DETAILED ACTION
In a communication received on 12 August 2026, the applicants amended claims 1, 3, 4, 6, 9, 11, 13, 14, 16, and 20, and canceled claim 10
Claims 1-6, 8-9, 11-16 and 18-23 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to claim(s) 1, 9, 11, and 20-23 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
With respect to claim 1, the applicants allege, "the claimed anomaly is defined by the loading composition of the specific web application itself A domain is identified as anomalous because it appears in a subsequent loading of that web application even though it is not part of the set of domains that the same web application, as characterized by its own normalized load-test baseline, is expected to load" (page 10) with respect to the claimed limitation(s), "identifying, by the device and based on the baseline of expected domains, an anomalous domain that is accessed during a subsequent loading of the web application, wherein the anomalous domain is a domain that is inserted into the subsequent loading of the web application relative to the baseline of expected domains and that is not included in the baseline of expected domains". The examiner respectfully traverses. The arguments/remarks pertain to whether the cited prior art does not disclose or suggest anomaly detection for domain page load analysis for a webapp. The examiner concludes that the cited prior art clearly discloses or suggests determining the domains on load test and then establishing a baseline and comparing to that baseline.
"The test for obviousness is not whether the features of a secondary reference may be bodily incorporated into the structure of the primary reference.... Rather, the test is what the combined teachings of those references would have suggested to those of ordinary skill in the art." In re Keller, 642 F.2d 413, 425, 208 USPQ 871, 881 (CCPA 1981).
As best understood by the examiner, the claimed limitations read on domains loaded in a subsequent loading that are not in a baseline of domains but does not require determining or identifying malice or source of insertion. The applicants argue the references individually while the rejection relies on a combination of the teachings. Additionally, the applicants' specification supports the interpretation that a web application may be a webpage (¶0052). Lad discloses monitoring domains loaded by a page and groups them by domain (Lad, ¶0192). Crabtree discloses continuous monitoring and comparison to a baseline for determining anomalous activity (Crabtree, ¶0077). Together, the references as a whole describe a baseline deviation analysis applied to page domain load records. Such a combination is plausible according to improving anomaly detection by monitoring activity against an established baseline of network browsing activity (Crabtree, ¶0077). Therefore, the cited prior art clearly discloses or suggests monitoring page loads and comparing them to a baseline from observed page loads for a webpage.
In conclusion, the applicants argue(s) that the cited prior art does not disclose or suggest anomaly detection for domain page load analysis for a webapp. The examiner traverses because the cited prior art clearly discloses or suggests determining the domains on load test and then establishing a baseline and comparing to that baseline.
With respect to claim 9, the applicants allege, "the results of a different web application may contribute to the baseline of the web application with respect to domains that the two applications share, while domains of the different application that do not also appear in the load-test results for the web application are not incorporated into the baseline. None of Lad, Crabtree, or Fuh teaches or suggests this feature." (page 14-15) with respect to the claimed limitation(s), "determining the baseline of expected domains comprises normalizing an aggregation of the results of the plurality of load tests for the web application and results of one or more load tests for a different web application, wherein the aggregation does not include domains identified in the results of the one or more load tests for the different web application that do not also appear in the results of the plurality of load tests for the web application". The examiner respectfully traverses. The arguments/remarks pertain to whether the cited prior art does not disclose or suggest excluding domains not common between two result sets. The examiner concludes that the cited prior art clearly suggests incorporating the overlapping domains into a baseline
"The test for obviousness is not whether the features of a secondary reference may be bodily incorporated into the structure of the primary reference.... Rather, the test is what the combined teachings of those references would have suggested to those of ordinary skill in the art." In re Keller, 642 F.2d 413, 425, 208 USPQ 871, 881 (CCPA 1981).
As best understood by the examiner, the exclusion of domains reads on retaining overlapping domains across result sets. The applicants' mostly argue differences individually of the references when the combination is relied upon for the rejection. Lad discloses the test results pertaining to domains loaded for a webpage (i.e., web application) (Lad, ¶0055). Crabtree discloses functionality of aggregating baselines from a group (Crabtree, ¶0091). Fuh discloses a technical database implementation of matching columns and intersecting key values to merge and intersect datasets (Fuh, ¶0008). The combined teachings as a whole pertain to utilizing a domain as a key for joining datasets that have overlapping domains before aggregating into a baseline. Such a combination is possible in order to improve processing efficiency by reducing data brought into further data analysis by selective intersection (Fuh, ¶0038). The cited prior art clearly discloses or suggests the exclusion of domains that are not common to both sets of domain page loads.
In conclusion, the applicants argue(s) that the cited prior art does not disclose or suggest excluding domains not common between two result sets. The examiner traverses because the cited prior art clearly suggests incorporating the overlapping domains into a baseline.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-6, 8, 11-16, and 18-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lad et al. (US 2013/0311832 A1) in view of Crabtree et al. (US 2018/0183766 A1).
With respect to claim 1, Lad discloses: a method, comprising:
receiving, at a device, results of a plurality of load tests for a web application, the results comprising one or more domains accessed when loading the web application during the plurality of load tests (i.e., device receiving results exported by agents with multiple page-load tests grouped by domain/provider during web-application loading; test results are collected for correlation and analysis in Lad, ¶0048, ¶0055, ¶0057, ¶0192).
Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses:
determining, by the device, a baseline of expected domains that are accessed during loading of the web application based on normalizing the results of the plurality of load tests (i.e., normalize incoming data, analyze aggregated data to predict normal usage, generate baseline of expected domains in Crabtree, ¶0061, ¶0075, ¶0091-0092).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
Lad discloses recording domains accessed during loading, presenting application delivery information and recommendations (¶0051, ¶0079, ¶0192-0193). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses:
identifying, by the device and based on the baseline of expected domains, an anomalous domain that is accessed during a subsequent loading of the web application, wherein the anomalous domain is a domain that is inserted into the subsequent loading of the web application relative to the baseline of expected domains and that is not included in the baseline of expected domains (i.e., incoming activity is compared with an established baseline and unusual domain access or a blacklisted-domain access is flagged in Crabtree, ¶¶0077, 0092, 0107); and
performing, by the device, one or more mitigation actions in response to identifying the anomalous domain (i.e., responsive to detection, execute commands, issue alerts, defensive measures, and automate corrective action in Crabtree, ¶0055, ¶0057, ¶0093).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 2, Lad further discloses: the method as in claim 1, wherein one or more agents perform load tests to generate the results of the plurality of load tests (i.e., using multiple software agents to collect information on the web application from different points in the network in Lad, ¶0043).
With respect to claim 3, Lad further discloses the method as in claim 1, further comprising:
receiving, by the device, results of a plurality of multi-step transaction tests comprising additional information about the one or more domains (i.e., using multiple software agents to collect information on the web application from different points in the network; include response time and throughput associated with different domains in Lad, ¶0043, ¶ 0192).
With respect to claim 4, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, wherein identifying, by the device and based on the baseline of expected domains, the anomalous domain that is accessed during the subsequent loading of the web application comprises matching the anomalous domain to a domain in a list of known malicious domains (i.e., identify a domain, during web browsing, that is matched to a blacklist of domains in Crabtree, ¶0107).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 5, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, wherein determining, by the device, the baseline of expected domains that are accessed during loading of the web application is further based on a specific time period of the results of the plurality of load tests (i.e., baseline from data of a specific time period suggested by anomalous behavior identified by activities such as web browsing and access to domains in the off-hours in Crabtree, ¶0092).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 6, Lad further discloses: the method as in claim 1, wherein the web application comprises a webpage, further wherein the results of the plurality of load tests comprise results of page load tests (i.e., the results of page load tests of multiple components from different domains from a webpage in Lad, ¶0057, ¶0192).
With respect to claim 8, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, wherein the one or more mitigation actions comprises blocking, by the device, the anomalous domain from the loading of the web application (i.e., identifying anomalous behavior and locking the device out of network from continued access to the web in Crabtree, ¶0107).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 11, the limitation(s) of claim 11 are similar to those of claim(s) 1. Therefore, claim 11 is rejected with the same reasoning as claim(s) 1.
With respect to claim 12, the limitation(s) of claim 12 are similar to those of claim(s) 2. Therefore, claim 12 is rejected with the same reasoning as claim(s) 2.
With respect to claim 13, the limitation(s) of claim 13 are similar to those of claim(s) 3. Therefore, claim 13 is rejected with the same reasoning as claim(s) 3.
With respect to claim 14, the limitation(s) of claim 14 are similar to those of claim(s) 4. Therefore, claim 14 is rejected with the same reasoning as claim(s) 4.
With respect to claim 15, the limitation(s) of claim 15 are similar to those of claim(s) 5. Therefore, claim 15 is rejected with the same reasoning as claim(s) 5.
With respect to claim 16, the limitation(s) of claim 16 are similar to those of claim(s) 6. Therefore, claim 16 is rejected with the same reasoning as claim(s) 6.
With respect to claim 18, the limitation(s) of claim 18 are similar to those of claim(s) 8. Therefore, claim 18 is rejected with the same reasoning as claim(s) 8.
With respect to claim 19, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the tangible, non-transitory, computer-readable medium as in claim 11, wherein the one or more mitigation actions comprises causing a graphical user interface to display an indication of the anomalous domain at an end-user device (i.e., system administrators and group members receive notice of anomalous behavior and corrective actions in Crabtree, ¶0107).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 20, the limitation(s) of claim 20 are similar to those of claim(s) 1. Therefore, claim 20 is rejected with the same reasoning as claim(s) 1.
Claim(s) 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lad et al. (US 2013/0311832 A1) in view of Crabtree et al. (US 2018/0183766 A1), and further in view of Fuh et al. (US 2007/0061288 A1).
With respect to claim 9, Lad discloses test results for targets are stored and components grouped by domain/provider for cross application domain result aggregation enablement (¶0053, ¶0055, ¶0192). Lad and Crabtree do(es) not explicitly disclose the following. Fuh, in order to optimize runtime and processing resources (¶0038, ¶0057), discloses: the method as in claim 1, wherein determining the baseline of expected domains comprises normalizing an aggregation of the results of the plurality of load tests for the web application and results of one or more load tests for a different web application (i.e., records from multiple data sets are joined on matching domain-identifier values and combined into an aggregate result in Fuh, ¶¶0008, 0090)
wherein the aggregation does not include domains identified in the results of the one or more load tests for the different web application that do not also appear in the results of the plurality of load tests for the web application (i.e., AND/intersection of semi-join results retains matching identifiers shared by both data sets and excludes unmatched records in Fuh, ¶¶0008, 0055, 0090).
Based on Lad in view of Crabtree, and further in view of Fuh, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Fuh to improve upon those of Lad in order to optimize runtime and processing resources.
Claim(s) 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lad et al. (US 2013/0311832 A1) in view of Crabtree et al. (US 2018/0183766 A1), and further in view of Glazier et al. (US 2022/0038469 A1).
With respect to claim 21, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, further comprising, based on comparisons between (i) domains accessed during a plurality of load tests for the one or more different web applications and (ii) respective baselines of expected domains for the one or more different web applications (i.e., each monitored entity's aggregated data is used to form its baseline and later activity is compared with that baseline in Crabtree, ¶¶0075, 0077).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
Lad supplies domain/provider data for multiple application targets and Crabtree supplies baseline-based anomaly flags (Lad ¶0192; Crabtree ¶¶0075, 0077). Lad and Crabtree do(es) not explicitly disclose the following. Glazier, in order to improve domain-risk assessment using historical cross-application threat and provider reputation information (¶0021), discloses: in response to identifying the anomalous domain, performing, by the device, a cross-application analysis that compares the anomalous domain, or a provider network associated with the anomalous domain, to domains or provider networks that were flagged as anomalous for one or more different web applications (i.e., current web-application domains and associated hosting-provider infrastructure are compared with historical attack information from other application-security threats in Glazier, ¶¶0021, 0022)
wherein the one or more mitigation actions are performed based at least in part on the cross-application analysis (i.e., domain and provider reputation analysis drives dynamically generated and deployed protective security policies in Glazier, ¶¶0039, 0040).
Based on Lad in view of Crabtree, and further in view of Glazier, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Glazier to improve upon those of Lad in order to improve domain-risk assessment using historical cross-application threat and provider reputation information.
Claim(s) 22 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lad et al. (US 2013/0311832 A1) in view of Crabtree et al. (US 2018/0183766 A1), and further in view of Fakeri-Tabrizi et al. (US 2019/0068634 A1).
With respect to claim 22, Lad and Crabtree discloses the combined system compares domains observed in subsequent page loads with an application-specific expected-domain baseline (Lad ¶0192; Crabtree ¶¶0075, 0077). Lad and Crabtree do(es) not explicitly disclose the following. Fakeri-Tabrizi, in order to improve domain-anomaly classification by applying detection at the stable core-domain level (¶0054), discloses: the method as in claim 1, wherein identifying the anomalous domain comprises identifying the anomalous domain based on a domain level, such that a domain that is accessed during the subsequent loading of the web application and that differs from the baseline of expected domains at a second level domain is identified as the anomalous domain (i.e., a core domain is the second-level domain plus top-level domain and anomaly detection operates at that core-domain level in Fakeri-Tabrizi, ¶¶0027, 0054)
and a domain that differs from the baseline of expected domains only at a third level domain or lower is not identified as the anomalous domain (i.e., multi-level subdomains are aggregated to the same core domain, treating a lower-level-only change as the same comparison identity in Fakeri-Tabrizi, ¶¶0027, 0054).
Based on Lad in view of Crabtree, and further in view of Fakeri-Tabrizi, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Fakeri-Tabrizi to improve upon those of Lad in order to improve domain-anomaly classification by applying detection at the stable core-domain level.
Claim(s) 23 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lad et al. (US 2013/0311832 A1) in view of Crabtree et al. (US 2018/0183766 A1), and further in view of Glazier et al. (US 2022/0038469 A1) and Rodniansky et al. (US 2021/0144160 A1).
With respect to claim 23, Lad supplies domain/provider data for multiple application targets and Crabtree supplies baseline-based anomaly flags (Lad ¶0192; Crabtree ¶¶0075, 0077). Lad and Crabtree do(es) not explicitly disclose the following. Glazier, in order to improve domain-risk assessment using historical cross-application threat and provider reputation information (¶0021), discloses: the method as in claim 1, wherein performing the one or more mitigation actions comprises feeding the anomalous domain into a firewall of a device on which an agent is installed (i.e., domain-reputation results generate security policies deployed to a web server that may be a firewall or web-application firewall in Glazier, ¶¶0039, 0040, 0053).
Based on Lad in view of Crabtree, and further in view of Glazier, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Glazier to improve upon those of Lad in order to improve domain-risk assessment using historical cross-application threat and provider reputation information.
Lad and Crabtree discloses agents observe application loads, identify anomalous domain access, and initiate mitigation (Lad ¶¶0043, 0192; Crabtree ¶0107). Lad, Crabtree, and Glazier do(es) not explicitly disclose the following. Rodniansky, in order to handle anomalous encrypted connections efficiently by terminating them through the inline protection system (¶0042), discloses: such that an active Transport Layer Security (TLS) connection with the anomalous domain is terminated (i.e., an agent and network protection system respond to an anomalous TLS request by causing the server to drop the active TLS connection and return a termination response in Rodniansky, ¶¶0037, 0042).
Based on Lad in view of Crabtree, and further in view of Glazier and Rodniansky, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Rodniansky to improve upon those of Lad in order to handle anomalous encrypted connections efficiently by terminating them through the inline protection system.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHERMAN L LIN whose telephone number is (571)270-7446. The examiner can normally be reached Monday through Friday 9:00 AM - 5:00 PM (Eastern).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joon Hwang can be reached on 571-272-4036. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Sherman Lin
9/30/2026
/S. L./Examiner, Art Unit 2447
/JOON H HWANG/Supervisory Patent Examiner, Art Unit 2447
