Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
2. This action is in response to the application filed May 16, 2025.
3. Claims 1-20 have been examined and are pending with this action.
4. The Information Disclosure Statement filed May 16, 2025 has been considered.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
5. Claims 1-2, 4, 10-11, 13 ,and 19 are rejected under 35 U.S.C. 102(a)(1) and 102(a)(2) as being anticipated by Mahaffey et al. (US 2015/0163121 A1).
INDEPENDENT:
As per claim 1, Mahaffey teaches a method for detecting domain fronting within a network, comprising:
collecting, from a plurality of devices within the network, data associated with a network site (see Mahaffey, Abstract: “Data is collected from a set of devices”; [0001]: “The present disclosure relates to the field of device monitoring and more particularly, to systems and techniques for gathering data across a large-scale of computing devices, evaluating the data, and responding accordingly”; and [0006]: “The process of collecting such data is referred to as monitoring or acquisition. A norm is established in an analysis process using the collected data. The analysis process uses risk models, correlation of states and events or event sequences, and prior knowledge concerning known bad actors (applications, websites, etc.), and known bad behaviors (for example, malformed content, vulnerability exploits, etc.)”);
generating, based at least in part on the data, a baseline associated with the network site (see Mahaffey, Abstract: “A norm is established using the collected data. The norm is compared with data collected from a particular device”; [0119]: “The analysis server analyzes the observations collected by the collection server. The analysis server includes a baseline generator 770, anomaly evaluation component 775, context ontology 778, and filter 781”; and [0120]: “a flow of the system includes monitoring a set of computing devices (step 910) to collect observation data, based on the monitoring, establishing a norm or baseline (step 915), determining that activity associated with a first computing device is outside the norm (step 920), and responding (step 925)”);
receiving, from the plurality of devices, network data associated with network traffic (see Mahaffey, [0303]: “In another specific implementation, the mapping is performed in a privileged context (e.g., root). In a privileged context like root there can be fingerprinting key kernel structures; monitoring network traffic; and applying signatures”);
identifying, based at least in part on the baseline and the network traffic, one or more connections associated with suspicious activity (see Mahaffey, Abstract: “If there is a deviation outside of a threshold deviation between the norm and the data collected from the particular device, a response is initiated”; [0121]: “establishing a norm using the received data (step 1020), determining that activity associated with a first computing device is outside the norm (step 1025), and responding (step 1030)”; and [0122]: “Observations can include device events, states, state changes, configuration, user activity, application activity, duration of activity, geographic location of device during such activity (e.g., longitude and latitude), application requests (e.g., programmatic requests to operating system services and resources), date and time of occurrence, accesses to user data (e.g., accesses to user contacts), applications that have been installed, network connections that have been made, types of network connections made (e.g., virtual private network), remote services that have been called, websites that have been contacted, or combinations of these”); and
generating, based at least in part on identifying, an alert (see Mahaffey, Abstract: “If there is a deviation outside of a threshold deviation between the norm and the data collected from the particular device, a response is initiated”; and [0008]: “Responses can include notification and alerting of a user or administrator or analyst, via email or SMS or interactive voice response (IVR) or instant messaging or chat or via device push services or via user interface popups, or via entering or modifying records in a system used for workflow such as a trouble ticket system”).
As per claim 10, Mahaffey teaches a system comprising:
one or more processors (see Mahaffey, [00]: “For example, a computer system could include more than one processor (i.e., a multiprocessor system, which may permit parallel processing of information) or a system may include a cache memory. The computer system shown in FIG. 2 is but an example of a computer system suitable for use”); and
one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations (see Mahaffey, [0048]: “A computer-implemented or computer-executable version of the program instructions useful to practice the systems and techniques described in this application may be embodied using, stored on, or associated with computer-readable medium. A computer-readable medium may include any medium that participates in providing instructions to one or more processors for execution”) comprising:
collecting, from a plurality of devices within a network, data associated with a network site (see Claim 1 rejection above);
generating, based at least in part on the data, a baseline associated with the network site (see Claim 1 rejection above);
receiving, from the plurality of devices, network data associated with network traffic (see Claim 1 rejection above);
identifying, based at least in part on the baseline and the network traffic, one or more connections associated with suspicious activity (see Claim 1 rejection above); and
generating, based at least in part on identifying, an alert (see Claim 1 rejection above).
As per claim 19, Mahaffey teaches one or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations (see Claim 10 rejection above) comprising:
collecting, from a plurality of devices within a network, data associated with a network site (see Claim 1 rejection above);
generating, based at least in part on the data, a baseline associated with the network site (see Claim 1 rejection above);
receiving, from the plurality of devices, network data associated with network traffic (see Claim 1 rejection above);
identifying, based at least in part on the baseline and the network traffic, one or more connections associated with suspicious activity (see Claim 1 rejection above); and
generating, based at least in part on identifying, an alert (see Claim 1 rejection above).
DEPENDENT:
As per claims 2 and 11, which respectively depend on claims 1 and 10, Mahaffey further teaches wherein the network traffic comprises domain names and IP addresses (see Mahaffey, [0059]: “The differences in the monitoring levels can include differences in the amount of data collected, type of data collected, data collection sampling frequency, timing of data collection, location of data collection, depth of data collection, or combinations of these. For network connections, the depth of data collection can include just domain names, or domain names and size of data transmitted and length or duration of connections, or content that is transmitted or received on a network connection”; and [0075]: “For example, the personal data may include images or photos taken by the camera, location information from the sensor of the device (e.g., a current physical location of the device), a location history of the device, or a log or history of domains, IP addresses, other devices that the device has communicated with”).
As per claims 4 and 13, which respectively depend on claims 1 and 10, Mahaffey further teaches wherein the data comprises one or more of a plurality of domain name service (DNS) responses associated with the network site, internet protocol (IP) addresses of servers at the network site, destination IP addresses (see Mahaffey, [0133]: “Behavioral data may include information about what the data object did when it ran on the device. Examples of behavioral data include information about network connections caused by the data object (e.g., server names, source/destination addresses and ports, duration of connection, connection protocols, amount of data transmitted and received, total number of connections, frequency of connections, and network interface information for the connection, DNS requests made), behavior of the data object when run (e.g., system calls, API calls, libraries used, inter-process communication calls, number of SMS messages transmitted, number of email messages sent, information about user interfaces displayed, URLs accessed), overhead caused by the data object (e.g., battery used, CPU time used, network data transmitted, storage used, memory used)”).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
6. Claims 3 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Mahaffey et al. (US 2015/0163121 A1) in view of Bazalgette et al. (US 2020/0358792 A1).
As per claims 3 and 12, which respectively depend on claims 1 and 10, Mahaffey does not explicitly teach wherein the one or more connections indicate potential support of domain fronting by one or more hosting providers.
Bazalgette teaches wherein the one or more connections indicate potential support of domain fronting by one or more hosting providers (see Mahaffey, [0093]: “Combining unsupervised machine learning with JA3 is incredibly powerful for the detection of domain fronting. Other factors can and are factored into a malicious determination. Domain fronting is merely an example popular technique to circumvent censorship and to hide C2 traffic. While some infrastructure providers take action to prevent domain fronting on their end, it is still prevalent and actively used by attackers”; and [0094]: “the cyber-security appliance via the analysis module cooperating with the other modules and AI models can detect domain fronting on encrypted network traffic in transit via TLS/SSL inspection and use of JA3”).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the system of Mahaffey in view of Bazalgette so that the one or more connections indicate potential support of domain fronting by one or more hosting providers. One would be motivated to do so because Bazalgette teaches in paragraph [0087], “The analysis module using the supervised machine learning makes the detection of domain fronting, without having to break up and break into encrypted traffic, possible by instead combining unusual JA3 detection with other anomalies, such as beaconing. This is a good trigger to start hunting for a domain fronting threat hunt.”, emphasis added.
7. Claims 5-6, 14-15, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Mahaffey et al. (US 2015/0163121 A1) in view of Radon (US 2024/0338576A1).
As per claims 5, 14, and 20, which respectively depend on claims 1, 10, and 19, Mahaffey further teaches wherein generating the baseline comprises:
determining a subset of the data corresponding to a domain name (see Mahaffey, [0006]: “A norm is established in an analysis process using the collected data. The analysis process uses risk models, correlation of states and events or event sequences, and prior knowledge concerning known bad actors (applications, websites, etc.), and known bad behaviors (for example, malformed content, vulnerability exploits, etc.)”; [0012]: “The first database is associated with an organization, comprises data collected from a first subset of the plurality of devices, and the devices in the first subset are associated with the organization. The second database includes data collected from a second subset of the plurality of device, and the devices in the second subset are not associated with the organization”; [0083]: “More particularly, the monitor may observe configuration or state on device components… web applications (uniform resource locator (URL) and domain of origin, version information, etc.), cloud or web services (url and domain, version information, etc.), behavior of same (outputs, connections made to other components, to network locations, to file system, etc.), or combinations of these”; and [0231]: “A norm is established using the collected data (step 1020). In step 1025, a determination is made that activity associated with a first computing device is outside the norm. That is, an anomaly is detected. The activity may violate the established norm by falling above the norm or below the norm by a predetermined value or threshold”); and
generating, based on the subset of the data, a histogram comprising IP addresses and one or more DNS fields (see Mahaffey, [0173]: “Techniques that can be used in anomaly detection include statistical profiling using histograms, parametric statistical modeling, nonparametric statistical modeling, Bayesian networks, neural networks, support vector machines (SVM), rule-based systems”).
Mahaffey does not explicitly teach that the histogram comprises IP addresses and one or more DNS fields.
Radon teaches that the histogram comprises IP addresses and one or more DNS fields (see Radon, [0086]: “In certain embodiments, the features can comprise any type of features (e.g., of the identifier and/or resource, applications, systems, and/or devices that the identifier points to or references) and can include, but are not limited to, lexical features (e.g., length of identifier, length of top level domain, length of primary domain, length of hostname, length of path, number of vowels, number of consonants, whether the IP address is used as the domain name, number of non-alphanumeric characters, etc.), file name features (e.g., length of file name to be accessed, number of detainers, etc.), directory-related features (e.g., length of directory, number of sub-directory tokens, etc.), the Kolmogrov Complexity or the Shannon Entropy of an address string, bag-of-word features, etc.), host-based features (e.g., WHOIS information (e.g., domain name registration date, information relating to the registrar, information about the registrant), domain name properties (e.g., time-to-live (TTL) values from a domain registration date), geographic properties (e.g., location of the IP address), content-based features (e.g., presence of HTML forms, presence of <input>tags, presence of keywords can ask users to provide credit card information, password, social security number etc., length of HTML form, length of <style>, length of <script>, length of the whole document, average length of words, word count, distinct word count, number of words in text, number of words in title, number of images, number of iframes, number of zero size iframes, number of hyperlinks, link to remote source of script, number of null characters, usage of string concatenation, number of times domain names appear in the HTML content, number of unique subdomains (of primary domain of the URL) is present in the HTML content, number of unique directory paths for all referenced files in the HTML content, Javascript features (e.g., extensive usage of eval( ), extensive usage of unescape( ), number of long strings, number of event attachments, number of “iframe” strings), any use of non-alphanumeric Javascript obfuscation (as described, e.g., in the book “Web Application Obfuscation” by Mario Heiderich, Eduardo Alberto Vela Nava, Gareth Heyes, David Lindsay), webpage screenshot-based features (e.g., earth mover's distance between images, contrast context histogram features, scale invariant feature transform features, deep learning based features of images), character features (e.g., characters in the identifier), features relating to the edit distance between strings and/or characters in the identifier, HTML content in the identifier features, other features, or a combination thereof.”).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the system of Mahaffey in view of Radon so that the histogram comprises IP addresses and one or more DNS fields. One would be motivated to do so because histograms can comprise any subjective data to represent the distribution of continuous data.
As per claims 6 and 15, which respectively depend on claims 5 and 14, Mahaffey does not explicitly teach wherein the histogram further comprises indications of round-trip time (RTT), time to live (TTL), and content delivery network (CDN) servers or hosting providers used by computing devices or applications at the network site.
Radon teaches wherein the histogram comprises indications of round-trip time (RTT), time to live (TTL), and content delivery network (CDN) servers or hosting providers used by computing devices or applications at the network site (see Radon, [0086]: “In certain embodiments, the features can comprise any type of features (e.g., of the identifier and/or resource, applications, systems, and/or devices that the identifier points to or references) and can include, but are not limited to, lexical features (e.g., length of identifier, length of top level domain, length of primary domain, length of hostname, length of path, number of vowels, number of consonants, whether the IP address is used as the domain name, number of non-alphanumeric characters, etc.), file name features (e.g., length of file name to be accessed, number of detainers, etc.), directory-related features (e.g., length of directory, number of sub-directory tokens, etc.), the Kolmogrov Complexity or the Shannon Entropy of an address string, bag-of-word features, etc.), host-based features (e.g., WHOIS information (e.g., domain name registration date, information relating to the registrar, information about the registrant), domain name properties (e.g., time-to-live (TTL) values from a domain registration date), geographic properties (e.g., location of the IP address), content-based features (e.g., presence of HTML forms, presence of <input>tags, presence of keywords can ask users to provide credit card information, password, social security number etc., length of HTML form, length of <style>, length of <script>, length of the whole document, average length of words, word count, distinct word count, number of words in text, number of words in title, number of images, number of iframes, number of zero size iframes, number of hyperlinks, link to remote source of script, number of null characters, usage of string concatenation, number of times domain names appear in the HTML content, number of unique subdomains (of primary domain of the URL) is present in the HTML content, number of unique directory paths for all referenced files in the HTML content, Javascript features (e.g., extensive usage of eval( ), extensive usage of unescape( ), number of long strings, number of event attachments, number of “iframe” strings), any use of non-alphanumeric Javascript obfuscation (as described, e.g., in the book “Web Application Obfuscation” by Mario Heiderich, Eduardo Alberto Vela Nava, Gareth Heyes, David Lindsay), webpage screenshot-based features (e.g., earth mover's distance between images, contrast context histogram features, scale invariant feature transform features, deep learning based features of images), character features (e.g., characters in the identifier), features relating to the edit distance between strings and/or characters in the identifier, HTML content in the identifier features, other features, or a combination thereof.”)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the system of Mahaffey in view of Radon so that histogram comprises indications of round-trip time (RTT), time to live (TTL), and content delivery network (CDN) servers or hosting providers used by computing devices or applications at the network site. One would be motivated to do so because histograms can comprise any subjective data to represent the distribution of continuous data.
Claim Objections
8. Claims 7-8 and 16-17 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
The following is an examiner' s statement of reasons for allowance: The prior art of record does not disclose, teach, or suggest neither singly nor in combination the claimed limitation of “identifying the one or more connections associated with the suspicious activity further comprises: determining that a connection to a domain includes a destination IP address with low prevalence compared to other connections from the network site; sending, to an endpoint associated with the domain or a similar domain, one or more scans; receiving, in response to the one or more scans, one or more responses; and determining, based on the one or more responses, that the destination IP address supports evasive behavior” as recited in dependent claims 7 and 16.
Claims 8 and 17 are allowable because the additional limitations depend on allowable claims 7 and 16, respectively.
Conclusion
9. For the reasons above, claims 1-6, 9-15, and 18-20 have been rejected, claims 7-8 and 16-17 have been objected to, and claims 1-20 and remain pending.
10. Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL Y WON whose telephone number is (571)272-3993. The examiner can normally be reached on Wk.1: M-F: 8-5 PST & Wk.2: M-Th: 8-7 PST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Nicholas R Taylor can be reached on 571-272-3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Michael Won/Primary Examiner, Art Unit 2443
