DETAILED ACTION
This action is in response to the claims filed 7/11/2025. Claims 1-21 are pending. Independent claims 1, 11 and 21, and corresponding dependent claims are directed towards a computerized platform, method and non-transitory computer readable medium for providing an e-mail addon for evaluating e-mails as potential phishing attacks.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Drawings
The drawings are objected to because: Fig. 4 item 360 is not described in the specification; and Fig. 6 item 520 is not described in the specification. Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. The figure or figure number of an amended drawing should not be labeled as “amended.” If a drawing figure is to be canceled, the appropriate figure must be removed from the replacement sheet, and where necessary, the remaining figures must be renumbered and appropriate changes made to the brief description of the several views of the drawings for consistency. Additional replacement sheets may be necessary to show the renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Specification
The disclosure is objected to because of the following informalities: the first recitation of the following acronyms is not expanded: pg. 2 DMARC, SPF and DKIM; pg. 5 FBI; pg. 6 DNS; pg. 13 TCP/IP, SMS, JSON, TLS, SSL and VPN; pg. 14 SGI MIPS, PA-RISC, IDE, SCSI and PCI; and pg. 16 OS, HTML and XML; pg. 12 l. 10 “530” should most likely be “520” and “530” should be added elsewhere to describe item 530 in Fig. 6; and PG. 13 “Json” should be “JSON”. Appropriate correction is required.
Claim Objections
Claims 5, 11 and 21 are objected to because of the following informalities, shown with suggested amendments: Claim 5 l. 3 the acronyms DMARC, SPF and DKIM are not expanded; Claim 11 l. 5 “[[an]]the e-mail” for proper antecedent basis; Claim 21 ll. 1-3 “which when executed by a processing system of a computer causes the processing system to provide a user with an indication” for grammar; and Claim 21 l. 7 “[[an]]the e-mail” for proper antecedent basis. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 8-10 and 18-20 are rejected under 35 U.S.C. 112(b) as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor regards as the invention.
Claim 8 ll. 1-3 recite “the one or more characteristics of the link within the e-mail include one or more of whether the link is clear and direct, whether the link is a shortened link, or whether the link is misleading” of which “clear and direct” and “misleading” are relative/subjective terms that render the claim indefinite. The terms “clear and direct” and “misleading” are not defined by the claim, the specification does not provide a standard for ascertaining their requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. As such, the “one or more characteristics of the link” is rendered indefinite. For purposes of applying prior art the limitation has been construed as “the one or more characteristics of the link within the e-mail include one or more of an indication of whether the link is clear and direct, whether the link is a shortened link, or an indication of whether the link is misleading”.
Claim 9 ll. 1-3 recite “wherein the one or more characteristics of the attachment to the e-mail include one or more of whether a file extension of the attachment is considered dangerous” of which “considered dangerous” is a relative/subjective term that renders the claim indefinite. The term “considered dangerous” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. As such, the “the one or more characteristics of the attachment to the e-mail” is rendered indefinite. For purposes of applying prior art the limitation has been construed as “wherein the one or more characteristics of the attachment to the e-mail include one or more of an indication of whether a file extension of the attachment is considered dangerous”.
Claim 9 ll. 3-4 recite the limitation “whether the attachment has a file extension that is consistent with its context” which lacks proper antecedent basis as it is unclear to which limitation the term “its” is referencing (“attachment” or “file extension”). For purposes of applying prior art the limitation has been construed as “whether the attachment has a file extension that is consistent with [[its]] the context of the attachment”.
Claim 10 ll. 1-4 recite “wherein the one or more characteristics of the content of the e-mail including one or more of … or whether the e-mail appears suspicious to the user” of which “appears suspicious to the user” is a relative/subjective term that renders the claim indefinite. The term “appears suspicious to the user” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. As such, the “the one or more characteristics of the content of the e-mail” is rendered indefinite. For purposes of applying prior art the limitation has been construed as “wherein the one or more characteristics of the content of the e-mail including one or more of … or an indication of whether the e-mail appears suspicious to the user”.
Claim 18 ll. 1-3 recite “the one or more characteristics of the link within the e-mail include one or more of whether the link is clear and direct, whether the link is a shortened link, or whether the link is misleading” of which “clear and direct” and “misleading” are relative/subjective terms that render the claim indefinite. The terms “clear and direct” and “misleading” are not defined by the claim, the specification does not provide a standard for ascertaining their requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. As such, the “one or more characteristics of the link” is rendered indefinite. For purposes of applying prior art the limitation has been construed as “the one or more characteristics of the link within the e-mail include one or more of an indication of whether the link is clear and direct, whether the link is a shortened link, or an indication of whether the link is misleading”.
Claim 19 ll. 1-2 recite “wherein the one or more characteristics of the attachment to the e-mail include one or more of whether a file extension of the attachment is considered dangerous” of which “considered dangerous” is a relative/subjective term that renders the claim indefinite. The term “considered dangerous” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. As such, the “the one or more characteristics of the attachment to the e-mail” is rendered indefinite. For purposes of applying prior art the limitation has been construed as “wherein the one or more characteristics of the attachment to the e-mail include one or more of an indication of whether a file extension of the attachment is considered dangerous”.
Claim 19 l. 3 recites the limitation “whether the attachment has a file extension that is consistent with its context” which lacks proper antecedent basis as it is unclear to which limitation the term “its” is referencing (“attachment” or “file extension”). For purposes of applying prior art the limitation has been construed as “whether the attachment has a file extension that is consistent with [[its]] the context of the attachment”.
Claim 20 ll. 1-3 recite “wherein the one or more characteristics of the content of the e-mail include one or more of … or whether the e-mail appears suspicious to the user” of which “appears suspicious to the user” is a relative/subjective term that renders the claim indefinite. The term “appears suspicious to the user” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. As such, the “the one or more characteristics of the content of the e-mail” is rendered indefinite. For purposes of applying prior art the limitation has been construed as “wherein the one or more characteristics of the content of the e-mail include one or more of … or an indication of whether the e-mail appears suspicious to the user”.
Claim Rejections - 35 USC § 101
35 U.S.C. § 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-10 are rejected under 35 U.S.C. § 101 because the claimed invention is directed to non-statutory subject matter.
Regarding claim 1, the claimed invention is drawn to a “computerized platform” with no components/elements of the “platform” claimed. As such, the “computerized platform” can be broadly interpreted as comprising various types of software (software modules, virtualized hardware, data, programming code, etc.) and no tangibly-embodied structural features. As such the invention does not fall within at least one of the four categories of patent eligible subject matter recited in 35 U.S.C § 101 (process, machine, manufacture or composition of matter). Examiner recommends including some form of a “hardware processor” (e.g. hardware processor, microprocessor, microcontroller, etc.) or “memory” (i.e. medium, RAM, ROM, etc.) as a claimed element of the “computerized platform” as neither a “hardware processor” or “memory” can be broadly interpreted as software.
Claims 2-10 further fail to recite any positive structural limitations to overcome the 35 U.S.C. §101 issues of claim 1 discussed above, and are also rejected.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claim 1-6, 8-16 and 18-21 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Jakobsson (US 2020/0067978 A1), published Feb. 27, 2020.
As to claims 1, 11 and 21, Jakobsson discloses a computerized platform for providing a user with an indication of one of a risk level or a probability of an e-mail including a phishing attack (Jakobsson ¶38 techniques for protecting users from communications from malicious entities; ¶36 phishing; ¶70 probability assessment that message is deceptive; ¶102 phishing email with likelihood of 95%), a method (Jakobsson ¶31 technique), and a non-transitory computer-readable medium (Jakobsson ¶31 computer readable storage medium), hereinafter referred to by the computerized platform, the computerized platform configured to perform a method comprising: performing an assessment of one or more characteristics of one or more aspects of the e-mail (Jakobsson ¶33 examines characteristics including sender address, name, message text, graphics, audio and referenced web addresses); determining the one of the risk level or the probability of the e-mail including a phishing attack based on results of the assessment (Jakobsson ¶68 hyperlinks, hyperlink text, logos, and urgency terms used increase risk score; ¶70 probability assessment that message is deceptive; ¶102 phishing email with likelihood of 95%); and providing the user with the indication of the one of the risk level or the probability of the e-mail including the phishing attack (Jakobsson ¶102 output indicating “phishing email” with likelihood of 95% ).
As to claims 2 and 12, Jakobsson discloses the invention as claimed as described in claims 1 and 11, respectively, including wherein the computerized platform is configured to produce a graphical display (Jakobsson ¶40 plugin on web browser client – indicates display environment) including the indication of the one of the risk level or the probability of the e-mail including the phishing attack (Jakobsson ¶102 output indicating “phishing email” with likelihood of 95%).
As to claims 3 and 13, Jakobsson discloses the invention as claimed as described in claims 2 and 12, respectively, including wherein the computerized platform is further configured to provide an indication of one or more factors contributing to the one of the risk level or the probability of the e-mail including the phishing attack within the graphical display (Jakobsson ¶97 adding warning or explanation to message).
As to claims 4 and 14, Jakobsson discloses the invention as claimed as described in claims 1 and 11, respectively, including wherein the one or more aspects include one or more of a source of the e-mail (Jakobsson ¶48 evaluates the sender/originator e-mail address, name, location, IP address, domain type and first or subsequent contact), spoof potential of the e-mail (Jakobsson ¶55 likelihood sender information matches purported entity and evaluating DMARC and DKIM), a link within the e-mail (Jakobsson ¶67-68 evaluate whether hyperlinks lead to sender associated domains, and assigns risk score based on hyperlinks and hyperlink text), an attachment to the e-mail (optional limitation – not required), or content of the e-mail (Jakobsson ¶68 assesses bank terminology, urgency language, hyperlink text, and logos and uses them to increase risk score).
As to claims 5 and 15, Jakobsson discloses the invention as claimed as described in claims 4 and 14, respectively, including wherein the one or more characteristics of the source of the e-mail include one or more of whether a domain of the source of the e-mail is trusted (Jakobsson ¶55 matching domain of purported sender), whether the domain of the source of the e-mail is DMARC, SPF, or DKIM enabled (Jakobsson ¶55 evaluating DMARC and DKIM), whether a top level domain of the source of the e-mail is trusted (optional limitation – not required), whether the top level domain of the source of the e-mail is dangerous (optional limitation – not required), or an age of the domain of the source of the e-mail (optional limitation – not required).
As to claims 6 and 16, Jakobsson discloses the invention as claimed as described in claims 4 and 14, respectively, including wherein the one or more characteristics of the source of the e-mail include whether the user has had prior contact with the source of the e-mail (Jakobsson ¶48 evaluates whether first or subsequent contact).
As to claims 8 and 18, Jakobsson discloses the invention as claimed as described in claims 4 and 14, respectively, including wherein the one or more characteristics of the link within the e-mail include one or more of whether the link is clear and direct (optional – not required), whether the link is a shortened link (optional – not required), or whether the link is misleading (Jakobsson ¶57 malicious URL “www.evilhacker.com/acmebank-login” has legitimate bank name “ACME bank”; ¶67 check if link domain leads to sender).
As to claims 9 and 19, Jakobsson discloses the invention as claimed as described in claims 4 and 14, respectively, failing, however, to explicitly disclose wherein the one or more characteristics of the attachment to the e-mail include one or more of whether a file extension of the attachment is considered dangerous or whether the attachment has a file extension that is consistent with its context. However, Claim 9 does not require assessment of an attachment because Claim 4 recites the source, spoof potential, link, attachment, and content as alternatives, requiring only “one or more”. As shown in the rejection of Claim 4, Jakobsson assesses the source, spoof potential, link, and content. Accordingly, the limitation qualifying the attachment alternative are not required by the Claim 4 which carries into dependent Claim 9.
As to claims 10 and 20, Jakobsson discloses the invention as claimed as described in claims 4 and 14, respectively, including wherein the one or more characteristics of the content of the e-mail include one or more of whether the e-mail includes a prompt of urgency (Jakobsson ¶68 assesses bank terminology, urgency language, hyperlink text, and logos and uses them to increase risk score; ¶57 “immediately” “as soon as possible” and “within” “hours” language), whether the e-mail includes spelling or grammar mistakes (Jakobsson ¶107 email having incorrectly spelled wording), or whether the e-mail appears suspicious to the user (Jakobsson ¶52 making communication available to human reviewers who assess whether the communication appears to have been sent on behalf of the purported authoritative entity and return that assessment to the platform).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 7 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Jakobsson (US 2020/0067978 A1), published Feb. 27, 2020, in view of Jakobsson (US 2017/0230323 A1), published Aug. 10, 2017, hereinafter referred to as Jakobsson‘323.
As to claims 7 and 17, Jakobsson substantially discloses the invention as claimed as described in claims 4 and 14, respectively, failing, however, to explicitly disclose wherein the one or more characteristics of the source of the e-mail include whether a Reply To address of the email matches the source of the e-mail. Jakobsson’323 describes a method for detection of business email compromise. With this in mind, Jakobsson’323 discloses wherein the one or more characteristics of the source of the e-mail include whether a Reply To address of the email matches the source of the e-mail (Jakobsson’323 ¶104-105 Deception detector that checks if Reply To address is not equal to From address; ¶110 determine how deceptive Reply To address is relative to from & sender fields; ¶127 check if Reply To goes to different domain than From). It would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains to combine the Reply To checking of Jakobsson’323 with the phishing attempts detection of Jakobsson, such that one characteristic of the email that is checked is the Reply To address being the same as the source of the email, as it would advantageously reduce the level of risk of replying to the wrong/phishing entity (Jakobsson’323 ¶127).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Gatti (US 2017/0026410 A1) is related to a phishing campaign ranker.
Celik (US 2019/0028510 A1) is related to detecting phishing e-mails.
Grewal et al. (US 2022/0210188 A1) is related to message phishing detection using machine learning.
Krishnappa (US 9,246,933 B1) is related to detecting malicious email attachments, including comparing a file extension.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ERIC W SHEPPERD whose telephone number is (571)270-5654. The examiner can normally be reached Monday - Thursday, Alt. Friday, 7:30AM - 5:00PM, EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal Dharia can be reached at (571)272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Eric W Shepperd/Primary Examiner, Art Unit 2492
Prosecution Insights