Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to claim(s) 1-20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-6, 11-13, 15-17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Jones (US 2020/0314122) in view of Krishnamurthy (US 2010/0095375)
Regarding Claim 1,
Jones (US 2020/0314122) teaches an information processing apparatus, comprising: at least one processor; a memory in circuit communication with the processor; wherein the processor is configured to execute program instructions stored in the memory to implement:
an information acquisition part configured to acquire suspicious site information;
an element extraction part configured to extract a specified element(s) from the suspicious site information (Paragraph [0055] teaches extracting suspicious strings from suspicious site information)
and a similarity determination part configured to calculate a similarity of character string between a specified domain of a URL in the specified element(s) and a specified domain of a URL of the suspicious site information, or a similarity of between all or any of the specified element(s) to determine whether or not a site related to the suspicious site information is a phishing site based on whether or not the similarity is within a predetermined numerical range (Paragraph [0033] teaches using URL string classification, determining a threshold to determine whether the site is a phishing site)(Paragraph [0055] teaches string match to identify brand mimicry, and determining to what extent the URL string includes text that looks like a brand name even if the characters do not match exactly)
Jones does not explicitly teach acquire suspicious site information from a suspicious site using content from a legitimate site
Krishnamurthy (US 2010/0095375) teaches wherein suspicious site information from a suspicious site using content from a legitimate site (Paragraph [0050-0052] and Fig. 5 teaches phishing site (i.e. suspicious site) uses content from the legitimate site)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the suspicious site of Jones to include content from a legitimate site as taught by Krishnamurthy
The motivation is for the suspicious site to deceive users (Paragraph [0052-0053] of Krishnamurthy)
Regarding Claim 2,
Jones and Krishnamurthy teaches the information processing apparatus according to claim 1. Jones teaches wherein the specified element(s) is a link element(s), and the similarity determination part is configured to calculate the similarity of character string between the specified domain of the URL in the specified element(s) and the specified domain of the URL in the suspicious site information to determine whether or not the site related to the suspicious site information is the phishing site, and wherein the similarity determination part comprises:
an element determination part configured to determine whether or not the URL exists in the specified element(s); and a domain similarity determination part configured to calculate, when the URL exists in the specified element(s), the similarity of character strings between the specified domain of the URL in the specified element(s) and the specified domain of the URL in the suspicious site information, to determine whether or not the site related to the suspicious site information is the phishing site depending on whether or not the similarity is within the predetermined numerical range (Paragraph [0055] teaches string match to identify brand mimicry, and determining to what extent the URL string includes text that looks like a brand name even if the characters do not match exactly).
Regarding Claim 4,
Jones and Krishnamurthy teaches the information processing apparatus according to claim 2. Jones teaches wherein the domain similarity determination part is configured to extract the specified domain of the URL in the specified element(s) and to extract the specified domain of the URL of the suspicious site information (Paragraph [0052-0053, 0056] teaches URL classification extracting domain of URL)
Regarding Claim 5,
Jones and Krishnamurthy teaches the information processing apparatus according to claim 2. Jones teaches further comprising an output part, wherein the domain similarity determination part is configured to determine that the site related to the suspicious site information is highly likely to be the phishing site when the similarity is within the predetermined numerical range (Paragraph [0052-0056] teaches determining domain similarity is likely suspicious), to output a warning indicating that the site related to the suspicious site information is highly likely to be the phishing site from the output part (Fig. 3-4, teaches an alert/warning that indicates the site is malicious).
Regarding Claim 6,
Jones and Krishnamurthy teaches the information processing apparatus according to claim 2. Jones teaches wherein the domain similarity determination part is configured to determine that the site related to the suspicious site information is not the phishing site when the similarity is not within the predetermined numerical range (Paragraph [0025] if the determination does not exceed a phish classification threshold, the URL is determined to be legitimate)
Regarding Claim 11,
Claim 11 is similar in scope to Claim 1 and is rejected for a similar rationale.
Regarding Claims 12-13, 15-17,
Claims 12-13, 15-17 are similar in scope to Claims 1-2, 5-6 and is rejected for a similar rationale.
Regarding Claim 3,
Jones and Krishnamurthy teaches the information processing apparatus according to claim 2. Jones teaches but does not explicitly teach wherein the element determination part is configured to determine that the site related to the suspicious site information is not the phishing site when the URL does not exist in the specified element(s), or when the element extraction part does not extract the specified element(s).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify Jones to determine a site is not a phishing site when a URL doesn’t exist and the results would be predictable (i.e. there could be no phishing URL if there is no URL)
Regarding Claim 21,
Jones and Krishnamurthy teaches the information processing apparatus according to claim 1, but does not explicitly teach wherein the similarity determination part is configured to determine that the suspicious site(s) is not the phishing site(s) when the similarity indicates that the specified domain of the URL in the specified element(s) and the specified domain of the URL of the suspicious site(s) itself are the same.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify Jones to determine a site is not phishing if the URL in the specified elements and the URL of the domain are exactly the same (i.e. if the suspicious site URL and the brand URL are exactly the same then there is no phishing)
Claim(s) 7-10, 14, 18-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Jones and Krishnamurthy in view of Taniguchi (US 2023/0388342)
Regarding Claim 7,
Jones and Krishnamurthy teaches the information processing apparatus according to claim 1. Jones teaches, wherein the specified element(s) is any of link element(s), relative path(s) and character string(s), and the similarity determination part is configured to calculate the similarity between character string(s) and all or any of the specified elements to determine whether or not the site related to the suspicious site information is the phishing site based on whether or not the similarity is within the predetermined numerical range, and wherein the similarity determination part comprises(Paragraph [0055] teaches string match to identify brand mimicry, and determining to what extent the URL string includes text that looks like a brand name even if the characters do not match exactly):
Jones does not explicitly teach an element completion part configured to complete a relative path(s) when the specified element(s) has the relative path(s) so that the relative path(s) becomes the URL;
and an element similarity determination part configured to calculate the similarity of character strings between all or any of the predetermined elements after the completion to determine whether or not the site related to the suspicious site information is the phishing site depending on whether or not the similarity is within the predetermined numerical range.
Taniguchi (US 2023/0388342) teaches an element completion part configured to complete a relative path(s) when the specified element(s) has the relative path(s) so that the relative path(s) becomes the URL;
and an element similarity determination part configured to calculate the similarity of character strings between all or any of the predetermined elements after the completion to determine whether or not the site related to the suspicious site information is the phishing site depending on whether or not the similarity is within the predetermined numerical range (Paragraph [0051-0052] and Fig. 5, teaches completing a partial character string of a selected phishing site URL)(Paragraph [0040] teaches the phishing string is similar to a legitimate domain name)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the phishing detection method of Jones to include the URL completion method of Taniguchi
The motivation is to prevent phishing scams (Paragraph [0026] of Taniguchi)
Regarding Claim 8,
Jones and Taniguchi teaches the information processing apparatus according to claim 7. Taniguchi teaches wherein the element similarity determination part is configured to extract the specified domain of the URL in the specified element(s) (Paragraph [0043-0046])
Regarding Claim 9,
Jones and Taniguchi teaches the information processing apparatus according to claim 7. Jones teaches further comprising an output part, wherein the element similarity determination part is configured to determine that the site related to the suspicious site information is highly likely to be the phishing site when the similarity is within the predetermined numerical range, and to output a warning indicating that the site related to the suspicious site information is highly likely to be the phishing site from the output part (Paragraph [0052-0056] teaches determining domain similarity is likely suspicious), (Fig. 3-4, teaches an alert/warning that indicates the site is malicious).
Regarding Claim 10,
Jones and Taniguchi teaches the information processing apparatus according to claim 7. Jones teaches wherein the element similarity determination part is configured to determine that the site related to the suspicious site information is not the phishing site when the similarity is not within the predetermined numerical range (Paragraph [0025] if the determination does not exceed a phish classification threshold, the URL is determined to be legitimate)
Regarding Claim 14, 18
Claims 14, 18 is similar in scope to claim 7 and is rejected for a similar rationale.
Regarding Claims 19-20,
Claims 19-20 are similar in scope to Claims 9-10 and are rejected for a similar rationale.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HARRIS C WANG whose telephone number is (571)270-1462. The examiner can normally be reached M-F 9:00-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, LUU PHAM can be reached at 571-270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HARRIS C WANG/Primary Examiner, Art Unit 2439
Prosecution Insights