Detailed Action
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Acknowledgments
The submission filed on 10/28/25 is acknowledged.
Status of Claims
Claims 1-20 are pending.
In the Amendment filed on 10/28/25, claims 1, 7, 13, 15, 16 and 19 were amended, and no claims were cancelled or added.
Claims 1-20 are rejected.
Response to Arguments
Regarding the rejections under 35 U.S.C. 112
In view of the amendments to the claims, the previous rejections are withdrawn.
Regarding the rejection under 35 U.S.C. 103
Applicant's arguments have been fully considered but they are not persuasive (as explained below) and/or are moot in view of the new combinations of references being used in the current rejections.
Applicant argues:
[1] Applicant submits that the cited references do not teach or disclose the above features and claimed proxy assessment as recited in amended claim 1. [2] Prior to the present amendments, the Office Action asserts that Anderson discusses comparing observed latencies between communication layers and to baseline or expected values (see Office Action, at 10, citing Anderson, at [0023], [0028], [0038]-[0039], and [0044]). [3] However, Anderson's approach is fundamentally rule-based or threshold-based. [4] For example, the alleged "differential latency" analysis cited by the Office is performed by directly comparing the observed latency of one layer to a baseline to detect anomalies that may indicate proxy or VPN usage. [5] However, Anderson does not disclose or suggest applying a machine learning model trained on historical network timing data, using as input the measured times from a public node to the application and internet layers, to determine whether a difference between the two measured times exceeds a threshold indicative of proxy or VPN usage. [6] Instead, Anderson relies on static rules or predetermined thresholds, not on a data-driven, learned model. (Response, pp. 9-10; bracketed numerals indicating individual sentences added for reference in discussion below)
In response:
Regarding [3], it is not clear what point Applicant is making, and the assertion is not understood and appears unsound.
Applicant's claims do not stipulate that they are not "fundamentally rule-based or threshold-based." Rather, Applicant's instant amendment amends the independent claims to state that the proxy assessment is performed by determining whether a value (specifically, a difference between the two measured times) exceeds a threshold. As such, Applicant's claims are threshold-based, and apparently rule-based insofar as the use of the "threshold indicative of proxy or VPN usage" may plausibly be deemed a rule. Thus, it is not clear how [3] even constitutes an argument allegedly distinguishing Applicant's claims from the prior art reference Anderson. (Indeed, Anderson does not even teach the precise threshold that Applicant's amendment introduces, so Applicant's claims are more "threshold-based" and "rule-based" than prior art reference Anderson.) In any event, as far as alleging a point of distinction of the instant claims relative to Anderson, [3] is fundamentally incorrect.
As for [4], this statement is incorrect. As thoroughly explained in the "Response to Arguments" ("8. Regarding the rejection under 35 U.S.C. 103") in the previous Office Action (issued 07/28/25), pages 3-10,1 Anderson teaches both
(1) comparing the actual/observed latency of a given communication layer to the baseline/expected latency of the given communication layer … and (2) comparing the actual/observed latency of a given communication layer with the actual/observed latency of a different communication layer …. (Office Action issued 07/28/25, pages 8-9)
Moreover, this explanation in the previous Office Action explicitly indicated that the term "differential latency" refers to "(2) comparing the actual/observed latency of a given communication layer with the actual/observed latency of a different communication layer …": "the terms 'differential latency/different latencies/differences in latencies/ deviations of latencies between/associated with (different) communication layers' refer to (2)." (Office Action issued 07/28/25, page 9) Thus, as per [4] Applicant misrepresents and addresses only partially, and in summary fashion, the substance of the Examiner's response to Applicant's arguments.
As for [5], the Office respectfully disagrees. Anderson teaches:
applying a machine learning model trained on historical network timing data, using as input the measured times from a public node to the application and internet layers, to determine whether a difference between the two measured times … indicative of proxy or VPN usage;
Anderson does not teach:
… exceeds a threshold …;
The rejection in the body of the instant Office Action hereinbelow indicates the specific portions of Anderson that teach the claim language in question.2
As for [6], this reiterates the substance of [3], and accordingly the same counterarguments presented above against [3] apply also to [6].
Applicant further argues:
In contrast, the present specification expressly recites the use of a machine learning model for proxy or VPN detection. Specification, at [0034]; [0051]-[0053]. Independent claim 1 leverages a machine learning model trained on historical network timing data, which enables the system to adapt to evolving proxy and VPN behaviors and to detect sophisticated spoofing attempts that may evade static rule-based systems like Anderson's. Thus, Anderson does not teach or suggest the use of a machine learning model for proxy assessment as claimed, nor does it provide any motivation or reasonable expectation of success for such an approach. (Response, p. 10)
In response:
Again, as indicated above, Anderson does teach the claimed machine learning model limitations other than the specific "threshold" portion thereof (as set forth in the rejection hereinbelow), and hence Anderson does not constitute a "static rule-based system" to any greater extent than Applicant's claims constitute a "static rule-based system."
As indicated above, the "Response to Arguments" ("8. Regarding the rejection under 35 U.S.C. 103") in the previous Office Action (issued 07/28/25), pages 3-10, is reproduced below:
---
Applicant's arguments have been fully considered but they are not persuasive.
The Office responds to Applicant's arguments as follows.
Applicant argues:
However, amended claim 1 does not recite measuring latency times between layers, as in Anderson. Instead, time is measured for a signal between an external "public node" and a respective layer of the user device. …
In contrast to claim 1, the cited portions of Anderson perform a fundamentally different measurement. The measured latencies recited in the cited sections of Anderson (Office Action, at 16) refer to "differential latency between communication layers," "a difference in latency between two or more communication layers" and communications "between particular communication layers." Anderson, at [0023]. Again, Anderson refers measuring latency of data packets traveling between communications layers rather than measuring signal lengths from a public node to an application layer, and a public node to an internet layer.
Applicant misunderstands/misrepresents Anderson. Anderson teaches the claimed subject matter in question.
As best understood, Applicant argues that Anderson teaches measuring a length of time it takes a signal to travel between a first layer and a second layer. However, Anderson does not teach this. Rather, Anderson teaches measuring the time it takes for a signal to travel between a node/endpoint and a given layer. Further Anderson teaches making these measurements for different layers. Further, Anderson teaches comparing such a measurement for a first layer with such a measurement for a second layer, where the first layer can be an application layer and the second layer can be an internet layer. (Anderson also teaches obtaining a baseline or reference of such a measurement for a given layer, and comparing the baseline/reference (also referred to as an "expected") measurement for the given layer with a subsequent actual/observed measurement for the given layer. Further, Anderson teaches carrying out such comparisons for multiple, different layers.)
In order to demonstrate that Anderson indeed teaches this subject matter, an explanation is provided as follows, by explicating an exemplary portion of Anderson, namely, 0048.
(Note in 0048 as reproduced below each sentence is identified by a numeral in brackets, and in some cases portions of a sentence are identified by letters in brackets. These numerals and letters will be referred to in the following discussion. When a numeral / letter is referred to, the reader should bear in mind the underlined part of the corresponding sentence / corresponding portion of the sentence.)
Anderson states:
… [1] In one aspect, [a] the computer system 302 can determine whether one or more of the communication layers 210 are being routed through an intermediary, such as a VPN service 236, [b] by comparing the expected latency between the apparent client 230 and the web service 200 to the observed latency associated with the communication traffic. [2] The computer system 302 can determine the expected latency by directly probing the purported network connecting the client 230 to the computer system 302 through the use of pings and traceroutes, acquiring Border Gateway Protocol (BGP) routing data, or purchasing network latency data from Internet service providers. [3] Using the expected latency data, the computer system 302 can establish a baseline expected latency between the web service 200 and the apparent client 230 (or VPN service 236). [4][a] Differences between the latencies of one or more of the communication layers 210 and the baseline or expected latencies [b] can indicate that computer systems in different locations from the purported client 230 are executing those communication layers 210. [5] In one aspect, the computer system 302 can initiate multiple DNS queries by the DNS resolver 237, observe the latencies between the DNS resolver 237 and the web service 200 over those DNS queries, and compare the observed latencies against the expected latency of such network connections and/or the observed latencies of the other communication layers 210. [6] Utilizing this technique, the computer system 302 can detect whether the DNS resolver 237 is at a different location than the actual client 230, which can in turn indicate that communications from the client 230 are being relayed through a VPN service 236. [7] Accordingly, a computer system 302 executing the process 100 can characterize, at step 108, the illustrated connection configuration when the attributes of the communication layers 210, determined at step 106, indicate that the communication layers 210 are being routed through a VPN service 236 and that the DNS resolver 237 executing the name service layer 220 is being hosted by the VPN service 236. (0048)
As explained above, Anderson determines a baseline/expected latency (i.e., travel time, as further explained below) between the apparent client and the web service ([2], [3]), and then measures an actual/observed latency between the same two points ([5]), and compares the actual/observed latency to the baseline/expected latency ([1][b], [5]). For all of these measurements, at the client endpoint, what is being measured is the time to a particular communication layer of the client ([4]). In addition to comparing the actual/observed latency of a given communication layer to the baseline/expected latency of the given communication layer ([1][b], [5]), Anderson also compares the actual/observed latency of a given communication layer with the actual/observed latency of a different communication layer ([5]).
As also explained above, the expected/baseline latency may be determined by traceroute ([2]). As is well known to one of ordinary skill in the art, traceroute measures the travel time between nodes/endpoints. See, e.g., Sheldon ("traceroute definition") and Fortinet ("What is Traceroute: What Does It Do & How Does It Work?"), as set forth below.
Sheldon ("traceroute definition"):
What is traceroute?
Traceroute is a command-line utility that returns information about the communication route between two nodes on an Internet Protocol (IP) network. The utility sends out User Datagram Protocol (UDP) test packets and tracks their path as they travel from the system where the utility is running -- the source -- to the destination, which might be a server, router or other device on the network.
How traceroute works
When two nodes communicate across the internet or a large private IP network, data packets travel -- or hop -- from one gateway to the next until they reach their destination. Traceroute gathers details about these gateways and generates a list that shows the hostname and IP address of each one, if the information is available. The utility also records the time it took, in milliseconds, for the UDP packet to travel round-trip between the source computer and the specific gateway.
… Traceroute uses this message to determine the round-trip time for the data to travel between the source computer and the first gateway. (pp. 1-3)
Fortinet ("What is Traceroute: What Does It Do & How Does It Work?"):
How To Read a Traceroute Report
Hops and Round Trip Times (RTT)
The traceroute report lists data pertaining to every router the packets pass through as they head to their destination. The hops get numbered on the left side of the report window. Each line in the report has the domain name—if that was included—as well as the IP address belonging to the router.
There are also three measurements of time, displayed in milliseconds. These tell you the length of time to send the ICMP packets from your computer to that router and back.
Typical Hop Sequence
A "hop" refers to the move data makes as it goes from one router to the next. The first hop within the report provides information about the first router, which would be on your local-area network (LAN). The hops that come after provide data about routers controlled by your internet service provider (ISP).
When the ICMP packets get beyond the ISP's domain, they go to the general internet, and you will likely see that the hop times increase, typically due to geographical distance.
…
What Is the Difference Between Ping and Traceroute?
The primary difference between ping and traceroute is that while ping simply tells you if a server is reachable and the time it takes to transmit and receive data, traceroute details the precise route info, router by router, as well as the time it took for each hop. (pp. 2-3)
Thus, when Anderson refers to latencies of communication layers, which latencies can be determined by traceroute (or when Anderson refers to actual/observed latencies, which are being compared with latencies determined by traceroute), Anderson is referring to the travel time between two nodes/endpoints, and, as explained above with reference to Anderson 0048 ([4][b], [5]), at the user device node/endpoint the travel time is being measured to a particular communication layer of the user device.
Thus, Anderson 0048 teaches "for at least two data layers of the user device, measuring a length of time for a signal to travel between a public node from which the signal originates, and the respective data layer of the user device."
Further, Anderson 0048 pertains to a configuration including "application layer 212, … and TCP/IP layer 218" (0048). (Under broadest reasonable interpretation, the TCP/IP layer 218 teaches "an internet layer," as per 0038, second sentence.) Again, Anderson 0023 (which is part of the introduction to the disclosure as a whole and thus pertains to all embodiments) teaches that the TCP/IP model including the four communication layers, namely, application layer, transport layer, Internet layer, and link layer, pertains to the disclosure as a whole.
Therefore, Anderson 0048, 0023 teaches "wherein a first data layer of the at least two data layers of the user device is an application layer, and wherein a second data layer of the at least two data layers is an internet layer."
Further, as noted above, Anderson teaches not only comparing the actual/ observed latency of a given communication layer to the baseline/expected latency of the given communication layer (0048 [1][b], [5]), but also comparing the actual/observed latency of a given communication layer with the actual/observed latency of a different communication layer (0048 [5]). Based on these comparisons of travel times, Anderson determines whether a proxy is being used (0048 [1][a], [4][b], [6], [7], see also Abstract ("proxies")).
Therefore, Anderson 0048 teaches "performing a proxy assessment based on the measured lengths of time."
It should be noted that the limitation "performing a proxy assessment based on the measured lengths of time" does not require comparing latencies of different communication layers, but is taught merely by comparing an actual/observed latency of a given layer to a baseline/expected latency of the same given layer, so long as this is done for multiple different layers, as is indeed taught by Anderson 0048, [4][a] ("Differences between the latencies of one or more of the communication layers 210 and the baseline or expected latencies").
For the sake of completeness, it will be noted that other portions of Anderson also teach both (1) comparing the actual/observed latency of a given communication layer to the baseline/expected latency of the given communication layer (as taught by 0048 [1][b], [5]), for multiple different layers (as taught by 0048 [4]), and (2) comparing the actual/observed latency of a given communication layer with the actual/observed latency of a different communication layer (as taught by 0048 [5]). Examples of such other portions are set forth below, where the term "measured" is used for "actual/observed," and the terms 'differential latency/different latencies/differences in latencies/deviations of latencies between/associated with (different) communication layers' refer to (2).
[0023] … For example, the Internet protocol suite model (also referred to as the TCP/IP model) conceptualizes four communication layers: an application layer, a transport layer, an Internet layer, and a link layer. … The attributes associated with particular communication layers (e.g., latency) or between particular communication layers (e.g., differential latency between communication layers) can be utilized to characterize the connection configuration of the client that is connecting to the web server. The web service provider can then take various actions, such as ending the client session, according to the client connection configuration type.
[0028] The determined attributes can include attributes of individual communication layers (e.g., latency) or attributes between different communication layers (e.g., a difference in latency between two or more communication layers). Differences in the latencies associated with different communication layers can indicate the presence of network relays, which can in turn be utilized to characterize the client connection configuration. … By detecting discrepancies between attributes within individual communication layers or across multiple communication layers, such as … different latencies associated with different communication layers, different latencies with an individual communication than would be expected based on the alleged location of the client 230, … the computer system 302 can detect brokering, mimicry, or relaying of the functions associated with one or more of the communication layers of the client session that are indicative of fraud or the like.
[0038] … The TCP/IP layer 218 can be conceptualized as incorporating one or more functions of the transport layer and/or Internet layer in the Internet protocol suite model. ….
[0039] …. If the TCP/IP layer 218 is being brokered by a service such as a proxy, there can be differences between (i) the latency of the TCP/IP layer 218 and the latencies of one or more of the other communication layers 210 and/or (ii) the measured latency of the TCP/IP layer 218 and the expected latency of the TCP/IP layer 218 given the advertised network endpoint of the client 230.
[0044] … the web service 200 can also measure or compare attributes between the communication layers 210 to characterize the client configuration type. For example, the web service 200 could be programmed to measure latencies associated with the different communication layers 210 and then compare those measured latencies to determine whether the latencies associated with one or more of the communication layers 210 deviate from the other communication layers 210. When the latencies associated with different communication layers 210 deviate from each other, that can indicate that different computer systems in different locations are executing different communication layers 210.
---
This concludes the "Response to Arguments" ("8. Regarding the rejection under 35 U.S.C. 103") in the previous Office Action (issued 07/28/25), pages 3-10.
Claim Objections
Claim 16 is objected to because of the following informalities:
Claim 16 recites:
wherein the third machine learning model is trained on crowd-sourced historical location data associated with prior transactions;
The underlined language is understood to be a clerical error introduced by the instant claim amendments. Note that in the initial step of claim 16 "third" has been amended to "fourth," and that in corresponding claim 7 the corresponding recitation of "third" has been amended to "fourth." In view of the claims and the disclosure, it is understood that Applicant intended, consistently with the remainder of claim 16 and with corresponding claim 7, to recite "fourth" instead of the underlined language "third." Accordingly, the underlined language "third" should be changed to "fourth."
Appropriate correction is required.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-6, 9-15 and 17-20 are rejected under 35 U.S.C. 103 as being unpatentable over Jia et al. (U.S. Patent Application Publication No. 2019/0295088 A1), hereafter Jia, in view of Anderson et al. (U.S. Patent Application Publication No. 2020/0213192 A1), hereafter Anderson, further in view of Schloss (U.S. Patent Application Publication No. 2021/0099426 A1), and further in view of Magruder et al. (WO 2023/230456 A1), hereafter Magruder.
Regarding Claims 1, 13 and 19
Jia teaches:
receiving transaction information associated with a transaction request initiated via a user device, wherein the transaction information is indicative of a request of a user to perform a real-time transaction; (0006-0008, 0056-0057, Fig. 7, 708, 710, 0064-0067, Fig. 8, 806, 0032-0034, Figs. 5-8 (0047-0055) collects behavior data in both the pre-purchase stages and the purchase stage and generates features therefrom (the behavior data and/or the features generated therefrom teach the recited transaction information); the behavior data collected in the purchase stage / features generated therefrom (aka new behavior data/features 0034, 0066) pertain to a current real-time purchase transaction initiated by user (wherein the transaction information is indicative of a request of a user to perform a real-time transaction); examples of this behavior data are given in 0040-0046, Figs. 3-4, 0048, 0049, 0051, 0053, Figs. 5-6, 0056, 0064, Figs. 7-8)
generating a user profile comprising a plurality of transaction characteristics associated with the user, wherein a first transaction characteristic is determined using a second machine learning model …; (0007-0008, 0026, 0032-0034, 0056-0057, 0064-0066 (i) fraud prediction scores (0007-0008), aka fraud risk scores (0026, 0032-0034, 0056-0057, 0064-0066), are generated from behavior data captured during pre-purchase stages, e.g., sign-up and add payment instrument stages (Figs. 5-6), and (ii) purchase history statistics/features (aka 0008 spending history statistics or 0034 historical spending statistics) (see 0058-0062), based on user's prior activity, are generated; (i) and/or (ii) teach the user profile; note that each of (i) and (ii) comprise and are based on multiple (underlying) components (plurality of transaction characteristics associated with the user); regarding wherein a first transaction characteristic is determined using a second machine learning model: 0006-0007, 0026, 0032-0034, 0064-0067, 0086, 0088 score generation component 116 generates features from behavior data (0007, 0034, 0054, 0057, 0065), and inputs the features into machine learning models in order to output a fraud risk score; these features constitute transaction characteristics; 0032, 0040-0043, 0064 the behavior data may include various types of data including device data such as device IP address and device IP geolocation, which device data is comparable to the recited "pattern associated with Wi-Fi Access Point Signals sent to the user device during at least one historical transaction" (see Magruder 00218, cited below); although Jia does not explicitly teach that score generation component 116 uses machine learning to generate the features from the behavior data, it would have been obvious to combine Jia's embodiments such as to have score generation component 116 employ machine learning to generate the features from the behavior data (i.e., use a second machine learning model to determine a first transaction characteristic is), (i) because score generation component 116 already has access to machine learning models at hand and employs them for a related task, namely, a next stage of generating fraud risk scores from the features generated from the behavior data, (ii) because the recited "transaction characteristic" determined by machine learning (namely, "a pattern associated with Wi-Fi Access Point Signals sent to the user device during at least one historical transaction") is similar in nature to the data that score generation component 116 employs machine learning to work on, (iii) because 0101 teaches that Jia's disclosure is not limited to the disclosed embodiments but is amenable to modification without departing from the spirit and scope of the invention, and (iv) per MPEP 2143.I.(A) (Combining prior art elements according to known methods to yield predictable results), (C) (Use of known technique to improve similar devices (methods, or products) in the same way) and (D) (Applying a known technique to a known device (method, or product) ready for improvement to yield predictable results), inasmuch as machine learning is a known element that could be applied to the other task in question (namely, determining a transaction characteristic) to yield predictable results and to improve performance of the other task)
applying a third machine learning model to generate a transaction score based on the plurality of transaction characteristics associated with the user profile and the transaction information, wherein the transaction score is indicative of a fraud determination for the transaction request; and (0057, Fig. 7, 708, 710, 0066-0067, Fig. 8, 806, 0034, 0008 inputs into machine learning model (i) new behavior data captured during the current real-time purchase transaction (or features generated therefrom) (the transaction information) and/or (ii) purchase history statistics/features (aka 0008 spending history statistics or 0034 historical spending statistics) (see 0058-0062) and (iii) fraud risk score(s) generated based on pre-purchase stages (as per "generating" step above, components of (ii) and/or (iii) and/or underlying components on which (ii) and/or (iii) are based teach the plurality of transaction characteristics associated with the user profile), and machine learning model generates as output a purchase-time fraud risk score, i.e., a new fraud risk score indicative of whether the current transaction is fraudulent (transaction score))
blocking the transaction request when the transaction score exceeds a predetermined threshold. (0008, 0035, 0067-0068 blocking/cancelling the transaction based on the score, i.e., if the score is (sufficiently) indicative of fraud, i.e., if the score exceeds the range of scores deemed not (sufficiently) indicative of fraud and lies within the range of scores deemed (sufficiently) indicative of fraud)
Jia does not explicitly disclose but Anderson teaches:
for two data layers of the user device, measuring a length of time for a signal to travel between a public node from which the signal originates, and the respective data layer of the user device, wherein a first data layer of the two data layers of the user device is an application layer, and wherein a second data layer of the two data layers is an internet layer; (Abstract, 0001, 0003, 0005, 0023, 0027-0029, 0038-0039, 0044-0045, 0048 see explanation provided in the Response to Arguments, above)
performing a proxy assessment by comparing the measured length of time for the signal to travel from the public node to the application layer with the measured length of time for the signal to travel from the public node to the internet layer, wherein the proxy assessment comprises applying a first machine learning model trained on historical network timing data and uses the measured length of times as input, to determine whether a difference between the two measured times … indicative of proxy or VPN usage; (Abstract, 0001, 0003, 0005, 0007, 0023, 0027-0029, 0038-0039, 0044-0045, 0048, 0053, Fig. 1, 106-108 see explanation provided in the Response to Arguments, above; note in particular regarding to determine whether a difference between the two measured times … indicative of proxy or VPN usage: note in particular 0045 Anderson's teaching, "measure the various attributes … between the communication layers," includes measuring the travel time to layer A versus measuring the travel time to layer B, i.e., measuring a difference between the travel times to layers A and B, respectively, and Anderson's teaching, "compare the measured attributes to pre-characterized or stored profiles of various types of connection configurations," includes comparing these measurements (i.e., comparing this difference) to expected valid values; in this regard, note that this discussion of 0045 continues: "The correlation/model scoring module 204 can be programmed to utilize various statistical classification techniques for correlating the measured attributes of the communication layers 210 with the connection configuration profiles." -- "statistical classification techniques" typically involve comparison against a threshold to effect classification (where the threshold may be adjusted, e.g., using an ROC curve, to optimize the amount of false positives generated), thus Anderson suggests comparing the difference in travel times (to different layers) against a threshold; note also 0044 "When the latencies associated with different communication layers 210 deviate from each other, that can indicate that different computer systems in different locations are executing different communication layers 210 [i.e., can indicate a proxy or VPN, i.e., a bad actor]." -- note Anderson states that this deviation "can indicate," not that this deviation necessarily does indicate -- this formulation of Anderson suggests that the deviation must be compared against a threshold to determine if the deviation is significant enough to indeed indicate "that different computer systems in different locations are executing different communication layers 210," i.e., to indeed indicate proxy or VPN usage; alternatively, 0039 it would be obvious to combine (i) and (ii), i.e., to apply the idea of (ii) (namely, comparing a difference between a latency value and an expected latency value) to (i) (namely, the difference between the latency of one layer (i.e., travel time to one layer) and the latency of another layer (i.e., travel time to another layer)); likewise 0028 teaches "detecting discrepancies between attributes … across multiple communication layers, such as different types of software applications and/or operating systems executing or associated with different communication layers, different latencies associated with different communication layers, … the computer system 302 can detect brokering, mimicry, or relaying of the functions associated with one or more of the communication layers of the client session that are indicative of fraud or the like."; again (ii) of 0039 can be applied to 0028; regarding wherein the proxy assessment comprises applying a first machine learning model trained on historical network timing data and uses the measured length of times as input: the discussion of 0045 set forth above continues: " In one aspect, the correlation/model scoring module 204 can include a machine-learning system trained via supervised or unsupervised machine-learning techniques to correlate a feature vector of communication layer attributes with a set of connection configuration profiles." -- note here "communication layer attributes" refers to the latencies or other travel time data, thus teaching that the machine learning system has been trained on historical network timing data and uses the measured length of times as input; alternatively, 0029 "In another aspect, the computer system 302, 308 can execute a machine-learning model that has been trained via supervised or unsupervised machine-learning techniques to correlate communication layer attributes [trained on historical network timing data] with one or more client connection types. Accordingly, the determined communication layer attributes can be fed to the machine-learning model [uses the measured length of times as input], which can then output the particular client connection type corresponding thereto.")
… a second transaction characteristic is based on the proxy assessment; (Abstract, 0001, 0003, 0005, 0023, 0027-0029, 0038-0039, 0044-0045, 0048 this limitation follows from the explanation provided in the Response to Arguments, above)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified Jia's systems and methods for detecting and preventing fraudulent transactions, by incorporating therein these teachings of Anderson regarding measuring latency times of/across different communication layers of a TCP/IP stack and based thereon determining the connection configuration/type (e.g., VPN, proxy, malicious actor), because these teachings represent a known and reliable way of detecting behavior that is potentially malicious, fraudulent, etc., and therefore incorporating them in Jia would make Jia's systems and methods more robust for detecting/preventing fraud, based on a wider range of evidence, see Anderson, citations given, see Jia, 0004.
Although as explained above Anderson suggests comparing a difference/ deviation (between travel times to different layers) to a threshold, Anderson does not explicitly state this comparison with a threshold. However, while Jia in view of Anderson does not explicitly disclose the following in its entirety, Schloss teaches:
performing a proxy assessment by comparing …, wherein the proxy assessment … determine whether … exceeds a threshold (Abstract, "error band," "control limit"; 0015 "standard error thresholds"; 0019 "a threshold amount"; 0035 "specified limit value"; 0044-0045 "control limit"; claims 12 and 15 "an acceptable range of times") indicative of proxy or VPN usage; (Abstract, "detecting network traffic tampering by monitoring the network traffic for network packets that arrive outside of an allowable error band and rejecting those packets for which transit times are outside the control limits due to possible tampering"; 0015 "One way to detect these types of attacks is to observe the characteristics of the network packet timing, particularly round-trip packet times between an end user device and a server on the IP-based network. A change in network packet timing outside of standard error thresholds (either much faster or much slower) is indicative of a possible network packet redirection (e.g. an anomaly)"; 0019 "As used herein, a “timing anomaly” refers to an end-to-end or round trip packet time that is greater or less than a baseline metric packet trip time. In some cases, the round-trip packet time may be considered a timing anomaly only if it differs from the baseline metric by a threshold amount."; 0028 thresholds; 0035 "if the round-trip packet time unexpectedly increases beyond a specified limit value, the packet may have been surreptitiously diverted"; 0044-0045 "if the packet round trip time is within the control limits, no further action is required as the packet can be presumed to not have been surreptitiously redirected" (0044); "If the packet transmission time (or round trip time) is outside the defined limits [i.e., control limits], the system takes an action as defined for that specific endpoint pair" (0045); claim 15 "wherein the discrepancy comprises a difference between the calculated packet transmission time and the historical packet transmission time that is not within an acceptable range of times"; see also 0002-0003, 0034, and claims 1, 4, 8 and 10-14, for relevant context; note: although Schloss doesn’t teach measuring a difference between a travel time to an application layer and a travel time to an internet layer, and comparing that difference to a threshold, Schloss teaches round trip travel times and other timing information, and comparing any of this timing data to a threshold, thus teaching comparison with a threshold in the context of Anderson)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Jia's systems and methods for detecting and preventing fraudulent transactions, as modified by Anderson's teachings regarding measuring latency times of/across different communication layers of a TCP/IP stack and based thereon determining the connection configuration/type (e.g., VPN, proxy, malicious actor), by incorporating therein these teachings of Schloss pertaining to determining if an anomaly in transit timing of a packet differs from a baseline metric by a threshold amount, because it provides a practical standard (namely, the threshold) by which to operationalize/render practical Anderson's teachings: that is, in practice, in order to determine if a deviation from a baseline represents an anomaly (i.e., a bad actor, i.e., proxy or VPN usage), it is necessary to provide a threshold (which represents the measure of significant deviation) and to determine if the deviation from the baseline exceeds the threshold, such that insignificant deviations are not treated as anomalies and only significant deviations are determined to be anomalies.
Jia in view of Anderson and Schloss does not explicitly disclose but Magruder teaches:
… wherein a first transaction characteristic is determined using … determining a pattern associated with Wi-Fi Access Point Signals sent to the user device during at least one historical transaction, and …; (00218 note a "set of Wi-Fi access points" indicates a pattern; note as per Magruder throughout, see, e.g., Abstract, the context is during at least one historical transaction)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Jia's systems and methods for detecting and preventing fraudulent transactions, as modified by Anderson's teachings regarding measuring latency times of/across different communication layers of a TCP/IP stack and based thereon determining the connection configuration/type (e.g., VPN, proxy, malicious actor), and as further modified by Schloss's teachings regarding determining if an anomaly in transit timing of a packet differs from a baseline metric by a threshold amount, by incorporating therein these teachings of Magruder pertaining to detecting a pattern associated with Wi-Fi access points, because it would incorporate a more robust set of evidence for making fraud determinations and would improve performance of the system, i.e., improve fraud detection/prevention, see Magruder, e.g., 0069-0075, 0076-0105, see Jia, 0004.
Regarding Claim 2
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 1 as set forth above. Jia further teaches:
wherein the transaction information comprises at least one of: transaction data associated with the user, and information about a device associated with the transaction. (Further to the prior art cited for claims 1, 13 and 19 above, 0006, 0040-0046, Figs. 3-4, 0056, 0064 behavior data collected at pre-transaction stages and at transaction stage (behavior data collected at transaction stage = transaction information) includes, e.g., payment instrument information/shipping location (Fig. 3), email address/device location (Fig. 4), user's purchase history/any data associated with user actions conducted via user account (0046) (transaction data associated with the user), and, e.g., device data (Fig. 4, 0042-0044) (information about a device associated with the transaction))
Regarding Claim 3
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 1 and intervening claim 2 as set forth above. Jia further teaches:
wherein the transaction data associated with the user comprises at least one of: a time of the transaction, a date of the transaction, at least one party associated with the transaction, a product or service associated with the transaction, a location of the transaction, a mode of the transaction, and a transaction history associated with the user. (Further to the prior art cited for claim 2 above, Fig. 4 device location (a location of the transaction), 0046 user's purchase history (transaction history associated with the user), 0046 any data associated with user actions conducted via user account (time of the transaction, a date of the transaction, at least one party associated with the transaction, a product or service associated with the transaction, a location of the transaction, a mode of the transaction, and a transaction history associated with the user))
Regarding Claim 4
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 1 and intervening claim 2 as set forth above. Jia further teaches:
wherein the information about the device comprises at least one of: a type of device, an operating system of the device, a party operating the device, at least one application operating on the device, a location history of the device, a transaction history associated with the device, and wireless information associated with the transaction. (Further to the prior art cited for claim 2 above, 0042 device identifier, i.e., device fingerprint, which indicates the type of device, 0043 IP geolocation (location history of the device), 0043 device IP address (wireless information associated with the transaction), 0044 email address (party operating the device))
Regarding Claim 5
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 1 and intervening claims 2 and 4 as set forth above. Jia further teaches:
wherein the wireless information associated with the transaction comprises at least one of: Wi-Fi information, Wi-Fi Access Point Signal information, and IP data. (0043, 0056, 0064 device IP address)
Regarding Claim 6
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 1 as set forth above. Jia further teaches:
wherein the user profile further comprises a device fingerprint for one or more transactions. (0042, 0056, 0064 the device ID/fingerprint, and more generally the behavior data collected in the pre-purchase stages, may also be deemed part of the user profile; see "generating" step of claims 1, 13 and 19 above for context)
Regarding Claims 9 and 18
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claims 1 and 13 as set forth above. Jia further teaches:
wherein at least one transaction characteristic is a behavioral characteristic associated with at least one of the user and the device. (As cited for the "generating" step of claims 1, 13 and 19 above, purchase history statistics/features (aka 0008 spending history statistics or 0034 historical spending statistics) (see 0058-0062), based on user's prior activity, are generated; these purchase history statistics/features are user behavioral characteristics.)
Regarding Claim 10
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 1 and intervening claim 9 as set forth above. Jia further teaches:
wherein the behavioral characteristic is a transaction pattern relating to at least one of a time, a location, and a type of transaction. (As cited for the "generating" step of claims 1, 13 and 19 above, purchase history statistics/features (aka 0008 spending history statistics or 0034 historical spending statistics) (see 0058-0062), based on user's prior activity, are generated; these purchase history statistics/features are transaction patterns relating to at least one of a time, a location, and a type of transaction.)
Regarding Claim 11
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 1 as set forth above. Jia further teaches:
further comprising updating the user profile with the transaction score. (0056-0062 with every subsequent transaction, the purchase history statistics are updated (0056); the purchase-time fraud risk score of the previous transaction is incorporated into the calculation of the purchase history statistics for the next transaction, and hence is incorporated into the calculation of the purchase-time fraud risk score of the next transaction; recall, as per claim 1, 13 and 19 above, the user profile includes the purchase history statistics, and hence the user profile is updated with the transaction score for each subsequent transaction)
Regarding Claim 12
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 1 as set forth above. Jia further teaches:
further comprising blocking the transaction request when a second transaction score is indicative of fraud. (0008, 0035, 0067-0068)
Regarding Claim 14
Claim 14 is rejected on the same grounds as claims 3 and 4 collectively.
Regarding Claim 15
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 13 as set forth above. Jia further teaches:
wherein the third machine learning model is trained on historical location data associated with one or more prior transactions and associated fraud determinations. (As per the "applying" step of claims 1, 13 and 19 above, the transaction score for the current transaction is generated by a machine learning (ML) model (the second machine learning model) using purchase history statistics/features (aka 0008 spending history statistics or 0034 historical spending statistics) (see 0058-0062) and/or fraud risk score(s) generated based on pre-purchase stages (associated fraud determinations). Note that, as per 0032, 0050, 0057, 0065-0066, while the behavior data collected in pre-purchase stages for generating the fraud risk score may be discarded to conserve storage resources, this discarding is not required (e.g., 0065 "may discard some or all of the behavior data used to create the fraud risk score" -- indicating retention of some of this behavior data); thus, this behavior data may also be retained and used (i.e., in place of / in addition to the fraud risk score, as would be understood by one of ordinary skill in the art in view of Jia's disclosure) to generate the transaction score for the current transaction. As per 0006-0008, 0026, 0032-0034, 0040, 0043, 0056-0062, 0064-0066, this behavior data collected in the pre-purchase stages includes location data of prior transactions (historical location data associated with one or more prior transactions). Thus, the ML model used to generate the transaction score for the current transaction (the second machine learning model) may use historical location data associated with one or more prior transactions and associated fraud determinations. As per 0007, 0033-0034, 0065-0066, the ML models are "suitably trained," i.e., the ML models are trained on the same kind of data that they are to be used on in actual use.
Alternatively, in regard to the historical location data associated with one or more prior transactions, as per 0034 the ML model used to generate the transaction score for the current transaction (the second machine learning model) may be the same as or similar to the ML model used to generate the fraud risk score in the pre-purchase stages. As per 0006-0008, 0026, 0032-0034, 0040, 0043, 0056-0062, 0064-0066, the behavior data collected in the pre-purchase stages includes location data of prior transactions (historical location data associated with one or more prior transactions) and is used by the pre-purchase stage ML model to calculate the fraud risk score in the pre-purchase stages; as per 0007, 0033-0034, 0065-0066, the ML models are "suitably trained," i.e., the ML models are trained on the same kind of data that they are to be used on in actual use. Thus, since the ML model for generating the fraud risk score in the pre-purchase stages is trained using historical location data associated with one or more prior transactions, and the ML model for generating the purchase-time fraud risk score for the current transaction is the same as or similar to the ML model for generating the fraud risk score in the pre-purchase stages, the ML model for generating the purchase-time fraud risk score for the current transaction is also trained using historical location data associated with one or more prior transactions.)
Regarding Claim 17
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 13 as set forth above. Jia further teaches:
wherein at least one transaction characteristic is based on prior transaction activity associated with the user. (As explained in the "generating" step of claims 1, 13 and 19 above, the recited user profile may comprise the set of fraud prediction scores (0007-0008), aka fraud risk scores (0026, 0032-0034, 0056-0057, 0064-0066), and/or purchase history statistics/features (aka 0008 spending history statistics or 0034 historical spending statistics) (see 0058-0062); accordingly, each fraud risk score and/or each purchase history statistic/feature may be one of the recited plurality of transaction characteristics; both the fraud risk score and the purchase history statistics/features are based on prior transaction activity associated with the user)
Regarding Claim 20
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claim 19 as set forth above. Jia further teaches:
wherein the transaction characteristic relates to at least one of IP data, Wi-Fi data, Wi-Fi Access Point Signal data, application data, sensor data, atmospheric pressure data, altitude data, satellite data, fingerprinting data, and fraudulent transaction data. (See prior art cited and explanation provided at claim 17 above. The fraud risk score and/or purchase history statistic/feature (transaction characteristic) relate to the data of past fraudulent transactions (fraudulent transaction data) and to the data of the device (IP data (0043 device IP address), Wi-Fi data (0043 device IP address), Wi-Fi Access Point Signal data (0043 device IP address), application data (is related to any other data of the device), fingerprinting data (0042 device ID/fingerprint)) of the user who performed the pertinent transactions (i.e., the transactions in respect of which behavior data was collected, which behavior data was used to generate the fraud risk scores and purchase history statistics/features))
Claims 7, 8 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Jia et al. (U.S. Patent Application Publication No. 2019/0295088 A1), hereafter Jia, in view of Anderson et al. (U.S. Patent Application Publication No. 2020/0213192 A1), hereafter Anderson, further in view of Schloss (U.S. Patent Application Publication No. 2021/0099426 A1), further in view of Magruder et al. (WO 2023/230456 A1), hereafter Magruder, and further in view of Dutt et al. (U.S. Patent Application Publication No. 2016/0162900 A1), hereafter Dutt.
Regarding Claims 7 and 16
Jia in view of Anderson, Schloss and Magruder teaches the limitations of base claims 1 and 13 as set forth above. Jia further teaches:
wherein a third transaction characteristic is determined by a fourth machine learning model trained to analyze a spoofing metric and the transaction information, (As explained in the "generating" step of claims 1, 13 and 19 above, the recited user profile may comprise, in part or in whole, the set of fraud prediction scores (0007-0008), aka fraud risk scores (0026, 0032-0034, 0056-0057, 0064-0066), generated based on behavior data collected at the pre-purchase stages, and each fraud risk score may be one of the recited plurality of transaction characteristics; per 0007-0008, 0026, 0032-0034, 0056-0057, 0064-0066 one of the fraud risk scores (a second transaction characteristic) may be determined (i.e., generated as output of a machine learning model) by inputting into the machine learning model (i) behavior data collected at a pre-purchase stage, the behavior data including device geolocation (Fig. 3, 312, 0043), which is an indicator of whether the user/device is being spoofed, i.e., a spoofing metric, and (ii) transaction data at a pre-purchase stage, e.g., any transaction-related information, e.g., any of the behavior data mentioned in 0040-0046, Figs. 3-4, 0056, 0064, e.g., 0045 (e.g., credit card information) or 0046 (any data associated with user actions conducted via user account) (the transaction information))
wherein the fourth machine learning model is trained on … historical location data associated with prior transactions. (As per 0006-0008, 0026, 0032-0034, 0040, 0043, 0056-0062, 0064-0066, the behavior data collected in pre-purchase stages includes location data of prior transactions (historical location data associated with prior transactions) and is used to calculate the fraud risk scores for the pre-purchase stages (a second transaction characteristic); as per 0007, 0033-0034, 0065-0066, the machine learning model is "suitably trained," i.e., the machine learning model is trained on the same kind of data that it is to be used on in actual use)
Jia in view of Anderson, Schloss and Magruder does not explicitly disclose but Dutt teaches:
… crowd-sourced …. (claim 11, 0045, 0056 location data of user device, for use in determining whether a transaction is fraudulent / preventing fraudulent transactions, may be crowd-sourced)
It would have been obvious to one of ordinary skill in the art not later than the effective filing date of the claimed invention to have modified the combination of Jia's systems and methods for detecting and preventing fraudulent transactions, as modified by Anderson's teachings regarding measuring latency times of/across different communication layers of a TCP/IP stack and based thereon determining the connection configuration/type (e.g., VPN, proxy, malicious actor), as further modified by Schloss's teachings regarding determining if an anomaly in transit timing of a packet differs from a baseline metric by a threshold amount, and as further modified by Magruder's teachings pertaining to detecting a pattern associated with Wi-Fi access points, by incorporating therein these teachings of Dutt regarding the use of crowd-sourced data, because it would provide additional data/evidence for use in determining whether a transaction is fraudulent, and accordingly would facilitate making such determinations and improve such determinations, see Dutt, citations given, see Jia, 0004.
Regarding Claim 8
Jia in view of Anderson, Schloss, Magruder and Dutt teaches the limitations of base claim 1 and intervening claim 7 as set forth above. Jia further teaches:
wherein the spoofing metric is based on at least one of: an anomaly detection, a Wi-Fi score, a suspicion measurement, a detection score, and a cross-check of historical transactions originating from a same location as the transaction information. (Further to the prior art cited and explanation given for claims 7 and 16 above, the device geolocation (Fig. 3, 312, 0043) (spoofing metric) is a measure of suspicion that the current transaction is fraudulent (suspicion measurement))
Conclusion
The prior art made of record and not relied upon, as set forth in the accompanying Notice of References Cited (PTO-892), is considered pertinent to applicant's disclosure. Among the cited references, Mattei and Einhorn teach subject matter similar to that taught by Jia, and Zoldi and Hammad teach subject matter similar to that taught by Jia, except not that the transaction characteristic is based on a fraud score.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DOUGLAS W PINSKY whose telephone number is (571)272-4131. The examiner can normally be reached on 8:30 am - 5:30 pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jessica Lemieux can be reached on 571-270-3445. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DOUGLAS W PINSKY/
Examiner, Art Unit 3962
/JESSICA LEMIEUX/Supervisory Patent Examiner, Art Unit 3626
1 For the reader's convenience, this "Response to Arguments" section ("8. Regarding the rejection under 35 U.S.C. 103") in the previous Office Action is provided below.
2 The "Response to Arguments" section ("8. Regarding the rejection under 35 U.S.C. 103") in the previous Office Action and provided below should be read as background in order to understand how Anderson teaches the portion of the instant amended claim language that Anderson teaches.
Prosecution Insights