DETAILED ACTION
Response to Amendment
This action is in response to amendment filed January 20, 2026 for the application # 18/302,925 filed on April 19, 2023. Claims 1-4, 6-13, 15-22 are pending and are directed toward SYSTEMS AND METHODS FOR EXTERNAL DETECTION OF MISCONFIGURED SYSTEMS.
Any claim objection/rejection not repeated below is withdrawn due to Applicant's amendment.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Response to Arguments
Applicant’s arguments with regards to claims 1-4, 6-13, 15-22 have been fully considered, but they are not persuasive and moot because of new grounds of rejection of new added claims 21 and 22.
“not described” argument – Applicant argues that Xu' s system is not described as executing any of such DNS queries to extract metadata, and therefore does not teach or suggest at least "executing queries on the communication traffic to extract metadata" as recited in pending claim 1 (REMARKS, page 7).
Response: Xu teaches at least 2 types of queries. One are the queries for DNS, and another to determine events of the monitored traffic. See, for example: “the passive DNS data from the plurality of security devices includes DNS responses to DNS queries for non-existent domains (NXDOMAINs )” (Xu, Column 4, lines 63-64), and “Referring to FIG. 3, network traffic monitoring begins at 302. An IP address and port engine 304 determines an IP address and port number for a monitored traffic flow (e.g., a session) based on packet analysis. A policy check engine 306 determines whether any policies can be applied based on the IP address and port number. As is also shown in FIG. 3, an application signature check engine 308 identifies an application (e.g., using an APP-ID engine using various application signatures for identifying applications based on packet flow analysis).” (Xu, Column 13, lines 3-12).
“by contrast” argument – Applicant argues that by contrast, Xu only appears to describe collection of data for sinkholing of domains, while also requiring storage of such data by describing (REMARKS, page 7).
Response: First, log event are metadata created based on traffic monitoring. Second, storing log events in no way precludes their analysis. See, for example Applicant’s own disclosure: “In some embodiments, the traffic data and/or data regarding the domain names may be stored and analyzed by accessing the storage 208.” (Specification, page 6, lines 28-29).
Conclusion -Therefore, in view of the above reasons, Examiner maintains rejections.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4, 6-13 and 15-22 are rejected under 35 U.S.C. 103 as being unpatentable over Xu (US 9,560,072, Jan. 31, 2017) in view of Sullivan (US 2017/0180312, Pub. Date: Jun. 22, 2017), hereinafter referred to as Xu and Sullivan respectively.
As per claim 1, Xu teaches a computer-implemented method for external detection of a vulnerable system, the vulnerable system coupled to a communication network based on domain name properties (malware sample analysis 204, using network analysis engine 206, can identify malware domains (if any) that the malware sample attempts to access, which can be logged and sent to candidate bad network domains 208, Xu, Column 10, lines 48-51), the method comprising:
receiving communication traffic in the communication network to identify one or more domain name associated with a vulnerable system (collecting passive DNS data from a plurality of security devices to discover candidates for sinkholing of domain names, Xu, Column 4, lines 51-53), the communication traffic originating from at least one server system in the communication network (Generally, an NXDOMAIN is a condition or error that can be indicated for an Internet domain name that is unable to be resolved using the DNS servers ( e.g., invalid domain name) or that the Internet domain name is not yet registered. In some cases, an NXDOMAIN can also be indicated due to a network or DNS server problem, Xu, Column 3, lines 56-62);
executing queries on the communication traffic to extract metadata the passive DNS data from the plurality of security devices includes DNS responses to DNS queries for non-existent domains (NXDOMAINs), Xu, Column 4, lines 63-64);
identifying a domain name of the one or more domain names having an associated property indicative of vulnerability of the domain name based on the metadata, wherein the domain name having the associated property (each of the DNS responses includes a destination IP address that corresponds to a client device requesting a domain name resulting in an NXDOMAIN DNS response, and the distinct client devices are determined based on distinct IP addresses associated with DNS responses provided in the passive DNS data. Xu, Column 4, lines 64-67 - Column 5, lines 1-3) indicative of vulnerability comprises a domain name associated with malicious activity (can detect and report detected malicious/malware domains to the cloud security service, such as similarly described above. Xu, Column 15, lines 60-62);
when the domain name is not registered with a domain name registry (wherein each of the one or more domain names is not yet registered, Xu, Column 4, lines 56-57), registering the domain name (and automatically registering each of the one or more domain names with a domain registry, Xu, Column 4, lines 57-58);
Although Xu in view of Sullivan teaches (as was provided in now canceled claim 5) associating the registered domain name with a server system configured to monitor communication traffic to the registered domain name (In one embodiment, cloud security service 800 collects Passive DNS ( PDNS) data and identifies candidate network domains for sinkholing that are associated with a significant number of distinct hosts ( e.g., a threshold number of distinct infected host devices, such as client devices). The cloud security service can also perform the analysis of candidate network domains over a period of time to select candidate network domains for sinkholing that are associated with a significant number of distinct hosts over a threshold period of time, Xu, Column 16, lines 26-35), but he does not teach that this the “the second communication traffic”. Sullivan however teaches “the second communication traffic” as was claimed, specifically (When registration for the service is accepted, flow moves from block 340 to block 350 where the service server 125 causes the proxy server 120 to monitor communications received to and from that domain. The service server 125 configures the DNS system 140 such that DNS requests for the domain resolve to the proxy server 120; and configures the proxy server to handle communication for the domain. Sullivan, [0040]).
Xu in view of Sullivan are analogous art to the claimed invention, because they are from a similar field of endeavor of systems, components and methodologies for providing secure communication between computer systems. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify Xu in view of Sullivan. This would have been desirable because, for example, the proxy server 120 is configured to redirect traffic to the dedicated computing device as well as to the command and control server 130 while logging information regarding the requests and responses sent and received from the C&C server 130 (Sullivan, [0037]).
Xu in view of Sullivan further teaches detecting, from the second communication traffic, the vulnerable system associated with the malicious activity. (As a result, traffic from hosts (e.g., host devices, such as a computer, laptop, tablet, smart phone, server, and/or another type of computing device) that is resolved to this IP address can be analyzed by a network device controlled by the security entity, which can then, for example, determine which clients attempted to connect to that bad network domain (e.g., log which clients attempted to connect to the bad network domain and how many times) and/or perform various other actions (Xu, Column 6, lines 15-23). See also The client device may be susceptible to being infected with viruses, worms, or other vulnerabilities and may be part of a botnet network. Sullivan, [0037]).
Xu in view of Sullivan further teaches “to extract metadata in real-time while monitoring the communication traffic” as currently amended. Specifically Sullivan [0027] teaches “While in one embodiment the events are reported to the service server 125 in real time, in other embodiments the events are reported to the service server 125 differently (e.g., event logs are batched and transmitted to the service server 125 at regular intervals or as the system resources allow, event logs are batched and downloaded from the service server 125 at regular intervals or as the system resources allow, or other possible mechanisms”.
Xu in view of Sullivan are analogous art to the claimed invention, because they are from a similar field of endeavor of systems, components and methodologies for providing secure communication between computer systems. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify Xu in view of Sullivan. This would have been desirable because, for example, bad domains can be periodically received ( e.g., daily, hourly, or based on some other period of time or upon request) from a cloud security service ( e.g., cloud security service 120 of 25 FIG. 1) that provides firewall 300 with content updates (e.g., including signature updates, such as bad domain data including DNS signatures) (Xu, Column 13, lines 22-28).
As per claim 2, Xu in view of Sullivan teaches the method of claim 1, wherein the vulnerable system is a malware-infected server system (706- Determine Client is Infected with Identified Malware Based on Attempts to Connect to Sinkholed Bad Network Domain, Xu, FIG.7).
As per claim 3, Xu in view of Sullivan teaches the method of claim 1, wherein the vulnerable system is a misconfigured server system (In some cases, an NXDOMAIN can also be indicated due to a network or DNS server problem. Xu, Column 3, lines 61-62).
As per claim 4, Xu in view of Sullivan teaches the method of claim 1, wherein the metadata further comprises a geographical location associated with each domain name (For example, by discovering and selecting such candidate network domains for public sinkhole domains, the cloud security service can observe more infected hosts from a variety of enterprise networks (e.g., subscribing customer enterprise networks in a variety of geographical locations, across the world). Xu, Column 16, lines 36-41).
As per claim 6, Xu in view of Sullivan teaches the method of claim 1, wherein each domain name is selected from the group consisting of: (i) an unregistered domain name, (ii) a misconfigured domain name, (iii) an abandoned domain name (if a user attempts to perform a DNS lookup or host command on an unregistered or invalid domain name, such as examplefakedomain.com, then an error can be received indicating that such is a non-existing domain name, or in other words, that such is a non-existent domain (NXDOMAIN). Generally, an NXDOMAIN is a condition or error that can be indicated for an Internet domain name that is unable to be resolved using the DNS servers ( e.g., invalid domain name) or that the Internet domain name is not yet registered. In some cases, an NXDOMAIN can also be indicated due to a network or DNS server problem. Xu, Column 3, lines 51-62), and (iv) an algorithm-generated domain name (as malware can generate many different network domains, such as by using domain generation algorithms (DGAs), many of which are generated for evasion detection purposes and take-down evasion purposes. Xu, Column 7, lines 25-28).
As per claim 7, Xu in view of Sullivan teaches the method of claim 1, wherein receiving the communication traffic comprises: receiving the communication traffic from at least one Internet Service Provider (ISP) (As an example, by analyzing such logged traffic, the security provider can determine which hosts and networks ( e.g., hosts, ISPs, and/or company networks, even if such are not customers of the cloud security service) are infected with the known malware ( e.g., identified malware) based on logged attempts to connect to the bad network domain. Xu, Column 10, lines 23-29).
As per claim 8, Xu in view of Sullivan teaches the method of claim 1, further comprising: comparing a relative magnitude of the communication traffic to an expected amount of the communication traffic (if a threshold number of connections was attempted to the bad network domain ( e.g., requiring a threshold number of connections can be used to disregard noise that can result from mistyped network domain queries and DGA randomly generated network domains that were not commonly queried by the malware ), then the bad network domain can be determined, Xu, Column 7, lines 47-53).
As per claim 9, Xu in view of Sullivan teaches the method of claim 1, wherein receiving the communication traffic comprises: measuring a frequency of the communication traffic to the domain name (determining that a threshold number of connections were attempted to the bad network domain can be implemented using traffic analysis techniques, Xu, Column 7, lines 36-38).
As per claim 10, Xu in view of Sullivan teaches the method of claim 1, wherein the metadata comprises at least one of the group consisting of: (a) geographical location of the communication traffic (e.g., subscribing customer enterprise networks in a variety of geographical locations, across the world. Xu, Column 16, lines 39-41), (b) frequency of the communication traffic (The signatures can then be used by the cloud security service to identify candidate bad network domains for sinkholing based on a number of attempts by hosts that trigger each such signature ( e.g., based on a number of hosts that attempt to connect to a particular bad network domain, Xu, Column 7, lines 16-21), (c) magnitude of the communication traffic (determining that a threshold number of connections were attempted to the bad network domain can be implemented using traffic analysis techniques, Xu, Column 7, lines 36-38), (d) aggregated counters of a number of unique Internet Protocol (IP) addresses per country, (e) a number of events observed per period (the network traffic is collected and/or monitored for events and/or reporting based on events (e.g., some of the network traffic can be monitored using pass through techniques and/or some of the network traffic can be collected and analyzed for monitoring the network traffic offline, such as in logs of network traffic) Xu, Column 12, lines 54-59), and (f) a ratio of unique IP addresses to a sum of a portion of the communication traffic (determined based on distinct IP addresses associated with DNS responses provided in the passive DNS data. Xu, Column 5, lines 1-3).
Claims 11-13 and 15-22 have limitations similar to those treated in the above rejection, and are met by the references as discussed above, and are rejected for the same reasons of obviousness as used above.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the conflicting application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement.
Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b).
Claims 1-4, 6-13 and 15-22 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over claims 1-20 of US patent No. 10,812,520. Although the conflicting claims are not identical, they are not patentably distinct from each other because all elements of claims 1-4, 6-13 and 15-22 of the instant application correspond to elements of claims 1-20 of US patent No. 10,812,520. The above claims of the present application would have been obvious over claims 1-20 of US patent No. 10,812,520 because each element of the claims of the present application is anticipated by the claims of the US patent No. 10,812,520 and as such are unpatentable for obviousness-type double patenting (In re Goodman (CAFC) 29 USPQ2D 2010 (12/3/1993)).
Claims 1-4, 6-13 and 15-22 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over claims 1-21 of US patent No. 11,671,441. Although the conflicting claims are not identical, they are not patentably distinct from each other because all elements of claims 1-4, 6-13 and 15-22 of the instant application correspond to elements of claims 1-21 of US patent No. 11,671,441. The above claims of the present application would have been obvious over claims 1-21 of US patent No. 11,671,441 because each element of the claims of the present application is anticipated by the claims of the US patent No. 11,671,441 and as such are unpatentable for obviousness-type double patenting (In re Goodman (CAFC) 29 USPQ2D 2010 (12/3/1993)).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to OLEG KORSAK whose telephone number is (571)270-1938. The examiner can normally be reached on 5:00 AM- 4:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal Dharia can be reached on (571) 272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/OLEG KORSAK/Primary Examiner, Art Unit 2492