Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
This office action is responsive to amendment received on 9/6/2026. Claims 1, and 16 are amended. Claims 1-22 are pending examination.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-22 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Step 1: Claims 1, 12 and 16 are directed to a system, which falls within the statutory category of machine under U.S.C. 101. Claims 2-11, 13-15, and 17-22 depend from claims 1, 12 and 16 respectively, and are also directed to system.
Step 2A: claims 1-22 are directed tot eh abstract idea of detecting anomalous email sending behavior by comparing current activity to historical patterns, which falls within the mental process and mathematical relationship categories of abstract ideas identified by the courts. Specifically, the claims recite, collecting behavior data about a sender’s email patterns (send rate, transmission velocity, frequency), calculating a baseline pattern from historical data, determining current message behavior, comparing current behavior to baseline to generate deviation, and creating warning or quarantining messages based on deviations. This process of pattern recognition and anomaly detection is a fundamental practice in security monitoring that can be performed mentally or with pen and paper by reviewing email logs and observing patterns.
This is similar to abstract ideas found in Electric Group, LLC v. Alstom S.A. (collecting and analyzing data to detect abnormalities) and Credit Acceptance Corp. v. Westlake services (using data about past transactions to identify potential fraud).
Step 2A, Prong 2: The claims do not integrate the abstract idea into a practical application. The additional elements such as computerized sender system, analysis server, behavior dataset, status dataset, processors, and computer readable instructions, use the abstract idea with generic computer components to perform data gathering, calculation, and notification functions. The claims do not improve the functioning of a computer or other technology, do not apply the abstract with any particular machine or transformation or provide any meaningful limitation beyond linking the abstract idea to a particular technological environment. The computer components are simply used as tool to perform the abstract idea, they do not provide a technological improvement or solution.
Step 2B: the claims do not recite an inventive concept enough to transform the abstract idea into patent eligible subject matter. When considered both individually and as an ordered combination, the additional elements amount to no more than generic computer components, conventional activities and insignificant extra solution activity. The claims recite elements at high level of generality without any specific technical implementation of unconventional configuration. There is no improvement in computer functionality, network security technology, or email system operation. The computer server is only used as a tool to automate the abstract idea. In conclusion claims 1-22 are rejected under 35 U.S.C 101.
Dependent claims 2-11, 13-15 and 17-22 further describe the abstract idea of monitoring user activity, comparing it to historical patterns and flagging deviations. The dependent claims do not include additional elements that integrate the abstract idea into a practical application or that provide significantly more than the abstract idea. Therefore, the dependent claims are also not patent eligible.
Response to Arguments
Applicant's arguments regarding 35 USC § 101 have been fully considered but they are not persuasive. Applicant arguments are listed below.
Regarding Step 2A, Prong One
The applicant argues that the claims do not recite mathematical concept because independent claims do not expressly recite a mathematical formula or equation. The applicant also argues that the claims do not recite a mental process because a person can not mentally intercept or quarantine an electronic message.
The examiner respectfully disagrees. The claims recite collecting information concerning a sender’s message behavior, calculating a baseline pattern, determining current message behavior, comparing the current behavior with the baseline, and determining whether a deviation exists. These limitations amount to evaluating and analyzing information. The specification explains that the baseline and deviation determinations maybe performed using statistical calculations, including averages, means, standard deviation and other statistical techniques. The specification also describes Z-score analysis for determining whether the current message activity is outside an acceptable range. Filtering or blocking electronic messages with a computer is still just an abstract concept. These additional computer limitations are considered under Step 2A, Prong two. Accordingly, the examiner maintains that the claims recite an abstract idea involving the collection and analysis of information to identify abnormal sender behavior.
Regarding Step 2A, Prong Two
The applicant argues that the claims integrate the alleged abstract idea into a practical application because the analysis server intercepts the electronic message before it reaches the recipient and quarantines the message when abnormal behavior is detected. The applicant also relies on Finjan, SRI, and USPTO Example 40.
These arguments are not persuasive. The claims state that the message is intercepted and quarantined, but do not recite a particular technological improvement in how the interception or quarantine is performed. The specification explains that existing electronic messaging components, including sender systems, SMTP servers, DNS routing, networks and recipient systems, may be used to transmit the electronic message. The specification also explains that MX record information may be used to route the message through the analysis server before the message reaches the recipient. Therefore, the analysis server messaging components are used to carry out the claimed behavioral analysis. The claims do not recite an improvement to MX routing, the messaging protocol, the analysis server itself, or the way in which messages are quarantined.
The applicant’s reliance on Finjan is not persuasive because Finjan involved a particular computer security technique for generating and attaching security information to downloadable content. Whereas, the current claims broadly analyze sender behavior, determine whether the behavior deviates from a baseline, and act based on that determination. The claims do not recite a comparable specific improvement to computer functionality.
The applicant’s reliance on SRI is not persuasive. The current claims do not recite the particular network -monitoring arrangement at issue in SRI. Instead, the claimed server analyzes sender behavior and takes action when an abnormality is detected.
The applicants reliance on Example 40 is not persuasive. Example 40 involved a particular monitoring technique that reduced unnecessary network traffic and improved network performance. The present claims do not recite a similar improvement in network performance or computer operation. Rather, the detected deviation is used to determine whether an electronic message should be quarantined. Accordingly, the claims use the abstract analysis in an electronic messaging environment but do not integrate the abstract idea into a technological improvement.
Applicant’s arguments regarding the dependent claims.
The applicant argues that claims 3,7, and 8 provide specific improvements because they use additional information such as status information, sender location and login activity to improve detection of unauthorized access.
This argument is not persuasive. These limitations define the information used in making the determination. Using additional information to improve the accuracy of the analysis does not by itself improve the operation of the computer or messaging system.
The applicant also argues that claims 13,14,15 and 22 provide a practical application because they mark, quarantine, or provide warnings concerning potentially malicious messages.
In response. These limitations use the result of the behavioral analysis to determine what action should be taken. The specification describes the process as gathering historical information, generating a baseline, comparing current activity with the baseline, determining an anomaly, and then taking an action based on the result. Such actions may include generating a warning, locking an account, quarantining or deleting a message, modifying a header, or requiring additional authentication. The claims do not recite a specific technological improvement in how these actions are achieved.
Argument regarding claim 21.
The applicant argues that claim 21 provides a technological improvement because the analysis server modifies the header of the electronic message to indicate that the message may be from a compromised account, The applicant compares this feature to Finjan.
The examiner respectfully disagrees. Claims 21 broadly requires adding an indicator tot eh message header based on the result of the behavioral analysis. The claim does not recite a new header structure, new messaging protocol, or specific technical mechanism for modifying the message. The specification explains that the header may simply be edited to include information indicating different levels of detected abnormality so that later action may be taken. Therefore, the header information communicates the result of the analysis rather than improving the operation of the computer or messaging system itself.
Argument regarding 2B.
The applicant argues that the Office did not provide sufficient evidence that intercepting and quarantining electronic messages are well understood, routine and conventional.
Response. The examiner has considered applicant’s argument. The rejection does not rely only on an unsupported finding that the claimed combination is conventional. Rather, when considered individually and as an ordered combination, the additional elements use computer and electronic messaging components to perform the claimed behavioral analysis and act based on the result. The specification describes the process as using historical information to generate a baseline. Comparing current activity with the baseline determining whether an abnormality exists and then raking an action. The claims do not recite a specific improvement to how the computer, analysis server, massage routing system or quarantine process operates. Instead, these computer components are used to carry out the claimed information analysis and respond to its result. Therefore, the additional elements, considered individually and as an ordered combination, do not amount to significantly more than the abstract idea.
In conclusion. The applicant’s arguments have been fully considered but are not persuasive. The claims remain directed to analyzing sender behavior by establishing a baseline, comparing current messages behavior with that baseline, identifying a deviation, and acting based on eh result. The additional computer and messaging limitations do not recite a specific improvement to computer or network technology. Accordingly, the rejection of claims 1-22 under 35 U.S.C. 101 is maintained.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SARGON N NANO whose telephone number is (571)272-4007. The examiner can normally be reached 7:30 AM-3:30 PM. M.S.T..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Nicholas Taylor can be reached at 571 272 3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SARGON N NANO/Primary Examiner, Art Unit 2443
Prosecution Insights