Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
Claims 1-17 are presented for examination.
Information Disclosure Statement
No information disclosure statement (IDS) is submitted.
Drawings
The drawings filed on 05/30/2025 are accepted by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the conflicting application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement.
Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b).
Claims of Patent # 12,355,792 contains every element of claims of the instant application. Claims of the instant application therefore are not patently distinct from the earlier patent claims and as such are unpatentable over obvious-type double patenting. A later patent claim is not patentably distinct from an earlier claim if the later claim is anticipated by the earlier claim.
“A later patent claim is not patentably distinct from an earlier patent claim if the later claim is obvious over, or anticipated by, the earlier claim. In re Longi, 759 F.2d at 896, 225 USPQ at 651 (affirming a holding of obviousness-type double patenting because the claims at issue were obvious over claims in four prior art patents); In re Berg, 140 F.3d at 1437, 46 USPQ2d at 1233 (Fed. Cir. 1998) (affirming a holding of obviousness-type double patenting where a patent application claim to a genus is anticipated by a patent claim to a species within that genus). “ELI LILLY AND COMPANY v BARR LABORATORIES, INC., United States Court of Appeals for the Federal Circuit, ON PETITION FOR REHEARING EN BANC (DECIDED: May 30, 2001).
Claim Comparison
Instant Application # 19/224,382
US Patent # 12,355,792
1. A system, comprising:
a processor configured to: determine, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information;
monitor the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status; and in response to determining the change to active status of the particular domain, take a remedial action with respect to the particular domain; and
a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1, wherein monitoring the list for a change includes determining whether the aged dormant domain is associated with an algorithmically generated domain.
3. The system of claim 2, wherein determining whether the aged dormant domain is associated with the algorithmically generated domain includes performing Markov chain analysis.
4. The system of claim 2, wherein determining whether the aged dormant domain is associated with the algorithmically generated domain includes evaluating a DNS traffic pattern for an abnormality.
5. The system of claim 4, wherein the abnormality comprises a burst of DNS requests for new subdomains.
6. The system of claim 4, wherein the abnormality comprises an abnormally high percentage of algorithmically generated domain traffic.
7. The system of claim 1, wherein taking the remedial action includes categorizing the particular domain as being associated with a phishing attack.
8. The system of claim 1, wherein taking the remedial action includes categorizing the particular domain as being associated with a levesquatting attack.
9. The system of claim 1, wherein taking the remedial action includes categorizing the particular domain as being associated with wildcard DNS abuse.
10. The system of claim 1, wherein taking the remedial action includes adding the particular domain to a block list.
11. The system of claim 1, wherein taking the remedial action includes responding to a DNS query with an indication that a DNS request indicates that a client has been compromised.
12. The system of claim 1, wherein determining the list includes determining whether an average DNS request for a given domain is below a threshold for a given time window.
13. The system of claim 1, wherein monitoring the list of candidate strategically aged io domains includes determining whether an average DNS request for a given domain is above a threshold within a time window.
14. The system of claim 1, wherein the processor is further configured to collect a first set of metrics quantifying activities associated with the particular domain prior to changing status and collect a second set of metrics quantifying activities associated with the particular domain after is changing the status.
15. The system of claim 1, wherein taking the remedial action includes labeling the particular domain as being associated with a phishing campaign.
16. A method, comprising: determining, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information; monitoring the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status; and in response to determining the change to active status of the particular domain, taking a 25 remedial action with respect to the particular domain.
17. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: determining, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information; monitoring the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status; and in response to determining the change to active status of the particular domain, taking a remedial action with respect to the particular domain.
1. A system, comprising: a processor configured to: determine, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information;
monitor the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status, at least in part by determining that a threshold volume of DNS traffic for the particular domain has been exceeded; and in response to determining the change to active status of the particular domain, take a remedial action with respect to the particular domain; and a memory coupled to the processor and configured to provide the processor with instructions.
2. The system of claim 1, wherein taking the remedial action includes determining whether the particular domain is associated with an algorithmically generated domain.
3. The system of claim 2, wherein determining whether the particular domain is associated with the algorithmically generated domain includes performing Markov chain analysis.
4. The system of claim 2, wherein determining whether the particular domain is associated with the algorithmically generated domain includes evaluating a DNS traffic pattern for an abnormality.
5. The system of claim 1, wherein taking the remedial action includes determining whether the particular domain is associated with a phishing attack.
6. The system of claim 1, wherein taking the remedial action includes determining whether the particular domain is associated with wildcard DNS abuse.
7. The system of claim 1, wherein taking the remedial action includes adding the particular domain to a block list.
8. The system of claim 1, wherein taking the remedial action includes responding to a DNS query with an indication that a DNS request indicates that a client has been compromised.
9. The system of claim 1, wherein determining the list includes determining whether an average DNS request for a given domain is below a threshold for a given time window.
10. The system of claim 1, wherein monitoring the list of candidate strategically aged domains includes determining whether an average DNS request for a given domain is above a threshold within a time window.
11. The system of claim 1, wherein the processor is further configured to collect a first set of metrics quantifying activities associated with the particular domain prior to changing status and collect a second set of metrics quantifying activities associated with the particular domain after changing the status.
12. A method, comprising: determining, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information; monitoring the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status, at least in part by determining that a threshold volume of DNS traffic for the particular domain has been exceeded; and in response to determining the change to active status of the particular domain, taking a remedial action with respect to the particular domain.
13. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for: determining, as a list of candidate strategically aged domains, a set of initially benign aged dormant domains, including by evaluating passive Domain Name System (DNS) information; monitoring the list of candidate strategically aged domains for a change by a particular domain from a dormant status to an active status, at least in part by determining that a threshold volume of DNS traffic for the particular domain has been exceeded; and in response to determining the change to active status of the particular domain, taking a remedial action with respect to the particular domain.
14. The method of claim 12, wherein taking the remedial action includes determining whether the particular domain is associated with an algorithmically generated domain.
15. The method of claim 14, wherein determining whether the particular domain is associated with the algorithmically generated domain includes performing Markov chain analysis.
16. The method of claim 14, wherein determining whether the particular domain is associated with the algorithmically generated domain includes evaluating a DNS traffic pattern for an abnormality.
17. The method of claim 12, wherein taking the remedial action includes determining whether the particular domain is associated with a phishing attack.
18. The method of claim 12, wherein taking the remedial action includes determining whether the particular domain is associated with wildcard DNS abuse.
19. The method of claim 12, wherein taking the remedial action includes adding the particular domain to a block list.
20. The method of claim 12, wherein taking the remedial action includes responding to a DNS query with an indication that a DNS request indicates that a client has been compromised.
21. The method of claim 12, wherein determining the list includes determining whether an average DNS request for a given domain is below a threshold for a given time window.
22. The method of claim 12, wherein monitoring the list of candidate strategically aged domains includes determining whether an average DNS request for a given domain is above a threshold within a time window.
23. The method of claim 12, further comprising collecting a first set of metrics quantifying activities associated with the particular domain prior to changing status and collecting a second set of metrics quantifying activities associated with the particular domain after changing the status.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US Patent No. 10,944,781, “a system for identifying malicious domain names from a passive domain name system server log may include at least one physical processor and physical memory that includes computer-executable instructions that, when executed by the physical processor, cause the physical processor to (1) create, at a computing device, a pool of domain names at least in part from the passive domain name server log, (2) identify respective features of each domain name in the pool of domain names, (3) prepare a list of known benign domain names and the respective features of each known benign domain name on the list of known benign domain names, wherein the known benign domain names are in the pool of domain names, (4) prepare a list of known malicious domain names and the respective features of each known malicious domain name on the list of known malicious domain names, wherein the known malicious domain names are in the pool of domain names, (5) compute a classification model based at least in part on (A) the respective features of each known benign domain name on the list of known benign domain names, and (B) the respective features of each known malicious domain name on the list of known malicious domain names, (6) identify respective features of an unclassified domain name, and (7) classify, using the classification model, the unclassified domain name as a malicious domain name, based on the respective features of the unclassified domain name”.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MORSHED MEHEDI whose telephone number is (571) 270-7640. The examiner can normally be reached on M - F, 8:00 am to 4:00 pm EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Linglan Edwards can be reach on (571) 270-5440. The fax number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from their Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (In USA or Canada) or 571-272-1000.
/MORSHED MEHEDI/Primary Examiner, Art Unit 2408
Prosecution Insights