Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This is a reply to the application filed on 01/06/2024, in which, claims 1-18 are pending. Claims 1, and 10 are independent.
When making claim amendments, the applicant is encouraged to consider the references in their entireties, including those portions that have not been cited by the examiner and their equivalents as they may most broadly and appropriately apply to any particular anticipated claim amendments.
Drawings
The drawings filed on 01/06/2024 are accepted
Specification
The disclosure filed on 01/06/2024 is accepted
Information Disclosure Statement
The information disclosure statements (IDS) submitted on 02/14/2025 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-18 are rejected under 35 U.S.C. 101 because the claimed invention is directed
to an abstract idea without significantly more.
Claim 1 is directed to an abstract idea without significantly more.
The following limitations are directed to an abstract idea because they recite an abstract idea:
A method for identifying algorithmically generated domain names comprising: collecting a first plurality of fully-qualified domain names from first related network traffic via observed communications (mental process; a human can mentally observe and collect a list of domain names from observed network communications, such as reading them off of a log or printed report and writing them down.)
Determining a first randomness value for the first plurality of fully-qualified domain names (mental process; a human can mentally evaluate how random a set of domain names appears, e.g., looking at "asdkjqwe.com" versus "google.com" and assigning a randomness score with pen and paper.)
Determining a first character distribution value for the first plurality of fully-qualified domain names (mental process; a human can mentally count or tally the distribution of characters across a list of domain names using pen and paper.)
Determining a first length value for the first plurality of fully-qualified domain names (mental process; a human can mentally count the number of characters in each domain name.)
Generating a fingerprint by a formula utilizing a set of precision parameters and taking as input at least the first length value, the first randomness value, and the first character distribution value (mental process; a human can mentally (or with pen and paper) combine the length, randomness, and character distribution values using a formula or rule of thumb to produce a summary identifier for the group of domain names.)
Storing the fingerprint in a record and associating the fingerprint with the first related network traffic (mental process; a human can mentally or with pen and paper write down the fingerprint in a notebook and note which observed network traffic it corresponds to.)
Additional elements include: wherein the observed communications comprise a computer network, wherein the formula comprises a network security algorithm, and wherein the record comprises a database.
These additional elements fail to integrate the abstract idea into a practical application because no improvement to a computer or technology is achieved. The claimed invention ends with storing the fingerprint. Further, these additional elements recite at a high level of generality (i.e., computer network, network security algorithm, database) using computers as a tool to implement the abstract idea. Further, these additional elements are insignificant presolution activity.
The additional elements alone, and in combination with the abstract idea, fail to arrive at significantly more than the abstract idea itself. As noted previously, no improvement to a computer or technology is achieved. The claimed invention ends with storing the fingerprint. Further, these additional elements recite at a high level of generality (i.e., computer network, network security algorithm, database) using computers as a tool to implement the abstract idea. Further, these additional elements are insignificant presolution activity. Independent claim 10 is rejected under similar rationale. Dependent claims do not add an inventive step to the abstract idea of the independent claims and are therefore rejected based on the aforementioned rationale discussed in the rejection.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 5-7 and 14-16 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 5 and 14 recites "each randomness value," "each character distribution value," and "each length value." There is insufficient antecedent basis for these limitations. Claim 1, from which claim 5 depends, introduces only "a first randomness value," "a first character distribution value," and "a first length value" a single instance of each. The use of "each" shows a plurality of such values that has not been previously recited, rendering the scope of the claim unclear. To overcome, replace "each" with "the first" in claim 5 (and in claim 6), or alternatively amend claim 1 to expressly recite that a plurality of randomness, character distribution, and length values is determined. Claim 7 and 16 recites "a percent of labels in the group not found in another group" and subsequently references "P is the percent of labels in the group not found in the other group." There is insufficient antecedent basis for "another group" and "the other group." Only a single "group of fully-qualified domain names known to have been generated by a particular malware strain" is introduced; no second or comparator group is previously recited. To overcome, expressly introduce a second group prior to its first reference and conform the subsequent references to "the second group."
Appropriate correction is required.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1, 4, 8-10, 13, and 17-18 is rejected under 35 U.S.C. 102(a)(1) as being anticipated by Antonakakis et al. (US 20130191915 A1, referred to as Antonakakis).
In reference to claim 1, A method for identifying algorithmically generated domain names comprising: collecting a first plurality of fully-qualified domain names from first related network traffic via a computer network (Antonakakis: [0007]-[0010], [0023], [0055] and Fig. 3 Provides for collection of a plurality of fully-qualified domain names from related DNS network traffic monitored on a computer network.)
determining a first randomness value for the first plurality of fully-qualified domain names (Antonakakis: [0011], [0021] and [0029]-[0031] Provides for computing a randomness value across the plurality of domain names via Shannon-style character entropy (EBF) of the domain strings.)
determining a first character distribution value for the first plurality of fully-qualified domain names (Antonakakis: [0011] and [0027]-[0033] Provides for clusters on character frequency distribution, computes n-gram frequency distributions (with n=1 being raw character frequency), and tallies distinct-character counts across the domain set, all of which teach a "character distribution value".)
determining a first length value for the first plurality of fully-qualified domain names (Antonakakis: [0011], [0021] and [0033] Provides for determining length values across the plurality of domains.)
generating a fingerprint by a network security algorithm utilizing a set of precision parameters and taking as input at least the first length value, the first randomness value, and the first character distribution value (Antonakakis: [0018], [0025] and [0046]-[0054] Provides for generating a multi-dimensional feature vector / Random-Forest DGA model.)
storing the fingerprint in a database and associating the fingerprint with the first related network traffic (Antonakakis: [0013], [0048]-[0056] and Fig. 3 Provides for persisting the generated DGA model (the "fingerprint") into the classifier's knowledge base and tying it back to the originating NX-domain traffic and the assets that produced it.)
In reference to claim 4, The method of claim 1 wherein said determining said first length value for the first plurality of fully-qualified domain names comprises: determining an average domain name length of said first plurality of fully-qualified domain names (Antonakakis: [0021] and [0033] Provides for the SDF feature family expressly enumerates the average of the domain-name length as one of its four length-based statistical features computed over the set NX[k] of α domains (the "first plurality").)
determining the first length value comprising an average domain name log-length by calculating log10(1+the average domain name length of said first plurality of fully-qualified domain names) (Antonkakis: [0033] Provides for the average domain-name length. Sivaguru: Section IV Lexical Features Provides for using logarithmic transformations of length values. Combined results in the scaling choice of the computed average.)
In reference to claim 8, The method of claim 1 further comprising: detecting a second plurality of fully-qualified domain names from second related network traffic via the computer network (Antonakakis: [0008], [0052]-[0056] and Fig. 3 Provides for ongoing collection of a second plurality of NX domains from subsequent (post-training) network traffic streamed in from the ISP/RDNS sensor.)
determining a second randomness value for the second plurality of fully-qualified domain names (Antonakakis: [0030]-[0031], [0047] and [0052] Provides for computing the same EBF (entropy/randomness) features on each new α-sized batch of incoming NX domains exactly as was done at training time.)
determining a second character distribution value for the second plurality of fully-qualified domain names (Antonakakis: [0027]-[0033] and [0047]-[0052] Provides for computing the same NGF (n-gram/character distribution) features on each new α-sized batch of incoming NX domains.)
determining a second length value for the second plurality of fully-qualified domain names (Antonakakis: [0033] and [0047]-[0052] Provides for computing the same SDF length-based features on each new α-sized batch of incoming NX domains.)
generating a value by the network security algorithm utilizing the set of precision parameters and taking as input at least the second length value, the second randomness value, and the second character distribution value (Antonakakis: [0047]-[0052] Provides for generating, at inference time, a feature vector (the recited "value") from length (SDF), randomness (EBF), and character-distribution (NGF) inputs and feeding it through the same Random-Forest classification pipeline used at training.)
signaling when the fingerprint correlates to the value (Antonakakis: [0013], [0047]-[0056] and Fig. 3 Provides for emitting a classification report/signal whenever the per-asset NX-domain feature vector correlates with (matches) a stored DGA model.)
In reference to claim 9, The method of claim 1 wherein said generating of said fingerprint comprises generating said fingerprint in response to a stateless function call (Antonakakis: [0018]-[0025] and [0047]-[0052] Provides for a feature-vector generation step that is stateless.)
In reference to claim 10, A system for identifying algorithmically generated domain names comprising: a database; a computer network interface coupled to a computer network; and a processor coupled to the computer network interface and the database and comprising at least one code segment for performing the following steps: collecting a first plurality of fully-qualified domain names from first related network traffic via a computer network (Antonakakis: [0007]-[0010], [0023], [0055] and Fig. 3 Provides for collection of a plurality of fully-qualified domain names from related DNS network traffic monitored on a computer network.)
determining a first randomness value for the first plurality of fully-qualified domain names (Antonakakis: [0011], [0021] and [0029]-[0031] Provides for computing a randomness value across the plurality of domain names via Shannon-style character entropy (EBF) of the domain strings.)
determining a first character distribution value for the first plurality of fully-qualified domain names (Antonakakis: [0011] and [0027]-[0033] Provides for clusters on character frequency distribution, computes n-gram frequency distributions (with n=1 being raw character frequency), and tallies distinct-character counts across the domain set, all of which teach a "character distribution value".)
determining a first length value for the first plurality of fully-qualified domain names (Antonakakis: [0011], [0021] and [0033] Provides for determining length values across the plurality of domains.)
generating a fingerprint by a network security algorithm utilizing a set of precision parameters and taking as input at least the first length value, the first randomness value, and the first character distribution value (Antonakakis: [0018], [0025] and [0046]-[0054] Provides for generating a multi-dimensional feature vector / Random-Forest DGA model.)
storing the fingerprint in a database and associating the fingerprint with the first related network traffic (Antonakakis: [0013], [0048]-[0056] and Fig. 3 Provides for persisting the generated DGA model (the "fingerprint") into the classifier's knowledge base and tying it back to the originating NX-domain traffic and the assets that produced it.)
In reference to claim 13, The system of claim 10 wherein said determining said first length value for the first plurality of fully-qualified domain names comprises: determining an average domain name length of said first plurality of fully-qualified domain names (Antonakakis: [0021] and [0033] Provides for the SDF feature family expressly enumerates the average of the domain-name length as one of its four length-based statistical features computed over the set NX[k] of α domains (the "first plurality").)
determining the first length value comprising an average domain name log-length by calculating log10(1+the average domain name length of said first plurality of fully-qualified domain names) (Antonkakis: [0033] Provides for the average domain-name length. Sivaguru: Section IV Lexical Features Provides for using logarithmic transformations of length values. Combined results in the scaling choice of the computed average.)
In reference to claim 17, The system of claim 10 wherein said at least one code segment is further configured to perform the following steps: detecting a second plurality of fully-qualified domain names from second related network traffic via the computer network (Antonakakis: [0008], [0052]-[0056] and Fig. 3 Provides for ongoing collection of a second plurality of NX domains from subsequent (post-training) network traffic streamed in from the ISP/RDNS sensor.)
determining a second randomness value for the second plurality of fully-qualified domain names (Antonakakis: [0030]-[0031], [0047] and [0052] Provides for computing the same EBF (entropy/randomness) features on each new α-sized batch of incoming NX domains exactly as was done at training time.)
determining a second character distribution value for the second plurality of fully-qualified domain names (Antonakakis: [0027]-[0033] and [0047]-[0052] Provides for computing the same NGF (n-gram/character distribution) features on each new α-sized batch of incoming NX domains.)
determining a second length value for the second plurality of fully-qualified domain names (Antonakakis: [0033] and [0047]-[0052] Provides for computing the same SDF length-based features on each new α-sized batch of incoming NX domains.)
generating a value by the network security algorithm utilizing the set of precision parameters and taking as input at least the second length value, the second randomness value, and the second character distribution value (Antonakakis: [0047]-[0052] Provides for generating, at inference time, a feature vector (the recited "value") from length (SDF), randomness (EBF), and character-distribution (NGF) inputs and feeding it through the same Random-Forest classification pipeline used at training.)
signaling when the fingerprint correlates to the value (Antonakakis: [0013], [0047]-[0056] and Fig. 3 Provides for emitting a classification report/signal whenever the per-asset NX-domain feature vector correlates with (matches) a stored DGA model.)
In reference to claim 18, The system of claim 10 wherein said generating of said fingerprint comprises generating said fingerprint in response to a stateless function call (Antonakakis: [0018]-[0025] and [0047]-[0052] Provides for a feature-vector generation step that is stateless.)
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 2-3 and 11-12 are rejected under 35 U.S.C. 103 as being unpatentable over Antonakakis et al. (US 20130191915 A1, referred to as Antonakakis), in view of Sivaguru et al. (“Inline Detection of DGA Domains Using Side Information”, referred to as Sivaguru).
In reference to claim 2, The method of claim 1 wherein said determining said first randomness value for the first plurality of fully-qualified domain names comprises: determining an entropy over all domains of the first plurality of fully-qualified domain names (Antonakakis: [0029]-[0031] Provides for an entropy computation taken across the plurality (set NX[k] of α domains).)
Antonakakis doesn’t explicitly teach determining the first randomness value comprising the entropy over all domains of the first plurality of fully-qualified domain names divided by a maximum possible entropy achievable. However, Sivaguru teaches:
determining the first randomness value comprising the entropy over all domains of the first plurality of fully-qualified domain names divided by a maximum possible entropy achievable (Sivaguru: Section IV Lexical Features Provides for Shannon entropy divided by the maximum possible entropy.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis, which provides a method for identifying algorithmically generated domain names by computing entropy across a plurality of domain names as part of a randomness value determination, with the teachings of Sivaguru, which introduces normalizing entropy by dividing the calculated Shannon entropy by the maximum possible entropy achievable. One of ordinary skill in the art would recognize the ability to incorporate Sivaguru's entropy normalization technique into Antonakakis's randomness value calculation to produce a standardized metric. One of ordinary skill in the art would be motivated to make this modification in order to enable more meaningful comparisons of randomness across domain names of varying lengths.
In reference to claim 3, The method of claim 1 wherein said determining said first character distribution value for the first plurality of fully-qualified domain names comprises: determining a number of digit characters, a number of non-digit characters, and a total number of characters in each of the first plurality of fully-qualified domain names (Sivaguru: Section IV Lexical Features Provides for determining the number of digit characters (digits_sld), the total number of characters (sld_len), and by simple arithmetic the number of non-digit characters (sld_len − digits_sld) for each domain in the plurality)
determining the first character distribution value comprising ((nc−nd)/(nc+nd)+1)/2, wherein nc is the total number of digit characters of the first plurality of fully-qualified domain names, and nd is the total number of non-digit characters of the first plurality of fully-qualified domain names (Sivaguru: Section IV Lexical Features Provides for formula ((nc−nd)/(nc+nd)+1)/2 which algebraically simplifies to nc/(nc+nd), which is exactly the dig ratio.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis, which provides a method for identifying algorithmically generated domain names by determining character distribution values across a plurality of domain names, with the teachings of Sivaguru, which introduces a specific mathematical formula for calculating character distribution based on the ratio of digit characters to non-digit characters using the normalized expression ((nc−nd)/(nc+nd)+1)/2. One of ordinary skill in the art would recognize the ability to incorporate Sivaguru's specific digit-ratio calculation methodology into Antonakakis's character distribution determination to provide a standardized and bounded metric. One of ordinary skill in the art would be motivated to make this modification in order to produce a normalized character distribution value that falls within a consistent range regardless of domain name composition.
In reference to claim 11, The system of claim 10 wherein said determining said first randomness value for the first plurality of fully-qualified domain names comprises: determining an entropy over all domains of the first plurality of fully-qualified domain names (Antonakakis: [0029]-[0031] Provides for an entropy computation taken across the plurality (set NX[k] of α domains).)
Antonakakis doesn’t explicitly teach determining the first randomness value comprising the entropy over all domains of the first plurality of fully-qualified domain names divided by a maximum possible entropy achievable. However, Sivaguru teaches:
determining the first randomness value comprising the entropy over all domains of the first plurality of fully-qualified domain names divided by a maximum possible entropy achievable (Sivaguru: Section IV Lexical Features Provides for Shannon entropy divided by the maximum possible entropy.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis, which provides a method for identifying algorithmically generated domain names by computing entropy across a plurality of domain names as part of a randomness value determination, with the teachings of Sivaguru, which introduces normalizing entropy by dividing the calculated Shannon entropy by the maximum possible entropy achievable. One of ordinary skill in the art would recognize the ability to incorporate Sivaguru's entropy normalization technique into Antonakakis's randomness value calculation to produce a standardized metric. One of ordinary skill in the art would be motivated to make this modification in order to enable more meaningful comparisons of randomness across domain names of varying lengths.
In reference to claim 12, The system of claim 10 wherein said determining said first character distribution value for the first plurality of fully-qualified domain names comprises: determining a number of digit characters, a number of non-digit characters, and a total number of characters in each of the first plurality of fully-qualified domain names (Sivaguru: Section IV Lexical Features Provides for determining the number of digit characters (digits_sld), the total number of characters (sld_len), and by simple arithmetic the number of non-digit characters (sld_len − digits_sld) for each domain in the plurality)
determining the first character distribution value comprising ((nc−nd)/(nc+nd)+1)/2, wherein nc is the total number of digit characters of the first plurality of fully-qualified domain names, and nd is the total number of non-digit characters of the first plurality of fully-qualified domain names (Sivaguru: Section IV Lexical Features Provides for formula ((nc−nd)/(nc+nd)+1)/2 which algebraically simplifies to nc/(nc+nd), which is exactly the dig ratio.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis, which provides a method for identifying algorithmically generated domain names by determining character distribution values across a plurality of domain names, with the teachings of Sivaguru, which introduces a specific mathematical formula for calculating character distribution based on the ratio of digit characters to non-digit characters using the normalized expression ((nc−nd)/(nc+nd)+1)/2. One of ordinary skill in the art would recognize the ability to incorporate Sivaguru's specific digit-ratio calculation methodology into Antonakakis's character distribution determination to provide a standardized and bounded metric. One of ordinary skill in the art would be motivated to make this modification in order to produce a normalized character distribution value that falls within a consistent range regardless of domain name composition.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 5-6 and 14-15 are rejected under 35 U.S.C. 103 as being unpatentable over Antonakakis et al. (US 20130191915 A1, referred to as Antonakakis), in view of Schiavoni et al. (“Phoenix: DGA-Based Botnet Tracking and Intelligence”, referred to as Schiavoni).
In reference to claim 5, The method of claim 1 wherein said set of precision parameters comprises: a parameter n1 specifying a number of digits of precision used by each randomness value (Schiavoni: Section 4 (Linguistic Features LF1 and LF2) and (Statistical Linguistic Filter, threshold estimation) Provides for tunable parameter that controls the randomness/linguistic feature values are used to discriminate domains.)
a parameter n2 specifying a number of digits of precision used by each character distribution value (Schiavoni: Section 4 step 3 (DGA Fingerprinting), CF4 Provides for range-based quantization parameter.)
a parameter n3 specifying a number of digits of precision used by each length value (Schiavoni: Section 4 step 3 (DGA Fingerprinting), CF2 Provides for a range-based parameter.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis, which provides a method for identifying algorithmically generated domain names through generating fingerprints using a set of precision parameters along with randomness, character distribution, and length values, with the teachings of Schiavoni, which introduces specific tunable precision parameters controlling the digits of precision used for randomness, character distribution, and length values through range-based quantization in linguistic and statistical features. One of ordinary skill in the art would recognize the ability to incorporate Schiavoni's specific precision parameter structure into Antonakakis's fingerprint generation methodology to provide configurable granularity for feature representation. One of ordinary skill in the art would be motivated to make this modification in order to enable fine-tuning of the fingerprinting algorithm's sensitivity by adjusting precision levels for different feature types.
In reference to claim 6, The method of claim 5 wherein said precision parameters comprise: n1 comprising rounding each randomness value to thousandths; n2 comprising rounding each character distribution value to tenths; and n3 comprising rounding each length value to thousandths (Schiavoni: V-C (DGA Fingerprinting) Provides for the specific decimal positions are routine choices that an ordinarily skilled engineer would arrive at through standard parameter tuning.)
In reference to claim 14, The system of claim 10 wherein said set of precision parameters comprises: a parameter n1 specifying a number of digits of precision used by each randomness value (Schiavoni: Section 4 (Linguistic Features LF1 and LF2) and (Statistical Linguistic Filter, threshold estimation) Provides for tunable parameter that controls the randomness/linguistic feature values are used to discriminate domains.)
a parameter n2 specifying a number of digits of precision used by each character distribution value (Schiavoni: Section 4 step 3 (DGA Fingerprinting), CF4 Provides for range-based quantization parameter.)
a parameter n3 specifying a number of digits of precision used by each length value (Schiavoni: Section 4 step 3 (DGA Fingerprinting), CF2 Provides for a range-based parameter.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis, which provides a method for identifying algorithmically generated domain names through generating fingerprints using a set of precision parameters along with randomness, character distribution, and length values, with the teachings of Schiavoni, which introduces specific tunable precision parameters controlling the digits of precision used for randomness, character distribution, and length values through range-based quantization in linguistic and statistical features. One of ordinary skill in the art would recognize the ability to incorporate Schiavoni's specific precision parameter structure into Antonakakis's fingerprint generation methodology to provide configurable granularity for feature representation. One of ordinary skill in the art would be motivated to make this modification in order to enable fine-tuning of the fingerprinting algorithm's sensitivity by adjusting precision levels for different feature types.
In reference to claim 15, The system of claim 14 wherein said precision parameters comprise: n1 comprising rounding each randomness value to thousandths; n2 comprising rounding each character distribution value to tenths; and n3 comprising rounding each length value to thousandths (Schiavoni: V-C (DGA Fingerprinting) Provides for the specific decimal positions are routine choices that an ordinarily skilled engineer would arrive at through standard parameter tuning.)
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 7 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Antonakakis et al. (US 20130191915 A1, referred to as Antonakakis), in view of Schiavoni et al. (“Phoenix: DGA-Based Botnet Tracking and Intelligence”, referred to as Schiavoni) in further view of Rosenberg et al. (“V-Measure: A conditional entropy-based external cluster evaluation measure”, referred to as Rosenberg.) in further view of Coq et al. (“An improved method for model selection based on Information Criteria”, referred to as Coq.)
In reference to claim 7, The method of claim 5 wherein said generating of said fingerprint further comprises: determining the set of precision parameters comprising (Schiavoni: Section 5.2 Provides for procedure to determine the value of a fingerprint-influencing parameter by analytical sweep.)
loading labeled training data comprising a group of fully-qualified domain names known to have been generated by a particular malware strain (Schiavoni: Section 5 Provides for loading labeled FQDN training data grouped by malware strain (Conficker.A/B/C, Torpig, Bamital) used as ground truth to validate and tune the fingerprinting pipeline.)
looping over all possible parameter settings (n1=1 . . . 10, n2=1 . . . 10, n3=1 . . . 10) (Schiavoni: Section 5 Provides for sweeping a parameter across its range of values and evaluating each setting.)
for each of the possible parameter settings, computing a respective label (Schiavoni: Step 4.4 provides for computing labels (cluster assignments / DGA family) under a given parameterization of the fingerprinting/clustering pipeline
for each respective computed label, determining; a percent of labels in the group not found in another group (Schiavoni: Step 5.2 Provides for a between-group separation metric.)
a percent of non-unique labels within the group (Schiavoni: Step 5.2 Provides for an within-group uniformity metric.)
Antonakakis in view of Schiavoni doesnt explicitly teach a value H, where H=P*Q−0.01*log(n1+n2+n3), wherein P is the percent of labels in the group not found in the other group, and wherein Q is the percent of non-unique labels within the group; and preserving the set of precision parameters comprising a parameter set (n1, n2, n3) that maximizes the value H. However, Rosenberg teaches:
a value H, where H=P*Q (Rosenberg: Section 2 Provides for the product structure h·c at the numerator of VB as the cluster-quality scoring combinator of homogeneity and completeness.)
wherein P is the percent of labels in the group not found in the other group (Rosenberg: Section 2 Provides for homogeneity, i.e., the cluster-quality property that a label appears in only one class group.)
wherein Q is the percent of non-unique labels within the group (Rosenberg: Section 2 Provides for completeness, i.e., the cluster-quality property that members of a class collapse to shared labels.)
preserving the set of precision parameters comprising a parameter set (n1, n2, n3) that maximizes the value H (Rosenberg: Section 5 / Figure 4 Provides for selecting the configuration that maximizes the cluster-quality score over a swept parameter grid.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis in view of Schiavoni, which together provide a method for generating fingerprints using sweepable precision parameters and evaluating parameter settings against labeled training data through separation and uniformity metrics, with the teachings of Rosenberg, which introduces a combined cluster-quality score derived as the product of homogeneity (labels appearing in only one class group) and completeness (members of a class collapsing to shared labels). One of ordinary skill in the art would recognize the ability to incorporate Rosenberg's combinatorial scoring approach into the combined parameter-tuning framework to provide a single, unified quality metric for evaluating fingerprint parameter configurations. One of ordinary skill in the art would be motivated to make this modification in order to enable systematic identification of optimal precision parameters by combining two complementary cluster-quality dimensions into a single comparable value
Antonakakis in view of Schiavoni in further view of Rosenberg, doens’t explicitly teach the scaling part of the formula −0.01*log(n1+n2+n3). However, Coq discloses: −0.01*log(n1+n2+n3) (Coq: Section II Provides for the canonical information criterion form IC = −log(ML) + Pen with a log-scaled penalty growing in parameter complexity, e.g., BIC's α(n)=log n at Eq. (2) and Section III–IV provides for calibrating the penalty weight as a small coefficient that nudges toward parsimony without dominating the fit term, the same role the 0.01 coefficient plays in the claim.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis in view of Schiavoni and Rosenberg, which together provide a method for optimizing fingerprint precision parameters using a combined homogeneity-completeness cluster-quality score, with the teachings of Coq, which introduces an information-criterion framework incorporating a log-scaled penalty term weighted by a small calibration coefficient to balance model fit against parameter complexity. One of ordinary skill in the art would recognize the ability to incorporate Coq's complexity-penalty term into the combined parameter optimization score to discourage unnecessarily high precision parameter values. One of ordinary skill in the art would be motivated to make this modification in order to prevent overfitting of the fingerprinting algorithm.
In reference to claim 16, The system of claim 15 wherein said generating of said fingerprint further comprises: determining the set of precision parameters comprising (Schiavoni: Section 5.2 Provides for procedure to determine the value of a fingerprint-influencing parameter by analytical sweep.)
loading labeled training data comprising a group of fully-qualified domain names known to have been generated by a particular malware strain (Schiavoni: Section 5 Provides for loading labeled FQDN training data grouped by malware strain (Conficker.A/B/C, Torpig, Bamital) used as ground truth to validate and tune the fingerprinting pipeline.)
looping over all possible parameter settings (n1=1 . . . 10, n2=1 . . . 10, n3=1 . . . 10) (Schiavoni: Section 5 Provides for sweeping a parameter across its range of values and evaluating each setting.)
for each of the possible parameter settings, computing a respective label (Schiavoni: Step 4.4 provides for computing labels (cluster assignments / DGA family) under a given parameterization of the fingerprinting/clustering pipeline
for each respective computed label, determining; a percent of labels in the group not found in another group (Schiavoni: Step 5.2 Provides for a between-group separation metric.)
a percent of non-unique labels within the group (Schiavoni: Step 5.2 Provides for an within-group uniformity metric.)
Antonakakis in view of Schiavoni doesnt explicitly teach a value H, where H=P*Q−0.01*log(n1+n2+n3), wherein P is the percent of labels in the group not found in the other group, and wherein Q is the percent of non-unique labels within the group; and preserving the set of precision parameters comprising a parameter set (n1, n2, n3) that maximizes the value H. However, Rosenberg teaches:
a value H, where H=P*Q (Rosenberg: Section 2 Provides for the product structure h·c at the numerator of VB as the cluster-quality scoring combinator of homogeneity and completeness.)
wherein P is the percent of labels in the group not found in the other group (Rosenberg: Section 2 Provides for homogeneity, i.e., the cluster-quality property that a label appears in only one class group.)
wherein Q is the percent of non-unique labels within the group (Rosenberg: Section 2 Provides for completeness, i.e., the cluster-quality property that members of a class collapse to shared labels.)
preserving the set of precision parameters comprising a parameter set (n1, n2, n3) that maximizes the value H (Rosenberg: Section 5 / Figure 4 Provides for selecting the configuration that maximizes the cluster-quality score over a swept parameter grid.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis in view of Schiavoni, which together provide a method for generating fingerprints using sweepable precision parameters and evaluating parameter settings against labeled training data through separation and uniformity metrics, with the teachings of Rosenberg, which introduces a combined cluster-quality score derived as the product of homogeneity (labels appearing in only one class group) and completeness (members of a class collapsing to shared labels). One of ordinary skill in the art would recognize the ability to incorporate Rosenberg's combinatorial scoring approach into the combined parameter-tuning framework to provide a single, unified quality metric for evaluating fingerprint parameter configurations. One of ordinary skill in the art would be motivated to make this modification in order to enable systematic identification of optimal precision parameters by combining two complementary cluster-quality dimensions into a single comparable value
Antonakakis in view of Schiavoni in further view of Rosenberg, doens’t explicitly teach the scaling part of the formula −0.01*log(n1+n2+n3). However, Coq discloses: −0.01*log(n1+n2+n3) (Coq: Section II Provides for the canonical information criterion form IC = −log(ML) + Pen with a log-scaled penalty growing in parameter complexity, e.g., BIC's α(n)=log n at Eq. (2) and Section III–IV provides for calibrating the penalty weight as a small coefficient that nudges toward parsimony without dominating the fit term, the same role the 0.01 coefficient plays in the claim.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Antonakakis in view of Schiavoni and Rosenberg, which together provide a method for optimizing fingerprint precision parameters using a combined homogeneity-completeness cluster-quality score, with the teachings of Coq, which introduces an information-criterion framework incorporating a log-scaled penalty term weighted by a small calibration coefficient to balance model fit against parameter complexity. One of ordinary skill in the art would recognize the ability to incorporate Coq's complexity-penalty term into the combined parameter optimization score to discourage unnecessarily high precision parameter values. One of ordinary skill in the art would be motivated to make this modification in order to prevent overfitting of the fingerprinting algorithm.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTO-892.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AIDAN EDWARD SHAUGHNESSY whose telephone number is (703)756-1423. The examiner can normally be reached on Monday-Friday from 7:30am to 5pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson, can be reached at telephone number (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/usptoautomated-interview-request-air-form.
/A.E.S./Examiner, Art Unit 2432
/Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
Prosecution Insights