DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Specification
The title of the invention is not descriptive. A new title is required that is clearly indicative of the invention to which the claims are directed.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1-4, 7, 9-11 is/are rejected under 35 U.S.C. 102(a)(1) / (a)(2) as being anticipated by Sysman et al., (US Publication No. 2017/0134423), hereinafter “Sysman”.
Regarding claims 1, 10-11, Sysman discloses
processing circuitry to estimate a decoy theme which is a theme of information that a high risk user being a user of a target system is attempting to leak externally, based on an access log indicating access in the target system by the high risk user [Sysman, paragraphs 21, 191-194, 216-220, figures 2A-2F, 7, Monitoring logs; The campaign manager may create the fake identity to be consistent with information of the certain user as used during one or more of the past attempts and/or attacks; The campaign manager creates and/or updates one or more of the decoy endpoints and/or the decoy network to comply with the fake identity created for the certain user in order to verify consistency of the deception environment as viewed by the potential attacker; Assuming the certain user is a programmer, the campaign manager may create the decoy endpoint to include typical programming environment consistent with the programming area of the certain user], and
to place a decoy file matching the estimated decoy theme in the target system [Sysman, paragraphs 191-194, 216-220, figures 2A-2F, 7, The campaign manager may create the fake identity to be consistent with information of the certain user as used during one or more of the past attempts and/or attacks. The campaign manager creates and/or updates one or more of the decoy endpoints and/or the decoy network to comply with the fake identity created for the certain user in order to verify consistency of the deception environment as viewed by the potential attacker. Assuming the certain user is a programmer, the campaign manager may create the decoy endpoint to include typical programming environment consistent with the programming area of the certain user].
Regarding claim 2, Sysman further discloses
wherein the processing circuitry calculates a risk value corresponding to each user based on an access pattern in the target system of each user of the target system, and wherein the high risk user is, among users of the target system, a user whose corresponding risk value is equal to or greater than a risk criterion value [Sysman, paragraphs 21, 191-194, 199, 216-220, figures 2A-2F, 7, review potential attackers available profile].
Regarding claim 3, Sysman further discloses
wherein the processing circuitry increases a risk value corresponding to the target user if the target user, who is a user of the target system, accesses the decoy file [Sysman, paragraphs 21, 191-194, 199, 216-220, figures 2A-2F, 7, review potential attackers available profile].
Regarding claim 4, Sysman further discloses
wherein the processing circuitry selects a file from a database storing files that are candidates for the decoy file based on the estimated decoy theme [Sysman, paragraph 120].
Regarding claim 7, Sysman further discloses
wherein the processing circuitry generates a file based on the estimated decoy theme as the decoy file, and uses the generated file as the decoy file [Sysman, paragraphs 21, 191-194, 199, 216-220, figures 2A-2F, 7].
Regarding claim 9, Sysman further discloses
wherein the processing circuitry estimates the decoy theme based on a viewing time by the high risk user of each file stored in the target system [Sysman, paragraphs 21, 191-194, 199, 216-220, figures 2A-2F, 7].
Allowable Subject Matter
Claims 5-6, 8 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WILLIAM J GOODCHILD whose telephone number is (571)270-1589. The examiner can normally be reached M-F 8am-4:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeff Pwu can be reached at 571-272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/William J. Goodchild/Primary Examiner, Art Unit 2433
Prosecution Insights