [0003], [0004], and [0014]. Claims 1 and 11, for example, solve the aforementioned technological problem and lead to a tangible improvement to anti-malware technology. See, e.g., Application at [0071], [0089].
In response, the Examiner maintains the rejection as shown above. The question is not whether or not the abstract idea is useful, it is whether or not the claim provides an improvement to a technology. The improvement here is to the abstract idea of determining whether a website should be accessed or not. This can all be performed in the human mind. The act of blocking a website is something performed by a generic computer, and there is no improvement to the technology of blocking/denying access, only in the analysis of websites which can be performed in the human mind. Therefore the rejection is maintained as shown above.
Applicant's arguments with respect to claims 1-8 and 10-20 have been considered but are either repetitions of the above arguments or moot in view of the new ground(s) of rejection.
Conclusion
The examiner requests, in response to this Office action, support be shown for language added to any original claims on amendment and any new claims. That is, indicate support for newly added claim language by specifically pointing to page(s) and line no(s) in the specification and/or drawing figure(s). This will assist the examiner in prosecuting the application.
When responding to this office action, Applicant is advised to clearly point out the patentable novelty which he or she thinks the claims present, in view of the state of the art disclosed by the references cited or the objections made. He or she must also show how the amendments avoid such references or objections See 37 CFR 1.111(c).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BEN M RIFKIN whose telephone number is (571)272-9768. The examiner can normally be reached Monday-Friday 9 am - 5 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alexey Shmatov can be reached at (571) 270-3428. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BEN M RIFKIN/ Primary Examiner, Art Unit 2123
