Prosecution Insights
Last updated: April 19, 2026
Application No. 18/354,360

CREDENTIAL MISUSE DETECTION VIA ENTROPIC ANALYSIS OF STREAMING BEHAVIOR VARIABILITY

Final Rejection §101§103
Filed
Jul 18, 2023
Examiner
PRASAD, NANCY N
Art Unit
3624
Tech Center
3600 — Transportation & Electronic Commerce
Assignee
Charter Communications Operating LLC
OA Round
2 (Final)
22%
Grant Probability
At Risk
3-4
OA Rounds
5y 8m
To Grant
40%
With Interview

Examiner Intelligence

Grants only 22% of cases
22%
Career Allow Rate
70 granted / 324 resolved
-30.4% vs TC avg
Strong +18% interview lift
Without
With
+18.3%
Interview Lift
resolved cases with interview
Typical timeline
5y 8m
Avg Prosecution
37 currently pending
Career history
361
Total Applications
across all art units

Statute-Specific Performance

§101
37.9%
-2.1% vs TC avg
§103
44.9%
+4.9% vs TC avg
§102
2.8%
-37.2% vs TC avg
§112
9.0%
-31.0% vs TC avg
Black line = Tech Center average estimate • Based on career data from 324 resolved cases

Office Action

§101 §103
DETAILED ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Status of Application This office action is in response to the amendments and arguments filed by applicant on 09/26/25. Claims 1, 5-6, 9, 13-14, 16-17, and 19-20 are amended No claims are cancelled No claims are added Claims 1-20 are pending Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-20 is/are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., an abstract idea) without significantly more. Step One - First, pursuant to step 1 in the January 2019 Guidance on 84 Fed. Reg. 53, the claims 1-8 is/are directed to a system which is a statutory category. Step One - First, pursuant to step 1 in the January 2019 Guidance on 84 Fed. Reg. 53, the claims 9-15 is/are directed to a system which is a statutory category. Step One - First, pursuant to step 1 in the January 2019 Guidance on 84 Fed. Reg. 53, the claims 16-20 is/are directed to a method which is a statutory category. Under the 2019 PEG, Step 2A under which a claim is not “directed to” a judicial exception unless the claim satisfies a two-prong inquiry. Further, particular groupings of abstract ideas are consistent with judicial precedent and are based on an extraction and synthesis of the key concepts identified by the courts as being abstract. With respect to the Step 2A, Prong One, the claims as drafted, and given their broadest reasonable interpretation, fall within the Abstract idea grouping of “certain methods of organizing human activity” (business relations; relationships or interactions between people). For instance, independent Method Claim 1 are directed to an abstract idea, as evidenced by claim limitations “determining, an account entropy based on a viewing probability distribution for a total amount of content streamed for a defined account within a defined analysis period, wherein the account entropy measures viewing behavior variability of the defined account over the defined analysis period; grouping, the total amount of content streamed into groups based on an account-stream characteristic that has probabilistic utility in determining the credential sharing; determining, a group entropy for each of the groups; determining, a watch-time variability based on the account entropy and each group entropy, wherein the watch-time variability measures an increase in disorder when two or more groups of the groups are unrelated with respect to the account-stream characteristic for use in determining account password sharing, and wherein determining the watch-time variability comprises: determining, a weight for each group entropy, wherein the weight for each group entropy is based on a watch-time for the streams in each group divided by a total amount of watch-time for the total amount of content streamed; and subtracting, each weighted group entropy from the account entropy in order to determine the watch-time variability; determining, the credential sharing for the defined account based on the watch-time variability; wherein determining the credential sharing for the defined account comprises: obtaining, one or more fraud detection factors: determining, an account fraud indicator by assigning a weight to each of the one or more fraud detection factors and the watch-time variability; and determining the credential sharing for the defined account based on the account fraud indicator; and imposing, responsive to determining the credential sharing for the defined account, account restriction on the defined account.” in claim 1. These claim limitations belong to the grouping of “certain methods of organizing human activity” because the claims are related to detecting fraud or suspicious activity in a user account while not penalizing legal activity performed by a user from a different location or device while using a streaming service and performing account or credential sharing (see specification [0002]-[0003]). Detecting fraud or suspicious activity in a user account while not penalizing legal activity performed by one or more human entities involves organizing human activity based on the description of “certain methods of organizing human activity” provided by the courts. The court have used the phrase “Certain methods of organizing human activity” as —fundamental economic principles or practices (including hedging, insurance, mitigating risk); commercial or legal interactions (including agreements in the form of contracts; legal obligations; advertising, marketing or sales activities or behaviors; business relations); managing personal behavior or relationships or interactions between people (including social activities, teaching, and following rules or instructions). Independent Claims 9 and 16 is/are recite substantially similar limitations to independent claim 1 and is/are rejected under 2A for similar reasons to claim 1 above. With respect to the Step 2A, Prong Two - This judicial exception is not integrated into a practical application. In particular, the claim only recites “from a plurality of streaming devices, by the watch-time variability unit, a credential sharing detection system comprising: an Internet Protocol (IP) server configured to, a processor, in cooperation with the IP server, and connected to a tangible medium with instructions, the processor configured to execute the instructions to:, A computer implemented method for determining watch-time variability for a defined account, the program instructions executable by a computer to cause the computer to perform a method comprising: A computer implemented method for determining credential sharing, the method comprising: by a service provider system, A credential sharing detection system comprising: an Internet Protocol (IP) server configured to, A computer-implemented method for determining a credential sharing of a video streaming service account based on entropy of streaming data, the method comprising: by a watch-time variability unit, by a fraud detection unit, A system comprising: a watch-time variability unit configured to: A credential sharing detection system comprising: an Internet Protocol (IP) server configured to: by a watch-time variability unit, by the watch-time variability unit, by the watch-time variability unit, by a fraud detection unit, by the fraud detection unit,”, such that it amounts to no more than: adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea, as discussed in MPEP 2106.05(f). As a result, claims 1, 9 and 16 do not provide any specifics regarding the integration into a practical application when recited in a claim with a judicial exception. Similarly dependent claims 2-8, 10-15, and 17-20 are also directed to an abstract idea under 2A, first and second prong. In the present application, all of the dependent claims have been evaluated and it was found that they all inherit the deficiencies set forth with respect to the independent claims. For instance, dependent claims 3 recite “wherein the account-stream characteristic for use in determining account password sharing comprises a combination of streaming device identifiers and Internet Protocol (IP) addresses” and dependent claims 6 recite “further comprising: responsive to determining the credential sharing for the defined account, imposing account restriction or account termination on the defined account”. Here, these claims offer further descriptive limitations of elements found in the independent claims which are similar to the abstract idea noted in the independent claim above. Dependent claims 2 recites “by the watch-time variability unit” in the claim limitations “further comprising: binning, by the watch-time variability unit, the total amount of content streamed for the defined account within the defined analysis period into time bins, wherein each of the time bins corresponds to a defined time interval within the defined analysis period; normalizing, by the watch-time variability unit, amount of content streamed in each time bin by the total amount of content streamed in order to generate the viewing probability distribution; and generating, by the watch-time variability unit and based on normalized amount of content streamed, the viewing probability distribution for the defined account”. In this claim, “by the watch-time variability unit” is an additional element. Dependent claims 5 recites “by the fraud detection unit” in the claim limitations “the one or more fraud detection factors: include at least one of out-of-home device factor, non-home network usage factor, non-home account location usage factor, out-of-home streaming volume factor, total concurrent streams factor, distant events relative to home account location factor, repeat device types factor, or weighted concurrent streams factor, and wherein the weight assigned to each of the one or more fraud detection factors and the watch-time variability is assigned based on at least one of reliability, accuracy, and correctness”. Dependent claims 5 recites in the claim limitations “wherein the account restriction or on the defined account is account termination on of the defined account”. In the above claims, “by the watch-time variability unit” is an additional element. The additional elements discussed above, are still being recited such that it amounts to no more than adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea, as discussed in MPEP 2106.05(f). As a result, Examiner asserts that dependent claims, such as dependent claims 2-8, 10-15, and 17-20 are also directed to the abstract idea identified above. With respect to Step 2B, the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. First, the invention lacks improvements to another technology or technical field [see Alice at 2351; 2019 IEG at 55], and lacks meaningful limitations beyond generally linking the use of an abstract idea to a particular technological environment [Alice at 2360, 2019 IEG at 55], and fails to effect a transformation or reduction of a particular article to a different state or thing [2019 IEG, 55]. For the reasons articulated above, the claims recite an abstract idea that is limited to a particular field of endeavor (MPEP § 2106.05(h)) and recites insignificant extra-solution activity (MPEP § 2106.05(g)). By the factors and rationale provided above with respect to these MPEP sections, the additional elements of the claims that fail to integrate the abstract idea into a practical application also fail to amount to “significantly more” than the abstract idea. As discussed above with respect to integration of the abstract idea into a practical application, the additional element(s) of “from a plurality of streaming devices, by the watch-time variability unit, a credential sharing detection system comprising: an Internet Protocol (IP) server configured to, a processor, in cooperation with the IP server, and connected to a tangible medium with instructions, the processor configured to execute the instructions to:, A computer implemented method for determining watch-time variability for a defined account, the program instructions executable by a computer to cause the computer to perform a method comprising: A computer implemented method for determining credential sharing, the method comprising: by a service provider system, A credential sharing detection system comprising: an Internet Protocol (IP) server configured to, A computer-implemented method for determining a credential sharing of a video streaming service account based on entropy of streaming data, the method comprising: by a watch-time variability unit, by a fraud detection unit, A system comprising: a watch-time variability unit configured to: A credential sharing detection system comprising: an Internet Protocol (IP) server configured to: by a watch-time variability unit, by the watch-time variability unit, by the watch-time variability unit, by a fraud detection unit, by the fraud detection unit,” are insufficient to amount to significantly more. Applicants originally submitted specification describes the computer components above at least in page/ paragraph [0031]. In light of the specification, it should be noted that the components discussed above did not meaningfully limit the abstract idea because they merely linked the use of the abstract idea to a particular technological environment (i.e., "implementation via computers"). In light of the specification, it should be noted that the claim limitations discussed above are merely instructions to implement the abstract idea on a computer. See MPEP 2106.05(f). (See MPEP 2106.05(f) - Mere Instructions to Apply an Exception - “Thus, for example, claims that amount to nothing more than an instruction to apply the abstract idea using a generic computer do not render an abstract idea eligible.” Alice Corp., 134 S. Ct. at 235). Mere instructions to apply an exception using computer component cannot provide an inventive concept.). The claim fails to recite any improvements to another technology or technical field, improvements to the functioning of the computer itself, use of a particular machine, effecting a transformation or reduction of a particular article to a different state or thing, adding unconventional steps that confine the claim to a particular useful application, and/or meaningful limitations beyond generally linking the use of an abstract idea to a particular environment. See 84 Fed. Reg. 55. Viewed individually or as a whole, these additional claim element(s) do not provide meaningful limitation(s) to transform the abstract idea into a patent eligible application of the abstract idea such that the claim(s) amounts to significantly more than the abstract idea itself. Independent Claims 8 and 15 is/are recite substantially similar limitations to independent claim 1 and is/are rejected under 2B for similar reasons to claim 1 above. Further, it should be noted that additional elements of the claimed invention such as claim limitations when considered individually or as an ordered combination along with the other limitations discussed above in method claim 1 also do not meaningfully limit the abstract idea because they merely linked the use of the abstract idea to a particular technological environment (i.e., "implementation via computers"). In light of the specification, it should be noted that the claim limitations discussed above are merely instructions to implement the abstract idea on a computer. See MPEP 2106. Similarly, dependent claims 2-8, 10-15, and 17-20 also do not include limitations amounting to significantly more than the abstract idea under the second prong or 2B of the Alice framework. In the present application, all of the dependent claims have been evaluated and it was found that they all inherit the deficiencies set forth with respect to the independent claims. Further, it should be noted that the dependent claims do not include limitations that overcome the stated assertions. Here, the dependent claims recite features/limitations that include computer components identified above in part 2B of analysis of independent claims 1, 9 and 16. As a result, Examiner asserts that dependent claims, such as dependent claims 2-8, 10-15, and 17-20 are also directed to the abstract idea identified above. For more information on 101 rejections, see MPEP 2106, January 2019 Guidance at https://www.govinfo.gov/content/pkg/FR-2019-01 -07/pdf/2018-28282.pdf Claim Rejections - 35 USC § 103 - withdrawn In the most recent filings, applicants have amended independent claims 1-20. Please see the Remarks dated 09/26/25, especially on pages 16 and 21-23 from applicants why the 103 rejection is overcome are persuasive. In light of applicants’ arguments and the amendments filed by applicants to previously presented claims in light of the originally filed disclosure the previously made rejection under 35 U.S.C. 103 has been withdrawn for following reasons: None of the references cited - Lonstein; Wayne D. et al. (US 10,080,047), further in view of Pang; Jeffrey et al. (US 2015/0333986), Hegglin; Daniel M. et al. (US 2010/0131971), and Hoffberg; Steven M. (US 2007/0087756) show the claim limitations discussed below in light of the specification. As per claims 1 and 9: “A computer-implemented method for determining a credential sharing of a video streaming service account based on entropy of streaming data, the method comprising: determining, by a watch-time variability unit, an account entropy based on a viewing probability distribution for a total amount of content streamed for a defined account within a defined analysis period, wherein the account entropy measures viewing behavior variability of the defined account over the defined analysis period; grouping, by the watch-time variability unit, the total amount of content streamed into groups based on an account-stream characteristic that has probabilistic utility in determining the credential sharing; determining, by the watch-time variability unit, a group entropy for each of the groups; determining, by the watch-time variability unit, a watch-time variability based on the account entropy and each group entropy, wherein the watch-time variability measures an increase in disorder when two or more groups of the groups are unrelated with respect to the account-stream characteristic for use in determining account password sharing, and wherein determining the watch-time variability comprises: determining, by the watch-time variability unit, a weight for each group entropy, wherein the weight for each group entropy is based on a watch-time for the streams in each group divided by a total amount of watch-time for the total amount of content streamed; and subtracting, by the watch-time variability unit, each weighted group entropy from the account entropy in order to determine the watch-time variability; determining, by a fraud detection unit, the credential sharing for the defined account based on the watch-time variability; wherein determining the credential sharing for the defined account comprises: obtaining, by the fraud detection unit, one or more fraud detection factors: determining, by the fraud detection unit, an account fraud indicator by assigning a weight to each of the one or more fraud detection factors and the watch-time variability; and determining the credential sharing for the defined account based on the account fraud indicator; and imposing, responsive to determining the credential sharing for the defined account, account restriction on the defined account.” As per claim 16: “A credential sharing detection system comprising: an Internet Protocol (IP) server configured to obtain from a plurality of streaming devices account data and streaming data for streams viewed on an account using an account credential, wherein a service provider associated with the IP server provides the account for streaming access via the account and the account credential; a processor configured to cooperate with the IP server and connected to a tangible medium with instructions, the processor configured to execute the instructions to: generate a viewing probability distribution for the account for use in determining an account credential sharing, wherein the viewing probability distribution is expressed as a function of a fraction of total amount of content streamed in a defined analysis period; generate an account entropy based on the viewing probability distribution account for use in determining the account credential sharing; group the streams into two or more groups based on an account-stream characteristic that has a probabilistic utility to indicate the account credential sharing, wherein to group the streams into the two or more groups comprises to: determine relationships between streaming devices of the plurality of streaming devices used for streaming content using the account credential and IP addresses used for streaming the content; compare among the relationships to determine respective one or more clusters that have disconnected streaming devices and respective IP addresses; and divide the streams into the two or more groups based on the respective one or more clusters; generate a group entropy for each of the two or more groups account for use in determining account credential sharing: determine a watch-time variability based on the account entropy and each group entropy account for use in determining account credential sharing, wherein the watch-time variability measures an increase in disorder when two or more groups of the groups are unrelated with respect to the account-stream characteristic for use in determining account password sharing; obtain one or more fraud detection factors; determine an account fraud indicator by assigning a weight to each of the one or more fraud detection factors and the watch-time variability; detect credential sharing for the account based on the account fraud indicator; and provide, based on a respective value of the watch-time variability, an indication of credential sharing for the account; and impose, responsive to the credential sharing for the account, account restriction on the account.” * The limitations underlined above are the newly amended claim limitations, which are not shown by the combination of the previously presented prior art references. Reference Lonstein; Wayne D. et al. (US 10,080,047) shows in col. 3, lines 45-58: billions of viewers where each live video stream, pirate and/or viewer is given individual interaction and remediation; the ability to interact and remediate viewers of live video streams; the ability to scan, monitor and document social media, forums and blogs for password sharing (“access-fraud”) and to hold accountable would-be participants in password selling and/or sharing; and the ability to monetize illegal streamers and viewers of digital content and/or educate, re-direct, divert and/or convert those streamers and viewers into paid or otherwise legal subscribers/consumers by providing a website, application or other virtual or physical legal access portal for content address link to an authorized version of the video streaming content. Lonstein shows: col. 6, lines 8-15: document and communicate with streamers, viewers or both. In the identification process, multi-faceted separate databases based upon, factors such as stream content, stream viewers, streamer identities, geographic data of stream origination, geographic data of stream viewers, all the while increasing its virtual persona creation database and maintain virtual networks by the creation, evolution and expanding reach of the personas. col. 12, lines 28-47, discusses password and user account association verification. Lonstein shows a dynamic, growing and active database of viewer likes, dislikes, habits and behaviors (col. 8, lines 65-67), along with collecting user's username, profile name, user unique identifier, such as a user ID, internet protocol (IP) address, network address, internet address, date and time of the sharing of the link, profile link (in col. 12, lines 12-47), as well as tracking user behavior to know when the behavior is illegal (col. 13, lines 42-61). Lonstein shows a dynamic, growing and active database of viewer likes, dislikes, habits and behaviors (col. 8, lines 65-67), along with collecting user's username, profile name, user unique identifier, such as a user ID, internet protocol (IP) address, network address, internet address, date and time of the sharing of the link, profile link (in col. 12, lines 12-47), as well as tracking user behavior to know when the behavior is illegal (col. 13, lines 42-61). Lonstein shows col. 7, lines 47-53: By acceptance as a follower, friend, contact or other relationship, the dynamic virtual personas will additionally be notified of non-public, private or other secretive settings on all LSA's, which are designed to allow the streamer and/or viewer to anonymize the stream and limit public knowledge and therefore detection of such streams. Lonstein shows col. 7, lines 47-53: By acceptance as a follower, friend, contact or other relationship, the dynamic virtual personas will additionally be notified of non-public, private or other secretive settings on all LSA's, which are designed to allow the streamer and/or viewer to anonymize the stream and limit public knowledge and therefore detection of such streams. Lonstein shows: col. 16, lines 21-25: output information is presented to the user using a statistical and/or probabilistic analysis of both risk and reliability. col. 4, lines 60-67 and col. 12, lines 18-27: IP addresses. Lonstein does not explicitly show “viewing probability distribution”. As such, the reference does not show the above claim limitations. Lonstein shows in Fig. 3, how the viewers can be grouped by age, gender, etc. In col. 13, lines 35-40: the reference shows identifying and monitoring password sharers or streamers. Lonstein is able to find “account password sharing” by monitoring behavior patterns online. However, Lonstein does not explicitly show “probabilistic”. Lonstein does not explicitly show “variability measures the increase in disorder when the two or more groups are unrelated”. As such, the reference does not show the above claim limitations. Reference Pang shows see [0045]-[0046] “probabilistic” in video traffic statistics and [0048]-[0049] shows probabilistic distribution and different variables that help further understand user streaming behavior. However, the reference does not show the above claim limitations. Pang shows “variability measures the information gain when the two or more groups are disassociated as a result of segmentation” see [0045]-[0046] shows video traffic statistics and [0048]-[0049] shows probabilistic distribution and different variables that help further understand user streaming behavior, [0052]: the computer system 300 computes the following statistical measures to summarize the flow-level features for whole sessions: mean, standard deviation, minimum, maximum, 25th percentile, median (50th percentile), and 75.sup.th percentile. [0048]: For continuous quantification of user video engagement, the computer system 300 utilizes a continuous variable representing the fraction of video download completion. FIG. 5 is graph 500 that shows the cumulative distribution function (CDF) of video download completion according to an embodiment. Reference Lonstein and Pang do not show “normalizing” in the claim above. Lonstein and Pang do not show “weight”. As such, the reference does not show the above claim limitations. Reference Hoffberg shows “normalizing” at least in [0422]: output information is presented to the user using a statistical and/or probabilistic analysis of both risk and reliability…..normalizing the distribution function. Hoffberg shows “weights” at least in [0451]. References Lonstein, Pang, and Hoffberg do not explicitly show “disconnected streaming”. As such, the reference does not show the above claim limitations. Reference Hegglin shows the above claim limitation at least in [0011]: the second service level is a predetermined service level provided by the cable modem termination system to suspect cable modems. Reference Hegglin does not explicitly show the amended claims. As such, the reference does not show the above claim limitations. *Additionally, the prior art made of record and not relied upon is considered pertinent to applicant's disclosure; however, the reference does not show the above claim limitations: NPL Reference: Reference Yurcan, Bryan. How to stop fraud attacks on streaming services. Arkose Labs. Date: 07/09/2020. https://www.arkoselabs.com/blog/blocking-attacks-on-streaming-services-platforms-made-simple/ This reference discloses how attacks on streaming services include new fake account creation, account takeover, phishing, and spam. These attacks are on the rise as fraudsters are tapping into the opportunities presented by an overwhelming increase in the number of users accessing these services. However, the reference does not show the claim limitations above. Foreign Reference: Reference (CN 110012322) An Y et al. This reference discloses obtaining preset first video networking service by a client based on first user information when receiving a verification success signaling. An audio and video sharing operation is received for the first video networking service. The first audio and video stream data is transmitted to a stream media server. The first video network service is turned-off when receiving a verification unsuccessful signaling. The first audio and video stream data is converted into second audio and video stream data conforming to a network protocol when the stream media server receives the first audio and video stream data. The second audio and video stream data is transmitted to a video network server. The video network server is configured to send the second audio and video stream data to a video network. However, the reference does not show the claim limitations above. None of the prior art of record, taken individually or in combination, teach, interalia, the claimed invention as detailed in independent claims 1, 8 and 15, wherein the novelty of the claimed invention is in the combination of limitations and not in any single limitation. Response to Arguments Applicants’ arguments are moot in view of the new grounds of rejection necessitated by the amendments made to previously presented claims. Applicant’s Argument #1 Applicants argue on page(s) 17-20 of applicants remarks that “Moreover, claim 1 as amended recites a practical application at Step 2A Prong Two by taking proactive measures (i.e., imposing account restriction on the defined account) based on determining the credential sharing. This is analogous to claim 3 of Example 47 of the USPTO Subject Matter Eligibility Examples. Steps (d)-(f) of claim 3 of Example 47 recite "(d) detecting a source address associated with the one or more malicious network packets," "(c) dropping the one or more malicious network packets," and "(f) blocking future traffic from the source address. The USPTO Subject Matter Eligibility Examples explains that steps "(d)-(f) provide for improved network security using the information from the detection to enhance security by taking proactive measures to remediate the danger by detecting the source address associated with the potentially malicious packets. Specifically, the claim reflects the improvement in step (d), dropping potentially malicious packets in step (e), and blocking future traffic from the source address in step (f) and that the "disclosed system detects network intrusions and takes real-time remedial actions."5 Similarly, claim 1 of the present application recites detecting credential sharing to automatically impose account restriction. Claim 3 of Example 47 was patent eligible over 35 U.S.C. § 101 and claim 1 should be found patent eligible for at least the same reasons.” (see applicants remarks for more details). Response to Argument #1 Applicants' arguments have been fully considered; however, the examiner respectfully disagrees. Unlike Claim 3, Example 47, in the 2024 Guidance Update on Patent Subject Matter Eligibility, Including on Artificial Intelligence (2024 AI SME Update) in the Federal Register on July 17, 2024. Particularly, Example 47, claim 3 and following the steps in claim 3, which is eligible under 35 U.S.C. 101. Here, in claim 3, steps (a)-(d) discuss the use of a computer at a high level of generality. However, once you get to steps (e and f), the specific remedial actions that are executed to remediate or prevent network intrusions. The claimed steps of (e), automatically dropping the one or more malicious network packets, and (f), blocking future traffic from the source address, provide specific computer solutions that use the output from the ANN to provide security solutions to the detected anomalies. As indicated in paragraph six of the background, the system may “automatically” perform dropping of malicious network packets and blocking future traffic without the need for any action by a network administrator. Instead, the ANN may make decisions about whether a network packet is potentially malicious and take action to drop malicious network packets and block future traffic (see pages 10-11) helps make the claim overall eligible. The discussions that follow on pages 11-13 explain the analysis even further. By contrast, the improvements in the current application are directed to business improvements which are abstract and not directed to any particular technology or technical field. Blocking accounts that are sharing passwords allows the company to have more users paying to use their services instead of users sharing the services with one subscription fee. Improving the revenue of the company is a business improvement and does not really improve the technological field. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. NPL Reference: Yurcan, Bryan. How to stop fraud attacks on streaming services. Arkose Labs. Date: 07/09/2020. https://www.arkoselabs.com/blog/blocking-attacks-on-streaming-services-platforms-made-simple/ This reference discloses how attacks on streaming services include new fake account creation, account takeover, phishing, and spam. These attacks are on the rise as fraudsters are tapping into the opportunities presented by an overwhelming increase in the number of users accessing these services. Foreign Reference: (CN 110012322) An Y et al. This reference discloses obtaining preset first video networking service by a client based on first user information when receiving a verification success signaling. An audio and video sharing operation is received for the first video networking service. The first audio and video stream data is transmitted to a stream media server. The first video network service is turned-off when receiving a verification unsuccessful signaling. The first audio and video stream data is converted into second audio and video stream data conforming to a network protocol when the stream media server receives the first audio and video stream data. The second audio and video stream data is transmitted to a video network server. The video network server is configured to send the second audio and video stream data to a video network. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to NANCY PRASAD whose telephone number is (571)270-3265. The examiner can normally be reached M-F: 8:00 AM - 4:30 PM EST. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Patricia Munson can be reached on (571)270-5396. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /N.P/Examiner, Art Unit 3624 /PATRICIA H MUNSON/Supervisory Patent Examiner, Art Unit 3624
Read full office action

Prosecution Timeline

Jul 18, 2023
Application Filed
Jun 28, 2025
Non-Final Rejection — §101, §103
Sep 12, 2025
Interview Requested
Sep 17, 2025
Examiner Interview Summary
Sep 17, 2025
Applicant Interview (Telephonic)
Sep 26, 2025
Response Filed
Jan 15, 2026
Final Rejection — §101, §103
Mar 11, 2026
Interview Requested
Mar 25, 2026
Applicant Interview (Telephonic)
Mar 25, 2026
Examiner Interview Summary

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12555114
FRAUD DETECTION USING MULTI-TASK LEARNING AND/OR DEEP LEARNING
2y 5m to grant Granted Feb 17, 2026
Patent 12493891
SIGHT INFORMATION COLLECTION IN HEAD WORN COMPUTING
2y 5m to grant Granted Dec 09, 2025
Patent 12045838
SYSTEM AND METHOD OF IDENTIFICATION AND AUTHENTICATION FOR TRACING AGRICULTURAL ASSETS, IDENTIFICATION ELEMENT FOR SECURE IDENTIFICATION OF AGRICULTURAL ASSETS AND CORRESPONDING COMPUTER PROGRAMS
2y 5m to grant Granted Jul 23, 2024
Patent 12039570
USER-CUSTOMIZABLE, USER-PERSONALIZABLE AND USER COMPENSABLE KEYBOARD PROVIDING SYSTEM AND METHOD
2y 5m to grant Granted Jul 16, 2024
Patent 11995595
AUTOMATED STRUCTURED WORKFLOW RECOMMENDATION SYSTEM
2y 5m to grant Granted May 28, 2024
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

3-4
Expected OA Rounds
22%
Grant Probability
40%
With Interview (+18.3%)
5y 8m
Median Time to Grant
Moderate
PTA Risk
Based on 324 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month