Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Response to Amendment
This is a reply to the application filed on 11/05/2025, in which, claim(s) 1-2, 4-8 and 11 is/are pending.
Claim(s) 3, 9-10 is/are cancelled.
Drawings
The drawings were received on 11/05/2025. These drawings are Fig. 4.
Claim Rejections - 35 U.S.C. § 112:
Applicants’ arguments with respect to 112 2nd paragraph with rejection of claim(s) 1-10 has been fully considered and are persuasive. The rejection has been withdrawn in view of the amendment to claim.
Claim Rejections - 35 U.S.C. § 101:
Applicants’ arguments with respect to claim(s) 1-20 has been fully considered and are persuasive. The rejection of 35 USC §101 has been withdrawn in view of the amendment to claim.
Claim Rejections - 35 USC § 112
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-2, 4-8 and 11 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 1 and 11 reciting “generate a plurality of data sets by combining the confirmed data and at least one of pre-stored words…”. It is unclear how one can generated a plurality of data sets by combining a data + a word.
Claims 1 and 11 reciting “conform the information about the one or more services…” (emphasis added). It is unclear how the information is conformed.
Claims 1 and 11 reciting “determine a threat level for each of the one or more services based on the network information and the plurality of data sets…, determine a threat level for a service according to a different criterion based on a type of the service…”. It is unclear how the threat level is determined, based on determine a threat level for a service according to a different criterion based on a type of the service or a different criterion based on a type of the service.
Claims 1 and 11 reciting “a first criterion being at least one of whether the service is externally disclosed, whether a communication type for the service is in plaintext, whether a version of the service is the latest, whether there are disclosed vulnerabilities, whether certificate is possible based on the plurality of data sets, and whether sensitive information is included in banner information…, a second criterion which is at least one of whether each page provided by the HTTP-related service is externally disclosed, whether sensitive information is included in each page by the HTTP-related service, and whether the HTTP-related service is externally disclosed…” (emphasis added). If the first and second criterion are the same, why would the threat determination require both the first and second criterion?
Claims 1 and 11 reciting “a first criterion being at least one of whether the service is externally disclosed, whether a communication type for the service is in plaintext, whether a version of the service is the latest, whether there are disclosed vulnerabilities, whether certificate is possible based on the plurality of data sets, and whether sensitive information is included in banner information…” (emphasis added). The term “possible” is indefinite.
Dependent claims 2, 4-8 are rejected for at least in part for incorporating the deficiency as stated above.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim(s) 1 and 11 recites the limitation “determine a threat level for each of the one or more services based on the network information and the plurality of data sets,
determine a threat level for a service according to a different criterion based on a type of the service,
wherein the one or more services included in the server comprises a hypertext transfer protocol (HTTP)-related service or a service different from the HTTP-related service, and
based on the type of the service corresponding to the service different from the HTTP- related service, determine a threat level for the service different from the HTTP-related service according to a first criterion being at least one of whether the service is externally disclosed, whether a communication type for the service is in plaintext, whether a version of the service is the latest, whether there are disclosed vulnerabilities, whether certificate is possible based on the plurality of data sets, and whether sensitive information is included in banner information, and
based on the type of the service corresponding to the HTTP-related service, determine a threat level for the HTTP-related service according to both the first criterion and a second criterion which is at least one of whether each page provided by the HTTP-related service is externally disclosed, whether sensitive information is included in each page by the HTTP-related service, and whether the HTTP-related service is externally disclosed” (emphasis added). There is insufficient antecedent basis for the term “a threat”, “a service” limitation in the claim.
Dependent claims 2, 4-8 are rejected for at least in part for incorporating the deficiency as stated above.
Examiner Note:
The newly amendment makes the claimed invention unclear. It is recommended that the claims be redraft with the scanning of information (2), generating of data, and threat calculation stated clearly and in proper sequential order.
Internet Communications
Applicant is encouraged to submit a written authorization for Internet communications (PTO/SB/439, http://www.uspto.gov/sites/default/files/documents/sb0439.pdf) in the instant patent application to authorize the examiner to communicate with the applicant via email. The authorization will allow the examiner to better practice compact prosecution. The written authorization can be submitted via one of the following methods only: (1) Central Fax which can be found in the Conclusion section of this Office action; (2) regular postal mail; (3) EFS WEB; or (4) the service window on the Alexandria campus. EFS web is the recommended way to submit the form since this allows the form to be entered into the file wrapper within the same day (system dependent). Written authorization submitted via other methods, such as direct fax to the examiner or email, will not be accepted. See MPEP § 502.03.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Sidagni (US 20140047546 A1) discloses a vulnerability risk management (VRM) module receives an indication of a VRM service to be provided from the end user. The VRM module extracts from the indication either external IP addresses or the web application URL and a list of assets of the enterprise computer system to be tested. The VRM module discovers the assets of the enterprise computer system. The VRM module receives a request for a vulnerability scan using a predefined scan configuration based on preferences of the end user and a specified date and time to conduct the scan. The VRM module reports and stores a preliminary list of potential vulnerabilities in the VRM vulnerability database. The preliminary list is fed to an expert system, which applies specific rule sets using an inference engine and a knowledge base to refine results stored in the VRM vulnerability database by removing extraneous information and false positives.
Shua (US 20220345483 A1) discloses methods and systems for assessing internet exposure of a cloud-based workload are disclosed. A method comprises accessing at least one cloud provider API to determine a plurality of entities capable of routing traffic in a virtual cloud environment associated with a target account containing the workload, querying the at least one cloud provider API to determine at least one networking configuration of the entities, building a graph connecting the plurality of entities based on the networking configuration, accessing a data structure identifying services publicly accessible via the Internet and capable of serving as an internet proxy; integrating the identified services into the graph; traversing the graph to identify at least one source originating via the Internet and reaching the workload, and outputting a risk notification associated with the workload.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DAO Q HO whose telephone number is (571)270-5998. The examiner can normally be reached on 7:00am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached on (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DAO Q HO/Primary Examiner, Art Unit 2432