DETAILED ACTION
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This Office Action is in response to the communication filed on 07/29/2024.
Claims 1-20 are pending for consideration.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Specification
The lengthy specification has not been checked to the extent necessary to determine the presence of all possible minor errors. Applicant’s cooperation is requested in correcting any errors of which applicant may become aware in the specification.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 8-9, and 15-16 are rejected under 35 U.S.C. 103 as being unpatentable over Sixta et al. (US 12,381,914)(hereinafter Sixta) in view of Xu et al. (US 10,896,018)(hereinafter Xu).
Regarding claim 1, Sixta teaches a network component (Sixta: see Fig. 2 item 102) comprising one or more processors (Sixta: see Fig. 2 item 202) and one or more computer-readable non-transitory storage media coupled to the one or more processors and including instructions that, when executed by the one or more processors, cause the network component to perform operations (Sixta: see Fig. 2 item 206) comprising: rendering each of a plurality of emails to generate a plurality of images (Sixta: see Col 5 lines 55-58, "In some cases, the techniques described herein include determining image data for the email. In some cases, the image data for the email includes each image generated by rendering a markup payload of the email"); processing each of the plurality of images to generate a plurality of processed images (Sixta: see Col 3 lines 28-32, " In some cases, given an email associated with P markup payloads, the email security system generates image data that includes P rendered images, where each rendered image is the output of rendering one of the P markup payloads").
However, Sixta fails to teach extracting a plurality of features from each of the plurality of processed images; encoding the plurality of features into a vector for each of the plurality of processed images to generate a plurality of vectors; and determining whether two or more of the plurality of vectors are visually similar.
Nevertheless, Xu-which is in the same field of endeavor- teaches extracting a plurality of features from each of the plurality of processed images (Xu: see Col 13 lines 44-47, "providing the image for processing through an image model, the image model providing an initial set of features, each feature in the initial set of features being representative of the image"); encoding the plurality of features into a vector for each of the plurality of processed images to generate a plurality of vectors ((Xu: see Col 13 lines 39-42, "processing, by the one or more processors, the image to generate a vector, the vector comprising features representative of the image, at least one feature representing one of more keywords of the image"); and determining whether two or more of the plurality of vectors are visually similar (Xu: see Col 8 lines 23-29, "In some implementations, the vector module 212 provides the image vector to the comparison module 214. In some examples, the comparison module 214 compares the image vector to known vectors of the known vector DB 216. In some examples, the image vector is compared to known vectors in an effort to identify at least one known vector that is determined to be sufficiently similar to the image vector").
Sixta and Xu are analogous art because they are from the same field of endeavor, image feature rendering and detection. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to use the image generated by Sixta with Xu’s vector encoding to determine the similarity between images. The suggestion/motivation for doing so would be to detect a social engineering attack; specifically attacks that utilize trusted icons, logos or information to convince a user to interact with the attack.
Regarding claim 8, claim 8 is drawn to the method corresponding to the product same as claimed in claim 1. Therefore, method claim 8 corresponds to product claim 1 and is rejected for the same reasons of motivation/combination of references used above.
Regarding claim 15, claim 15 is drawn to the product corresponding to the product same as claimed in claim 1. Therefore, product claim 15 corresponds to product claim 1 and is rejected for the same reasons of motivation/combination of references used above.
Regarding claim 2, Sixta and Xu teach rendering a HyperText Markup Language (HTML) source for each of the plurality of emails (Sixta: see Col 5 lines 62-64, "In some cases, to determine the image data for the email, the email security system renders a markup payload (e.g., an HTML payload) of the email"; Col 6 lines 13-20, "In some cases, to render a markup payload of an email, the email security system renders a webpage based on the markup payload and captures a screenshot of the webpage. In some cases, to render a markup payload of the email, the email security system renders a webpage based on the markup payload and prints the webpage into an image-based file (e.g., into a Joint Photographic Experts Group (JPEG) file, into a PDF file, and/or the like)").Motivation to combine Sixta and Xu, in the instant claim, is the same as that in claim 1.
Regarding claim 9, claim 9 is drawn to the method corresponding to the product same as claimed in claim 2. Therefore, method claim 9 corresponds to product claim 2 and is rejected for the same reasons of motivation/combination of references used above.
Regarding claim 16, claim 16 is drawn to the product corresponding to the product same as claimed in claim 2. Therefore, product claim 16 corresponds to product claim 1 and is rejected for the same reasons of motivation/combination of references used above.
Claims 3-4, 10-11, and 17-18 are rejected under 35 U.S.C. 103 as being unpatentable over Sixta and Xu, as applied above, and in further view of Choudhary et al. (US 12,020, 484)(hereinafter Choudhary).
Regarding claim 3, Sixta and Xu teach the invention detailed above.
However, Sixta and Xu fail to teach each of the plurality of vectors captures a numerical representation of visual elements embedded within a single email.
Nevertheless, Choudhary-which is in the same field of endeavor- teaches each of the plurality of vectors captures a numerical representation of visual elements embedded within a single email (Choudhary: see Col 10 lines 6-13, "The summarization of the extracted features by the dense layer allows the neural network processor 103 to generate an n-dimensional feature vector. In an example, if the 1-D array, representing the normalized pixel values of the reference image, at the input layer of the neural network model is of 3×32×32 dimensions, the dense layer may generate a 128-dimensional feature vector of the reference image").
Sixta, Xu, and Choudhary are analogous art because they are from the same field of endeavor, image detection utilizing clustering techniques. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to use numerical representations of the vectors generated by Sixta and Xu when determining similarities between images. The suggestion/motivation for doing so would be to improve the efficiency and scalability of the matching technique.
Regarding claim 10, claim 10 is drawn to the method corresponding to the product same as claimed in claim 3. Therefore, method claim 10 corresponds to product claim 3 and is rejected for the same reasons of motivation/combination of references used above.
Regarding claim 17, claim 17 is drawn to the product corresponding to the product same as claimed in claim 3. Therefore, product claim 17 corresponds to product claim 3 and is rejected for the same reasons of motivation/combination of references used above.
Regarding claim 4, Sixta, Xu and Choudhary teach grouping two or more of the plurality of vectors that are visually similar together using a clustering algorithm or a similarity threshold). Motivation to combine Sixta, Xu and Choudhary, in the instant claim, is the same as that in claim 3.
Regarding claim 11, claim 11 is drawn to the method corresponding to the product same as claimed in claim 4. Therefore, method claim 11 corresponds to product claim 4 and is rejected for the same reasons of motivation/combination of references used above.
Regarding claim 18, claim 18 is drawn to the product corresponding to the product same as claimed in claim 4. Therefore, product claim 18 corresponds to product claim 4 and is rejected for the same reasons of motivation/combination of references used above.
Claims 5, 12, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Sixta, Xu, and Choudhary, as applied to claims 3-4, 10-11, and 17-18, and in further view of Kalman (US 8,260,078)(hereinafter Kalman).
Regarding claim 5, Sixta, Xu, and Choudhary teach normalizing each of the plurality of images to modify pixel values to adhere to a particular range and distribution (Choudhary: see Col 17 lines 54-56, "The pixel values of each of the plurality of images may be normalized such that the pixel values fall in the range 0-1").
However, Sixta, Xu, and Choudhary fail to teach sharpening each of the plurality of images to accentuate edges and intricate details.
Nevertheless, Kalman-which is in the same field of endeavor- teaches sharpening each of the plurality of images to accentuate edges and intricate details (Kalman: see Col 1 lines 65-67- Col 2 lines 1-4, "For example, sharpening artifacts known as "bright overshoot" and "dark undershoot," known collectively as "overshoot," may be introduced into the digital image by the sharpening filter within regions of the digital image that rapidly transition from a bright area to a dark area. Such a region may be indicative of an edge between different objects represented by the digital image").
Sixta, Xu, Choudhary, and Kalman are analogous art because they are from the same field of endeavor, image analysis and enhancement. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to utilize Choudhary’s method for normalization of image pixels with Kalman’s method for sharpening the image. The suggestion/motivation for doing so would be to improve the accuracy of the detection system by sharpening edges and details that will be used when determining similarities.
Regarding claim 12, claim 12 is drawn to the method corresponding to the product same as claimed in claim 5. Therefore, method claim 12 corresponds to product claim 5 and is rejected for the same reasons of motivation/combination of references used above.
Regarding claim 19, claim 19 is drawn to the product corresponding to the product same as claimed in claim 5. Therefore, product claim 19 corresponds to product claim 5 and is rejected for the same reasons of motivation/combination of references used above.
Claims 6, 13, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Sixta and Xu, as applied to claims 1, 8, and 15, and in further view of Nutt et al. (US 10,027,610)(hereinafter Nutt).
Regarding claim 6, Sixta and Xu teach the invention detailed above.
However, Sixta and Xu fail to teach cropping each of the plurality of images to eliminate outer segments, the outer segments including an email header and redundant spaces surrounding a body of each of the plurality of images.
Nevertheless, Nutt-which is in the same field of endeavor- teaches cropping each of the plurality of images to eliminate outer segments, the outer segments including an email header and redundant spaces surrounding a body of each of the plurality of images (Nutt: see Col 2 lines 1-5, "Some example embodiments could include embodiments where cropping an image includes at least loading the content source, crop the image, identify any html tags, crop the html tags, locate coordinates and dimensions of any links within the content source").
Sixta, Xu, and Nutt are analogous art because they are from the same field of endeavor, image analysis and enhancement. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to utilize Nutt’s method for cropping the image generated by Sixta and Xu . The suggestion/motivation for doing so would be to make smaller or closer similarity thresholds by focusing on specific areas.
Regarding claim 13, claim 13 is drawn to the method corresponding to the product same as claimed in claim 6. Therefore, method claim 13 corresponds to product claim 6 and is rejected for the same reasons of motivation/combination of references used above.
Regarding claim 20, claim 20 is drawn to the product corresponding to the product same as claimed in claim 6. Therefore, product claim 20 corresponds to product claim 6 and is rejected for the same reasons of motivation/combination of references used above.
Claims 7 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Sixta and Xu, as applied to claims 1, 8, and 15 and in further view of Luo et al. (US 12,333,394)(hereinafter Luo).
Regarding claim 7, Sixta and Xu teach the invention detailed above.
However, Sixta and Xu fail to teach the plurality of emails comprise historic emails and new emails; the historic emails represent emails that have been manually reclassified to include correct labels, the correct labels comprising spam, phishing, and graymail labels; and the plurality of new emails have been filtered to only include emails with one or more visual components.
Nevertheless, Luo-which is in the same field of endeavor- teaches the plurality of emails comprise historic emails and new emails; the historic emails represent emails that have been manually reclassified to include correct labels (Luo: see Col 27 lines 8-17, "receiving a labeled cluster comprising an email-category label and seed data; assigning the email-category label to the unlabeled email based on a first derivative edge in an expansion graph thereby creating a labeled email, wherein the first derivative edge is a directional edge from the labeled cluster to the feature and the first derivative edge represents first inference logic that the email-category label associated with the labeled cluster is also associated with the unlabeled email"; Col 27 claim 4, " the seed data comprise a previously labeled email, a denylist, an allowlist, or a communication graph"), the correct labels comprising spam, phishing, and graymail labels (Luo: see Col 5 lines 22-34, "...It may be a “spam” email which is electronic junk mail that is unsolicited and often contains advertising from some product. The email 104 may be a “phishing” email which is a fraudulent email falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private information that will be used for identity theft or other crime. “Bulk” email is another possibility for the email 104. Bulk email is email that is sent to large groups at once. It is typically comprised of advertising or marketing messages that are sent as mass email"; Col 8 lines 38-42, "These initial labels may be referred to as “seeds” because they provide a starting point for creating a cluster of emails or of email features that are similar, and thus, are believed to be associated with the same label (e.g., good, spam, bulk email, etc.)"); and the plurality of new emails have been filtered to only include emails with one or more visual components (Luo: see Col 8 lines 45-49, "At 304, unlabeled emails are received. These unlabeled emails may be emails that already exist within an email system. The unlabeled emails may include but are not limited to newly received emails that have come into an email system from an external network"; Col 11 lines 3-10, "FIG. 7 shows a different use of clustering in which various features of an unlabeled email 700 are used to provide potential labels for the unlabeled email 700. Labels may be associated with the unlabeled email 700 based on clusters to which features of the unlabeled email 700 belong. In this example, the clusters are labeled email addresses 702, labeled host servers 704, labeled URLs 706, and labeled fingerprints 708").
Sixta, Xu, and Luo are analogous art because they are from the same field of endeavor, privacy preservation of email communications. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to utilize Luo’s method of utilizing previously categorized emails to categorize unlabeled emails. The suggestion/motivation for doing so would be to continuously train a system to identify different categories of emails.
Regarding claim 14, claim 14 is drawn to the method corresponding to the product same as claimed in claim 7. Therefore, method claim 14 corresponds to product claim 7 and is rejected for the same reasons of motivation/combination of references used above.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KELAH JANAE MCFARLAND-BARNES whose telephone number is (571)272-5953. The examiner can normally be reached Monday through Friday 8:00am until 4:00pm Central Time.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn D Feild can be reached at 571-272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KELAH JANAE MCFARLAND-BARNES/Examiner, Art Unit 2431
/LYNN D FEILD/Supervisory Patent Examiner, Art Unit 2431