DETAILED ACTION
This Office Action is with regard to the most recent papers filed 2/5/2026.
Response to Arguments
Applicant's arguments filed 2/5/2026 have been fully considered but they are not persuasive.
On pages 1-2, Applicant argues the obvious-type double patenting rejection.
Applicant argues that Schmugar has nothing to do with learning an attack-safe baseline and has nothing to do with any rate-invariant attribute and rate-based attribute. In response to applicant's arguments against the references individually, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). In this case, Applicant is arguing that Schmugar in isolation of the claims of 18/058,482, where the argued details are presented in the claims of 18/058,482. Thus, this argument cannot be deemed persuasive.
On pages 3-9, Applicant argues the application of Med to the claimed validating, such as in claim 1.
Applicant directly addresses the responses to Applicant’s previous arguments. First, on page 5, Applicant argues that the purpose of the claims is not to teach how. This appears to be in response to the suggestion that if Applicant intends for the validation o be used in a specific manner or to be performed in a specific manner, the claims should be amended to reflect this. It was never contended that the claims should be amended to teach how to perform the functions. Instead, it was suggested that if Applicant does not wish to have a broad interpretation of the claims, and has a specific scope in mind, then these details should be amended into the instant claims.
On page 5, Applicant also addresses that “It should also be understood that the validation requires use of both the rate-based attribute and the rate-invariant attribute,” arguing that the proposal of updating the rate-based attribute fails to teach this element as it only updates the rate-based attribute. However, the updating performs the measurements again, as stated in the rejection, where the measurements are provided in Medvedovsky: Figure 2 and Paragraphs [0065]-[0066] and [0072], where such is cited for both the measuring of the rate-based and rate-invariant attributes.
On pages 5-7, Applicant addresses the response to the validating, that the interpretation is unreasonable and attempts to stretch the meaning of the claim element (“validating”). It should be noted that the concept of validating data and measurements is notoriously well-known (which, lacking detail (and assuming Applicant’s narrow assertions as to the scope of the term), could simply perform the complete method twice, whether at the same node or at a different node, to see if the same result is achieved), where allowance of the instant claims does not stand or fall with such validating.). The reason that Medvedovsky is applied to the term “validating” is because the term is considered to be broad enough to have the continuously measuring and updating to be within the scope of the term “validating,” as an incorrect baseline would be changed, while a correct baseline would stay the same (as such updating would result in the same baseline). To apply another reference to such validating would involve asserting that Medvedovsky does not disclose validating, which would be inaccurate as “validating” is broad enough to include the disclosure of Medvedovsky within its scope.
Applicant then on pages 8-9, asserts that the office is attempting to change the rejection from a 102 to a 103 without providing a full and proper 103. This is not the case. As above, the Office was attempting to show that even if Applicant were deemed to be persuasive, the claims would not be in condition for allowance, as broadly providing for the validation of determined information would not result in allowance of the claims, but would instead result in a rejection under 35 USC 103.
Accordingly, Applicant’s arguments, which all appear to be directed towards the responses to the previous arguments, have been deemed not persuasive. It is also reiterated that some of the arguments misinterpret the statements in the Office Action (e.g. arguing that the Office contended that the claims need to teach how to make and use the claimed invention and that the Office attempted to change the rejection from a 102 to a 103 rejection), and these arguments cannot be persuasive.
On pages 9-10, Applicant again addresses the rejection of Medvedovsky in view of Schmuger. Applicant does not appear to provide any further detail, but merely states that the proposed combination entirely lacks the claim language without referring to the teachings of Medvedovsky, which teaches the measuring of the rate-invariant attribute, as applied in, for example, claim 1. It is unclear how Applicant’s previous argument, as argued in the instant arguments, could attack the combination, as a whole, without any reference in the instant arguments or the previous arguments, to the teachings of Medvedovsky. Accordingly, this argument cannot be deemed persuasive, as it still solely refers to Schmuger in isolation of the applied teachings of Medvedovsky.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-35 are provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claim 1-39 of copending Application No. 18/058482 (reference application). Although the claims at issue are not identical, they are not patentably distinct from each other because the instant claims are deemed to be an obvious variation of the claims of ‘482.
With regard to claim 1, the instant claim is substantially provided for in claim 1 of ‘482. However, ‘482 does not provide, but Schmugar teaches validating the at least one computed baseline using the measured rate-invariant attribute and rate-based attribute (Schmugar: Paragraphs [0032] and [0051]). Accordingly, it would have been obvious to one of ordinary skill in the art at the time of filing to validate the determined baselines to ensure that the baseline accurately reflects normal behavior of the system (Schmugar: Paragraph [0051]).
With regard to claims 2-17, the instant claims provide substantially similar subject matter to that provided in claims 1-19 of ‘482 and/or provided with the teaching of Schmugar, as addressed with regard to claim 1.
With regard to claims 18-35, the instant claims are similar to claims 1-17, and are rejected for similar reasons.
This is a provisional nonstatutory double patenting rejection because the patentably indistinct claims have not in fact been patented.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1-9, 11-26, and 28-35 is/are rejected under 35 U.S.C. 102a1 as being anticipated by US 2021/0194903 (Medvedovsky).
With regard to claim 1, Medvedovsky discloses a method for learning attack-safe baseline, comprising:
receiving application-layer transactions directed to a protected entity (Medvedovsky: Figure 1 and Paragraphs [0060] and [0065] to [0066]. Medvedovsky monitors traffic on behalf of a server (protected entity), where the traffic includes HTTPS requests, where HTTP is an example of an application-layer protocol, meaning that the HTTPS traffic would be received application-layer transactions.);
measuring values of a rate-based attribute and a rate-invariant attribute from the received application-layer transactions (Medvedovsky: Figure 2 and Paragraphs [0065]-[0066] and [0072]. Both rate-based and rate-invariant features of the inspected traffic are determined.);
determining, based on the measured rate-based attribute, if the received application-layer transactions represent a normal behavior (Medvedovsky: Figure 2 and Paragraphs [0065]-[0066] and [0072]. Whether behavior is normal or abnormal is determined.);
computing at least one baseline using application-layer transactions determined to represent the normal behavior (Medvedovsky: Paragraphs [0068] to [0070]. Baselines are determined to define normal behavior.); and
validating the at least one computed baseline using the measured rate-invariant attribute and rate-based attribute (Medvedovsky: Paragraph [0012]. The measurements are performed multiple times, where this refines the baselines if there is a change.).
With regard to claim 2, Medvedovsky discloses wherein determining if the received application-layer transactions represent a normal behavior, further comprises: providing an initial assessment of the measured rate-based attribute (Medvedovsky: Paragraphs [0068] to [0070]).
With regard to claim 3, Medvedovsky discloses wherein determining if the received application-layer transactions represent a normal behavior, further comprises: comparing the measured rate-based attribute to a first threshold and a second threshold, wherein the first threshold represents a maximum value for the rate-based attribute and the second threshold represents a minimum value for the rate-based attribute, wherein a measured rate-based attribute above the first threshold represents an abnormal behavior (Medvedovsky: Paragraphs [0050] and [0072]. When the attributes exceed a maximum deviation either above or below a baseline, the traffic is considered to be anomalous (abnormal).).
With regard to claim 4, Medvedovsky discloses determining if the measured rate-based attribute has changed by an anomaly factor, wherein a measured rate-based attribute that has not changed by the anomaly factor represents a normal behavior (Medvedovsky: Paragraphs [0050] and [0072]. When the attributes exceed a maximum deviation either above or below a baseline, the traffic is considered to be anomalous (abnormal).), where such is defined as, for example, MaxDev, which would be within the scope of an “anomaly factor” in as much detail as required by the instant claim.).
With regard to claim 5, Medvedovsky discloses wherein determining if the measured rate-based attribute has changed by an anomaly factor, further comprises: checking if a current measured value of the rate-based attribute changes from its respective average value by the anomaly factor (Medvedovsky: Paragraphs [0050] and [0072] and [0030]).
With regard to claim 6, Medvedovsky discloses pausing the baseline learning when the received measured rate-based attribute represents an abnormal behavior (Medvedovsky: Paragraph [0103]).
With regard to claim 7, Medvedovsky discloses re-initiating the baseline learning when the measured rate-based represents abnormal behavior (Medvedovsky: Figure 4. The method provides a loop, where all paths lead back to the beginning step (S410). During the process, it is determined if an alarm is triggered or not. Measurements and calculations of the baseline are performed when the alarm is not on, while the attack is monitored if the alarm is on.).
With regard to claim 8, Medvedovsky discloses wherein validating the at least one computed baseline further comprises: determining if a preconfigured active learning period has been completed, wherein the preconfigured active learning period includes durations or a number of transactions received during which application-layer transactions determined to represent the normal behavior utilized to compute the at least one baseline; and determining if a quality learning condition has been met (Medvedovsky: Paragraph [0050]. As in the rejection of claim 1, the repeated calculations of the baseline would provide such validation, where each loop is performed for a predefined learning period. If there is no change, then the baselines are not adjusted, and thus a “quality learning condition” would be met. For clarity, Applicant should amend the instant claim to clearly provide for what constitutes a “quality learning condition.”).
With regard to claim 9, Medvedovsky discloses that wherein the determining if a quality learning condition includes checking if a measured rate-invariant attribute is higher than a rate-invariant quality threshold and a measured rate-based attribute is higher than a rate-based quality threshold (Medvedovsky: Paragraph [0012]. Lacking detail of what the threshold is, any change would result in the updating of the baseline, making such a threshold at least 0. For clarity, Applicant should provide detail of what constitutes a “quality threshold”.).
With regard to claim 11, Medvedovsky discloses wherein the at least one computed baseline determines a normal behavior of an application attribute (AppAttribute) of the protected entity during peacetime (Medvedovsky: Paragraph [0064]).
With regard to claim 12, Medvedovsky discloses establishing short and medium baselines for at least one rate-based attributed using the at least one computed baseline (Medvedovsky: Abstract).
With regard to claim 13, Medvedovsky discloses wherein the at least one computed baseline determines a normal behavior of a traffic parameter of the protected entity during peacetime, wherein the traffic parameter may be any one of: a rate-based attribute and a rate-invariant attribute (Medvedovsky: Paragraphs [0066] to [0070]).
With regard to claim 14, Medvedovsky discloses computing the at least one baseline during time windows (Medvedovsky: Figure 2 and Paragraph [0064]).
With regard to claim 15, Medvedovsky discloses wherein application-layer transactions include any one of: HTTP requests, HTTP responses, HTTPs requests, and HTTPs responses (Medvedovsky: Abstract).
With regard to claim 16, Medvedovsky discloses wherein application-layer transactions include samples of the actual HTTP requests, their corresponding HTTP responses, wherein a sampling rate of the actual HTTP requests differs as a function of the protected entity incoming traffic volumes (Medvedovsky: Paragraph [0066]. Note that HTTPS is an extension of HTTP, and thus HTTPS transactions would be a type of HTTP transaction.).
With regard to claim 17, Medvedovsky discloses wherein the attack-safe baselines are utilized for detecting application-layer flood denial-of-service (DDoS) attacks carried by attackers utilizing application layer flood attack tools (Medvedovsky: Paragraphs [0091] and [0025]).
With regard to claims 18-26 and 28-35, the instant claims are similar to claims 1-9 and 11-17, and are rejected for similar reasons.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 10 and 27 is/are rejected under 35 U.S.C. 103 as being unpatentable over Medvedovsky in view of US 2020/0314126 (Schmugar).
With regard to claim 10, Medvedovsky fails to disclose, but Schmugar teaches determining that the baseline cannot be established for the protected entity when the at least one computed baseline learned has not met at least one quality learning condition (Schmugar: Paragraphs [0032] and [0051]). Accordingly, it would have been obvious to one of ordinary skill in the art at the time of filing to validate the determined baselines to ensure that the baseline accurately reflects normal behavior of the system (Schmugar: Paragraph [0051]).
With regard to claim 27, the instant claim is similar to claim 10, and is rejected for similar reasons.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 36 and 37 is/are rejected under 35 U.S.C. 103 as being unpatentable over Medvedovsky in view of US 2019/0303789 (Nishino).
With regard to claim 36, Medvedovsky fails to disclose, but Nishino teaches that validating comprises determining whether the at least one computed baseline satisfies at least one quality learning condition using the measured rate-invariant attribute and the measured rate-based attribute (Liu: Paragraphs [0067] and [0070] and Claim 6. Nishino can validate measurements, where an amount of data (e.g. Medvedovsky’s measured rate-invariant and rate-based attributes) impacts how validation is performed, and the validation can be performed based on the data, itself.). Accordingly, it would have been obvious to one of ordinary skill in the art at the time of filing to have validation satisfy at least one quality learning condition (e.g. amount of data or accuracy of data) using the measured rate-invariant attribute and the measured rate-based attribute to ensure that the baselines of Medvedovsky are calculated properly.
With regard to claim 37, the instant claim is similar to claim 36, and is rejected for similar reasons.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SCOTT B CHRISTENSEN whose telephone number is (571)270-1144. The examiner can normally be reached Monday through Friday, 6AM to 2PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, John Follansbee can be reached at (571) 272-3964. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
SCOTT B. CHRISTENSEN
Examiner
Art Unit 2444
/SCOTT B CHRISTENSEN/Primary Examiner, Art Unit 2444