DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed 02/09/2026 with respect to the rejection(s) of claim(s) 1-15, and 18-22 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made. See remarks on page 26-31.
The rejection of pending claims 1-15, and 18-22 under 35 U.S.C. 101 as directed to an abstract idea without significantly more, is withdrawn in view of MPEP 2106.04(d). The additional elements integrate the abstract idea into a practical application. See remarks on page 12-26.
Claim Rejections - 35 USC § 103
2. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Xie et al. (US 10009358 B1) in view of Lee et al. (US 11316874 B2), and further in view of Silva et al. (US 20220198471 A1).
4. Regarding claim 1, 13, and 20, Xie discloses method determining malicious network activity on a (Column 3/line 16)),
obtaining, by a computing device, one or more blockchains of transaction blocks for transactions involving digital currency, (Column 2/line 8, In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include the actions of generating a collection of hypergraphs representing user events across a collection of users; and Column 3/line 5, Generating the collection of hypergraphs includes obtaining event log data associated with the collection of users including one or more of login logs, signup logs, or transaction logs. Using the group of malicious user accounts or account activities as training data for a machine learning system that generates one or more classifiers further includes obtaining additional user accounts or account activities to use as good training data. The good training data and group of malicious user accounts or account activities are used to derive a set of rich features used to generate the one or more classifiers. The method further includes using the output additional malicious user accounts or account activities to derive a set of signals to combine with the one or more classifiers to provide real-time detection of future user events or user accounts.)
extracting, by a computing device, graph feature data based on the resultant one or more entity graphs; and applying classification processing to the extracted graph feature data to identify a suspected malicious entity from the one or more entities associated with the one or more entity graphs, (Column 2/line 49, Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: assigning a suspiciousness score to each node of the hypergraphs, wherein each node corresponds to a feature profile associated with user accounts or events; applying one or more graph diffusion techniques to the hyper graphs; and selecting a set of one or more nodes with high suspiciousness scores as candidate malicious accounts or events. Generating the collection of hypergraphs includes obtaining event log data associated with the collection of users including one or more of login logs, signup logs, or transaction logs. Using the group of malicious user accounts or account activities as training data for a machine learning system that generates one or more classifiers further includes obtaining additional user accounts or account activities to use as good training data. The good training data and group of malicious user accounts or account activities are used to derive a set of rich features used to generate the one or more classifiers. The method further includes using the output additional malicious user accounts or account activities to derive a set of signals to combine with the one or more classifiers to provide real-time detection of future user events or user accounts.)
Xie does not explicitly disclose deriving by a computing device from the one or more blockchains of transaction blocks a transaction graph representation of sequential transactions for a specified transaction at a particular transaction block.
However, Lee teaches deriving by a computing device from the one or more blockchains of transaction blocks a transaction graph representation of sequential transactions for a specified transaction at a particular transaction block, (Abstract Section, Aspects discussed herein relate to the storage of data in graph databases and detecting fraudulent behavior in the stored data. Fraud detection systems may use graph databases to store data, allowing for querying the graph database to obtain data using a variety of graph semantics such as nodes, edges, and properties. Graph databases in accordance with embodiments of the invention may include account nodes and attribute nodes, where nodes of the same type are not directly linked to each other. When a particular node is updated, an updated node may be created with a higher version number than the existing node. Each node may include an indication of the node being associated with fraudulent activity. Fraud indicators may be calculated based on the relationships between the nodes and fraud indicators for the nodes.; and Column 2/line 1, Fraud may be detected by identifying situations where a fraudster is reusing permutations of (possibly stolen) credentials to open new accounts or to perform account takeovers. For example, a fraudster may use the same mailing address to open multiple accounts and/or take over an existing account by changing the mailing address on file to a fraudulent address in order to receive a new card in the mail. When the request to update the mailing address node for the account is received, the existing address node may be replicated and the new version of the address node may be created with the fraudulent mailing address. The account node may be connected to previous versions of the address nodes by an immutable linking feature, such as account number, such that the account node is associated with each version of the address nodes.)
One of ordinary skill in the art would have recognized that applying the known technique of Xie to the known invention of Lee would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate authorization process features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the method to include deriving by a computing device from the one or more blockchains of transaction blocks a transaction graph representation of sequential transactions for a specified transaction at a particular transaction block result in an improved invention because applying said technique will ensure that transaction data are ordered in a sequential graph to view the relationship between transfers, thus improving the overall performance of the invention.
Xie as modified does not explicitly disclose generating, by the computing device, from the transaction graph representation resultant one or more entity-to-entity graphs, with each of the entity-to-entity graphs being representative of a likely cluster of a chain of digital currency transfers controlled by respective entity , wherein generating the entity-to-entity graphs comprises iteratively applying one or more localizing clustering processes to the transaction graph representation to produce the one or more entity-to- entity graphs.
However, Silva teaches generating, by the computing device, from the transaction graph representation resultant one or more entity-to-entity graphs, with each of the entity-to-entity graphs being representative of a likely cluster of a chain of digital currency transfers controlled by respective entity , wherein generating the entity-to-entity graphs comprises iteratively applying one or more localizing clustering processes to the transaction graph representation to produce the one or more entity-to- entity graphs, (Para. 0017-0018, nodes in graph 100 represent individual transactions and edges connect transactions that share common entities. Examples of transactions include a sale, a purchase, or another type of exchange or interaction. Examples of entities include a person, a business, a governmental group, an account, etc. Entities can take on various roles (e.g., as merchants, clients, etc.). In various embodiments, because connecting all transactions that share common entities results in very dense graphs, transactions are only connected if they occur in a specified time-window (e.g., only connect two transactions if they occurred within a 24-hour period). In addition, in some embodiments and as illustrated in FIG. 1, edge direction is used to encode the temporal sequence of transactions, with edges connecting older transactions to more recent transactions. Timing of transactions can be determined based on timestamps, which are digital records of the time of occurrence of particular events (e.g., as recorded by computers or other electronic devices). It is also possible to connect nodes using bidirectional edges (e.g., to represent two transactions as occurring within a same timestamp). In addition, in some embodiments, and as illustrated in FIG. 1, edges may be of different types. Different edges can correspond to different entity types in the data (e.g., entity types could be payment card, payment device, IP address, etc.). For example, an edge of type ‘card’ could connect two transactions that share the same payment card, while an edge of type ‘device’ could connect two transactions that share the same device….nodes in graph 100 represent entities, such as merchants or clients, and edges connect entities that appear in the same transaction. When the same two entities are parties to multiple transactions (e.g., a person making several purchases at a certain retail store), the information of all the transactions may be aggregated into a single edge, and information about the individual transactions (e.g., number of transactions, average amount, maximum amount etc.) may be included in the features of the respective edge. Entity networks can be directed, as illustrated in FIG. 1 (e.g., a directed edge from account A to account B indicating the direction of the flow of money). Edges may also be undirected (e.g., an undirected edge recording that a customer made a purchase with a certain device).; and Para. 0023, graph data 202 is comprised of transaction data in graph form. Graph 100 of FIG. 1 is an example of graph data that may be included in graph data 202. Graph data 202 can include graphs in which nodes represent transactions and/or graphs in which nodes represent entities. In various embodiments, nodes and edges of graphs included in graph data 202 are labeled. For example, nodes may be labeled as legitimate or illicit.)
One of ordinary skill in the art would have recognized that applying the known technique of Xie as modified to the known invention of Silva would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate graphical features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the method to include generating, by the computing device, from the transaction graph representation resultant one or more entity-to-entity graphs, with each of the entity-to-entity graphs being representative of a likely cluster of a chain of digital currency transfers controlled by respective entity , wherein generating the entity-to-entity graphs comprises iteratively applying one or more localizing clustering processes to the transaction graph representation to produce the one or more entity-to- entity graphs result in an improved invention because applying said technique groups related digital currency transfers into entity-based clusters so the system can identify which transfers are controlled by the same actor, thus improving the overall performance of the invention.
Xie as modified does not explicitly disclose wherein deriving the transaction graph representation comprises iteratively tracking, subject to transaction restricting rules and constraints, across a pre- determined range of transaction blocks containing the particular block, upstream parent network addresses linked to a network address associated with the particular transaction, and downstream children network addresses linked to the network address associated with the particular transaction.
However, Silva teaches wherein deriving the transaction graph representation comprises iteratively tracking, subject to transaction restricting rules and constraints, across a pre- determined range of transaction blocks containing the particular block, upstream parent network addresses linked to a network address associated with the particular transaction, and downstream children network addresses linked to the network address associated with the particular transaction, (Para. 0017, nodes in graph 100 represent individual transactions and edges connect transactions that share common entities. Examples of transactions include a sale, a purchase, or another type of exchange or interaction. Examples of entities include a person, a business, a governmental group, an account, etc. Entities can take on various roles (e.g., as merchants, clients, etc.). In various embodiments, because connecting all transactions that share common entities results in very dense graphs, transactions are only connected if they occur in a specified time-window (e.g., only connect two transactions if they occurred within a 24-hour period). In addition, in some embodiments and as illustrated in FIG. 1, edge direction is used to encode the temporal sequence of transactions, with edges connecting older transactions to more recent transactions. Timing of transactions can be determined based on timestamps, which are digital records of the time of occurrence of particular events (e.g., as recorded by computers or other electronic devices).; and Para. a distance from a specified node (corresponding to a transaction or entity of interest) to an illicit node is measured to predict a likelihood of money laundering or other fraud associated with the specified node. In various embodiments, the specified node is selected as a starting node from which traversal walks of a graph are performed. In various embodiments, each traversal walk starts from the selected starting node and proceeds to a next directly connected node selected at random, continuing until an illicit node is reached or no more steps are possible or another stopping criteria is reached. These traversals are referred to as random walks.; and Para. 0025, a random walker module (e.g., random walker module 302 of FIG. 3), receives a transaction graph, a set of seed nodes, and a parameter specifying a number of desired random walks for each of the seed nodes. Other parameters may also be received. The random walker module samples random walks for each seed node. In various embodiments, due to the graph being temporal in nature, graph traversal is limited to traveling backward in time (to past nodes) and traversal stops at a first illicit node found or when there are no more valid nodes to visit.)
One of ordinary skill in the art would have recognized that applying the known technique of Xie as modified to the known invention of Silva would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate graphical features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the method to include wherein deriving the transaction graph representation comprises iteratively tracking, subject to transaction restricting rules and constraints, across a pre- determined range of transaction blocks containing the particular block, upstream parent network addresses linked to a network address associated with the particular transaction, and downstream children network addresses linked to the network address associated with the particular transaction result in an improved invention because applying said technique will ensure that transaction data are ordered in a sequential graph to view the relationship between transfers, thus improving the overall performance of the invention.
Regarding claims 2 and 14, Xie discloses wherein applying the classification processing comprises: applying a machine learning classification process to the extracted graph feature data to determine the suspected malicious entity, (Column 2/line 60, Using the group of malicious user accounts or account activities as training data for a machine learning system that generates one or more classifiers further includes obtaining additional user accounts or account activities to use as good training data. The good training data and group of malicious user accounts or account activities are used to derive a set of rich features used to generate the one or more classifiers. The method further includes using the output additional malicious user accounts or account activities to derive a set of signals to combine with the one or more classifiers to provide real-time detection of future user events or user accounts.; and Column 3/line 5, In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include the actions of receiving input data, the input data including event logs for a collection of users; processing the input data according to each of: an IP-stat process, wherein the IP-stat process generate a set of IP address properties from the input data; and a user-stat process, wherein the IP-stat process generates a set of statistics and features for each user of the collection of users from the input data; and providing the processed input data to one or more detection modules that analyze the processed input data to perform attack detection.)
6. Regarding claims 3 and 15, Xie discloses wherein applying the classification processing comprises: applying a machine learning classification process to data derived based on the one or more entity-to-entity graphs; wherein the machine learning classification process is trained using initial address data comprising one or more digital currency addresses associated with one or more rogue transactions, (Column 1/line 45, The set of detected high-confidence malicious accounts and activities are then used as self-generated training data to feed into machine learning components to derive a set of risk models or a set of classifiers. Finally, these newly generated risk models or classifiers can be used to detect the remaining set of undetected user accounts or account activities. In this framework, the graph analysis bootstraps the system to automatically generate training data on demand, without relying on historical training data obtained from manual labels or external detection components. As such, early detection of malicious users and user activities in an un-supervised manner can be achieved. The input to the system includes Web logs that are readily available from services. Example inputs can include sign-in and sign-up logs. Other example inputs can include e-commerce transaction logs, online purchase logs, comment or review post logs, e.g., commonly available for social sites. The system can be implemented on commonly available computer systems without the need of special hardware. The system can be deployed in a cloud-computing environment, whereas it receives events or event logs from other service providers or end users directly… In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include the actions of generating a collection of hypergraphs representing user events across a collection of users; analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities satisfying a threshold confidence; using the group of malicious user accounts or account activities as training data for a machine learning system that generates one or more classifiers; and using the one or more generated classifiers to output additional malicious user accounts or account activities. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.)
7. Regarding claims 4 and 16, Xie discloses wherein applying the machine learning classification process comprises: applying an ensemble of independent classification processes to the data derived based on the one or more entity-to-entity graphs to separately determine, by the independent classification processes, respective classifications for one of the one or more entities; and determining a composite classification for the one or more entities based on the separate classifications determined by the independent classification processes, (Column 6/line 21, The IP stat process builds a rich set of IP (Internet Protocol) address properties, such as user population size and proxy information. The user stat process computes a set of statistics and features regarding each user, such as the user's registration age, the number of logins, the number of failed logins, the login velocity or rate of login over a specified time period, and user's predictable IP ranges, etc. Given the IP stats and the user stats, one or more detection modules 406 further analyzes the output IP and user statistics/features to perform attack detection. There can be different types of detection modules. The simplest type of detection module is a rule-based detection module. More advanced detection modules can be machine-learning based or graph-based modules that work alone or in combination. The output detection results 408 can be fed to the online service directly or fed to the frontend realtime detection engines. In addition, the output results 408 can also be fed back to the IP stat process module and user stat process module to update the computed states. As an example, the IP-stat process module 402 records how many detected bad users/events for each related IP address and IP address range. The user-stats process module 404 records the set of users that are detected as malicious accounts or compromised accounts.)
8. Regarding claim 5, Xie does not explicitly disclose wherein the transaction graph representation includes one or more starting nodes corresponding to the one or more digital currency addresses.
However, Lee teaches wherein the transaction graph representation includes one or more starting nodes corresponding to the one or more digital currency addresses, (Column 2/line 66, Fraud detection systems may use graph databases to store data, allowing for querying the graph database to obtain data using a variety of graph semantics such as nodes, edges, and properties. Graph databases in accordance with embodiments of the invention may include account nodes and attribute nodes, where nodes of the same type are not directly linked to each other. That is, account nodes are not linked to other account nodes and attribute notes are not linked to other attribute nodes. When a particular node is updated, an updated node may be created with a higher version number than the existing node. The updated node may then be linked while preserving the previous version(s) of the node. Each node may include an indication of the node being associated with fraudulent activity. Fraud proximity scores (and other fraud indicators) may be calculated based on the relationships between the attribute nodes, address nodes, and fraud indicators within the graph database.; and Column 8/line 57, At step 510, a graph database may be obtained. The graph database may be obtained from any of a variety of computing devices as described herein. The graph database may contain data for a variety of accounts, stored using a set of account nodes and attribute nodes as described herein. The graph database may be queried to determine features within the graph database. For example, a graph database may be queried to determine a number of unique account attributes (e.g. account numbers, social security numbers, etc.) stored in the graph database, the size of the graph database, and any of a variety of other queries. In several embodiments, a graph database may be queried to calculate a fraud proximity score for a particular account.)
One of ordinary skill in the art would have recognized that applying the known technique of Xie to the known invention of Lee would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate fraud detection features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the method to include wherein the transaction graph representation includes one or more starting nodes corresponding to the one or more digital currency addresses result in an improved invention because applying said technique will ensure that all transactions can be traced and tracked, thus improving the overall performance of the invention.
9. Regarding claims 6 and 17, Xie discloses wherein extracting graph feature data comprises: determining from the one or more entity-to-entity graphs one or more subgraphs; and computing for a subgraph, from the one or more determined subgraphs, one or more graph centralities, including one or more of: number of graph vertices, number of graph edges, total value of digital currency corresponding to the graph, number of graph loops, graph degree, graph neighborhood size, normalized closeness for one or more nodes of the graph, betweenness measure for the one or more nodes of the graph, a Page rank measure for the one or more nodes, cluster measure for the one or more nodes, coreness measure for the one or more nodes, or hub and authority measure for the one or more nodes, (Column 2/line 1, Through big-data analysis, the system automatically generates a set of malicious fake accounts, compromised accounts, and malicious account activities (e.g., spam, phishing, fraudulent transactions or payments). In addition, the system can also generate a set of risk models or classifiers to detect future events or user accounts either in real time or through periodic offline batch analysis.
In general, one innovative aspect of the subject matter described in this specification can be embodied in methods that include the actions of generating a collection of hypergraphs representing user events across a collection of users; analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities satisfying a threshold confidence; using the group of malicious user accounts or account activities as training data for a machine learning system that generates one or more classifiers; and using the one or more generated classifiers to output additional malicious user accounts or account activities. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods. For a system of one or more computers to be configured to perform particular operations or actions means that the system has installed on it software, firmware, hardware, or a combination of them that in operation cause the system to perform the operations or actions. For one or more computer programs to be configured to perform particular operations or actions means that the one or more programs include instructions that, when executed by data processing apparatus, cause the apparatus to perform the operations or actions…The foregoing and other embodiments can each optionally include one or more of the following features, alone or in combination. In particular, one embodiment includes all the following features in combination. Each hypergraph includes nodes corresponding to a feature profile associated with user accounts or events and edges indicating a relationship between nodes. Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: applying one or more community detection techniques to the hyper graphs to identify suspicious sub-graph components; determining that the nodes associated with the suspicious sub-graph components are suspicious; and outputting accounts or events associated with the suspicious sub-graph components as candidate malicious accounts or events. The method further includes examining the candidate accounts or events using a set of one or more rules or a whitelist to filter potential false positive accounts or events. Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: assigning a suspiciousness score to each node of the hypergraphs, wherein each node corresponds to a feature profile associated with user accounts or events; applying one or more graph diffusion techniques to the hyper graphs; and selecting a set of one or more nodes with high suspiciousness scores as candidate malicious accounts or events. Generating the collection of hypergraphs includes obtaining event log data associated with the collection of users including one or more of login logs, signup logs, or transaction logs.)
10. Regarding claim 7, Xie discloses wherein determining the one or more subgraphs comprises determining at least one of: an ego graph, or a simple graph, (Column 2/line 10, include the actions of generating a collection of hypergraphs representing user events across a collection of users; analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities satisfying a threshold confidence; using the group of malicious user accounts or account activities as training data for a machine learning system that generates one or more classifiers; and using the one or more generated classifiers to output additional malicious user accounts or account activities. Other embodiments of this aspect include corresponding computer systems, apparatus, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods. For a system of one or more computers to be configured to perform particular operations or actions means that the system has installed on it software, firmware, hardware, or a combination of them that in operation cause the system to perform the operations or actions. For one or more computer programs to be configured to perform particular operations or actions means that the one or more programs include instructions that, when executed by data processing apparatus, cause the apparatus to perform the operations or actions.; and Column 2/line 32, The foregoing and other embodiments can each optionally include one or more of the following features, alone or in combination. In particular, one embodiment includes all the following features in combination. Each hypergraph includes nodes corresponding to a feature profile associated with user accounts or events and edges indicating a relationship between nodes. Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: applying one or more community detection techniques to the hyper graphs to identify suspicious sub-graph components; determining that the nodes associated with the suspicious sub-graph components are suspicious; and outputting accounts or events associated with the suspicious sub-graph components as candidate malicious accounts or events. The method further includes examining the candidate accounts or events using a set of one or more rules or a whitelist to filter potential false positive accounts or events. Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: assigning a suspiciousness score to each node of the hypergraphs, wherein each node corresponds to a feature profile associated with user accounts or events; applying one or more graph diffusion techniques to the hyper graphs; and selecting a set of one or more nodes with high suspiciousness scores as candidate malicious accounts or events. Generating the collection of hypergraphs includes obtaining event log data associated with the collection of users including one or more of login logs, signup logs, or transaction logs.)
11. Regarding claim 8, Xie does not explicitly disclose wherein the transaction graph representation comprises transaction nodes in which a first transaction node specifies an output address associated with a second transaction node to which the first transaction node is connected.
However, Lee teaches wherein the transaction graph representation comprises transaction nodes in which a first transaction node specifies an output address associated with a second transaction node to which the first transaction node is connected, (Column 8/line 18, At step 416, edge data may be generated. The generated edge data may indicate the relationship between the account node indicated in the updated data and the updated node. The generated edge data may have a label corresponding to the class of data indicated in the updated data. The generated edge data may have a weight determined based on the label of the edge data and/or any other criteria, such as the difference in time between when the previous node was created and the updated data was received. For example, a recent change to a particular attribute of an account may be indicative of fraud, and more recently created edges may be given a greater weight in determining a fraud proximity score for an account. In several embodiments, the updated node includes an account node and the generated edge data may link the updated account node to a query node associated with the account node. In this way, a query node may link to every version of an account node, thereby facilitating the querying of different versions of an account stored within a graph database.; and Column 2/line 66, Fraud detection systems may use graph databases to store data, allowing for querying the graph database to obtain data using a variety of graph semantics such as nodes, edges, and properties. Graph databases in accordance with embodiments of the invention may include account nodes and attribute nodes, where nodes of the same type are not directly linked to each other. That is, account nodes are not linked to other account nodes and attribute notes are not linked to other attribute nodes. When a particular node is updated, an updated node may be created with a higher version number than the existing node. The updated node may then be linked while preserving the previous version(s) of the node. Each node may include an indication of the node being associated with fraudulent activity. Fraud proximity scores (and other fraud indicators) may be calculated based on the relationships between the attribute nodes, address nodes, and fraud indicators within the graph database.)
One of ordinary skill in the art would have recognized that applying the known technique of Xie to the known invention of Lee would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate fraud detection features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the method to include wherein the transaction graph includes one or more starting nodes corresponding to the one or more digital currency addresses result in an improved invention because applying said technique will ensure that the relationship of nodes are established during a transaction, thus improving the overall performance of the invention.
12. Regarding claim 9, Xie discloses wherein applying clustering processing to the transaction graph representation comprises applying the clustering processing to local areas of the transaction graph representation, (Column 6/line 46, A key component of the detection engine is graph analysis, where the system constructs activity graphs and identifies suspicious graph components. The graph analysis process allows the system to derive a global view of the correlations among user activities and various seemingly unrelated events, so that the system can detect stealthy attack patterns that may be difficult to identify when they are examined in isolation.; and Column 2/line 38, Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: applying one or more community detection techniques to the hyper graphs to identify suspicious sub-graph components; determining that the nodes associated with the suspicious sub-graph components are suspicious; and outputting accounts or events associated with the suspicious sub-graph components as candidate malicious accounts or events. The method further includes examining the candidate accounts or events using a set of one or more rules or a whitelist to filter potential false positive accounts or events. Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: assigning a suspiciousness score to each node of the hypergraphs, wherein each node corresponds to a feature profile associated with user accounts or events; applying one or more graph diffusion techniques to the hyper graphs; and selecting a set of one or more nodes with high suspiciousness scores as candidate malicious accounts or events. Generating the collection of hypergraphs includes obtaining event log data associated with the collection of users including one or more of login logs, signup logs, or transaction logs. Using the group of malicious user accounts or account activities as training data for a machine learning system that generates one or more classifiers further includes obtaining additional user accounts or account activities to use as good training data.)
13. Regarding claims 10 and 18, Xie discloses wherein applying clustering processing to the transaction graph representation comprises applying localized and/or temporal clustering processing to form clusters according to set of rules applied to input and output addresses of each transaction node in the transaction graph representation, (Column 6/line 46, A key component of the detection engine is graph analysis, where the system constructs activity graphs and identifies suspicious graph components. The graph analysis process allows the system to derive a global view of the correlations among user activities and various seemingly unrelated events, so that the system can detect stealthy attack patterns that may be difficult to identify when they are examined in isolation.; and Column 2/line 38, Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: applying one or more community detection techniques to the hyper graphs to identify suspicious sub-graph components; determining that the nodes associated with the suspicious sub-graph components are suspicious; and outputting accounts or events associated with the suspicious sub-graph components as candidate malicious accounts or events. The method further includes examining the candidate accounts or events using a set of one or more rules or a whitelist to filter potential false positive accounts or events. Analyzing the collection of hypergraphs to determine a group of malicious user accounts or account activities includes: assigning a suspiciousness score to each node of the hypergraphs, wherein each node corresponds to a feature profile associated with user accounts or events; applying one or more graph diffusion techniques to the hyper graphs; and selecting a set of one or more nodes with high suspiciousness scores as candidate malicious accounts or events. Generating the collection of hypergraphs includes obtaining event log data associated with the collection of users including one or more of login logs, signup logs, or transaction logs.)
14. Regarding claims 11 and 19, Xie does not explicitly disclose wherein deriving the transaction graph representation of sequential transactions comprises: identifying a particular address associated with a particular transaction; and generating a restricted transaction graph from the transaction graph representation that extends n transaction blocks upstream and downstream from the identified particular transaction with the identified particular address.
However, Lee teaches wherein deriving the transaction graph representation of sequential transactions comprises: identifying a particular address associated with a particular transaction; and generating a restricted transaction graph from the transaction graph representation that extends n transaction blocks upstream and downstream from the identified particular transaction with the identified particular address, (Column 2/line 1, Fraud may be detected by identifying situations where a fraudster is reusing permutations of (possibly stolen) credentials to open new accounts or to perform account takeovers. For example, a fraudster may use the same mailing address to open multiple accounts and/or take over an existing account by changing the mailing address on file to a fraudulent address in order to receive a new card in the mail. When the request to update the mailing address node for the account is received, the existing address node may be replicated and the new version of the address node may be created with the fraudulent mailing address. The account node may be connected to previous versions of the address nodes by an immutable linking feature, such as account number, such that the account node is associated with each version of the address nodes. Particular versions of the address node, such as the updated version inserted by the fraudster in this example, may be marked as fraudulent. In this way, accounts associated with the fraudulent versions of the address node may be identified. Additionally, when the account is recovered and a non-fraudulent address is associated with the account, the previously fraudulent address attribute node may be maintained as a historical record of the fraudulent activity.; and Column 2/line 66, Fraud detection systems may use graph databases to store data, allowing for querying the graph database to obtain data using a variety of graph semantics such as nodes, edges, and properties. Graph databases in accordance with embodiments of the invention may include account nodes and attribute nodes, where nodes of the same type are not directly linked to each other. That is, account nodes are not linked to other account nodes and attribute notes are not linked to other attribute nodes. When a particular node is updated, an updated node may be created with a higher version number than the existing node. The updated node may then be linked while preserving the previous version(s) of the node. Each node may include an indication of the node being associated with fraudulent activity. Fraud proximity scores (and other fraud indicators) may be calculated based on the relationships between the attribute nodes, address nodes, and fraud indicators within the graph database.)
One of ordinary skill in the art would have recognized that applying the known technique of Xie to the known invention of Lee would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate fraud detection features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the method to include wherein deriving the transaction graph representation of sequential transactions comprises: identifying a particular address associated with a particular transaction; and generating a restricted transaction graph from the transaction graph representation that extends n transaction blocks upstream and downstream from the identified particular transaction with the identified particular address result in an improved invention because applying said technique will ensure that only a fixed amount of transactions are chosen for fraud detection, thus improving the overall efficiency of the invention.
15. Regarding claim 12, Xie discloses further comprising: removing transaction blocks from the restricted transaction graph that are determined to be associated with addresses of gambling or exchange sites, (Column 7/line 18, Another technique for detecting an initial list of malicious accounts or events from the hypergraphs is to assign a suspiciousness score to each node, and then to apply one or more graph diffusion techniques. The graph diffusion process will infer a suspiciousness score for each graph node according to the graph structure, based on the set of nodes with pre-assigned scores. After performing graph diffusion, the system can pick the set of nodes with high suspiciousness scores to output as candidates for further examination.
Finally, these identified suspicious candidate accounts or events may be further examined using a set of one or more rules or a whitelist to filter potential false positive accounts or events. For example, one rule could be to examine whether an output suspicious account is (1) an old user, and (2) the account has a feature profile does not fit well with the feature profile of the suspicious graph node (since a node's feature profile may be computed from a set of users). If a suspicious account matches this rule, the account may be a false positive case.)
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Systems And Methods For Detecting And Protecting Against Malicious Software (US 10846405 B1) teaches computer-implemented method for detecting and protecting against malicious software may include loading an untrusted application having a defined entry point into an emulated computing environment, executing a first instance of the untrusted application in the emulated computing environment beginning at the defined entry point, executing a second instance of the untrusted application beginning at a second entry point downstream from the defined entry point so as to bypass at least a portion of the untrusted application executed in the first instance, identifying the untrusted application as a potential threat based on information extracted from the second instance of the untrusted application, and performing a security action to protect against the untrusted application identified as a threat. Various other methods, systems, and computer-readable media are also disclosed.
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
In addition to the foregoing, other aspects are described in the claims, drawings, and text. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Davida L. King whose telephone number is (571) 272-4724. The examiner can normally be reached M-F 8am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Neha Patel can be reached on (571) 270-1492. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/D.L.K./Examiner, Art Unit 3699
Prosecution Insights