Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1, 5, 9, 10, and 11 have been amended.
Claims 1-11 are pending.
Response to Arguments
Applicant’s arguments filed on June 3, 2026 have been considered.
With respect to arguments regarding the drawing objection, the new drawing sheet labeled “Replacement Sheet” fails to show “data file interface 240” and “similarity threshold module 226” which were both referred to in the specification, therefore the drawing objection still stands.
With respect to arguments regarding the specification objection, the specification still fails to provide proper antecedent basis for the subject matter in claim 5, in particular “calculating a fuzzy similarity score based on a degree of content overlap between a fingerprint of the detected URL and a fingerprint of known illegitimate pages”, therefore the objection still stands.
With respect to arguments regarding the abstract and claim objections, these are persuasive in view of the amendments, therefore the objections are withdrawn.
With respect to arguments regarding claims 1, 10, and 11, examiner respectfully disagrees. The argument states that the amended features are not taught by Nunes and Jeyakumar, however, Examiner cites paragraphs [0137] and [0153] of Nunes and paragraph [0173] of Jeyakumar to help teach the amended features.
With respect to arguments regarding claims 6, 7, and 9, this argument is not persuasive as these claims depend on claim 1 which is rejected.
With respect to arguments regarding claims 2-5, and 8, these arguments are not persuasive as they all depend on Claim 1 which is rejected.
With respect to arguments stated in the additional remarks, examiner respectfully disagrees, as Paragraphs [0137] and [0153] from Nunes and Paragraph [0173] are used to teach the amended features.
Drawings
The drawings are objected to under 37 CFR 1.83(a) because they fail to show data file interface 240 and similarity threshold module 226 in Fig. 2 as described in the specification. Any structural detail that is essential for a proper understanding of the disclosed invention should be shown in the drawing. MPEP § 608.02(d). Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. The figure or figure number of an amended drawing should not be labeled as “amended.” If a drawing figure is to be canceled, the appropriate figure must be removed from the replacement sheet, and where necessary, the remaining figures must be renumbered and appropriate changes made to the brief description of the several views of the drawings for consistency. Additional replacement sheets may be necessary to show the renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Specification
The specification is objected to as failing to provide proper antecedent basis for the subject matter in claim 5. See 37 CFR 1.75(d)(1) and MPEP § 608.01(o). Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 6, 7, 9-11 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nunes (US 20210203690 A1, hereinafter referred to as Nunes) in view of Jeyakumar (US 20200204572 A1, hereinafter referred to as Jeyakumar).
Regarding claim 1, Nunes discloses: A computer-implemented method in a security device to detect phishing attempts using machine learning of similarity features for web page comparisons (Nunes: Paragraph [0025] states, "The detection engines can utilize engineered rules, machine learning techniques, computer vision, and/or various other techniques to automate detection of malware and/or phishing based on the potential malware indicator(s)."), the method comprising: generating a legitimate web page database of known legitimate domains with similarity features, wherein the similarity features include visual vector embeddings, text embeddings and DOM embeddings (Nunes: Paragraph [0143]-[0145] states, "The model creator 1302 can create a model 1304(1) based on web page content 1303(1) by dynamically accessing the target website URL, markup language portion, style indicator, scripts, and/or images. The model creator 1302 can build a document object model (DOM) frame based on the markup language portion that can indicate a logical frame of the accessed web page...The scoring functions 1306 can include various functions that are run against the suspect model (e.g., the model 1304(1) that is built for the suspect web page) using various portions of the exemplary model (e.g., the model 1304(2) that is built for the exemplary web page)."); detecting a URL that is potentially malicious (Nunes: Paragraph [0154] states, "The scoring functions 1306 can include a style portion similarity detector that can compare a style structure of the suspect web page to a style structure of the legitimate web page. The style portion similarity detector can determine phishing pages that appear legitimate by replicating parts of exemplary web pages. For example, a phishing webpages can mimic a general design that appears familiar, such as a general design structure including identifiable characteristics such as fonts, colors, arrangement of visual elements of the exemplary web pages. The style structure can be included by the respective model in CSS structure, and/or using other structure representations."); executing, [by an isolated Internet-browser instance of the network security device], content returned from the detected URL and interacting with one or more key page elements of the content returned from the detected URL to generate a dynamic behavioral DOM structure for the detected URL (Nunes: Paragraph [0137] states, "The model creator 1304 can access the web page content 1303 for a suspect URL, and generate models based on the web page content 1303. With reference to FIG. 14, the content acquirer can determine the web page content 1303 for various types of static and/or dynamic web pages. As shown in FIG. 14, in some embodiments a server-side system 1402 can be used to generate web pages such as a web page 1406. The web page 1406 can then be accessed via a client-side application, such as a web browser 1436 (or an application 1434) that executes on a user device 1430. The web browser can render the web page 1406 in a user interface (UI) 1432." Paragraph [0153] states, "The model structure can be included by the respective model in a document object model (DOM) structure, and/or using other structure representations."), but fails to explicitly disclose: executing, by an isolated Internet-browser instance of the network security device, content returned from the detected URL.
However, in the same field of endeavor, Jeyakumar discloses: executing, by an isolated Internet-browser instance of the network security device, content returned from the detected URL (Jeyakumar: Paragraph [0173] states, "the threat detection platform may follow the link so that the HTML resource is accessed using a virtual web browser, extract a Document Object Model (DOM) for the HTML resource through the virtual web browser, and analyze the DOM to determine whether the link represents a security risk…if the second output indicates that the email includes a link to an HTML resource, the threat detection platform may follow the link so that the HTML resource is accessed using a virtual web browser, capture a screenshot of the HTML resource through the virtual web browser, apply a computer vision (CV) algorithm designed to identity similarities between the screenshot and a library of verified sign-in websites, and determine whether the link represents a security threat based on an output produced by the CV algorithm. As another example, if the second output indicates that the email includes an attachment, the threat detection platform may open the attachment within a secure processing environment and then determine whether the attachment represents a security threat based on an analysis of content of the attachment. For instance, the threat detection platform may use a headless browser instance running on a standalone computer server (also referred to as a “sandbox computer server”) to inspect the attachment (e.g., by generating a screenshot of its contents), rather than open the attachment directly on a computing device associated with the recipient of the email. Moreover, the threat detection platform may examine any links included in the attachment as discussed above.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nunes and include the above limitation with the teaching of Jeyakumar in order to ensure "detecting an attack based on the determined attributes (step 406), and optically performing remediation steps (step 408)" (Jeyakumar: paragraph [0104]).
This motivation applies to the remainder of the claim.
Nunes further discloses: comparing the detected URL against one or more known legitimate domains by calculating a similarity score between the detected URL and the known legitimate domain with respect to similarity features, against a similarity threshold, wherein the similarity score comprises a combination of a visual similarity score, a text similarity score and a Document Object Model (DOM) structure similarity score, and the similarity threshold represents a tolerance of variations from minor changes between the detected URL versus the one or more legitimate web pages, wherein the DOM structure comprises a dynamic behavioral DOM structure [generated from the isolated Internet-browser instance] representation of the detected URL (Nunes: Paragraph [0136] states, "The content phishing detection engine 302(3) includes a model creator 1304, one or more scoring functions 1306(1), 1306(2), . . . 1306(N) (referred to collectively as 1306), a machine learning model 1308, a data store 13010, and a scoring engine 1312." Paragraph [0145] states that "The scoring engine 1312 can aggregate scores from the scoring functions 1306 and determine whether the resultant score is greater than a certain phishing threshold." Paragraph [0153] states, "The scoring functions 1306 can include a web page structure similarity detector that can compare a model structure of the suspect web page to a model structure of the legitimate web page. The model structure can be included by the respective model in a document object model (DOM) structure, and/or using other structure representations. The web page structure similarity detector can examine analogous structure portions of the suspect model, such as for a login portion of the suspect web page and a corresponding login portion of the legitimate web page. The web page structure similarity detector can perform the similarity tests using edit distance calculations between similar elements in different models. The web page structure similarity detector can perform the similarity tests using vertices analysis between similar elements in different models. The web page structure similarity detector can analyze similarity in tag use (e.g., between tags in DOM) between the different models. The web page structure similarity detector can analyze similarity in paths from root tags between the two models. The web page structure similarity detector can look at partial scores of its various structure calculations and determine whether they indicate web page structure similarity that is greater than a certain phishing threshold." Paragraph [0154] states, "The scoring functions 1306 can include a style portion similarity detector that can compare a style structure of the suspect web page to a style structure of the legitimate web page. The style portion similarity detector can determine phishing pages that appear legitimate by replicating parts of exemplary web pages. For example, a phishing webpages can mimic a general design that appears familiar, such as a general design structure including identifiable characteristics such as fonts, colors, arrangement of visual elements of the exemplary web pages. The style structure can be included by the respective model in CSS structure, and/or using other structure representations." Paragraph [0159] states, "The content analyzer 1314 can perform textual similarity functions such as Jaccard similarity, fuzzy hashing, and/or cosine similarities between vectors for text tokens of the suspect web page and known vectors for legitimate web pages. The result from the content analyzer 1314 can be amended into the resultant score."), but fails to explicitly disclose: a dynamic behavioral DOM structure generated from the isolated Internet-browser instance representation of the detected URL.
However, Jeyakumar further discloses: a dynamic behavioral DOM structure generated from the isolated Internet-browser instance representation of the detected URL (Jeyakumar: Paragraph [0173] states, "the threat detection platform may follow the link so that the HTML resource is accessed using a virtual web browser, extract a Document Object Model (DOM) for the HTML resource through the virtual web browser, and analyze the DOM to determine whether the link represents a security risk…if the second output indicates that the email includes a link to an HTML resource, the threat detection platform may follow the link so that the HTML resource is accessed using a virtual web browser, capture a screenshot of the HTML resource through the virtual web browser, apply a computer vision (CV) algorithm designed to identity similarities between the screenshot and a library of verified sign-in websites, and determine whether the link represents a security threat based on an output produced by the CV algorithm. As another example, if the second output indicates that the email includes an attachment, the threat detection platform may open the attachment within a secure processing environment and then determine whether the attachment represents a security threat based on an analysis of content of the attachment. For instance, the threat detection platform may use a headless browser instance running on a standalone computer server (also referred to as a “sandbox computer server”) to inspect the attachment (e.g., by generating a screenshot of its contents), rather than open the attachment directly on a computing device associated with the recipient of the email. Moreover, the threat detection platform may examine any links included in the attachment as discussed above."); and responsive to detecting a malicious URL [based on the similarity score of the detected URL exceeding the similarity threshold], taking a security action against the detected URL as a phishing attempt according to a network security policy (Jeyakumar: Paragraph [0095] states, "The remediation engine 314 optionally operates to perform one or more remediation processes. The remediation engine 314 is preferably implemented in response to communication classification as an attack (e.g., by one or more analysis modules 312, by the master detector, etc.), but can alternatively or additionally be implemented at any other suitable time. In some embodiments, the remediation steps are based on or correlate to a customer remediation policy. The customer remediation policy may be predefined and received by the threat detection platform 302, be generated based on inference, analysis, and customer data, or be otherwise determined." Paragraph [0154]-[0156] states, "A URL database that includes URL-level data derived from links included in emails received an enterprise. For each URL, the threat detection platform may populate an entry with a model of URL suspiciousness, external data regarding URL quality (e.g., data from phishtank.com), data acquired via Google's SafeBrowsing API, or statistics regarding how often the URL is seen by the enterprise…An entry could include aggregated feedback for an email address, domain, link, normalized/hashed body, etc. For example, an entry in the label database may specify that 15 of 30 labels for emails from “A@exploit.com” have been labeled as positive for attacks, or that 10 out of 11 labels for emails containing a link to http://xyz.com have been labeled as positive for attacks."), but fails to explicitly disclose: detecting a malicious URL based on the similarity score of the detected URL exceeding the similarity threshold.
However, Nunes further discloses: detecting a malicious URL based on the similarity score of the detected URL exceeding the similarity threshold (Nunes: Paragraph [0145] states that "The scoring engine 1312 can aggregate scores from the scoring functions 1306 and determine whether the resultant score is greater than a certain phishing threshold.").
Regarding claim 6, Nunes as modified by Jeyakumar discloses: The method of claim 1, wherein the similarity score comprises configurable weight parameters that define the relative importance of each similarity type (Jeyakumar: Paragraph [0094] states, "The master detector can optionally output the factors, rules, weights, variables, decision tree nodes, or other attack detector parameters that contributed to the attack classification.").
The same motivation to modify with Jeyakumar, as in claim 1, applies.
Regarding claim 7, Nunes as modified by Jeyakumar discloses: The method of claim 1, wherein the security action comprises at least one of quarantining the detected URL and blocking the detected URL, according to the network security policy (Jeyakumar: Paragraph [0057] states that "the anti-spam filter 104 is designed to catch and quarantine malicious emails using blacklist(s) of senders, sender email addresses, and websites that have been detected in past unsolicited emails and/or policy frameworks defined by an enterprise.").
The same motivation to modify with Jeyakumar, as in claim 1, applies.
Regarding claim 9, Nunes discloses: The method of claim 1, wherein the security device is embedded within an Internet browser, wherein the DOM structure is generated from an instance of the Internet browser for interacting with key page elements of the detected URL to determine behaviors (Nunes: Paragraph [0143] states, "The model creator 1302 can create a model 1304(1) based on web page content 1303(1) by dynamically accessing the target website URL, markup language portion, style indicator, scripts, and/or images. The model creator 1302 can build a document object model (DOM) frame based on the markup language portion that can indicate a logical frame of the accessed web page. The model creator 1304 can access one or more exemplary web pages for the business that uses the MAPDAM platform 102.").
Claim 10 recites features similar to those in claim 1, therefore it is rejected in a similar manner.
Claim 11 recites features similar to those recited in claim 1, therefore the similar features are rejected in a similar manner.
Nunes further discloses: a processor (Nunes: Paragraph [0178] states, "The processor unit 1602, memory unit 1606, the network interfaces 1604, and the communication interface 1608 are coupled to the bus 1610."); a network interface communicatively coupled to the processor and to a data communication network (Nunes: Paragraph [0178] states, "The processor unit 1602, memory unit 1606, the network interfaces 1604, and the communication interface 1608 are coupled to the bus 1610."); and a memory, communicatively coupled to the processor (Nunes: Nunes: Paragraph [0178] states, "The processor unit 1602, memory unit 1606, the network interfaces 1604, and the communication interface 1608 are coupled to the bus 1610.").
Claim(s) 2 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nunes (US 20210203690 A1, hereinafter referred to as Nunes) in view of Jeyakumar (US 20200204572 A1, hereinafter referred to as Jeyakumar) in further view of Cheng (US 20230350986 A1, hereinafter referred to as Cheng).
Regarding claim 2, The combination of Nunes as modified by Jeyakumar discloses: The method of claim 1, but fails to explicitly disclose: wherein the visual similarity score is based on a vector-based comparison comprising at least one of cosine similarity and k-Nearest Neighbor (k-NN) search.
However, in the same field of endeavor, Cheng discloses: wherein the visual similarity score is based on a vector-based comparison comprising at least one of cosine similarity and k-Nearest Neighbor (k-NN) search (Cheng: Paragraph [0074] states that "a second similarity measure between the feature vector/map of the detected object representation(s) and the feature vector/map of the registered object representation(s), and/or a third similarity measure between the feature vector/map of the detected background scene representation(s) and the feature vector/map of the registered background scene representation(s) may be determined via computing, for example, an Euclidean distance, cosine similarity, Jaccard distance, Pearson correlation coefficient, or any suitable similarity measure, respectively.").
Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nunes as modified by Jeyakumar and include the above limitation with the teaching of Cheng in order "to determine whether and how the detected motion data representation(s) match(es) the registered motion data representation(s), and whether and how the detected non-motion data representation(s) match(es) the registered non-motion data representation(s)." (Cheng: Paragraph [0075]).
Claim(s) 3 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nunes (US 20210203690 A1, hereinafter referred to as Nunes) in view of Jeyakumar (US 20200204572 A1, hereinafter referred to as Jeyakumar) in further view of Khavronin (US 20220279220 A1, hereinafter referred to as Khavronin).
Regarding claim 3, Nunes discloses: The method of claim 1, wherein the text similarity score is based on a vector-based comparison [comprising a semantic analysis] (Nunes: Paragraph [0159] states, "The content analyzer 1314 can run comparison tests between text tokens of the suspect web model and text tokens for the type of business/entity that is using the MAPDAM platform 102, such as text tokens associated with businesses in the payment space. The content analyzer 1314 can perform textual similarity functions such as Jaccard similarity, fuzzy hashing, and/or cosine similarities between vectors for text tokens of the suspect web page and known vectors for legitimate web pages."), but fails to explicitly disclose: comprising a semantic analysis.
However, in the same field of endeavor, Khavronin discloses: comprising a semantic analysis (Khavronin: Paragraph [0203] states, "The resource classifier then uses NLP technique(s) to convert the different paths into one or more structural semantic vectors (also referred to as “embeddings”). The resource classifier may generate structural semantic vectors for each information object 112 and feeds these vectors into a suitable ML model to classify the information objects 112." Paragraph [0204] states, "The resource classifier may classify the information objects 112 based on structural semantic features." Paragraphs [0205]-[0211] states, "Feature F1: Structural semantics generated based on the structural relationships between information objects 112 (e.g., between webpages provided by hyperlinks)…Feature F2: Content semantics. Content semantics F2 may capture the language and metadata semantics of content contained within information objects 112…Feature F3: Topic Semantics. Topic semantics Business-to-Business (B2B) topics identify different business topics contained in the information objects 112…Feature F4: Content Interaction Behavior. Content interaction behavior is alternatively referred to as content consumption or content use…Feature F5: Entity Type. The entity type feature identifies types or locations of industries, companies, organizations, bot-based applications or users accessing the webpage…Feature F6: Lexical Semantics. Lexical semantics refers to the grammatical structure of information objects 112, and the relationships between individual words in a particular context.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to combine the teaching of Nunes as modified by Jeyakumar and include the above limitation with the teaching of Khavronin in order to "not only on the accuracy of identifying topics 102 on one particular information object 112 but also rated based on the accuracy of identifying related topics 102 on other closely linked information objects 112" (Khavronin: Paragraph [0215]).
Claim(s) 4 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nunes (US 20210203690 A1, hereinafter referred to as Nunes) in view of Jeyakumar (US 20200204572 A1, hereinafter referred to as Jeyakumar) in further view of Lakshmanan (US 10021133 B1, hereinafter referred to as Lakshmanan).
Regarding claim 4, Nunes discloses: The method of claim 1, wherein the DOM based similarity score is based on a vector-based comparison comprising a complete structure and hierarchy of the detected URL, including both visible elements [and hidden elements] of the detected URL (Paragraph [0153] states, "The scoring functions 1306 can include a web page structure similarity detector that can compare a model structure of the suspect web page to a model structure of the legitimate web page. The model structure can be included by the respective model in a document object model (DOM) structure, and/or using other structure representations…The web page structure similarity detector can analyze similarity in paths from root tags between the two models. The web page structure similarity detector can look at partial scores of its various structure calculations and determine whether they indicate web page structure similarity that is greater than a certain phishing threshold."), but fails to explicitly disclose: hidden elements of the detected URL.
However, in the same field of endeavor, Lakshmanan discloses: hidden elements of the detected URL (Lakshmanan: Page 7 Lines 26-35 states that "a page risk score may be arrived using URL and HTML, using attributes including but not limited to one or more of the following attributes: Has IP address for host? URL Keywords like (login, sign in etc.) Folder/API new-ness(based on server change entropy) Number of Sub folders Page Content Obfuscated Java Scripts Hidden iFrames.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to combine the teaching of Nunes as modified by Jeyakumar and include the above limitation with the teaching of Lakshmanan so that "the database also synchronizes itself on a periodic basis with the intelligence database 104 outside the network by pulling data to host the latest information on known phishing and blacklisted sites as obtained by the intelligence database through other sources" (Lakshmanan: col 4 lines 59-63).
Claim(s) 5 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nunes (US 20210203690 A1, hereinafter referred to as Nunes) in view of Jeyakumar (US 20200204572 A1, hereinafter referred to as Jeyakumar) in further view of Gardezi (US 20240195836 A1, hereinafter referred to as Gardezi).
Regarding claim 5, the combination of Nunes as modified by Jeyakumar discloses: The method of claim 1, but fails to explicitly disclose: compressing visual and textual elements of known illegitimate pages to fingerprints for storage; and calculating a fuzzy similarity score based on a degree of content overlap between a fingerprint of the detected URL and a fingerprint of known illegitimate pages.
However, in the same field of endeavor, Gardezi discloses: compressing visual and textual elements of known illegitimate pages to fingerprints for storage (Gardezi: Paragraph [0028] states, "If the generated hash value is determined to be “correlated” with a hash value associated with a code segment associated with a known phishing web page, namely the generated hash value meets or exceeds a correlation threshold positioned by empirical data between the first correlation range and the second correlation range as described above, the received URL may be determined to be associated with phishing cyberattacks. The generated hash value represents a transformation of the code segment, which may include, for example, the HTML content, CSS file, JavaScript images, or the like." Paragraph [0046] states that "this hash value undergoes a “fuzzy hash” comparison (as described above) with hash values associated with a known corpus of phishing web pages maintained within a knowledge data store 145 to determine whether the code segment 165/175 is part of a phishing cyberattack."); and calculating a fuzzy similarity score based on a degree of content overlap between a fingerprint of the detected URL and a fingerprint of known illegitimate pages (Gardezi: Paragraph [0057] states that "if a generated hash value associated with the code segment 165/175 (e.g., retrieved code segment 165 or any recovered code segment 175) is determined to be correlated with a hash value of a code segment associated with a known phishing web page, the code segment 165/175 is determined to be associated with a phishing cyberattack. As a result, the suspect URL 150 is determined to be associated with a phishing cyberattack.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nunes as modified by Jeyakumar and include the above limitation with the teaching of Gardezai in order to "produce a smaller sized representation (e.g., a hash value), which may be compared to representations (e.g., hash values) of code segments associated with known phishing web pages. The fuzzy hash generation and detection logic is also configured to conduct a “fuzzy hashing” detection, namely a comparison of hash values of two distinctly different items in order to determine a fundamental level of similarity" (Gardezi: Paragraph [0019]).
Claim(s) 8 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nunes (US 20210203690 A1, hereinafter referred to as Nunes) in view of Jeyakumar (US 20200204572 A1, hereinafter referred to as Jeyakumar) in further view of Jakobsson (US 11323464 B2, hereinafter referred to as Jakobsson).
Regarding claim 8, the combination of Nunes as modified by Jeyakumar discloses: The method of claim 1, but fails to explicitly disclose: wherein the security action depends on the amount of variation shown in the similarity score differences of the detected URL and the one or more legitimate domains, wherein higher variations result in harsher security actions.
However, in the same field of endeavor, Jakobsson discloses: wherein the security action depends on the amount of variation shown in the similarity score differences of the detected URL and the one or more legitimate domains, wherein higher variations result in harsher security actions (Jakobsson: [Col 16 lines 53-56] states, "The example URL artifact may be replaced with the URL “https://securityserver.com/URL12737” where the number 12737 is stored in a database along with the associated observed URL “http://www.nytimes.com/storyoftheday”. " [Col 18 lines 12-21] states that "the security system receives data associated with the recipients, as these access the modified artifacts. This information is added to the associated profiles. For purposes of efficiency, the information is periodically processed to compress it or otherwise reduce the amount of storage required. As the system obtains more and more information about a previously unobserved user, the user becomes observed, and a score corresponding to the accuracy of a prediction is generated and stored in the profile." [Col 18 lines 29-35] states that "a detected anomaly may result in different security actions. For example, if the accuracy score is low, a non-invasive action such as a simple alert may be taken, whereas in the accuracy score is high, a more invasive action such as blocking access to an artifact or blocking transmission of messages to/from the affected account, may be performed.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nunes as modified by Jeyakumar and include the above limitation with the teaching of Jakobsson in order to "minimize error rates, keep false positives below a maximum specified number, keep false negatives below a maximum specified number, minimizes a weighted error function that is associated with perceived costs associated with various misclassifications; and more" (Jakobsson: Col 49 lines 52-56).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHREYAJ RAM BHANDARI whose telephone number is (571)272-0727. The examiner can normally be reached 7:30-5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ali Shayanfar can be reached at (571) 270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHREYAJ RAM BHANDARI/ Examiner, Art Unit 2434
/NOURA ZOUBAIR/ Primary Examiner, Art Unit 2434
Prosecution Insights