Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 4/15/2025 and 7/3/2025 were filed before the mailing date of a first Office Action on the merits. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1, 8, and 9 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. The claims are generally narrative and indefinite, failing to conform with current U.S. practice. They appear to be a literal translation into English from a foreign document and are replete with grammatical and idiomatic errors. Particularly, the limitation “the placement target area being an area corresponding to part of a file tree managed by the target system and including a file estimated not to be used by a high-risk user who is a user of the target system in normal work of the high-risk user among one or more files accessed by the high-risk user” is unclear.
Claims 5 and 6 recite the limitation "when the notification data is transmitted from outside the target system". There is insufficient antecedent basis for this limitation in the claim because there is no prior reference of “the notification data is transmitted from outside the target system”. For the purposes of compact prosecution, this limitation is being interpreted to be “the notification function being a function to transmit notification data to outside of a system” from claim 1 (transmitted to outside of the target system, rather than transmitted from outside the target system).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, and 8-9 are rejected under 35 U.S.C. 103 as being unpatentable over US 20100077483 A1 Stolfo, et al., (hereinafter Stolfo) in view of US 20170206353 A1 Jai, et al. (hereinafter Jai).
Regarding claim 1, Stolfo teaches a placement location selection device comprising processing circuitry to: embed a notification function in a target file that is present in a placement target area (Stolfo; [0012], [0041-0042]), the notification function being a function to transmit notification data to outside of a system where the target file is stored when the target file is opened outside a target system (Stolfo; [0012], [0041-0042]), and monitor whether the notification data has been transmitted (Stolfo; [0041-0042]), wherein the file tree is a file system that hierarchically manages a plurality of files (Stolfo; [0145]; the examiner notes that although the reference does not explicitly disclose that the file system is hierarchically managed, the examiner argues that it is obvious from the example given in [0145] that the referenced file system is hierarchically managed).
Stolfo does not teach, the placement target area being an area corresponding to part of a file tree managed by the target system and including a file estimated not to be used by a high-risk user who is a user of the target system in normal work of the high-risk user among one or more files accessed by the high-risk user.
Jai teaches, the placement target area being an area corresponding to part of a file tree managed by the target system (Jai; [0021]) and including a file estimated not to be used by a high-risk user who is a user of the target system in normal work of the high-risk user among one or more files accessed by the high-risk user (Jai; [0021] "On the other hand, the baits may have characteristics for not being accessed by users for preventing from mistaking user access of baits as malicious data alteration by malware").
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified the teachings of Stolfo to incorporate the teachings of Jai to have a placement location selection device capable of having a target file not estimated to be accessed by a high-risk user. By having a dummy file that has characteristics for not being accessed by users, the teachings of Jai yield the predictable benefit of preventing accidentally access of the bait file (Jai; [0021]).
Regarding claim 8, Stolfo teaches a placement location selection method comprising: embedding a notification function in a target file that is present in a placement target area (Stolfo; [0012], [0041-0042]), the notification function being a function to transmit notification data to outside of a system where the target file is stored when the target file is opened outside a target system (Stolfo; [0012], [0041-0042]), and monitoring whether the notification data has been transmitted, by the computer, wherein the file tree is a file system that hierarchically manages a plurality of files (Stolfo; [0145]; the examiner notes that although the reference does not explicitly disclose that the file system is hierarchically managed, the examiner argues that it is obvious from the example given in [0145] that the referenced file system is hierarchically managed).
Stolfo does not teach, the placement target area being an area corresponding to part of a file tree managed by the target system and including a file estimated not to be used by a high-risk user who is a user of the target system in normal work of the high-risk user among one or more files accessed by the high-risk user, by a computer.
Jai teaches, the placement target area being an area corresponding to part of a file tree managed by the target system (Jai; [0021]) and including a file estimated not to be used by a high-risk user who is a user of the target system in normal work of the high-risk user among one or more files accessed by the high-risk user (Jai; [0021] "On the other hand, the baits may have characteristics for not being accessed by users for preventing from mistaking user access of baits as malicious data alteration by malware").
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified the teachings of Stolfo to incorporate the teachings of Jai to have a placement location selection device capable of having a target file not estimated to be accessed by a high-risk user. By having a dummy file that has characteristics for not being accessed by users, the teachings of Jai yield the predictable benefit of preventing accidentally access of the bait file (Jai; [0021]).
Regarding claim 9, Stolfo a non-transitory computer readable medium storing a placement location selection program that causes a placement location selection device, which is a computer, to execute (Stolfo; [0017]): a web bug embedding process of embedding a notification function in a target file that is present in a placement target area (Stolfo; [0012], [0041-0042], [0095]; the examiner notes that the referenced "beacon" is analogous to the disclosed web bug), the notification function being a function to transmit notification data to outside of a system where the target file is stored when the target file is opened outside a target system (Stolfo; [0012], [0041-0042]), and a beacon monitoring process of monitoring whether the notification data has been transmitted, wherein the file tree is a file system that hierarchically manages a plurality of files (Stolfo; [0095], [0145]; the examiner notes that although the reference does not explicitly disclose that the file system is hierarchically managed, the examiner argues that it is obvious from the example given in [0145] that the referenced file system is hierarchically managed).
Stolfo does not teach, the placement target area being an area corresponding to part of a file tree managed by the target system and including a file estimated not to be used by a high-risk user who is a user of the target system in normal work of the high-risk user among one or more files accessed by the high-risk user, by a computer.
Jai teaches, the placement target area being an area corresponding to part of a file tree managed by the target system (Jai; [0021]) and including a file estimated not to be used by a high-risk user who is a user of the target system in normal work of the high-risk user among one or more files accessed by the high-risk user (Jai; [0021] "On the other hand, the baits may have characteristics for not being accessed by users for preventing from mistaking user access of baits as malicious data alteration by malware").
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified the teachings of Stolfo to incorporate the teachings of Jai to have a placement location selection device capable of having a target file not estimated to be accessed by a high-risk user. By having a dummy file that has characteristics for not being accessed by users, the teachings of Jai yield the predictable benefit of preventing accidentally access of the bait file (Jai; [0021]).
Regarding claim 2, Stolfo (in view of Jai) teaches the placement location selection device according to claim 1. Stolfo additionally teaches, wherein the notification data includes information indicating the target file and a user who has opened the target file (Stolfo; [0165]) .
Regarding claim 3, Stolfo (in view of Jai) teaches the placement location selection device according to claim 1. Stolfo additionally teaches wherein the notification function is realized by a web bug (Stolfo; [0095], the examiner notes that the referenced "beacon" is analogous to the disclosed web bug).
Claims 4 and 5 are rejected under 35 U.S.C. 103 as being unpatentable over US 20100077483 A1 Stolfo, et al., (hereinafter Stolfo) in view of US 20170206353 A1 Jai, et al. (hereinafter Jai) and US 12381876 B2 Jeffords, et al., (hereinafter Jeffords).
Regarding claim 4, Stolfo (in view of Jai) teaches the placement location selection device according to claim 1. Stolfo (in view of Jai) does not teach, wherein the processing circuitry calculates a risk value corresponding to each user based on an access pattern in the target system of each user of the target, and wherein the high-risk user is a user whose corresponding risk value is equal to or greater than a risk reference value among users of the target system.
Jeffords teaches, wherein the processing circuitry calculates a risk value corresponding to each user based on an access pattern in the target system of each user of the target system (Jeffords; Column 2, Lines 6-20), and wherein the high-risk user is a user whose corresponding risk value is equal to or greater than a risk reference value among users of the target system (Jeffords; Column 26, lines 7-8 "machine learning model 218 access request risk score; may be numeric or categorical (e.g., low, medium, high"; the examiner notes that although the reference does not explicitly teach that a "high" risk score is in reference to being above a threshold, it would be obvious that a referenced "high" risk score would be above a certain threshold in relation to the "medium" and "low" score. The reference teaches another "entropy score" that is considered "high" when above a defined threshold (Jeffords; Column 15, lines 37-49)).
It would be prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified the teachings of Stolfo (in view of Jai) to additionally incorporate the teachings of Jeffords to provide a placement selection device capable of calculating a risk value corresponding to a user’s access patterns. It would have been reasonable for one of ordinary skill in the art to incorporate the teachings of Jeffords to improve the teachings of Stolfo (in view of Jai) to yield the predictable benefit of avoiding the potential delays caused by having humans review access requests rather than having them automatically reviewed based on the user’s access patterns (Jeffords; Abstract).
Regarding claim 5, Stolfo (in view of Jai and Jeffords) teaches the placement location selection device according to claim 4.
Jeffords teaches wherein the processing circuitry raises the risk value corresponding to the high-risk user when the notification data is transmitted (Jeffords; Column 16, lines 46-56; the examiner notes the reference discloses that the risk score is raised in response to an anomaly, but the reference also teaches than anomalies may raise alerts (see Column 12, lines 35-37)).
Jeffords does not teach wherein the notification data is transmitted to outside the target system.
Stolfo teaches wherein the notification data is transmitted to outside the target system (Stolfo; [0012], [0041-0042]; the examiner notes that in response to the transmission of the notification, the beacon provides a 2nd indication that differentiates between the decoy and actual information (Stolfo [0015])).
It would be prima facie obvious to one of ordinary skill in the art to have modified the teachings of Jeffords to incorporate the teachings of Stolfo to have the notification transmitted to outside the target system. It would have been reasonable for one of ordinary skill in the art to have modified the inventions in this manner because having the notification transmitted to outside the system would not have changed the functions of the inventions of Jeffords. Jeffords merely teaches that the risk score is raised in response to an anomaly (which the anomaly may raise an alert) (Jeffords; Column 12, lines 35-37, Column 16, lines 46-56).
Claims 6 and 7 are rejected under 35 U.S.C. 103 as being unpatentable over US 20100077483 A1 Stolfo, et al., (hereinafter Stolfo) in view of US 20170206353 A1 Jai, et al. (hereinafter Jai) and US 20190332766 Guri, et al., (hereinafter Guri).
Regarding claim 6, Stolfo (in view of Jai) teaches the placement location selection device according to claim 1. Stolfo does not teach, wherein when the notification data is transmitted from outside the target system, the processing circuitry checks whether a target file corresponding to the transmitted notification data is registered in a take-out file database in which each file legitimately taken outside the target system is registered.
Guri teaches, wherein when the notification data is transmitted from outside the target system (Guri; [0057-0060]; the examiner notes that the database would be considered outside the target system), the processing circuitry checks whether a target file corresponding to the transmitted notification data is registered in a take-out file database in which each file legitimately taken outside the target system is registered (Guri; [0057-0060]; the examiner notes that [0057] discloses a file access operation can include a "copy operation" which is analogous to taking a file outside the system).
It would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to have incorporated the teachings of Stolfo (in view of Jai) with the teachings of Guri to additionally have a take-out file database capable of registering files taken out of the system. Doing so would yield the predictable benefit of additionally screening to see if the copy operation was a malicious process (Guri; [0057-60]).
Regarding claim 7, Stolfo (in view of Jai and Guri) teaches the placement selection device according to claim 6.
Guri teaches wherein the take-out file database is part of a workflow system (Guri; [0038]; the examiner notes that the reference discloses that the techniques described herein are automated).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHRISTOPHER LAM whose telephone number is (571)272-8912. The examiner can normally be reached Monday-Friday 7:30-5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached at 572-272-8912. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/C.L./Examiner, Art Unit 2435
/J. BRANT MURPHY/Primary Examiner, Art Unit 2435
Prosecution Insights