Prosecution Insights
Last updated: April 19, 2026
Application No. 18/795,836

METHOD AND SYSTEM FOR DETECTING LOGIN ANOMALY

Non-Final OA §101§102§103
Filed
Aug 06, 2024
Examiner
GRIJALVA LOBOS, BORIS D
Art Unit
2446
Tech Center
2400 — Computer Networks
Assignee
Hopae Inc.
OA Round
1 (Non-Final)
82%
Grant Probability
Favorable
1-2
OA Rounds
2y 5m
To Grant
99%
With Interview

Examiner Intelligence

Grants 82% — above average
82%
Career Allow Rate
316 granted / 383 resolved
+24.5% vs TC avg
Strong +22% interview lift
Without
With
+22.2%
Interview Lift
resolved cases with interview
Typical timeline
2y 5m
Avg Prosecution
21 currently pending
Career history
404
Total Applications
across all art units

Statute-Specific Performance

§101
12.5%
-27.5% vs TC avg
§103
38.3%
-1.7% vs TC avg
§102
18.5%
-21.5% vs TC avg
§112
20.4%
-19.6% vs TC avg
Black line = Tech Center average estimate • Based on career data from 383 resolved cases

Office Action

§101 §102 §103
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . This Office action is in response to communications filed on 08/06/2024. Claims 1-9 are pending. DETAILED ACTION Claim Interpretation The following is a quotation of 35 U.S.C. 112(f): (f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof. The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph: An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof. The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked. As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph: (A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function; (B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and (C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function. Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function. Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function. Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “a login request management unit” and “an anomaly detection unit” in claim 6. Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-9 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more. The following is the Principles of Law: A patent may be obtained for "any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof'. The Supreme Court has "long held that this provision contains an important implicit exception [:] Laws of nature, natural phenomena, and abstract ideas are not patentable". Under the now familiar two-part test described by the Supreme Court in Alice, “[W]e must first determine whether the claims at issue are directed to a patent-ineligible concept”, such as an abstract idea. Alice Corp. Pty. Ltd. v. CLS Bank Int'l, 134 S. Ct. 2347, 2355 (2014). If so, we must then “consider the elements of each claim both individually and 'as an ordered combination' to determine whether the additional elements 'transform the nature of the claim' into a patent-eligible application. Id. (quoting Mayo, 132 S. Ct. at 1298, 1297). For the reasons set forth below, we find that the claims are directed to the abstract idea of classifying and storing digital images in an organized manner and fail to add an inventive concept sufficient to confer patent eligibility. The examiner is bound by and applies the framework as set forth by the Court in Mayo and reaffirmed by the Court in Alice for determining whether the claims are directed to patent-eligible subject matter. As reference, the examiner relies on the steps outlined by the 2019 Revised Subject Matter Eligibility Guidance published on Monday, January 7, 2019. The steps are as follows: Step one: Are the claims at issue directed to a process, machine, manufacture, or composition of matter? The examiner concludes that claims 1-9 are directed towards statutory subject matter. Step two: Are the claims directed to a law of nature, a natural phenomenon, or an abstract idea? In accordance with judicial precedent, and to increase consistency in examination practice, the 2019 Revised Patent Subject Matter Eligibility Guidance sets forth a procedure to determine whether a claim is ‘‘directed to’’ a judicial exception. The procedures for step two includes two sub-steps: Step 2A: This is a two prong inquiry. In Prong One, examiners evaluate whether the claim recites a judicial exception. Regarding claim 1, the examiner has determined that the limitations include an abstract idea. For example, the limitations recite A method of detecting login anomaly, the method comprising: receiving information on a login request made to a service provision server operating a target service; performing an evaluation of whether the received login request is anomalous using an anomaly detection model; and transmitting information on the evaluation to the service provision server.. The limitations are directed to the abstract idea of “An Idea ‘Of Itself”, see for example FairWarning IP, LLC v. Iatric Systems Inc, in which a system that collected and analyzed data to detect misuse and informed a user of the misuse was found as being directed towards an abstract idea. Further, the idea as a whole could be performed by a human. For example, receiving information could be performed through observation. Evaluation could be performed mentally by using judgement, or opinion, and transmitting information on the evaluation could be performed by forming an opinion and providing the opinion to a recipient. In prong two, the examiners evaluate whether the claim, as a whole, integrates the recited judicial exception into a practical application. To do this, additional elements recited in the claim are identified. The additional elements recited in claim 1 include a service provision server operating a target service. The examiner concludes that the additional elements do not reflect an improvement in the functioning of a computer, or other technology or technical field (the devices, systems, and networks in the claim are simply there to transmit/receive and process information). Transmitting, receiving, and processing information (including operating target services) could be performed by systems that are well-known in the art such as general purpose computing devices. The additional elements also fail to implement the judicial exception with a particular machine or manufacture integral to the claim. As mentioned above, transmitting, receiving, and processing data could be performed by any known computer in the art. The additional elements do not reflect a transformation or reduction of a particular article to a different state. The additional elements do not apply the judicial exception to effect a particular treatment or prophylaxis for a disease or medical condition. The additional elements do not apply the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular technology environment. Therefore, under Step 2A, the claim is found to be directed towards a judicial exception. Step 2B: Does the claim provide an inventive concept? The examiner concludes that the claim lacks specific limitations that are not well-understood, routine, or conventional in the field. The claimed steps not only could be mostly performed mentally, but they could be performed by a general purpose computing device without specialized equipment. Therefore, claim 1 is rejected as being directed towards an abstract idea. Regarding claims 2-4, the claims further limit the subject matter of claim 1, however, the limitations merely recite what the information comprises or how it’s processed (claims 2-3), and how the anomaly detection is performed (claim 4). Therefore, claims 2-4 do not add any features to transform the idea of claim 1 into significantly more than the abstract idea. Therefore, claims 2-4 are rejected as being directed towards an abstract idea. Claim 5 recites “a non-transitory computer-readable recording medium having stored thereon a computer program for executing the method of claim 1”. Performing the idea on a general purpose computer device does not transform the idea into significantly more than the abstract idea. Therefore, claim 5 is rejected as being directed towards an abstract idea. Regarding claims 6-9, the limitations recite features similar in scope to those of claims 1-4. Therefore, claims 6-9 are rejected for the same reasons as set forth in the rejection of claims 1-4, above. Claim Rejections - 35 USC § 102 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention. Claim(s) 1-3 and 5-8 is/are rejected under 35 U.S.C. 102(A)(1) as being anticipated by Rotter et al. (US 20160277439 A1, hereinafter Rotter). Regarding claim 1, Rotter discloses a method of detecting login anomaly (abstract, "methods are provided for […] managing the user authentication account provides heightened measures for authenticating the identity of the user [...]. The client application may also capture information regarding login attempts to the paired user account. The captured information may be sent to the authentication server for providing reports of login attempts and generating alerts to automatically lock the paired account in cases of suspicious behavior"), the method comprising: receiving information on a login request made to a service provision server operating a target service (¶[0064], "A requestor (which may or may not be the authorized user of the account for the client application 250), by means of an authentication application executing on computing device 220, attempts to log into an online user account for a client application 250 (e.g., bank, credit card company, utilities company, social or professional networking site, mobile phone, wireless device, and such) at a customer platform"; ¶[0065], "client application 250 may receive the request at an application server 230 via an API 232"; ¶[0104], "client application 250 may further monitor the activities of the user accounts to capture health related information. The captured information may include every login attempt (success and failed) to the paired and unpaired user accounts. For each login attempt, the client API 232 may capture information including state of user account (e.g., paired, unpaired, locked, unlocked, and such), date and time of the attempt, IP address of the attempt, geo locations of the attempt (i.e., of the user making the attempt), whether attempt was success or failure, and transaction related to successful attempt. The client application 250 may then provide the captured information to the authentication server 240 for further processing. In some embodiments, the client API 232 may send (i.e., publish) the captured information to the authentication server 240. For example, see the publish function in Appendix A. Note, in some embodiments, all personal identifiable information (PII) may be removed from the captured information by the client API 232, prior to sending the captured information to the authentication server 240. The authentication server 240 may capture and depersonalized similar information for every lock/unlock attempt to the paired user account"); performing an evaluation of whether the received login request is anomalous using an anomaly detection model (¶[0107], "authentication server 240 may further process the captured information for unusual patterns of activity experienced by a paired user account"); and transmitting information on the evaluation to the service provision server (¶[0107], "if an account experiences continuous unsuccessful logins or accessed when it is actually in locked status, and the authentication server 240 detects such activity, the authentication server 240 may generate a general alert, which is sent to the authentication application executing on the computing device 220 of the user for display. Alternatively, if the authentication server 240 determines that the activities are severe (e.g., brute force attack to hack into the account), then the authentication server 240 may send a request to the API 232 at the client application 250 to automatically lock the user accounts described above, and update the authentication database 255 accordingly"). Regarding claim 2, Rotter discloses the method of claim 1, wherein the information on the login request includes information on device fingerprint data excluding personal information of a user (¶[0104], "client application 250 may further monitor the activities of the user accounts to capture health related information. The captured information may include every login attempt (success and failed) to the paired and unpaired user accounts. For each login attempt, the client API 232 may capture information including state of user account (e.g., paired, unpaired, locked, unlocked, and such), date and time of the attempt, IP address of the attempt, geo locations of the attempt (i.e., of the user making the attempt), whether attempt was success or failure, and transaction related to successful attempt. The client application 250 may then provide the captured information to the authentication server 240 for further processing. In some embodiments, the client API 232 may send (i.e., publish) the captured information to the authentication server 240. For example, see the publish function in Appendix A. Note, in some embodiments, all personal identifiable information (PII) may be removed from the captured information by the client API 232, prior to sending the captured information to the authentication server 240. The authentication server 240 may capture and depersonalized similar information for every lock/unlock attempt to the paired user account"). Regarding claim 3, Rotter discloses the method of claim 1, wherein receiving the information comprises de-identification processing performed on the information on the login request (¶[0104], "client application 250 may further monitor the activities of the user accounts to capture health related information. The captured information may include every login attempt (success and failed) to the paired and unpaired user accounts. For each login attempt, the client API 232 may capture information including state of user account (e.g., paired, unpaired, locked, unlocked, and such), date and time of the attempt, IP address of the attempt, geo locations of the attempt (i.e., of the user making the attempt), whether attempt was success or failure, and transaction related to successful attempt. The client application 250 may then provide the captured information to the authentication server 240 for further processing. In some embodiments, the client API 232 may send (i.e., publish) the captured information to the authentication server 240. For example, see the publish function in Appendix A. Note, in some embodiments, all personal identifiable information (PII) may be removed from the captured information by the client API 232, prior to sending the captured information to the authentication server 240. The authentication server 240 may capture and depersonalized similar information for every lock/unlock attempt to the paired user account"). Regarding claim 5, Rotter discloses a non-transitory computer-readable recording medium having stored thereon a computer program for executing the method of claim 1 (¶[0039], "FIG. 1B is a block diagram of any internal structure of a computer/computing node (e.g., client processor/device 150 or server computers 160)"; ¶[0041], "The server computers 160 may include instances of the authentication server 240 and customer applications 250 (FIGS. 2A-2B), which can be implemented as a client that communicates to the server 160 utilizing encrypted data packets (e.g. via SSL)" - computer readable mediums storing instructions for execution by one or more processors to perform functions is inherent of computers). Regarding claim 6, Rotter discloses a system to detect login anomaly (abstract, "Systems and methods are provided for […] managing the user authentication account provides heightened measures for authenticating the identity of the user [...]. The client application may also capture information regarding login attempts to the paired user account. The captured information may be sent to the authentication server for providing reports of login attempts and generating alerts to automatically lock the paired account in cases of suspicious behavior"), the system comprising: a login request management unit configured to receive information on a login request made to a service provision server operating a target service (¶[0064], "A requestor (which may or may not be the authorized user of the account for the client application 250), by means of an authentication application executing on computing device 220, attempts to log into an online user account for a client application 250 (e.g., bank, credit card company, utilities company, social or professional networking site, mobile phone, wireless device, and such) at a customer platform"; ¶[0065], "client application 250 may receive the request at an application server 230 via an API 232"; ¶[0104], "client application 250 may further monitor the activities of the user accounts to capture health related information. The captured information may include every login attempt (success and failed) to the paired and unpaired user accounts. For each login attempt, the client API 232 may capture information including state of user account (e.g., paired, unpaired, locked, unlocked, and such), date and time of the attempt, IP address of the attempt, geo locations of the attempt (i.e., of the user making the attempt), whether attempt was success or failure, and transaction related to successful attempt. The client application 250 may then provide the captured information to the authentication server 240 for further processing. In some embodiments, the client API 232 may send (i.e., publish) the captured information to the authentication server 240. For example, see the publish function in Appendix A. Note, in some embodiments, all personal identifiable information (PII) may be removed from the captured information by the client API 232, prior to sending the captured information to the authentication server 240. The authentication server 240 may capture and depersonalized similar information for every lock/unlock attempt to the paired user account"); and an anomaly detection unit configured to perform an evaluation of whether the received login request is anomalous using an anomaly detection model (¶[0107], "authentication server 240 may further process the captured information for unusual patterns of activity experienced by a paired user account"), and transmit information on the evaluation to the service provision server (¶[0107], "if an account experiences continuous unsuccessful logins or accessed when it is actually in locked status, and the authentication server 240 detects such activity, the authentication server 240 may generate a general alert, which is sent to the authentication application executing on the computing device 220 of the user for display. Alternatively, if the authentication server 240 determines that the activities are severe (e.g., brute force attack to hack into the account), then the authentication server 240 may send a request to the API 232 at the client application 250 to automatically lock the user accounts described above, and update the authentication database 255 accordingly"). Regarding claim 7, Rotter discloses the system of claim 6, wherein the information on the login request includes information on device fingerprint data excluding personal information of a user (¶[0104], "client application 250 may further monitor the activities of the user accounts to capture health related information. The captured information may include every login attempt (success and failed) to the paired and unpaired user accounts. For each login attempt, the client API 232 may capture information including state of user account (e.g., paired, unpaired, locked, unlocked, and such), date and time of the attempt, IP address of the attempt, geo locations of the attempt (i.e., of the user making the attempt), whether attempt was success or failure, and transaction related to successful attempt. The client application 250 may then provide the captured information to the authentication server 240 for further processing. In some embodiments, the client API 232 may send (i.e., publish) the captured information to the authentication server 240. For example, see the publish function in Appendix A. Note, in some embodiments, all personal identifiable information (PII) may be removed from the captured information by the client API 232, prior to sending the captured information to the authentication server 240. The authentication server 240 may capture and depersonalized similar information for every lock/unlock attempt to the paired user account"). Regarding claim 8, Rotter discloses the system of claim 6, wherein the login request management unit is configured to perform de-identification processing on the information on the login request (¶[0104], "client application 250 may further monitor the activities of the user accounts to capture health related information. The captured information may include every login attempt (success and failed) to the paired and unpaired user accounts. For each login attempt, the client API 232 may capture information including state of user account (e.g., paired, unpaired, locked, unlocked, and such), date and time of the attempt, IP address of the attempt, geo locations of the attempt (i.e., of the user making the attempt), whether attempt was success or failure, and transaction related to successful attempt. The client application 250 may then provide the captured information to the authentication server 240 for further processing. In some embodiments, the client API 232 may send (i.e., publish) the captured information to the authentication server 240. For example, see the publish function in Appendix A. Note, in some embodiments, all personal identifiable information (PII) may be removed from the captured information by the client API 232, prior to sending the captured information to the authentication server 240. The authentication server 240 may capture and depersonalized similar information for every lock/unlock attempt to the paired user account"). Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claim(s) 4 and 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Rotter (US 20160277439 A1) in view of Ben Dov et al. (US 20250030694 A1, hereinafter Ben Dov). Regarding claim 4, Rotter discloses the method of claim 1. Rotter does not disclose that the anomaly detection model is customized based on attributes of the target service. Ben Dov discloses that anomaly detection model may be customized based on attributes of the target service (¶[0042], "one or more trained Machine Learning (ML) models may be applied to estimate, predict, and/or determine whether a privileged access is valid or potentially fraudulent. The ML model(s), for example, a neural network, a classifier, a Support Vector Machine (SVM), and/or the like may be trained to learn typical patterns of privileged accesses conducted by each user using a plurality of feature vectors created based on the historical data collected for the respective user during a plurality of previous valid privileged accesses to one or more secure resources. The trained ML model(s) may be then deployed to estimate a deviation of one or more privileged accesses conducted by the respective user from the typical privileged access patterns learned for the respective user"; ¶[0106], "access attributes relating to interaction of the user 204 with the user input interfaces of the client device 202 movement parameters may relate to one or more user input interfaces used by the user 204 for actually initiating and/or conducting the privileged access. For example, the access attributes may comprise movement parameters of a mouse used by the user 204 to move a cursor and/or a pointer to one or more certain locations, areas, text fields and/or the like in screen, page, and/or Graphic User Interface (GUI) presented to the user 204 via one or more output user interfaces of the user interface 218, for example, a screen" (i.e., the patterns depend on attributes of the target service such as the location of GUI fields which are provided by the application)). Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Rotter in view of Ben Dov so that the anomaly detection model is customized based on attributes of the target service. One of ordinary skill in the art would have been motivated because it would enable the system to work on multiple platforms without having to manually reprogram the detection model for each platform. Regarding claim 9, Rotter discloses the system of claim 6. Rotter does not disclose that the anomaly detection model is customized based on attributes of the target service. Ben Dov discloses that anomaly detection model may be customized based on attributes of the target service (¶[0042], "one or more trained Machine Learning (ML) models may be applied to estimate, predict, and/or determine whether a privileged access is valid or potentially fraudulent. The ML model(s), for example, a neural network, a classifier, a Support Vector Machine (SVM), and/or the like may be trained to learn typical patterns of privileged accesses conducted by each user using a plurality of feature vectors created based on the historical data collected for the respective user during a plurality of previous valid privileged accesses to one or more secure resources. The trained ML model(s) may be then deployed to estimate a deviation of one or more privileged accesses conducted by the respective user from the typical privileged access patterns learned for the respective user"; ¶[0106], "access attributes relating to interaction of the user 204 with the user input interfaces of the client device 202 movement parameters may relate to one or more user input interfaces used by the user 204 for actually initiating and/or conducting the privileged access. For example, the access attributes may comprise movement parameters of a mouse used by the user 204 to move a cursor and/or a pointer to one or more certain locations, areas, text fields and/or the like in screen, page, and/or Graphic User Interface (GUI) presented to the user 204 via one or more output user interfaces of the user interface 218, for example, a screen" (i.e., the patterns depend on attributes of the target service such as the location of GUI fields which are provided by the application)). Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Rotter in view of Ben Dov so that the anomaly detection model is customized based on attributes of the target service. One of ordinary skill in the art would have been motivated because it would enable the system to work on multiple platforms without having to manually reprogram the detection model for each platform. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: US 20200293638 A1, which discloses "a server device stores attributes of login attempts for a user. Attributes may also be referred to as user activity observations. The attributes can include data associated with historical attempts, successful or unsuccessful, to login to a user account. Examples of attributes can include IP address of device used to attempt to login, location of device used to login, number of unsuccessful attempts to login, type of device used to login, etc. Device information (e.g., geolocation, MAC address, IP address) can be recorded and stored in a database. In some examples, this information can be detected and recorded by the server device operating the application" (¶[0036]) and " confidence scoring is based on observations of historical user login attempts and identifying differences between the historical attributes and attributes for the current login attempt. In some examples, a machine-learning system can be used to formulate a user profile over time and use the profile to predict if certain login attempt behavior is normal or anomalous" (¶[0040]). Any inquiry concerning this communication or earlier communications from the examiner should be directed to BORIS D GRIJALVA LOBOS whose telephone number is (571)272-0767. The examiner can normally be reached M-F 10:30AM to 6:30PM EST. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Brian Gillis can be reached at 571-272-7952. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /BORIS D GRIJALVA LOBOS/ Primary Patent Examiner, Art Unit 2446
Read full office action

Prosecution Timeline

Aug 06, 2024
Application Filed
Jan 22, 2026
Non-Final Rejection — §101, §102, §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12598171
SYSTEMS AND METHODS FOR FAST AND SIMULTANEOUS MULTI-FACTOR AUTHENTICATION USING VECTOR COMPUTING
2y 5m to grant Granted Apr 07, 2026
Patent 12591459
MANAGING USE OF HARDWARE BUNDLES USING CONTROL MECHANISMS
2y 5m to grant Granted Mar 31, 2026
Patent 12591659
METHOD FOR IDENTIFYING POTENTIAL DATA EXFILTRATION ATTACKS IN AT LEAST ONE SOFTWARE PACKAGE
2y 5m to grant Granted Mar 31, 2026
Patent 12591651
DATA STORAGE DEVICE AND METHOD OF ACCESS WITH USER FINGERPRINT
2y 5m to grant Granted Mar 31, 2026
Patent 12574261
TAMPER-PROOF BATCH RECORDS
2y 5m to grant Granted Mar 10, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

1-2
Expected OA Rounds
82%
Grant Probability
99%
With Interview (+22.2%)
2y 5m
Median Time to Grant
Low
PTA Risk
Based on 383 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month