Prosecution Insights
Last updated: April 19, 2026
Application No. 18/882,986

DETECTION OF ANOMALOUS DATA EXFILTRATION USING INTELLIGENT DETECTION THRESHOLDS

Non-Final OA §101§DP
Filed
Sep 12, 2024
Examiner
NAHAR, SAYEDA S
Art Unit
2435
Tech Center
2400 — Computer Networks
Assignee
Rapid7 Inc.
OA Round
1 (Non-Final)
67%
Grant Probability
Favorable
1-2
OA Rounds
3y 5m
To Grant
99%
With Interview

Examiner Intelligence

Grants 67% — above average
67%
Career Allow Rate
18 granted / 27 resolved
+8.7% vs TC avg
Strong +36% interview lift
Without
With
+35.8%
Interview Lift
resolved cases with interview
Typical timeline
3y 5m
Avg Prosecution
25 currently pending
Career history
52
Total Applications
across all art units

Statute-Specific Performance

§101
14.0%
-26.0% vs TC avg
§103
61.6%
+21.6% vs TC avg
§102
4.4%
-35.6% vs TC avg
§112
17.6%
-22.4% vs TC avg
Black line = Tech Center average estimate • Based on career data from 27 resolved cases

Office Action

§101 §DP
Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Detail Action This office action is response to the application filed on . Claims 21-40 are pending in this communication. Double Patenting The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969). A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b). The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13. The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer. Claim 21 is rejected on the ground of nonstatutory double patenting as being unpatentable over claim 1,10 and 17 of Application No. 17577444 of Shivamoggi et al. (US Pat No. 12120136 B1). Regarding claim 21, A system, comprising: one or more computer systems that implement an anomalous data transfer detection system, (‘444: claim 1, “A system, comprising: one or more hardware processors with associated memory that implement anomalous data transfer detection,”) store, in a table, values indicating previous amounts of data transferred from an asset observed for previous periods; determine a data transfer threshold for the asset, including to: sort rows in the table in descending order according to the values; (‘444: claim 1, “sorting the individual hours of the individual days into a table of rows, in descending order according to the calculated logarithmic values”) determine, for each row of the table: (a) a median value of the row and all higher rows of the row in the table, and (b) a derivative value of the median value at the row; identify a set of local maxima based on respective derivative values of the rows; select a local maximum from the set as the data transfer threshold; (‘444: claim 1, “computing, for each individual row in the table, median values based on the calculated logarithmic values for a particular individual row and each higher row in the table; calculating, for each individual row in the table, derivative values based on a difference between the computed median value associated with the particular individual row and the computed median value associated with a next higher row in the table; identifying all local maxima in the derivative values; filtering the local maxima that exceed a derivative value threshold; and identifying the hotspot threshold associated with the particular asset as a particular local maximum having the largest calculated logarithmic value;”) in response to detection of an amount of data transfer from the asset that meets a detection condition based on the data transfer threshold, generate an alert indicating an anomalous data transfer event associated with the asset. (‘444: claim 1, “responsive to detecting the anomalous data transfer activity, generate an alert associated with the particular asset.”) Claims 29 is rejected on the ground of nonstatutory double patenting as being unpatentable over claim 5 of Application No. 17577444 of Shivamoggi et al. (US Pat No. 12120136 B1). Regarding claim 29, The system of claim 21, wherein the detection condition is based on an interquartile range applied to the data transfer threshold. (‘444: claim 5, “calculate, for the hotspots, the one or more statistics, wherein the calculated statistics include at least a median value and an interquartile range (IQR) value that are utilized to define a baseline value;”) Therefore, although the claims at issue are not identical, they are not patentably distinct from each other for the reasons above. Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 21-40 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more analyzed according to MPEP 2106. Step 1: The independent claims 21 and 31 do fall into one of the four statutory categories of “method”, and “system” claims. Nevertheless, the claim(s) still is/are considered as abstract idea (i.e., Mental process) for the following prongs and reasons. Step 2A: Prong 1: The limitations of the independent claims 21 and 31 recite the abstract idea of: determine a data transfer …. for the asset, store, in a table, values indicating previous amounts of data transferred from an asset observed for previous periods; (Mental process: a human stores values in a table indicating previous amounts of data transferred observed for previous periods) sort rows in the table in descending order according to the values; determine, for each row of the table: (a) a median value of the row and all higher rows of the row in the table, and (b) a derivative value of the median value at the row; identify a set of local maxima based on respective derivative values of the rows; select a local maximum …... (which is both mathematical formulas or equations and/or mathematical calculations and thus grouped as mathematical concepts, and which is also an observation and evaluation, which is a concept performed in the human mind and thus also grouped as Mental processes: a human sorts values in a table and calculates a median value, derivative value, a set of local maxima and a local maximum) 3. in response to detection of an amount of data transfer ….. generate an alert ….. (Mental process: a human generates an alert) The claim generically recites the concept of receiving/determining and storing data, and calculating/determining the received data which fall into an Abstract Idea category of “Mental Processes”, i.e., concepts performed in the human mind (including an observation, evaluation, judgment, opinion) which under its broadest reasonable interpretation, covers performance of the limitations in the human mind and / or with pen and paper. For example, the recited steps of claims can all be performed by a human-being responsible to receive an amount of values/data transferred from an asset/another human-being and calculates a median value, derivative value, a set of local maxima and a local maximum. Examiner would like to note that the recitation of generic computer components in a claim does not preclude that claim from reciting an abstract idea. For instance, if a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it is still in the mental processes grouping unless the claim limitation cannot practically be performed in the mind. Step 2A: Prong 2: The judicial exception (i.e., a method implemented using one or more computer systems) are not integrated into a practical application. In particular, the claims do not recite any additional element to perform beyond storing and calculating steps. To show that the involvement of a computer assists in improving the technology, the claims must recite the details regarding how a computer aids the method, the extent to which the computer aids the method, or the significance of a computer to the performance of the method. Merely adding generic computer components to perform the method is not sufficient. Thus, the claim must include more than mere instructions to perform the method on a generic component or machinery to qualify as an improvement to an existing technology (MPEP 2106.5(a) II). In this particular case, the additional elements of the claims (i.e., a method implemented using one or more computer systems) do not improve the functioning of the computer or to any other technology or technical field. The additional elements are recited at a high-level of generality (i.e., as generic terms performing generic computer functions (instant spec. [0039-0040,0121] disclose that the functions of the disclosed claims can be implemented using generic computer(s)) such that it amounts no more than mere executable instructions to implement the methods and techniques using generic computer components. Accordingly, the additional elements do not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. Therefore, the claims are directed to an abstract idea. Step 2B: The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the claims do not reflect improvement in the technology. Further, mere executable instructions to implement the methods and techniques using a generic computer component cannot provide an inventive concept. Thus, the claims are not patent eligible. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements (i.e., a method implemented using one or more computer systems) amount to no more than mere executable instructions using general purpose computer. To support this factual conclusion, the examiner takes Official Notice that one of the ordinary skill in the art, before the effective filing date of the claimed invention, would have found processors and/or software well-known and routine in technology that involves computers (instant spec. [0039-0040,0121] discloses that the functions of the disclosed claims can be implemented using generic computer(s)) such that it amounts no more than mere executable instructions to implement the methods and techniques using generic computer components. Accordingly, the additional elements do not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. Thus, the examiner asserts that the above noted elements, when considered individually or in combination, do not constitute as “significantly more” than the abstract idea. The dependent claims likewise incorporate the deficiencies of a claim upon which they ultimately depend and are also directed to non-patent-eligible subject matter. Overall, the analysis of the claims 21-40 demonstrates that limitations are directed to a mental process performable by a human being in their head using a pen and paper in a methodical and orderly manner. Therefore, the claims recite an abstract idea. Allowable Subject Matter Claims 21-40 would be allowable if rewritten to overcome the rejections under 35 U.S.C. 101 and the nonstatutory double patenting rejection, set forth in this Office action and to include all of the limitations of the base claim and any intervening claims. The following is a statement of reasons for the indication of allowable subject matter: In interpreting the currently amended claims, in light of the specification, the Examiner finds the claimed invention to be patentably distinct from the prior art of record. Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee. Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.” Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAYEDA SALMA NAHAR whose telephone number is (703)756-4609. The examiner can normally be reached M-F 12:00 PM to 6:00 PM EST. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached on (571) 270-3351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /SAYEDA SALMA NAHAR/Examiner, Art Unit 2491 /AMIR MEHRMANESH/Supervisory Patent Examiner, Art Unit 2491
Read full office action

Prosecution Timeline

Sep 12, 2024
Application Filed
Jan 06, 2026
Non-Final Rejection — §101, §DP (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12537850
CONCEALED MONITOR COMMUNICATIONS FROM A TASK IN A TRUSTED EXECUTION ENVIRONMENT
2y 5m to grant Granted Jan 27, 2026
Patent 12506751
METHOD AND SYSTEM FOR SCORING SEVERITY OF CYBER ATTACKS
2y 5m to grant Granted Dec 23, 2025
Patent 12493681
PUF-RAKE: A PUF-BASED ROBUST AND LIGHTWEIGHT AUTHENTICATION AND KEY ESTABLISHMENT PROTOCOL
2y 5m to grant Granted Dec 09, 2025
Patent 12457490
ON-DEMAND SUBSCRIPTION CONCEALED IDENTIFIER (SUCI) DECONCEALMENT FOR SELECT APPLICATIONS
2y 5m to grant Granted Oct 28, 2025
Patent 12445469
USING A THREAT INTELLIGENCE FRAMEWORK TO POPULATE A RECURSIVE DNS SERVER CACHE
2y 5m to grant Granted Oct 14, 2025
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

1-2
Expected OA Rounds
67%
Grant Probability
99%
With Interview (+35.8%)
3y 5m
Median Time to Grant
Low
PTA Risk
Based on 27 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month