DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claims 1-20 are pending.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the "right to exclude" granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the conflicting application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b).
"A later patent claim is not patentably distinct from an earlier patent claim if the later claim is obvious over, or anticipated by, the earlier claim. In re Longi, 759 F.2d at 896, 225 USPQ at 651 (affirming a holding of obviousness-type double patenting because the claims at issue were obvious over claims in four prior art patents); In re Berg, 140 F.3d at 1437, 46 USPQ2d at 1233 (Fed. Cir. 1998) (affirming a holding of obviousness-type double patenting where a patent application claim to a genus is anticipated by a patent claim to a species within that genus). " ELI LILLY AND COMPANY v BARR LABORATORIES, INC., United States Court of Appeals for the Federal Circuit, ON PETITION FOR REHEARING EN BANC (DECIDED: May 30, 2001).
Claims 1-20 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over claims 1-16 of U.S. Patent No. 12,390,116. Claims 1-16 of US Patent No. 12,390,116 contains every element of claim 1-20 of the instant application and as such anticipate claim 1-20 of the instant application. Although the conflicting claims are not identical, they are not patentably distinct from each other.
Claim Rejections - 35 USC § 101
835 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-18 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
The claims when analyzed under 2019 Revised Patent Subject Matter Eligibility Guidance, are directed to abstract idea. Claim 1 for example, recites a system and, therefore, is a machine. The claim recites the limitation of “…collect new hostnames…select candidate shadow domain from the new hostnames…perform classification of the candidate shadow domains …perform post-processing on the set of identified shadowed domains…perfume an action…”. These limitations, under broadest reasonable interpretation are directed performance of the limitation in a human mind or by a human. That is, nothing in the claim element precludes the step from practically being performed by human or in the mind. For example, the claim encompasses a human simply collecting new hostnames, selecting candidate shadow domains from the new hostnames, performing classification of the candidate shadow domains…to output a set of identified shadowed domains…perform post-processing on the set of identified shadowed domains; and performing an action based on the set of identified shadowed domain. Thus, the claim is directed to abstract idea when analyzed under step 2A prong 1.
Claim 1 is further analyzed in step 2A prong 2, to evaluate whether the claim as a whole integrates the recited judicial exception into a practical application of the exception. This evaluation is performed by identifying whether there are any additional elements recited in the claim beyond the judicial exception, and evaluating those additional elements individually and in combination to determine whether the claim as a whole integrates the exception into a practical application. However, each of the remaining limitation (i.e., processor, memory) appears to be generic computer functions which do not constitute meaningful limitations that would amount to significantly more than the abstract idea. The combination of these additional element is no more than generic computer functions. Thus, even in combination, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limitations on practicing the abstract idea.
Claim 1 is additionally analyzed under Step 2B to evaluates whether the claim as a whole amount to significantly more than the recited exception, whether any additional element, or combination of additional elements, adds an inventive concept to the claim. When claims evaluated under step 2B, it is no more than what is well-understood, routine, conventional activity in the field. The specification does not provide any indication anything other than a generic computer component. The mere collecting of new hostnames, selecting candidate shadowed domains, performing classification, perform post-processing and performing action is a well-understood, routing and conventional function when it is claimed in a merely generic manner as it is here.
Independent claims 9 and 16 include limitations similar to the limitations of claim 1 and is rejected under 35 U.S.C. 101 as being directed to abstract idea for the same reasons discussed above with respect to claim 1.
Claim 2 narrows the collecting of the new hostnames to include, determine whether a newly observed hostname (NOH) from a new hostnames dataset is found in an allowlist; and in the event that the NOH is found in the allowlist, determine that the NOH is not shadowed, which could be performed by a human. The claims do not recite additional elements that amounts to significantly more than the judicial exception, do not improve the functioning of the computer or other technology or technical field, and do not provide an inventive concept sufficient to transform the judicial exception into paten-eligible subject matter.
Claims 3, 10 and 17 narrow the performing of the classification of the candidate shadowed domains to include, extract the plurality of features relating to the candidate shadowed domains; and perform the classification of the candidate shadowed domains using a model or a set of rules, which could be performed by a human. The claims do not recite additional elements that amounts to significantly more than the judicial exception, do not improve the functioning of the computer or other technology or technical field, and do not provide an inventive concept sufficient to transform the judicial exception into paten-eligible subject matter.
Claims 4, 5, 11, 12 and 18 recite the additional elements of a machine learning model and a neural network, which are generic computer component. The claims do not recite additional elements that amounts to significantly more than the judicial exception, do not improve the functioning of the computer or other technology or technical field, and do not provide an inventive concept sufficient to transform the judicial exception into paten-eligible subject matter.
Claims 6 and 13 recite, wherein the performing of the post-processing on the set of identified shadowed domains, comprising to: compare a subnetwork of an IP address of an identified shadowed domain with a subnetwork of an IP address of a root domain associated with the identified shadowed domain; and in response to a determination that the subnetwork of an IP address of the identified shadowed domain matches the subnetwork of an IP address of the root domain associated with the identified shadowed domain, determine that the identified shadowed domain is likely benign, which could be performed by human. The claims do not recite additional elements that amounts to significantly more than the judicial exception, do not improve the functioning of the computer or other technology or technical field, and do not provide an inventive concept sufficient to transform the judicial exception into paten-eligible subject matter.
.
Claims 7, 14 and 19 recites, wherein the performing of the post-processing on the set of identified shadowed domains, comprising to: compare a time since creation of an identified shadowed domain with a predefined threshold; and in response to a determination that the time since creation of the identified shadowed domain is equal to or exceeds the predefined threshold, determine that the identified shadowed domain is not shadowed, which could be performed by human. The claims do not recite additional elements that amounts to significantly more than the judicial exception, do not improve the functioning of the computer or other technology or technical field, and do not provide an inventive concept sufficient to transform the judicial exception into paten-eligible subject matter.
Claims 8, 15 and 20 recite, wherein the performing of the post-processing on the set of identified shadowed domains, comprising to: compare a time since a root domain of an identified shadowed domain was registered with a predefined threshold; and in response to a determination that the time since the root domain of the identified shadowed domain was registered is less than or equal to the predefined threshold, determine that the identified shadowed domain is not shadowed, which could be performed by human. The claims do not recite additional elements that amounts to significantly more than the judicial exception, do not improve the functioning of the computer or other technology or technical field, and do not provide an inventive concept sufficient to transform the judicial exception into paten-eligible subject matter.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 7-10, 14-17, 19 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Stemm et al. (US Patent No.10,264,017 ), hereinafter Stemm, in view of Rolette et al. (US Publication No. 2016/0269362), hereinafter Rolette, further in view of Berger et al. (US Publication No. 2022/0394060), hereinafter Berger.
As per claims 1, 9 and 16, Stemm discloses, a system, comprising: a processor configured to: collect new hostnames [for a predetermined period of time] (column 1, lines 39-43, “A system may receive strings from various sources …the string may include IP addresses, hostnames, domains, name servers…”, and column 2, line 63-column 4, line 54, device 110 receives data form plurality of sources, for example from host name registration feed 101, hostname encounter feed 102, spam filtering feed 103, mobile security feed 104, e-mail security feed 105 and/or a DNS query feed 106); select candidate shadowed domains from the new hostnames (column 1, lines 47-50, “the system may filter the input set of string to identify the subset of strings that are of interest”, column 3, lines 63-66”); perform classification of the candidate shadowed domains based on a plurality of features relating to the candidate shadowed domains to output a set of identified shadowed domains (column 4, lines 12-35, and column 8, lines 6-14, “The DNS module 115 may retrieve DNS information associated with the string(s) of the subset of 122, and the rule-based engine 116 may be executed to determine, based on application of oner or more rules to DNS information whether to add the string(s) to the set 123 of ‘bad’ string”); and perform an action based on the set of identified shadowed domains (column 8, lines 29-35, “provide the set 123 of "bad" strings to a mobile security application 141, an e-mail security application 142, a DDoS mitigation application 143, a DNS security application 144, and/or other applications/devices. The applications 141-144 may use the set 123 of "bad" strings to make security decisions”) and a memory coupled to the processor and configured to provide the processor with instructions (figure 7, column 10, lines 40-66).
While Stemm discloses collect new hostnames, Stemm does not explicitly disclose collecting is for a predetermined period of time. However, in an analogous art, Rolette discloses, collecting for a predetermined period of time (paragraph [0019], “…The collecting of the domain names can help determine what domain names are used by entities within the network environment 142. The domain names seen during the timeframe can later be used when the enforcement engine is active”).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Stemm with Rolette. This would have been obvious because one of ordinary skill in the art would have been motivated to do so in order to achieve the predictable result of detecting malicious and suspicious activity within a predetermined timeframe.
Stemm in view of Rolette does not explicitly disclose, but in an analogous art, Berger discloses
perform post-processing on the set of identified shadowed domains based on a time associated with an identified shadowed domain (paragraph [0046], [0068], “output a maliciousness score for the first
domain name (and/or the corresponding first domain) based on one or more factors ( e.g.…age of the first domain…”).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Stemm and Rolette with Berger. This would have been obvious because one of ordinary skill in the art would have been motivated to determine likelihood of malicious domain based on the creation time of the domain name.
As per claim 2, Rolette furthermore discloses, wherein the collecting of the new hostnames for the predetermined period of time comprises to: determine whether a newly observed hostname (NOH) from a new hostnames dataset is found in an allowlist; and in the event that the NOH is found in the allowlist, determine that the NOH is not shadowed (paragraph [0036]-[0037], determining if the domain name corresponds to domain name of the whitelist, and forwarding the DNS request to the DNS server when the domain name determined to be on the whitelist/ or not shadowed. It is noted that the whitelist of DNS names is known as good and safe names, a determination of the domain name corresponding to the whitelist and forwarding the request based on the determination is an indication that it is not shadowed).
The motivation would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, providing the benefit of determining non-malicious networks by using list of safe domains and networks.
As per claims 3, 10 and 17, Stemm furthermore discloses, wherein the performing of the classification of the candidate shadowed domains comprises to: extract the plurality of features relating to the candidate shadowed domains; and perform the classification of the candidate shadowed domains using a model or a set of rules (column 4, lines 30-35, and column 8, lines 6-14, “The DNS module 115 may retrieve DNS information associated with the string(s) of the subset of 122, and the rule-based engine 116 may be executed to determine, based on application of one or more rules to DNS information whether to add the string(s) to the set 123 of ‘bad’ string”, and column 7, lines 37 discloses the classification is based on plurality of feature such as IP address, bad hostname, bad name server).
As per claims 7, 14 and 19, Berger furthermore discloses, wherein the performing of the post-processing on the set of identified shadowed domains, comprising to: compare a time since creation of an identified shadowed domain with a predefined threshold; and in response to a determination that the time since creation of the identified shadowed domain is equal to or exceeds the predefined threshold, determine that the identified shadowed domain is not shadowed (paragraph [0035], identified lookalike domain names stored in dictionary index, and paragraph [0046], “identify whether or not the lookalike domain name is malicious based on an age [time since creation] of the domain. For example, the threat detection model may be trained to output a larger likelihood of maliciousness score for newer domains (e.g., domains created less than a threshold or pre-determined time (e.g., less than six weeks, less than one year, or the like)) than for older domains (e.g., prior to the time period)) .
As per claims 8, 15 and 20, Berger furthermore discloses, wherein the performing of the post-processing on the set of identified shadowed domains, comprising to: compare a time since a [[root]] domain of an identified shadowed domain was registered with a predefined threshold; and in response to a determination that the time since the [[root]] domain of the identified shadowed domain was registered exceeding [is less than or equal] to the predefined threshold, determine that the identified shadowed domain is not shadowed (paragraph [0035], identified lookalike domain names stored in dictionary index, and paragraph [0046], “identify whether or not the lookalike domain name is malicious based on an age [time since creation] of the domain. For example, the threat detection model may be trained to output a larger likelihood of maliciousness score for newer domains (e.g., domains created less than a threshold or pre-determined time (e.g., less than six weeks, less than one year, or the like)) than for older domains (e.g., prior to the time period)).
While Berger discloses domain was registered, Berger does not identify the domain as a root domain. However, replacing a domain for a root domain does not affect the functionality of invention as claimed and would have been obvious to one of ordinary skill in the art. Berger is capable to perform the same step for root domain (compare a time since the root domain) without implementing an inventive step. Further, Berger instead of determining that domain registered is less than or equal to the threshold, discloses domain time less than a threshold value has larger likelihood of being shadowed domain, or in other words domain exceeding threshold of not being shadowed (paragraph [0035]). However, determination if the domain is not shadowed based on registered time of domain being less than the threshold instead of exceeding a threshold does not require an inventive step. Such modification would have been obvious to one of ordinary skill in the art. It would have been within the knowledge of an ordinary skill in the art to easily make such modification without implementing any inventive step, in order to detect malicious domain based on customized threshold values.
With respect to claim 4 and 5, which depend form claim 3, the limitation of “wherein the model is a machine learning model” and “wherein the machine learning model being a neural network” have not been addressed by the rejection. Specifically claim 3 recites “performing the classification…using a model or a set of rules”. The rejection of the claim 3 relied on the “set of rules” alternative and did not analyze or apply prior art to the recited “model”. Claim 4 and 5 further limits the model to a machine learning model and neural network, which were not considered in the rejection of claim3. Accordingly, the rejection do not address the additional limitations recited in claim 4 and 5.
With respect to claims 11, 12 and 18, similarly the rejection does not address the additional limitations recited therein. Each of these claims depends form claim 10 or 17 and further limits subject matter (“using a model”) that was not analyzed in the rejection of the corresponding base claim. Because the rejection of the parent claims does not address the limitations from which these dependent claims further depend, the additional limitations recited in claims 11, 12 and 18 have likewise not been considered.
Claims 6 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Stemm, Rolette and Berger, further in view of Manadhata et al. (US Publication No. 2016/0226819), hereinafter Manadhata.
As per claims 6 and 13, Stemm as modified does not explicitly disclose, but in an analogous art, Manadhata discloses, wherein the performing of the post-processing on the set of identified [shadowed] domains, comprising to: compare a subnetwork of an IP address of an identified [shadowed] domain with a subnetwork of an IP address of a [root] domain associated with the identified [shadowed] domain; and in response to a determination that the subnetwork of an IP address of the identified [shadowed] domain matches the subnetwork of an IP address of the [root] domain associated with the identified [shadowed] domain, determine that the identified [shadowed] domain is likely benign (paragraph [0023], “ Generally, with respect to the thresholding process, given an unknown IP address and the set of domain names to which the IP address is mapped, if more than a predetermined fraction (i.e., percentage) of the domain names are in the approved domain name list 120, then the IP address may also be considered as benign and assigned to the approved IP address list 122... A similar analysis may be applied to an unknown domain name and the set of IP addresses to which the domain name is mapped. Therefore, with respect to the thresholding process, the probability inference module 132 may consider a domain name that is not present in an approved domain name list 120 or a disapproved domain name list 128, to thus identify the domain name as benign (i.e., approved) or malicious (i.e., disapproved). Similarly, the probability inference module 132 may consider an IP address that is not present in an approved IP address list 122 or a disapproved IP address list 130, to thus identify the IP address as benign or malicious…”. It is noted that Manadhata does not label the domains as shadowed domain and root domain. However, it is noted that a particular label does not affect the functionality of the invention as claimed. Labeling domains as shadowed domain and root domain does not require an inventive step and would have been obvious to one of ordinary skill in the art).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine, Stemm, Rolette and Berger with Manadhata. This would have been obvious because one of ordinary skill in the art would have been motivated to improve security of network by identifying of benign versus malicious domains accessed by the network’s hosts or users.
References Cited, Not Used
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Young et al. (US Publication No. 2022/0337624) discloses, a system for preventing communications from detected phishing domains receives a communication associated with a
particular domain. The system determines that the particular domain is a phishing domain. In response, the system registers the particular domain in a Domain Name System (DNS) server to block the communication and future communications associated with the particular domain from being received at computing devices operably coupled with the DNS server. In one embodiment, a phishing domain detecting engine may be implemented by a machine learning algorithm, such as, a support vector machine, a neural network, a random forest, a k-means clustering, etc.
Perdisci et al. (US Patent No. 10,027,688) discloses, a method and system of detecting a malicious and/or botnet-related domain name, comprising: reviewing a domain name used in Domain Name System (DNS) traffic in a network; searching for information about the domain name, the information related to: information about the domain name in a domain name white list and/or a domain name suspicious list; and information about the domain name using an Internet search engine, wherein the Internet search engine determines if there are no search results or search results with a link to at least one malware analysis site; and designating the domain name as malicious and/or botnet-related based on the information.
Earl et al. (US Patent No. 9,300,623) discloses, a domain name system (DNS) cache integrity check system. The system comprises a checking server, which comprises an application that checks domain name to internet protocol (IP) address mappings amongst a plurality of DNS cache servers. The checking application consults a valid list data store and identifies a discrepant domain name to IP address mapping. The application requests for a mapping list from an authoritative DNS server. The checking application compares the discrepant mapping to the authoritative DNS server list, if the discrepant mapping is located on the authoritative DNS server list, the discrepant mapping is authorized and written to the valid list, if the discrepant mapping is not located on the authoritative DNS server list, the DNS cache server with the discrepant mapping is flushed and replaced with an authorized mapping from the authoritative DNS server list.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ALI ABYANEH whose telephone number is (571)272-7961. The examiner can normally be reached Monday - Friday from 8:00 am-5:00pm (EST).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alexander Lagor can be reached at (571)270-5143. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ALI S ABYANEH/ Primary Examiner, Art Unit 2437
.
Prosecution Insights