DETAILED ACTION
Claims 1-20 are pending and have been examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
It is noted that no Information Disclosure Statement has been filed.
No IDS has been received for this application. Applicants are reminded of the Duty to Disclose, from section 2001 of the MPEP (emphasis added). MPEP 2001 Duty of Disclosure, Candor, and Good Faith [R-08.2012] 37 C.F.R. 1.56 Duty to disclose information material to patentability.
(a) A patent by its very nature is affected with a public interest. The public interest is best served, and the most effective patent examination occurs when, at the time an application is being examined, the Office is aware of and evaluates the teachings of all information material to patentability. Each individual associated with the filing and prosecution of a patent application has a duty of candor and good faith in dealing with the Office, which includes a duty to disclose to the Office all information known to that individual to be material to patentability as defined in this section.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 recites the limitations "particular items", “content items”, and “the particular content items”, making it indefinite which items are being referenced. There is insufficient antecedent basis for this limitation in the claim.
In claims 1-3, claim 1 introduces “a notification”, then references “the one or more notification conditions”, “the one or more notification reporting”, making it indefinite. There is insufficient antecedent basis for this limitation in the claim.
Claim 6 recites “wherein the at communication”, it is indefinite what the intended metes and bounds is.
Claim 9 recites the limitations "set of operations”, making it indefinite if related to “the set of operations” introduced in claim 1 and referenced by claims 4-8, 10, and 12. There is insufficient antecedent basis for this limitation in the claim.
Claims 1-20 introduce “aggregate” to then refer to “the particular aggregate” making it indefinite. There is insufficient antecedent basis for this limitation in the claim.
This is not intended to be a complete list of such indefiniteness issues.
The dependent claims included in the statement of rejection but not specifically addressed in the body of the rejection have inherited the deficiencies of their parent claim and have not resolved the deficiencies. Therefore, they are rejected based on the same rationale as applied to their parent claims above.
Double Patenting
Claims 1-20 are provisionally rejected under the judicially created doctrine of obviousness-type double patenting as being unpatentable over claims of Patent No. 12598198. Although the conflicting claims are not identical, they are not patentably distinct from each other because
“A computer-program product comprising one or more non-transitory machine-readable storage media, including stored instructions configured to cause a computing system to perform a set of operations including: identifying, for each of a plurality of DNS communications associated with a DNS server, one or more DNS communication characteristics and a content item; generating a plurality of clusters of content items from the plurality of DNS communications using the DNS communication characteristics corresponding to the plurality of DNS communications, wherein the generation includes assigning, for each cluster of the plurality of clusters, particular items corresponding to a subset of the plurality of DNS communications to the cluster; for each cluster of the plurality of clusters, determining an aggregate amount of information conveyed by the particular content items in the cluster based on: determining, for each unique content item among the particular content items, an individual amount of information based on a number of character possibilities of the unique content item, wherein the number of character possibilities is based on a format including a number of different characters used at least once in the unique content item, wherein the unique content item uses only a subset of available characters; detecting that, with respect to a particular cluster of the plurality of clusters, a notification condition is satisfied based on the aggregate amount of information corresponding to the cluster; based at least in part on detecting that the particular cluster has the particular aggregate amount of information that satisfies the one or more notification conditions, triggering an action or notification reporting” (claim 1, instant application) is analogous to
“A computer-implemented method comprising: storing a plurality of Domain Name Service (DNS) communications for a DNS server, wherein each DNS communication of the plurality of DNS communications comprises one or more DNS communication characteristics and a content item; generating a plurality of clusters of content items from the plurality of DNS communications based at least in part on at least one DNS communication characteristic of the one or more DNS communication characteristics; for each cluster of particular content items of the plurality of clusters of content items from the plurality of DNS communications, determining an aggregate amount of information conveyed by the particular content items in the cluster based at least in part on: determining, for each unique content item among the particular content items, an individual amount of information based on a number of character possibilities of the unique content item such that the number of character possibilities is determined from: a length of the unique content item, and a format including a number of different characters used at least once in the unique content item, wherein the unique content item uses only a subset of available characters; and aggregating the individual amount of information for the particular content items; detecting that a particular cluster having a particular one or more values for the at least one DNS communication characteristic has a particular aggregate amount of information that satisfies one or more notification conditions; based at least in part on detecting that the particular cluster has the particular aggregate amount of information that satisfies the one or more notification conditions, triggering a notification reporting the particular aggregate amount of information and the particular one or more values for the at least one DNS communication characteristic” (claim 1, patent 12598198).
This is a provisional obviousness-type double patenting rejection because the conflicting claims of the instant application have not in fact been patented.
The claims of the conflicting patents and/or applications contain every element of claims 1-24 of the instant application and thus anticipate the claims of the instant application. Claims 1-24 of the instant application therefore are not patently distinct from the copending application claims and as such are unpatentable for obvious-type double patenting. A later patent/application claim is not patentably distinct from an earlier claim if the later claim is anticipated by the earlier claim.
“A later patent claim is not patentably distinct from an earlier patent claim if the later claim is obvious over, or anticipated by, the earlier claim. In re Longi, 759 F.2d at 896, 225 USPQ at 651 (affirming a holding of obviousness-type double patenting because the claims at issue were obvious over claims in four prior art patents); In re Berg, 140 F.3d at 1437, 46 USPQ2d at 1233 (Fed. Cir. 1998) (affirming a holding of obviousness-type double patenting where a patent application claim to a genus is anticipated by a patent claim to a species with that genus). “ELI LILLY AND COMPANY v BARR LABORATORIES, INC., United States Court of Appeals for the Federal Circuit, ON PETITION FOR REHEARING EN BANC (DECIDED: May 30, 2001).
“Claim 12 and Claim 13 are generic to the species of invention covered by claim 3 of the patent. Thus, the generic invention is “anticipated” by the species of the patented invention. Cf., Titanium Metals Corp. v. Banner, 778 F.2d 775, 227 USPQ 773 (Fed. Cir. 1985) (holding that an earlier species disclosure in the prior art defeats any generic claim) 4. This court’s predecessor has held that, without a terminal disclaimer, the species claims preclude issuance of the generic claim. In re Van Ornum, 686 F.2d 937, 944, 214 USPQ 761, 767 (CCPA 1982); Schneller, 397 F.2d at 354. Accordingly, absent a terminal disclaimer, claims 12 and 13 were properly rejected under the doctrine of obviousness-type double patenting.” (In re Goodman (CA FC) 29 USPQ2d 2010 (12/3/1993).
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) making identifying, generating, determining, detecting and alerting based on sets of text information.
This judicial exception is not integrated into a practical application because they are broad enough to cover the steps in the mind or with pen/paper, other than the generic computer components, acting on printouts of logs.
Regarding Prong One, these steps, as drafted, form a process that under its broadest reasonable interpretation covers performance of the limitation in the mind or with pen/paper but for the recitation of generic computer components. That is, other than reciting “a computer program product”, “computer implemented method”, and “a system”, nothing in the claim element precludes the step from practically being performed in the human mind. For example, but for the “a system” language, the claim encompasses a user/administrator analyzing log files as introduction to network security classes are taught.
Regarding Prong Two, there are no additional element(s) or a combination of elements in the claim that apply, rely on, or use the judicial exception in a manner that imposes a meaningful limit on the judicial exception, such that it is more than a drafting effort designed to monopolize the exception.
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the claims only use generic computer components. Mere instructions to apply an exception using generic components cannot provide an inventive concept. Additionally, the mere nominal recitation of a generic processor does not take the claim limitation out of the mental processes grouping. Thus, the claims recite a mental process and are not patent eligible.
The claims are directed to well-understood, routine, and conventional activity as evidenced by the “background of the invention” section and the cited references.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1, 2, 4, 6, 10, 13, 14, 16-18, and 20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Vega (20220407870).
Regarding claims 1, 13, and 17, Vega teaches A computer-program product comprising one or more non-transitory machine-readable storage media, including stored instructions configured to cause a computing system to perform a set of operations including: / A computer-implemented method comprising: / A system comprising: one or more processors; one or more non-transitory computer-readable media storing instructions, which, when executed by the system, cause the system to perform a set of operations including (abstract)):
identifying, for each of a plurality of DNS communications associated with a DNS server, one or more DNS communication characteristics and a content item (par.19-21);
generating a plurality of clusters of content items from the plurality of DNS communications using the DNS communication characteristics corresponding to the plurality of DNS communications, wherein the generation includes assigning, for each cluster of the plurality of clusters, particular items corresponding to a subset of the plurality of DNS communications to the cluster (par.21-23);
for each cluster of the plurality of clusters, determining an aggregate amount of information conveyed by the particular content items in the cluster based on: determining, for each unique content item among the particular content items, an individual amount of information based on a number of character possibilities of the unique content item, wherein the number of character possibilities is based on a format including a number of different characters used at least once in the unique content item, wherein the unique content item uses only a subset of available characters (par.27-30, 40-47);
detecting that, with respect to a particular cluster of the plurality of clusters, a notification condition is satisfied based on the aggregate amount of information corresponding to the cluster; based at least in part on detecting that the particular cluster has the particular aggregate amount of information that satisfies the one or more notification conditions, triggering an action or notification reporting (par.29-33).
Regarding claims 2, 14, and 18, Vega teaches wherein the notification reporting is triggered based at least in part on detecting that the particular aggregate amount of information satisfies the one or more notification reporting, wherein the notification reporting includes outputting the particular aggregate amount of information (par.42-44).
Regarding claims 4, 16, and 20, Vega teaches wherein the plurality of DNS communications comprises DNS requests, and wherein the DNS communication characteristic comprises a public domain name suffix of a DNS communication target, the set of operations further including parsing the DNS requests to separate public domain suffixes from content items of request text (par.27-29).
Regarding claim 6, Vega teaches wherein the plurality of DNS communications comprises DNS requests, and wherein the at communication characteristic comprises a subnet identifier of a DNS communication source, the set of operations further including accessing metadata associated with the DNS requests to identify subnet identifiers of sources of the DNS requests (par.27-29).
Regarding claim 10, Vega teaches wherein the plurality of DNS communications comprises DNS responses, and wherein the DNS communication characteristic comprises a public domain suffix of a DNS communication target, the set of operations further including parsing the DNS responses to separate public domain suffixes from content items of response text (par.27-29).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 3, 7, 8, 15, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Vega (20220407870), and further in view of Duan (20250202916).
Regarding claims 3, 15, and 19, Vega teaches wherein the action is triggered based at least in part on detecting that the particular aggregate amount of information satisfies the one or more notification reporting (par.42-44),
but does not expressly disclose, however, Duan teaches wherein the action includes adding an endpoint corresponding to the particular cluster to a whitelist or blacklist (par.70-75, 90-100).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Vega to use black and white lists as taught by Duan.
One of ordinary skill in the art would have been motivated to perform such a modification to provide efficient updates for allowed traffic (Duan, par.18-23).
Regarding claim 7, Vega teaches wherein the plurality of DNS communications comprises DNS requests, and wherein the DNS communication characteristic comprises a host comprising a DNS communication source (par.15-19, 42-44),
but does not expressly disclose, however, Duan teaches the set of operations further including accessing metadata associated with the DNS requests to identify hosts that originated the DNS requests (par.21-25, 35-41).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Vega to determine affected devices and source of attacks as taught by Duan.
One of ordinary skill in the art would have been motivated to perform such a modification to provide efficient updates for allowed traffic (Duan, par.18-23).
Regarding claim 8, Vega teaches wherein the plurality of DNS communications comprises DNS requests, and wherein the DNS communication characteristic comprises a tenant source of a DNS communication (par.15-19, 42-44),
but does not expressly disclose, however, Duan teaches the set of operations further including accessing metadata associated with the DNS requests to identify tenant sources of the DNS requests (par.21-25, 35-41).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Vega to determine affected devices and source of attacks as taught by Duan.
One of ordinary skill in the art would have been motivated to perform such a modification to provide efficient updates for allowed traffic (Duan, par.18-23).
Claims 5 and 9 are rejected under 35 U.S.C. 103 as being unpatentable over Vega (20220407870), and further in view of Pathak (11962565).
Regarding claim 5, Vega does not expressly disclose, however, Pathak teaches wherein the plurality of DNS communications comprises DNS requests, and wherein the DNS communication characteristic comprises a virtual network identifier of a DNS communication source, the set of operations further including accessing metadata associated with the DNS requests to identify virtual network identifiers of sources of the DNS requests (col.3, 50-67, col.4, 1-50).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Vega to also determine virtual identifiers of sources of traffic as taught by Pathak.
One of ordinary skill in the art would have been motivated to perform such a modification to further protect network traffic (Pathak, col.3-4).
Regarding claim 9, Vega does not expressly disclose, however, Pathak teaches wherein the plurality of DNS communications comprises DNS responses, and wherein the DNS communication characteristic comprises a virtual network identifier of a DNS communication source, set of operations further including accessing metadata associated with the DNS responses to identify virtual network identifiers of sources of the DNS responses.
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Vega to also determine virtual identifiers of sources of traffic as taught by Pathak.
One of ordinary skill in the art would have been motivated to perform such a modification to further protect network traffic (Pathak, col.3-4).
Claims 11 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Vega (20220407870), and further in view of Pangeni (20190058718).
Regarding claim 11, Vega does not expressly disclose, however, Pangeni teaches wherein determining the individual amount of information based on the number of character possibilities of the unique content item further comprises: computing a product of a length of the unique content item from unique content items among the particular content items and a logarithm of the number of different characters in the format of the unique content item from the unique content items, and wherein the aggregating the individual amount of information for the particular content items comprises summing information conveyed by the unique content items (par.50-60).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Vega to determine likelihood of DNS exfiltration as taught by Pangeni.
One of ordinary skill in the art would have been motivated to perform such a modification to further protect network traffic (Pangeni, par.2-5, 50-60).
Regarding claim 12, Vega does not expressly disclose, however, Pangeni teaches wherein the set of operations further includes: determining the number of unique content items among the particular content items; computing a sum of information conveyed by the unique content items; and dividing the summed information by the number of the unique content items; wherein the aggregate amount of information is an average amount of information conveyed by the unique content items (par.50-60).
Therefore, one of ordinary skill in the art would have found it obvious before the effective filing date of the claimed invention to modify Vega to determine likelihood of DNS exfiltration as taught by Pangeni.
One of ordinary skill in the art would have been motivated to perform such a modification to further protect network traffic (Pangeni, par.2-5, 50-60).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: the remaining references put forth on the PTO-892 form are directed to preventing data exfiltration by DNS queries.
Huang (20220400133) teaches An information leakage detection method and a device using the same are disclosed. The method includes the following steps. Network connection data of an electronic device is obtained. Log data related to a (domain name system) DNS is extracted from the network connection data. A DNS request in the log data is analyzed to obtain multiple character distribution feature values according to an analysis result. The character distribution feature values reflect a character distribution status of a domain name in the DNS request under different classification rules. A machine learning model determines whether the DNS request is a malicious DNS request according to the character distribution feature values, and the malicious DNS request is used to carry leaked data to a remote host.
Sharad (12519822) teaches to facilitate the detection of Domain Name System (DNS) exfiltration attacks. In some examples, a DNS request is used to generate a tokenized vector that corresponds to the DNS request, features of the DNS request, and aggregated features calculated over a sliding window representative of a recent history of events between a particular source and domain. The tokenized vector is input into a neural network to generate a probability score indicating a likelihood that the current DNS request corresponds to a DNS exfiltration. A graphical user interface is generated to display an indication of the probability score for the current DNS request.
Duan (20240205240) teaches DNS tunneling detector 138 (whether implemented on security platform 140, on data appliance 102, or other appropriate location/combinations of locations) uses a two-pronged approach in identifying malicious DNS tunneling. The first approach uses anomaly detector 146 (e.g., implemented using python) to build a set of real-time profiles (156) of DNS traffic for root domains. The second approach uses signature generation and matching (also referred to herein as similarity detection, and, e.g., implemented using Go). The two approaches are complementary. The anomaly detector serves as a generic detector that can identify previously unknown tunneling traffic. However, the anomaly detector may need to observe multiple DNS queries before detection can take place. In order to block the first DNS tunneling packet, similarity detector 144 complements anomaly detector 146 and extracts signatures from detected tunneling traffic which can be used to identify situations where an attacker has registered new malicious tunneling root domains but has done so using tools/malware that are similar to the detected root domains.
Bhatnagar (20230388322) teaches to detect domain name system tunneling (DNST). In some aspects, a method comprises: receiving a plurality of domain name system (DNS) requests to access one or more domains; processing, by using a machine learning model, the plurality of DNS requests to determine one or more suspicious DNS requests among the plurality of DNS requests; and processing, by using a statistical analysis model, the one or more suspicious DNS requests to determine whether the one or more suspicious DNS requests are potentially malicious DNS requests.
Chakkirala (11140123) teaches community detection based on DNS querying patterns are disclosed. For example, techniques for community detection based on DNS querying patterns for anomaly detection and monitoring efficiencies are disclosed. In some embodiments, a system, process, and/or computer program product for community detection based on DNS querying patterns includes receiving DNS log files, wherein the DNS log files include a DNS query and a DNS response for resolution of the DNS query; generating a graph based on the DNS log files; identifying a plurality of communities using the graph based on DNS querying patterns; and detecting an anomaly in DNS activity associated with one or more of the communities based on a DNS querying rule.
Dymshits (10915629) teaches detecting data exfiltration using domain name system (DNS) queries include, in various embodiments, performing operations that include parsing a DNS query to determine whether that DNS query is likely to contain hidden data that is being exfiltrated from a system or network. Statistical methods can be used to analyze the DNS query to determine a likelihood whether each of a plurality of segments of the DNS query are indicative of data exfiltration methods. If one or multiple DNS queries are deemed suspicious based on the analysis, a security action on the DNS query can be performed, including sending an alert and/or blocking the DNS query from being forwarded.
Arlitt (10880319) teaches a Domain Name System (DNS) server is to receive, over a network, a DNS query containing a domain name, the DNS query sent by a device. The DNS server is to determine whether the domain name is potentially generated by malware. In response to determining that the domain name is potentially generated by malware, the DNS server is to generate a DNS response containing information indicating that the domain name is potentially generated by malware, and send the DNS response to the network.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to David García Cervetti whose telephone number is (571)272-5861. The examiner can normally be reached Monday-Friday 8AM-5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, HADI S ARMOUCHE can be reached at (571)270-3618. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/David Garcia Cervetti/Primary Examiner, Art Unit 2409
