Prosecution Insights
Last updated: August 17, 2026
Application No. 19/046,725

PHISHING DETECTION ENGINE(S) FOR AUTONOMOUS PHISHING IDENTIFICATION

Non-Final OA §102§103
Filed
Feb 06, 2025
Examiner
ABRISHAMKAR, KAVEH
Art Unit
2494
Tech Center
2400 — Computer Networks
Assignee
Microsoft Technology Licensing, LLC
OA Round
1 (Non-Final)
78%
Grant Probability
Favorable
1-2
OA Rounds
1y 6m
Est. Remaining
95%
With Interview

Examiner Intelligence

Grants 78% — above average
78%
Career Allowance Rate
811 granted / 1038 resolved
+20.1% vs TC avg
Strong +17% interview lift
Without
With
+17.1%
Interview Lift
resolved cases with interview
Typical timeline
3y 0m
Avg Prosecution
14 currently pending
Career history
1056
Total Applications
across all art units

Statute-Specific Performance

§101
12.7%
-27.3% vs TC avg
§103
41.0%
+1.0% vs TC avg
§102
22.3%
-17.7% vs TC avg
§112
9.0%
-31.0% vs TC avg
Black line = Tech Center average estimate • Based on career data from 1038 resolved cases

Office Action

§102 §103
DETAILED ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . 1. This action is in response to the communication filed on February 6, 2025. Claims 1-20 were originally received for consideration. No preliminary amendments for the claims have been received. 2. Claims 1-20 are currently pending consideration. Information Disclosure Statement 3. An initialed and dated copy of Applicant’s IDS (form 1449), received on April 2, 2026, is attached to this Office Action. Claim Rejections - 35 USC § 102 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention. 4. Claim(s) 1-3, 5-6, 15-17 and 20 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Bowditch et al. (U.S. Patent Pub. No. US 2020/0358819). Regarding claim 1, Bowditch discloses: A computing apparatus comprising: a computer-readable storage media (paragraph 0041: storage device); a phishing detection engine (paragraph 0024: detection and extraction processor) comprising processor-executable instructions stored on the computer-readable storage media; and a processor coupled to the computer-readable storage media and configured to execute the processor-executable instructions, wherein the processor-executable instructions, when executed by the processor, direct the computing apparatus, to at least: determine focal content displayed on a user interface of a client device (paragraphs 0025-0026, 0029, 0039: a computer vision model is configured to extract or obtain one or more screenshots or images of an email, webpage, login page); extract a plurality of features from the focal content (paragraphs 0026, 0030, 0039: the extraction processor can include one or more feature extractors to extract a domain or URL associated with the request, keywords in an email, or other features indicative of an attack); detect potential phishing activity by processing the plurality of features using a machine-learning model (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity); and perform a security action to limit execution of the potential phishing activity responsive to detection (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues). Claim 2 is rejected as applied above in rejecting claim 1. Furthermore, Bowditch discloses: The computing apparatus of claim 1, wherein the processor-executable instructions to detect the potential phishing activity by processing the plurality of features using the machine- learning model, when executed by the processor, further direct the computing apparatus to: generate a prompt comprising the plurality of features and a request to detect phishing activity from the plurality of features (paragraph 30: can provide the retrieved screenshot as one or more inputs to the machine learning models); submit the prompt as an input into the machine-learning model (Fig. 1, paragraph 0030: the input is submitted to the classifier); receive a score for the plurality of features as an output from the machine-learning model (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity); determine a risk level that the plurality of features correspond to phishing activity based on the score (paragraphs 0037-0039: determining that a probability exceeds a threshold to allow a user to determine whether or not to proceed to a webpage); and detect the potential phishing activity based on the risk level (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity). Claim 3 is rejected as applied above in rejecting claim 1. Furthermore, Bowditch discloses: The computing apparatus of claim 1, wherein the processor-executable instructions to extract a plurality of features from the focal content, when executed by the processor, further direct the computing apparatus to: detect an application displaying active content on the user interface, wherein the active content comprises the focal content (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page); capture an image of the active content displayed by the application content (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page); and extract textual elements from the image (paragraphs 0026, 0030, 0039: the extraction processor can include one or more feature extractors to extract a domain or URL associated with the request, keywords in an email, or other features indicative of an attack). Claim 5 is rejected as applied above in rejecting claim 1. Furthermore, Bowditch discloses: The computing apparatus of claim 1, wherein the processor-executable instructions to perform the security action to limit execution of the potential phishing activity responsive to detection, when executed by the processor, further direct the computing apparatus to: block execution of an activation step for the potential phishing activity (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues). Claim 6 is rejected as applied above in rejecting claim 1. Furthermore, Bowditch discloses: The computing apparatus of claim 1, wherein the phishing detection engine is executed locally on the client device (paragraph 0041: the system can be part of an information handling system which can be on a personal computer or mobile device). Regarding claim 15, Bowditch discloses: A computer readable storage media comprising processor-executable instructions configured to cause a processor to: determine, by a phishing detection engine, first content displayed via a user interface on a client device (paragraphs 0025-0026, 0029, 0039: a computer vision model is configured to extract or obtain one or more screenshots or images of an email, webpage, login page); extract, by the phishing detection engine, a plurality of features from the first content (paragraphs 0026, 0030, 0039: the extraction processor can include one or more feature extractors to extract a domain or URL associated with the request, keywords in an email, or other features indicative of an attack); detect, by the phishing detection engine, potential phishing activity from the plurality of features (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity); determine, by the phishing detection engine, a risk level of the potential phishing activity (paragraphs 0037-0039: determining that a probability exceeds a threshold to allow a user to determine whether or not to proceed to a webpage); and perform, by the phishing detection engine, a security action to limit execution of the potential phishing activity based on the risk level (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues). Claim 16 is rejected as applied above in rejecting claim 15. Furthermore, Bowditch discloses: The computer readable storage media of claim 15, wherein the processor-executable instructions to detect, by the phishing detection engine, the potential phishing activity from the plurality of features cause the processor to further execute processor-executable instructions stored in the computer readable storage media to: generate, by the phishing detection engine, a prompt comprising the plurality of features (paragraph 30: can provide the retrieved screenshot as one or more inputs to the machine learning models); submit, by the phishing detection engine, the prompt as input into a machine-learning model (Fig. 1, paragraph 0030: the input is submitted to the classifier); and receive, by the phishing detection engine, an output from the machine-learning model comprising one or more phishing features from the plurality of features that indicate potential phishing activity (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity). Claim 17 is rejected as applied above in rejecting claim 15. Furthermore, Bowditch discloses: The computer readable storage media of claim 15, wherein: the processor-executable instructions to determine, by the phishing detection engine, the risk level of the potential phishing activity cause the processor to further execute processor- executable instructions stored in the computer readable storage media to: determine, by the phishing detection engine, that the potential phishing activity is high risk (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues); and the processor-executable instructions to perform, by the phishing detection engine, the security action to limit execution of the potential phishing activity based on the risk level (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues) cause the processor to further execute processor-executable instructions stored in the computer readable storage media to: block, by the phishing detection engine, an activation step of the potential phishing activity (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues). Claim 20 is rejected as applied above in rejecting claim 15. Furthermore, Bowditch discloses: The computer readable storage media of claim 15, wherein: the processor-executable instructions to determine, by the phishing detection engine, the first content displayed via the user interface on the client device cause the processor to further execute processor-executable instructions stored in the computer readable storage media to: detect, by the phishing detection engine, an application displaying active content on the user interface (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page); and capture, by the phishing detection engine, a screenshot of the active content being displayed (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page); and the processor-executable instructions to extract, by the phishing detection engine, the plurality of features from the first content (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page) cause the processor to further execute processor- executable instructions stored in the computer readable storage media to: extract, by the phishing detection engine, the first content from the screenshot (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page), wherein the first content comprises one or more of: textual elements; or image elements (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page). Claim Rejections - 35 USC § 103 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 5. Claim(s) 4, 7-14, 18 and 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bowditch et al. (U.S. Patent Pub. No. US 2020/0358819) in view of O’Connell et al. (US 2007/0239604). Claim 4 is rejected as applied above in rejecting claim 1. Furthermore, Bowditch discloses: The computing apparatus of claim 1, wherein the processor-executable instructions detect the potential phishing activity by processing the plurality of features using the machine- learning model, when executed by the processor, further direct the computing apparatus to: submit the plurality of features to the machine-learning model (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity); receive an indeterminate score as output from the machine-learning model (paragraphs 0037-0039: determining that a probability exceeds a threshold to allow a user to determine whether or not to proceed to a webpage). Bowditch does not explicitly disclose monitoring subsequent content interactions performed via the user interface with the focal content and detecting the potential phishing activity based on the subsequent content interactions. In an analogous art, O’Connell discloses a method for fraud detection where the user-browser interaction data is monitored, wherein the interaction data includes keyboard interactions, navigation/selection tendencies, or movement device interactions (paragraph 0027). Furthermore, O’Connell discloses that the fraud detection server may then determine fraud detection results based on the user-browser interaction during the current session and known fraudulent behavioral patterns and return the fraud detection results to the user (paragraph 0024). It would have been obvious to one of ordinary skill in the art to use O’Connell’s monitoring of subsequent interactions in order to provide more information to make a confident conjecture on a possible phishing attempt thereby increasing the confidence on properly identifying phishing attempts (O’Connell: paragraph 0024). Regarding claim 7, Bowditch discloses: A method comprising: capturing, by a phishing detection engine, first content displayed via a user interface on a client device (paragraphs 0025-0026, 0029, 0039: a computer vision model is configured to extract or obtain one or more screenshots or images of an email, webpage, login page); detecting, by the phishing detection engine, potential phishing activity from the first content (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity); and performing, by the phishing detection engine, a security action to limit potential damage of the phishing activity (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues). Bowditch does not explicitly disclose monitoring, by the phishing detection engine, subsequent content interactions performed via the user interface and determining, by the phishing detection engine, a high-risk of phishing activity based on the subsequent content interactions. Bowditch does not explicitly disclose monitoring subsequent content interactions performed via the user interface with the focal content and detecting the potential phishing activity based on the subsequent content interactions. In an analogous art, O’Connell discloses a method for fraud detection where the user-browser interaction data is monitored, wherein the interaction data includes keyboard interactions, navigation/selection tendencies, or movement device interactions (paragraph 0027). Furthermore, O’Connell discloses that the fraud detection server may then determine fraud detection results based on the user-browser interaction during the current session and known fraudulent behavioral patterns and return the fraud detection results to the user (paragraph 0024). It would have been obvious to one of ordinary skill in the art to use O’Connell’s monitoring of subsequent interactions in order to provide more information to make a confident conjecture on a possible phishing attempt thereby increasing the confidence on properly identifying phishing attempts (O’Connell: paragraph 0024). Claim 8 is rejected as applied above in rejecting claim 7. Furthermore, Bowditch discloses: The method of claim 7, wherein detecting, by the phishing detection engine, the potential phishing activity from the first content comprises: submitting, by the phishing detection engine, the first content as input into a machine- learning model (Fig. 1, paragraph 0030: the input is submitted to the classifier); and identifying, by the phishing detection engine, the potential phishing activity from an output of the machine-learning model (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity). Claim 9 is rejected as applied above in rejecting claim 7. Furthermore, Bowditch discloses: The method of claim 7, wherein monitoring, by the phishing detection engine, the subsequent content interactions performed via the user interface comprises: capturing, by the phishing detection engine, focal content displayed via the user interface at predefined time intervals after detecting the potential phishing activity from the first content (paragraphs 0025-0026, 0029, 0039: a computer vision model is configured to extract or obtain one or more screenshots or images of an email, webpage, login page); and processing, by the phishing detection engine, the focal content captured at the predefined time intervals for additional phishing activity (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity). Claim 10 is rejected as applied above in rejecting claim 7. Furthermore, O’Connell discloses: The method of claim 7, wherein: monitoring, by the phishing detection engine, the subsequent content interactions performed via the user interface comprises: detecting, by the phishing detection engine, a user interaction with the first content, wherein the user interaction causes second content to be displayed via the user interface (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); and detecting, by the phishing detection engine, one or more phishing features present in the second content (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); and determining, by the phishing detection engine, the high-risk of phishing activity based on the subsequent content interactions comprises: determining, by the phishing detection engine, the high-risk of phishing activity based on the one or more phishing features present in the second content (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior). Claim 11 is rejected as applied above in rejecting claim 7. Furthermore, O’Connell discloses: The method of claim 7, wherein detecting, by the phishing detection engine, the potential phishing activity from the first content comprises: detecting, by the phishing detection engine, one or more phishing features present in the first content (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); identifying, by the phishing detection engine, a plurality of historical user interactions associated with the client device (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); comparing, by the phishing detection engine, the one or more phishing features to the plurality of historical user interactions (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); and determining, by the phishing detection engine, that the first content comprises the potential phishing activity based on the comparison of the one or more phishing features to the plurality of historical user interaction (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior). Claim 12 is rejected as applied above in rejecting claim 7. Furthermore, O’Connell discloses: The method of claim 7, wherein the method further comprises: capturing, by the phishing detection engine, second content displayed via the user interface on the client device (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); detecting, by the phishing detection engine, potential phishing activity from the second content (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); detecting, by the phishing detection engine, one or more phishing features present in the second content (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); identifying, by the phishing detection engine, a plurality of historical user interactions associated with the client device (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); comparing, by the phishing detection engine, the one or more phishing features to the plurality of historical user interactions (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); and determining, by the phishing detection engine, a low risk of phishing activity for the second content based on the comparison of the one or more phishing features to the plurality of historical user interactions (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior). Claim 13 is rejected as applied above in rejecting claim 7. Furthermore, Bowditch discloses: The method of claim 7, wherein capturing, by the phishing detection engine, the first content displayed via the user interface on the client device comprises: detecting, by the phishing detection engine, an application displaying active content on the user interface (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page); capturing, by the phishing detection engine, a screenshot of the active content being displayed (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page); and extracting, by the phishing detection engine, the first content from the screenshot (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page), wherein the first content comprises one or more of: textual elements; or image elements (paragraphs 0029-0031: the extraction processor extracts or obtains screenshots or images of an email, webpage, or login page). Claim 14 is rejected as applied above in rejecting claim 7. Furthermore, Bowditch discloses: The method of claim 7, wherein the method further comprises: detecting, by the phishing detection engine, execution of the phishing activity (paragraphs 0030-0032, 0039: based on the extracted screenshot or image information, the machine learning model determines the probability that the screen or image are indicative of malicious activity/phishing activity); and performing, by the phishing detection engine, the security action to limit potential damage of the phishing activity (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues) comprises: generating, by the phishing detection engine, a summary of the phishing activity (paragraph 0051: generating a log or report in response to detecting phishing activity), wherein the summary comprises: screenshots of the subsequent content interactions (paragraph 0051: generating a log or report in response to detecting phishing activity); and identification of one or more phishing features within the first content that correspond to the phishing activity (paragraph 0051: generating a log or report in response to detecting phishing activity); and providing, by the phishing detection engine, the summary to a security system associated with the phishing detection engine (paragraph 0051: generating a log or report in response to detecting phishing activity). Claim 18 is rejected as applied above in rejecting claim 15. Furthermore, Bowditch discloses: The computer readable storage media of claim 15, wherein: the processor-executable instructions to determine, by the phishing detection engine, the risk level of the potential phishing activity cause the processor to further execute processor- executable instructions stored in the computer readable storage media to: determine, by the phishing detection engine, that the risk level of the potential phishing activity is indeterminate (paragraphs 0037-0039: determining that a probability exceeds a threshold to allow a user to determine whether or not to proceed to a webpage); and prevent, by the phishing detection engine, further content interactions with the first content on the user interface based on the potential phishing activity being high risk (paragraphs 0037-0039: the processor can provide an alert, alarm or other notification of a phishing attack including a pop-up window which will allow the user to prevent future communications with the webpage/domain such as to prevent the webpage from creating additional dialogues). Bowditch does not explicitly disclose monitoring subsequent content interactions with the first content performed via the user interface, reevaluating, by the phishing detection engine, the risk level of the potential phishing activity in view of the subsequent content interactions and determining, by the phishing detection engine, that the potential phishing activity is high risk based on the subsequent content interaction. In an analogous art, O’Connell discloses a method for fraud detection where the user-browser interaction data is monitored, wherein the interaction data includes keyboard interactions, navigation/selection tendencies, or movement device interactions (paragraph 0027). Furthermore, O’Connell discloses that the fraud detection server may then determine fraud detection results based on the user-browser interaction during the current session and known fraudulent behavioral patterns and return the fraud detection results to the user (paragraph 0024). It would have been obvious to one of ordinary skill in the art to use O’Connell’s monitoring of subsequent interactions in order to provide more information to make a confident conjecture on a possible phishing attempt thereby increasing the confidence on properly identifying phishing attempts (O’Connell: paragraph 0024). Claim 19 is rejected as applied above in rejecting claim 15. Furthermore, Bowditch does not explicitly discloses instructions configured to: capture, by the phishing detection engine, second content displayed via the user interface on the client device; detect, by the phishing detection engine, potential phishing activity from the second content; detect, by the phishing detection engine, one or more phishing features present in the second content; identify, by the phishing detection engine, a plurality of historical user interactions associated with the client device; and determine, by the phishing detection engine, a low risk of phishing activity for the second content based on the plurality of historical user interactions and the one or more phishing features of the second content. In an analogous art, O’Connell discloses capturing, by the phishing detection engine, second content displayed via the user interface on the client device (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); detecting, by the phishing detection engine, potential phishing activity from the second content (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); detecting, by the phishing detection engine, one or more phishing features present in the second content (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); identifying, by the phishing detection engine, a plurality of historical user interactions associated with the client device (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); comparing, by the phishing detection engine, the one or more phishing features to the plurality of historical user interactions (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior); and determining, by the phishing detection engine, a low risk of phishing activity for the second content based on the comparison of the one or more phishing features to the plurality of historical user interactions (paragraph 0047-0049: automated program detector may compare the user-browser interaction data with known fraudulent behavior). It would have been obvious to one of ordinary skill in the art to use O’Connell’s monitoring of subsequent interactions in order to provide more information to make a confident conjecture on a possible phishing attempt thereby increasing the confidence on properly identifying phishing attempts (O’Connell: paragraph 0024). Conclusion Any inquiry concerning this communication or earlier communications from the examiner should be directed to KAVEH ABRISHAMKAR whose telephone number is (571)272-3786. The examiner can normally be reached M-F 9-5:30. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung Kim can be reached at 571-272-3804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /KAVEH ABRISHAMKAR/ 07/30/2026Primary Examiner, Art Unit 2494
Read full office action

Prosecution Timeline

Feb 06, 2025
Application Filed
Aug 03, 2026
Non-Final Rejection mailed — §102, §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12707264
Smart wearable devices and system therefor
2y 11m to grant Granted Aug 11, 2026
Patent 12699778
RISK SCORING USING SUPERVISED MACHINE LEARNING
2y 8m to grant Granted Aug 04, 2026
Patent 12695776
METHOD OF CYBER SECURITY AND SYSTEM THEREOF
2y 5m to grant Granted Jul 28, 2026
Patent 12683787
METHOD AND SYSTEM OF ASSESSING, REMEDIATING, AND MAINTAINING NON-FUNGIBLE TOKENS (NFTS)
2y 2m to grant Granted Jul 14, 2026
Patent 12684018
CLOUD SECURITY VISUAL DASHBOARD
2y 1m to grant Granted Jul 14, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

1-2
Expected OA Rounds
78%
Grant Probability
95%
With Interview (+17.1%)
3y 0m (~1y 6m remaining)
Median Time to Grant
Low
PTA Risk
Based on 1038 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month