DETAILED ACTION
In a communication received on 5 January 2026, the applicants amended claims 1, 11, and 20.
Claims 1-6, 8-16, and 18-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to claim(s) 1, 11, and 20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
With respect to claim 1, the applicants allege, "Crabtree' s baseline is keyed to entities such as a user or a device, not to a specific web application that is subjected to synthetic load tests" (page 9) with respect to the claimed limitation(s), "determining, by the device, a baseline of expected domains that are accessed during loading of the web application based on normalizing an aggregation of test results". The examiner respectfully traverses. The arguments/remarks pertain to whether the cited prior art does not disclose or suggest an application specific baseline. The examiner concludes that the cited prior art clearly suggests a baseline profile of domains loaded during web application load tests
Ascertaining the differences between the prior art and the claims at issue requires interpreting the claim language, and considering both the invention and the prior art references as a whole (See 2141.02 "Differences Between Prior art and Claimed Invention).
As best understood by the examiner, the claimed limitation pertains to a list of domains accessed during web application loading. Although Crabtree supplies the baseline/anomaly framework based on aggregated user web access (¶0075, ¶0077, ¶0091). Lad more explicitly provides the application/page-load domain records (¶0192). The claimed list of domains accessed during web application is suggested by applying Crabtree's baseline analysis to Lad's application specific domain records.
In conclusion, the applicants argue(s) that the cited prior art does not disclose or suggest an application specific baseline. The examiner traverses because the cited prior art clearly suggests a baseline profile of domains loaded during web application load tests.
The applicants allege, "Crabtree does not contemplate load tests of a particular web application in the sense used in Applicant's specification" (page 9) with respect to the claimed limitation(s), "receiving, at a device, results of a plurality of load tests for a web application, the results comprising one or more domains accessed when loading the web application during the plurality of load tests". The examiner respectfully traverses. The arguments/remarks pertain to whether the cited prior art does not disclose or suggest an load tests / page-load results. The examiner concludes that the cited prior art clearly suggests active page-load/domain test results
Ascertaining the differences between the prior art and the claims at issue requires interpreting the claim language, and considering both the invention and the prior art references as a whole (See 2141.02 "Differences Between Prior art and Claimed Invention)
As best understood by the examiner, load tests broadly includes page load tests, transaction tests which identify domains accessed during a page load. Lad discloses the collection of test results from the agents (¶0036) to load the webpage and each component grouped by domain and provider (¶0192). The load tests correspond to test results from distributed agents substantially covering at least collecting a first data set that varies from a second data set. Lad supplies the active page load/domain test results for Crabtree to be applied for baseline and anomaly detection.
In conclusion, the applicants argue(s) that the cited prior art does not disclose or suggest an load tests / page-load results. The examiner traverses because the cited prior art clearly suggests active page-load/domain test results.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-6, 8-16, and 18-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lad et al. (US 2013/0311832 A1) in view of Crabtree et al. (US 2018/0183766 A1), and further in view of Fuh et al. (US 2007/0061288 A1).
With respect to claim 1, Lad discloses: a method, comprising:
receiving, at a device, results of a plurality of load tests for a web application, the results comprising one or more domains accessed when loading the web application during the plurality of load tests (i.e., device receiving results exported by agents with multiple page-load tests grouped by domain/provider during web-application loading; test results are collected for correlation and analysis in Lad, ¶0048, ¶0055, ¶0057, ¶0192),
the other test results identifying one or more domains accessed when loading the different web application (i.e., tests target different web pages/applications; page-load data identifies components accessed by domain/provider; test results identify accessed domains in Lad, ¶0055, ¶0057, ¶0192, ¶0200).
Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses:
determining, by the device, a baseline of expected domains that are accessed during loading of the web application based on normalizing an aggregation of test results (i.e., normalize incoming data, analyze aggregated data to predict normal usage, generate baseline of expected domains in Crabtree, ¶0061, ¶0075, ¶0091-0092).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
Lad discloses recording domains accessed during loading, presenting application delivery information and recommendations (¶0051, ¶0079, ¶0192-0193). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses:
identifying, by the device and based on the baseline of expected domains, an anomalous domain that is accessed during a loading of the web application (i.e., comparing activity to baselines and flag anomalous browsing, unusual domain access in Crabtree, ¶0077, ¶0092, ¶0107); and
performing, by the device, one or more mitigation actions in response to identifying the anomalous domain. (i.e., responsive to detection, execute commands, issue alerts, defensive measures, and automate corrective action in Crabtree, ¶0055, ¶0057, ¶0093).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
Lad discloses test results for targets are stored and components grouped by domain/provider for cross application domain result aggregation enablement (¶0053, ¶0055, ¶0192). Lad and Crabtree do(es) not explicitly disclose the following. Fuh, in order to optimize runtime and processing resources (¶0038, ¶0057), discloses:
wherein the aggregation of test results includes the results of the plurality of load tests and only normalized results of other test results for a different web application having at least one overlapping domain with the web application (i.e., joining and intersecting records based on matching values; limits the aggregation to other records that overlap based on an identifier with the target records in Fuh, ¶0008, ¶0090),
Lad discloses domain-grouped page-load data identifies different web applications with overlapping domain (¶0192, ¶0206). Lad and Crabtree do(es) not explicitly disclose identifying overlapping domains between web applications and the following. Fuh, in order to optimize runtime and processing resources (¶0038, ¶0057), discloses:
wherein the different web application has at least one overlapping domain with the web application (i.e., semi-join operation; matching records based on column values; semi-join results identifies whether two sets of records share an overlapping value in Fuh, ¶0008, ¶0093),
the at least one overlapping domain comprising a same domain identifier that appears in (i) the results of the plurality of load tests for the web application and (ii) the other test results for the different web application (i.e., "key" corresponds to a field or attribute, join retrieves data from two or more datasets on matching values, intersection selects identifiers in both result sets in Fuh, ¶0005, ¶0008, ¶0090), and
wherein the only normalized results of the other test results are normalized results for the at least one overlapping domain (i.e., semi-join operation performs AND/intersection filtering retaining common matched records; limiting to only results with overlapping values in Fuh, ¶0055, ¶0057, ¶0093).
Based on Lad in view of Crabtree, and further in view of Fuh, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Fuh to improve upon those of Lad in order to optimize runtime and processing resources.
With respect to claim 2, Lad further discloses: the method as in claim 1, wherein one or more agents perform load tests to generate the results of the plurality of load tests (i.e., using multiple software agents to collect information on the web application from different points in the network in Lad, ¶0043).
With respect to claim 3, Lad further discloses the method as in claim 1, further comprising:
receiving, by the device, results of a plurality of multi-step transaction test comprising additional information about the one or more domains (i.e., using multiple software agents to collect information on the web application from different points in the network; include response time and throughput associated with different domains in Lad, ¶0043, ¶ 0192).
With respect to claim 4, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, wherein identifying, by the device and based on the baseline of expected domains, the anomalous domain that is loaded during the loading of the web application comprises matching the anomalous domain to a domain in a list of known malicious domains (i.e., identify a domain, during web browsing, that is matched to a blacklist of domains in Crabtree, ¶0107).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 5, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, wherein determining, by the device, the baseline of expected domains that are accessed during loading of the web application is further based on a specific time period of the results of the plurality of load tests (i.e., baseline from data of a specific time period suggested by anomalous behavior identified by activities such as web browsing and access to domains in the off-hours in Crabtree, ¶0092).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 6, Lad further discloses: the method as in claim 1, wherein the web application comprises a webpage, further wherein the results of the plurality of load tests comprises results of page load tests (i.e., the results of page load tests of multiple components from different domains from a webpage in Lad, ¶0057, ¶0192).
With respect to claim 8, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, wherein the one or more mitigation actions comprises blocking, by the device, the anomalous domain from the loading of the web application (i.e., identifying anomalous behavior and locking the device out of network from continued access to the web in Crabtree, ¶0107).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 9, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, wherein the one or more mitigation actions comprises causing a graphical user interface to display an indication of the anomalous domain at an end-user device (i.e., notifying group members and admins of the anomalous device behavior and actions to take in Crabtree, ¶0107).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 10, Lad discloses the platform stores test results for targets and groups components by domain/provider suggesting cross application domain results aggregation (¶0053, ¶0060, ¶0192). Lad do(es) not explicitly disclose the following. Crabtree, in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline (¶0077), discloses: the method as in claim 1, wherein the anomalous domain comprises a particular domain from the baseline of expected domains but data associated with the loading of the particular domain for the web application is anomalous (i.e., anomalous behavior suggested by accessing a domain but a predetermined number of times within a certain timeframe or during off-hours in Crabtree, ¶0092).
Based on Lad in view of Crabtree, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Crabtree to improve upon those of Lad in order to improve detection of anomalous behavior establishing a baseline profile and monitoring corresponding to the baseline.
With respect to claim 11, the limitation(s) of claim 11 are similar to those of claim(s) 1. Therefore, claim 11 is rejected with the same reasoning as claim(s) 1.
With respect to claim 12, the limitation(s) of claim 12 are similar to those of claim(s) 2. Therefore, claim 12 is rejected with the same reasoning as claim(s) 2.
With respect to claim 13, the limitation(s) of claim 13 are similar to those of claim(s) 3. Therefore, claim 13 is rejected with the same reasoning as claim(s) 3.
With respect to claim 14, the limitation(s) of claim 14 are similar to those of claim(s) 4. Therefore, claim 14 is rejected with the same reasoning as claim(s) 4.
With respect to claim 15, the limitation(s) of claim 15 are similar to those of claim(s) 5. Therefore, claim 15 is rejected with the same reasoning as claim(s) 5.
With respect to claim 16, the limitation(s) of claim 16 are similar to those of claim(s) 6. Therefore, claim 16 is rejected with the same reasoning as claim(s) 6.
With respect to claim 18, the limitation(s) of claim 18 are similar to those of claim(s) 8. Therefore, claim 18 is rejected with the same reasoning as claim(s) 8.
With respect to claim 19, the limitation(s) of claim 19 are similar to those of claim(s) 9. Therefore, claim 19 is rejected with the same reasoning as claim(s) 9.
With respect to claim 20, the limitation(s) of claim 20 are similar to those of claim(s) 1. Therefore, claim 20 is rejected with the same reasoning as claim(s) 1.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHERMAN L LIN whose telephone number is (571)270-7446. The examiner can normally be reached Monday through Friday 9:00 AM - 5:00 PM (Eastern).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joon Hwang can be reached on 571-272-4036. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Sherman Lin
5/7/2026
/S. L./Examiner, Art Unit 2447
/JOON H HWANG/Supervisory Patent Examiner, Art Unit 2447
Prosecution Insights