Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed April 27, 2026 have been fully considered but they are not persuasive.
Applicant states that claims 1-6, 8 and 10-20 are pending. Claims 1, 6, 15, 18, and 20 have been amended. Claim 7 has been cancelled. New claim 22 has been added. No new subject matter has been added. In page 2 of the remarks, Applicant states that claims 6 and 15 were rejected under 35 U.S.C. 112(a) as failing to comply with the written description requirement, with Applicant respectfully disagrees with the rejections. With respect to claim 6, as set forth during the Examiner interview Applicant submits that a skilled person would understand how to extract URLs from code using regular expressions, and Applicant submits that it should not be necessary to provide specific examples in the specification of regular expressions in order to comply with the written description requirement. With claim 15, Applicant has amended the claim to remove the limitation "extension impersonation", and requests withdrawal of the 112(a) rejections. As a result of the removal, Examiner withdraws the 112(a) rejections for the claims above.
Next, in pages 3-4 of the remarks, Applicant states that claims 1-8, and 10-20 were previously rejected under 35 U.S.C. 101 because the claimed invention is allegedly directed to an abstract idea without significantly more, as the Examiner alleges that the independent claims recite limitations that are processes that can be performed in the mind, and with pen and paper, respectively. Applicant submits that at least the limitations of analyzing source code as claimed cannot practically be performed in the human mind or with a pen and paper, and thus does not recite a mental process. Examiner agreed during the Examiner interview that at least the limitation of performing a dynamic analysis by running the web browser extension on a host machine is not a mental process, and Applicant therefore submits that the additional limitations, when considered in combination, integrate the alleged abstract idea into a practical application because the claim improves the functioning of a computer or technical field. Applicant states that the rejections under 101 for claims 1-8, and 10-20 should be withdrawn as the limitation of dynamic analysis integrates the judicial exception into a practical application.
Examiner disagrees with the Applicant, as dependent claims that depending on rejected independent claims under U.S.C. 101 are also rejected. Although claim 9’s limitations do not fall under MPEP 2016.05(g), “Insignificant Extra-Solution Activity” on claim 9’s own merits, and have been integrated into the independent claims, the limitation of “generating an indication of risk posed by the web browser extension [...]”, as it still only amounts to a process that can be performed with pen and paper, and still falls under MPEP 2106.04(a)(2), subsection Ill, “Mental Processes”, as the judicial exception is not integrated into a practical application because the recited elements of independent claims 1, 18, and 20 amount to simply implementing the abstract idea on a computer, with claim 18 also reciting a system comprising a processor and a non-transitory computer-readable medium with instructions to be executed by a processor, and claim 20 reciting a non-transitory computer-readable medium. Furthermore, the limitation of “analyzing the source code”, and “generating an indication of risk posed by the web browser extension based on the analysis of the source code” of independent claims 1, 18 and 20 are processes that can be performed in the mind, and with pen and paper, respectively, and therefore, are grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”. Although the Specification of the Applicant describes the process of ‘analyzing the source code’ of the web browser extension in paragraph [0101], Fig. 12, step 1206, as determining one or more permissions granted by the browser extension and each of the assigning a risk category to one or more permissions, which is a process that can be performed in the mind with the assistance of a computer. Furthermore, ‘generating an indication of the risk posed’ is stated in paragraph [0104], Fig. 12, step 1208, as being an overall score calculated based on the risk score and one or more other scores, and the indication of a risk can also be a category of risk, including ‘negligible’, ‘low’, ‘high’, etc. Even with sufficient written description to explain this limitation in the invention, it will still be a mental processes that can be performed with pen and paper, as the indication is an overall score that is calculated using other scores provided, and a person of ordinary skill in the art would be able to assign a category risk based on the result of the indication provided. As a result, the above limitations are still rejected under 35 U.S.C. 101, and dependent claims that rely upon independent claims 1 and 18 are rejected for relying upon their respective independent claims. Dependent claims rely upon independent claims, and are rejected for similar rationale under U.S.C. 101 as well.
Claims 1, 3-4, 12-14, and 16-21 are rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez (US 2015/0007330 A1, hereinafter "Gomez") in view of Dingle et al. (US 9,443,077 B1, hereinafter "Dingle"). Claims 2, 5, 10-11, and 15 are rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez in view of Dingle, and further in view of Aggarwal et al. ("I Spy with My Little Eye: Analysis and Detection of Spying Browser Extensions", hereinafter "Aggarwal"). Claim 6 is rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez in view of Dingle, and further in view of Fernandez et al. (US 2020/0104483, hereinafter, "Fernandez"). Claim 7 is rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez in view of Dingle in view of Aggarwal and further in view of Call et al. (US 2014/0283067 A1, hereinafter "Call"). Claim 8 is rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez in view of Dingle and further in view of Park et al. (US 2017/0169224 A1, hereinafter "Park"). Reconsideration is respectfully requested for at least the following reasons. In particular, Applicant states that Gomez does not disclose performing a ‘dynamic analysis’ as claimed, as Gomez assessing and scores security risks associated with the web browser extension when first installed, at run time, and/or when the web browser extension is updated, as described in paragraph [0022] of Gomez. Applicant submits that performing a static analysis, even if performed at run time, is not a dynamic analysis that determines a behavior of a web browser extension. As for example described at paragraph [0074] of the Specification: "dynamic analysis analyzes the source code by running the web browser extension on a host machine to determine a behaviour of the web browser extension” in page 6 of the remarks. On pages 7-8 of the remarks, Applicant states that the Examiner relies on Dingle as allegedly disclosing "modifying the source code to enable monitoring activity of the web browser extension […]", and Applicant submits that the tracking code contemplated by Dingle is for tracking a flow of the tainted variable during execution of the re-written code, not for determining an execution flow of a web browser extension, as described in [Col. 17, lines 50-55] and [Col. 16, lines 11-22] of Dingle. Applicant has amended the independent claims to recite: "modifying the source code to enable monitoring activity of the web browser extension, comprising adding a coverage function for determining an execution flow of the web browser extension; and performing a dynamic analysis of the modified source code […] to determine a behaviour of the web browser extension and a time and sequence of the execution flow of the web browser extension”. Applicant submits that there is no teaching or suggestion by Dingle of modifying the source code of a web browser extension for tracking an execution flow as claimed, and states that claims 1, 18, and 20 are patentable, and the remaining claims are patentable by virtue of dependency, as well as the additional features recited therein. Applicant requests that the claims 1-6, 8, 10-20, and 22 be rendered allowable over the arguments described by the Applicant.
Examiner states that in the independent claims, the reference of Dingle discloses the limitation, as described in the independent claim 1 of “running the web browser extension with the modified source code on a host machine and a time and sequence of the execution flow of the web browser extension” in the section [Col. 17, lines 50-55] Fig. 4, block 406, tracking code being added during re-writing corresponds to inserting a function call in modifying source code of the browser extension of the Applicant. Tracking code is used to track behavior of the extension, corresponding to enabling determination of an execution flow of the browser extension. Furthermore, in the newly added claim 22, where it is stated that “wherein the dynamic analysis is performed in an isolated analysis environment on the host machine with a modified browser having a patch applied to provide information on activities of the web browser extension”, the reference of Gomez discloses the limitations in paragraph [0022] Assessing security risks associated with the web browser can be conducted when a web browser extension at run time, and [0035] Although a process for library dependencies is described, it can be done by analyzing source code of the extension, and when taking this passage and paragraph [0022] into account, corresponds to the limitation of dynamic analysis of source code by running the extension on the host machine to determine behavior of the extension. As a result of the references teaching the limitations of the amended claims, claims 1, 3-4, 12-14, 16-20, and 22 are rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez in view of Dingle. Claims 2, 5, 10-11, and 15 are rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez in view of Dingle, and further in view of Aggarwal. Claim 6 is rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez in view of Dingle, and further in view of Fernandez. Claim 8 is rejected under 35 U.S.C. 103 as allegedly being unpatentable over Gomez in view of Dingle and further in view of Park.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-8, and 10-21 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
The independent claims 1, 18 and 20 recite ‘analyzing the source code’, and ‘generating an indication of risk posed by the web browser extension based on the analysis of the source code’, which are processes that can be performed in the mind, and with pen and paper, respectively, and therefore, are grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”. This judicial exception is not integrated into a practical application because the recited elements of independent claims 1, 18, and 20 amount to simply implementing the abstract idea on a computer, with claim 18 also reciting a system comprising a processor and a non-transitory computer-readable medium with instructions to be executed by a processor, and claim 20 reciting a non-transitory computer-readable medium. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the addition of ‘obtaining source code of the web browser’ of independent claims 1, 18 and 20 merely amounts to data gathering, as stated in MPEP 2016.05(g), “Insignificant Extra-Solution Activity”.
Dependent claims 2-8, 10-17, 19, and 21 that rely upon independent claims 1 and 18 are rejected for relying upon their respective independent claims. Dependent claims 2-8, 10-17, and 21 depend on independent claim 1, and claim 19 depends on claim 18. As independent claims 1, 18, and 20 are rejected under 35 U.S.C. 101, the dependent claims listed are also rejected as well.
Furthermore, dependent claims 2-8, 13-16, and 19 are also rejected under 35 U.S.C. 101 as they also recite non-statutory subject matter, without adding significantly more to the independent claims.
In claim 2, the recitation of ‘determining one or more permissions’ and ‘assigning a risk category’ are mental processes that can be performed in the mind, and therefore, the elements are grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”.
In claim 3, the recitation of ‘analyzing the source code of the web browser extension… to identify one or more known risky behaviors’ is a mental process that can be performed in the mind, and therefore, the element is grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”.
In claim 4, the recitation of ‘analyzing the source code of the web browser extension… to identify one or more known risky behaviors’ is a mental process that can be performed in the mind, and therefore, the element is grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”.
In claim 5, the recitation of ‘analyzing the source code of the web browser extension… to detect obfuscation in the source code’ is a mental process that can be performed in the mind, and therefore, the element is grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”.
In claim 6, the recitation of ‘extracting one or more URLs from the source code using regular expressions’ merely amounts to data gathering, and therefore, the elements are grouped under data gathering as an insignificant extra-solution activity, as stated in MPEP 2016.05(g), “Insignificant Extra-Solution Activity”.
In claim 8, the recitation of ‘generating a call graph from the source code’, and ‘analyzing the call graph to identify suspicious behaviours’ are mental processes that can be performed in the mind, and therefore, the elements are grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”.
In claim 13, the recitation of ‘obtaining reputability information associated with the web browser extension’, and ‘generating the indication of risk posed by the web browser extension is further based on the reputability information’ merely amounts to data gathering, and therefore, the elements are grouped under data gathering as an insignificant extra-solution activity, as stated in MPEP 2016.05(g), “Insignificant Extra-Solution Activity”.
In claim 14, the recitation of ‘further comprising generating a reputation score based on the reputability information, wherein the reputability information associated with the web browser extension, a popularity of the web browser extension, reviews of the web browser extension, and a publisher of the web browser extension and wherein the indication of risk posed by the web browser extension is further based on the reputation score’ merely amounts to data gathering, and therefore, the elements are grouped under data gathering as an insignificant extra-solution activity, as stated in MPEP 2016.05(g), “Insignificant Extra-Solution Activity”.
In claim 15, the recitation of ‘generating a maliciousness score based on one or more known malicious indicators and/or a signature analysis of a hash of the web browser extension, wherein the one or more known malicious indicators comprise one or more of determining whether the extension was deleted, determining an update URL score, determining domain c2 affiliation, determining an extension impersonation determining whether the extension has been delisted from the webstore, and determining if an update URL has been modified, and wherein the indication of risk posed by the web browser extension is further based on the maliciousness score’ are mental processes that can be performed in the mind, and therefore, the elements are grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”.
In claim 16, the recitation of ‘storing results of the analysis of the source code of the web browser extension’, and ‘the indication of risk posed by the web browser extension’ are mental processes that can be performed in the mind, and therefore, the elements are grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”.
In claim 19, the recitation of ‘determine web browser extensions operating thereon’, and ‘determine the web browser extension to be analyzed from the web browser extensions’ are mental processes that can be performed in the mind, and therefore, the elements are grouped under mental processes, as described in MPEP 2106.04(a)(2), subsection III, “Mental Processes”.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 3-4, 12-14, 16-20, and 22 are rejected under 35 U.S.C. 103 as being unpatentable over Gomez (US 20150007330 A1) in view of Dingle et al. (US 9443077 B1), hereinafter Dingle.
Regarding claim 1, Gomez discloses ‘a method of analyzing a web browser extension, comprising: obtaining source code of the web browser extension’ ([0023] Security risk evaluation of a web browser extension, can be based on source code scan. More information is in paragraph [0047] for Fig. 2, block 210 of extracting source code of a browser extension.);
‘analyzing the source code to determine a risk posed by the web browser extension, comprises:’ ([0048] Fig. 2, block 230, evaluating risks such as in a source code for vulnerabilities is one of several key performance indicators (KPIs));
‘performing a dynamic analysis of the source code by running the web browser extension on a host machine to determine a behaviour of the web browser extension’ ([0022] Assessing security risks associated with the web browser can be conducted when a web browser extension at run time. [0035] Although a process for library dependencies is described, it can be done by analyzing source code of the extension, and when taking this passage and paragraph [0022] into account, corresponds to the limitation of dynamic analysis of source code by running the extension on the host machine to determine behavior of the extension of the applicant.).
‘and generating an indication of risk posed by the web browser extension based on the analysis of the source code’ ([0048] Fig. 2, block 232, security score is computed for the extension.);
Gomez does not appear to disclose, but Dingle teaches the limitation of ‘modifying the source code to enable monitoring activity of the web browser extension, comprising inserting a function call to enable determination of an execution flow of the web browser extension’ ([Col. 17, lines 50-55] Fig. 4, block 406, source code of browser extension is re-written to include tracking code to track behavior of the extension. [Col. 17, lines 50-55] Fig. 4, block 406, tracking code being added during re-writing corresponds to inserting a function call in modifying source code of the browser extension of the Applicant. Tracking code is used to track behavior of the extension, corresponding to enabling determination of an execution flow of the browser extension.);
And “running the web browser extension with the modified source code on a host machine and a time and sequence of the execution flow of the web browser extension” ([Col. 17, lines 50-55] Fig. 4, block 406, tracking code being added during re-writing corresponds to inserting a function call in modifying source code of the browser extension of the Applicant. Tracking code is used to track behavior of the extension, corresponding to enabling determination of an execution flow of the browser extension.);
Accordingly, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, having the teachings of Gomez and Dingle before them, to include Dingle’s ‘modifying the source code to enable monitoring activity of the web browser extension, comprising inserting a function call to enable determination of an execution flow of the web browser extension’ in Gomez’s method performing ‘analyzing a web browser extension’. One would have been motivated to make such a combination to increase security by re-writing code to include information or code to track a flow of a tainted variable during execution, with the tainted variable being a variable that receives or stores personal or otherwise sensitive information, to seed what the browser extension performs and determines whether the extension is malicious, as taught by Dingle [Col. 3, lines 24-28] and [Col. 16, lines 7-11].
Regarding claim 3, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez also discloses the limitation of ‘wherein analyzing the source code of the web browser extension comprises analyzing the source code to identify one or more known risky behaviours’ ([0049] Source code scanning tool can be used to determine a number of identified flaws in a piece of software.).
Regarding claim 4, Gomez in view of Dingle teaches the limitations of claims 1 and 3 as recited above. Gomez also discloses the limitation of ‘wherein the known risky behaviours comprise any one or more of: accessing a malicious webpage, making changes to a document object model, making browser application programming interface calls to gather information, making suspicious network requests, and making phishing requests’ ([0005] A security flaw can be exploited by an intruder to steal, modify, or delete information, such as personal information, credit card numbers, passwords, and other information utilizing flaws in a browser extension. By utilizing flaws in a browser extension, this corresponds to making browser API calls to gather information.).
Regarding claim 12, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez also discloses the limitation of ‘wherein obtaining the source code of the web browser extension comprises: receiving an identifier of the web browser extension’ ([0034] Users can download or otherwise obtain browser extension 20 for installation in web browser 30, and the process can correspond to obtaining an identifier for the web browser extension.);
‘and obtaining the source code from a webstore page using the identifier of the web browser extension’ ([0034] Users can download or otherwise obtain browser extension 20 for installation in web browser 30, and source code can be included with the browser extension.).
Regarding claim 13, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez also discloses the limitation of ‘further comprising obtaining reputability information associated with the web browser extension, and wherein generating the indication of risk posed by the web browser extension is further based on the reputability information’ ([0026] Reputation of the origin of the extension or developer, along with a popularity of the extension are taken into account for a security score that is to be added into an aggregate security score.);
Regarding claim 14, Gomez in view of Dingle teaches the limitations of claims 1 and 13 as recited above. Gomez also discloses the limitation of ‘further comprising generating a reputation score based on the reputability information, wherein the reputability information associated with the web browser extension is based on one or more of a description of the web browser extension, a popularity of the web browser extension, and a publisher of the web browser extension and wherein the indication of risk posed by the web browser extension is further based on the reputation score’ ([0036] A security score can be assigned to a web browser extension 20 based on key performance indicators (KPIs) such as the origin of the extension, such as a developer, popularity of the extension, and the nature of the extension. This corresponds to the publisher, popularity, and description of a web browser extension, respectively. Security score corresponds to the reputation score to indicate risk posed by the browser extension.).
Gomez does not appear to disclose, but Dingle teaches the limitation of ‘reviews of the web browser extension’ ([Col. 8, lines 13-16] Popularity includes reviews for the extension as well.)
Therefore, one of ordinary skill in the art would have been capable of applying this known method of ‘reviews of the web browser extension’ to a method of analyzing a web browser extension and the results would have been predictable to one of ordinary skill in the art. The one of ordinary skill in the art would have been motivated to determine extensions that could contain malware by pulling the most popular extensions first to assist with the malware determination process, as the most popular extensions can potentially contain malicious or suspicious code that is unknowingly downloaded by multiple users to discourage further downloads from occurring if malicious code is found within the extension, as stated by Dingle [Col. 9, lines 40-44].
Regarding claim 16, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez also discloses the limitation of ‘further comprising storing results of the analysis of the source code of the web browser extension and the indication of risk posed by the web browser extension’ ([0051] Method 200 involves storing of the results of the security risk evaluations for further use or analysis, wherein the individual and aggregated KPI scores are stored in a database, and the KPI scores correspond to analysis of a source code of a web browser extension, and the indication of risk of a browser extension.).
Regarding claim 17, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez also discloses the limitation of ‘wherein analyzing the source code of the web browser extension further comprises performing a static analysis of the source code’ ([0038] Static analysis of the source code of web browser extension 20 when source code of a browser extension is available. [0022] Assessing security risks associated with the web browser can be conducted when a web browser extension at run time.).
Regarding claim 18, Gomez in view of Dingle teach the limitations of independent claim 1 above, and the limitations of independent claim 18 are similar to those of claim 1 above. Gomez also discloses ‘a system, comprising: a processor;’ ([0007] A computer-based system for security evaluations of a web browser extension, and a processor is used to execute the processes.);
‘and a non-transitory computer-readable medium having computer-executable instructions stored thereon, which when executed by the processor configure the system to’ ([0007] A non-transitory computer readable storage medium contains instructions and is executable by at least one processor of a computer-based system.):
Regarding claim 19, Gomez in view of Dingle teaches the limitations of claim 18 as recited above. Gomez also discloses the limitation of ‘wherein the system is further configured to communicate with one or more user devices to determine web browser extensions operating thereon, and to determine the web browser extension to be analyzed from the web browser extensions operating on the one or more user devices’ ([0054] Fig. 2, method 200 is to be run on a periodic basis, and can check for updates to an installed browser extension on a computer, and when an update is found, can evaluate the update extension using the process in Fig. 2. Checking for updates to an installed extension and evaluating the updated extension corresponds to determining browser extensions operating, and determining the extension to be analyzed of the Applicant.).
Regarding claim 20, Gomez in view of Dingle teach the limitations of independent claim 1 above, and the limitations of independent claim 20 are similar to those of claim 1 above. Gomez discloses ‘a non-transitory computer-readable medium having computer-executable instructions stored thereon, which when executed by a processor configure the processor to perform a method of analyzing a web browser extension comprising’ ([0007] A non-transitory computer readable storage medium contains instructions and is executable by at least one processor of a computer-based system, wherein the system is utilized for analyzing web browser extensions.):
Regarding claim 22, Gomez in view of Dingle teach the limitations of independent claim 1 above. Gomez also discloses “wherein the dynamic analysis is performed in an isolated analysis environment on the host machine with a modified browser having a patch applied to provide information on activities of the web browser extension” ([0022] Assessing security risks associated with the web browser can be conducted when a web browser extension at run time. [0035] Although a process for library dependencies is described, it can be done by analyzing source code of the extension, and when taking this passage and paragraph [0022] into account, corresponds to the limitation of dynamic analysis of source code by running the extension on the host machine to determine behavior of the extension.).
Claims 2, 5-6, and 10-11 are rejected under 35 U.S.C. 103 as being unpatentable over Gomez in view of Dingle, and further in view of Aggarwal et al. ("I Spy with My Little Eye: Analysis and Detection of Spying Browser Extensions"), hereinafter Aggarwal.
Regarding claim 2, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez in view of Dingle does not appear to disclose, but Aggarwal teaches ‘wherein analyzing the source code of the web browser extension further comprises: determining one or more permissions granted by the web browser extension’ ([pg. 5] In '(1) Accessing sensitive user information', a list of permissions are shown for extensions, such as cookies, tabs, and 'all urls', and prior to this section on the same page, it states that 'we analyze the specific permissions used by extensions to access various privileged Chrome API endpoints', corresponding to determining one or more permissions granted by the browser extension.);
‘and assigning a risk category to each of the one or more permissions’ ([pg. 4] In table 4, the permissions are ranked based on a total percentage of spying extensions that use a permission, and a rank in table 4 corresponds to a risk category to each of one or more permissions of the applicant.);
Accordingly, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, having the teachings of Gomez, Dingle, and Aggarwal before them, to include Aggarwal’s ‘wherein analyzing the source code of the web browser extension comprises: determining one or more permissions granted by the web browser extension’ and ‘and assigning a risk category to each of the one or more permissions’ in Gomez’s method performing ‘analyzing a web browser extension’. One would have been motivated to make such a combination to enhance security by determining which permissions are utilized by an extension to determine what risks are posed by using the extension, and when the permission are determined to be used by the extension, gives a strong indicator that the extension is malicious/spying, as taught by Aggarwal [pg. 5], and permissions are categorized by a rank to determine which permissions are most common amongst malicious extensions, as taught by Aggarwal [pg. 5].
Regarding claim 5, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez in view of Dingle does not appear to disclose, but Aggarwal teaches ‘wherein analyzing the source code of the web browser extension comprises analyzing the source code to detect obfuscation in the source code’ ([pg. 12] In section 'Detection of Malicious Browser Extensions', a method can fail with 'extensions with obfuscated source code', which indicates that source code can contain obfuscations, corresponding to the limitation of the applicant.).
Accordingly, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, having the teachings of Gomez, Dingle, and Aggarwal before them, to include Aggarwal’s ‘wherein analyzing the source code of the web browser extension comprises analyzing the source code to detect obfuscation in the source code’ in Gomez’s method performing ‘analyzing a web browser extension’. One would have been motivated to make such a combination to enhance security by determining that if a browser extension's source code contains obfuscation of its own code, it can indicate that an extension may be a malicious one, as taught by Aggarwal [pg. 12].
Regarding claim 10, Gomez in view of Dingle teaches the limitations of claims 1 as recited above. Gomez in view of Dingle does not appear to disclose, but Aggarwal teaches ‘wherein performing the dynamic analysis comprises executing user scenarios on the host machine while the web browser extension is running, and collecting test logs from one or more sources for analysis’ ([pg. 14] A replay run is performed by using the first 'record' run while running a browser extension, and this is done to execute HTTP requests from the first step, called a live, or 'record' run, in Aggarwal. The results redirects are logged in a replay run, along with the HTTP requests, corresponding to collect test logs of the Applicant.).
Accordingly, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, having the teachings of Gomez, Dingle, and Aggarwal before them, to include Aggarwal’s ‘wherein performing the dynamic analysis comprises executing user scenarios on the host machine while the web browser extension is running, and collecting test logs from one or more sources for analysis’ in Gomez’s method performing ‘analyzing a web browser extension’. One would have been motivated to make such a combination to increases efficiency by having a recorded run be played again, this time with a browser extension being run, and when the replay run has finished, compare the logs of the replay run with those of the initial record run, as taught by Aggarwal [pg. 14].
Regarding claim 11, Gomez in view of Dingle teaches the limitations of claims 1, and 10 as recited above. Gomez in view of Dingle does not appear to disclose, but Aggarwal teaches ‘further comprising creating baseline logs by executing the user scenarios on the host machine without running the web browser extension, and wherein the test logs are compared to the baseline logs in the dynamic analysis’ ([pg. 13-14] A 'record' run can be created, and it is a clean session that is recorded without any extensions being run, and it is devoid of any previous coolies, storage, cache, or browsing history in this phase. In the section of '(2) Verification of Spying Extensions' in page 13, network request logs are automatically generated, wherein the logs created by a 'record run' corresponds to baseline logs of the Applicant. Logs of the 'record run' are compared with the logs of the 'replay run' of Aggarwal, including for changes in client-side storage, and browser API calls made by the extension that is being reviewed.).
Accordingly, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, having the teachings of Gomez, Dingle, and Aggarwal before them, to include Aggarwal’s ‘further comprising creating baseline logs by executing the user scenarios on the host machine without running the web browser extension, and wherein the test logs are compared to the baseline logs in the dynamic analysis’ in Gomez’s method performing ‘analyzing a web browser extension’. One would have been motivated to make such a combination to increases efficiency by running a first run without any other factors, such as a browser running or any other data in a browser, such that comparisons of logs between a first 'record' run and a replay run with a browser running has as little external factors as possible, as taught by Aggarwal [pg. 13-14].
Regarding claim 15, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez also discloses ‘generating a maliciousness score based on one or more known malicious indicators and/or a signature analysis of a hash of the web browser extension, wherein the one or more known malicious indicators comprise one or more of determining an update URL score, and determining if an update URL has been modified, and wherein the indication of risk posed by the web browser extension is further based on the maliciousness score’ ([0057] Updated browser extension can perform method 300 to determine an updated security score in step 380 to check for an update to the web browser extension, and proceeds to evaluate and score the updated web browser extension. [0048] Origin of extension is also stated as a publisher/developer of the extension. Updated score of the web browser extension corresponds to an update score and an update URL score of the extension.).
Gomez in view of Dingle does not appear to disclose, but Aggarwal teaches ‘determining whether the extension was deleted, determining domain c2 affiliation, determining an extension impersonation, determining whether the extension has been delisted from the webstore’ ([pg. 6] Section 4.2, "User Base and Ratings", Web-of-Trust extension was token down for spying, corresponding to a deleted extension and a delisted extension from a webstore. Furthermore, in [pg. 5], Section 4.1 (2), "Storing sensitive user information", spying extensions are shown to store data and have the data accessed by CnC remote server, and is sent to domains, corresponding to determining domain c2 affiliation. [pg. 9] Section 5.3, "Benefits of using API Call Sequence", static features such as file name based signatures can be adapted to bypass defenses involving detection of spying extensions, with file name based signatures being utilized to bypass the defenses.).
Therefore, one of ordinary skill in the art would have been capable of applying this known method of ‘determining whether the extension was deleted, determining domain c2 affiliation, determining an extension impersonation, determining whether the extension has been delisted from the webstore’ to a method of analyzing a web browser extension and the results would have been predictable to one of ordinary skill in the art. The one of ordinary skill in the art would have been motivated to determine extensions that collect user data and communicate with outside sources, and utilizes a Recurrent Neural Network (RNN) to analyze API call sequences and have some 'memory' on how extensions perform to determine which extensions spy on its users, as stated in Aggarwal [pg. 9-10, "RNN Detection Performance"].
Claim 6 are rejected under 35 U.S.C. 103 as being unpatentable over Gomez in view of Dingle as applied to claim 1 above, and further in view of Fernandez et al. (US 20200104483), hereinafter Fernandez, and in view of Call et al. (US 20140283067 A1), hereinafter Call.
Regarding claim 6, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez in view of Dingle does not appear to disclose, but Fernandez teaches ‘wherein analyzing the source code of the web browser extension further comprises: extracting one or more URLs from the source code using regular expressions, and evaluating the one or more URLs’ ([0033] Fig. 1, package analyzer can detect regular expressions, and load remote code if a remote URL is analyzed, corresponding to extracting URLs with regular expressions and evaluating the one or more URLs.);
Therefore, one of ordinary skill in the art would have been capable of applying this known method of ‘wherein analyzing the source code of the web browser extension further comprises: extracting one or more URLs from the source code using regular expressions, and evaluating the one or more URLs’ to a method of analyzing a web browser extension and the results would have been predictable to one of ordinary skill in the art. The one of ordinary skill in the art would have been motivated to analyze the contents and parse the contents of the software extensions against known malware that is located in an external databases to look for similarities in the code and look for common strings in known malware, as stated in Fernandez [0025].
Gomez in view of Dingle further in view of Aggarwal does not appear to disclose, but Call teaches ‘by determining whether each of the one or more URLs are associated with robotic network activity’ ([0005] Source code of a browser plug-in is identified for malicious hidden code that can set up a botnet, and when adapting a botnet to a URL of Aggarwal.)
enhance security by determining that a link is related to a botnet, and when it is detected in the code, can indicate a program as malicious so that the user can understand the content better, as taught by Call [0005].
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Gomez in view of Dingle, and further in view of Park et al. (US 20170169224 A1), hereinafter Park.
Regarding claim 8, Gomez in view of Dingle teaches the limitations of claim 1 as recited above. Gomez in view of Dingle does not appear to disclose, but Park teaches ‘wherein analyzing the source code of the web browser extension further comprises generating a call graph from the source code and analyzing the call graph to identify suspicious behaviours’ ([0069] Call flow graph (CFG) is generated from an analysis of source code, and is then expanded to a graph included to contain malicious code, corresponding to analyzing a graph to identify suspicious behaviors of the applicant.).
Accordingly, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, having the teachings of Gomez, Dingle, and Park before them, to include Park’s ‘wherein analyzing the source code of the web browser extension comprises generating a call graph from the source code and analyzing the call graph to identify suspicious behaviours’ in Gomez’s method performing ‘analyzing a web browser extension’. One would have been motivated to make such a combination to increase efficiency by having a call flow graph mapped out in order to detect malicious code of an application's source code, and is done to visualize the path code takes, as taught by Park [0060].
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TOMMY MARTINEZ whose telephone number is (703)756-5651. The examiner can normally be reached Monday thru Friday ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge L. Ortiz-Criado can be reached at (571) 272-7624 on Monday thru Friday 7AM-7PM ET. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/T.M./ Examiner, Art Unit 2496 /ABU S SHOLEMAN/Primary Examiner, Art Unit 2496
Prosecution Insights