DETAILED ACTION
A response was received on 14 May 2026. By this response, Claims 1-3, 7, 8, 10-13, 18, and 20 have been amended. Claims 15-17 have been canceled. New Claims 21 and 22 have been added. Claims 1-14 and 18-22 are currently pending in the present application.
Response to Arguments
Applicant's arguments filed 14 May 2026 have been fully considered but they are not persuasive.
Regarding the rejection of Claims 1-20 under 35 U.S.C. 103 as unpatentable over Cohen et al, US Patent 9438565, in view of Reybok, Jr. et al, US Patent 11575703, and with general reference to amended independent Claim 1, Applicant argues that Coehn and Reybok do not teach or suggest that detectors receiving the shared knowledge modify subsequent detection operations based on the shared knowledge (pages 12-13 of the present response, generally citing Reybok, abstract). However, at least Reybok does disclose modifying subsequent detection operations based on shared knowledge (see Reybok, column 19, lines 33-56, updating, i.e. modifying, rule, whitelist, or blacklist, which would modify the subsequent operations for detecting and mitigating threats, where this is based on the shared knowledge in response to an alert).
Applicant further alleges that the references do not disclose a cluster of detectors as claimed (page 13 of the present response, no evidence cited); however, both Cohen and Reybok explicitly disclose clusters (see Cohen, column 8, lines 35-55; Reybok, column 7, lines 7-14).
Applicant also argues that the references do not teach or suggest interceptors positioned in a data path of a computing system because at least Cohen disclose operating at the network layer rather than I/O or storage paths within a computing system (pages 13-14 of the present response, no evidence cited). However, it is noted that the claims do not limit the “computing system” to a single device or machine; the computing system can encompass a system that includes a cluster of servers, networks, or other embodiments that include network communication amongst multiple devices (see paragraph 0014 of the present specification). It is noted that because data is sent along the network, then this would meet the broadest reasonable interpretation of a “data path” as claimed.
Applicant additionally argues that the references do not teach or suggest redirecting an interceptor in response to failure of a detector (page 14 of the present response, no evidence cited). However, Cohen discloses redirecting in response to failure of a node (Cohen, column 8, lines 14-23, and column 8, line 56-column 9, line 21, detailing failover scenarios) and Reybok also discloses redirecting communications in response to failure (see Reybok, column 8, lines 11-27, failover).
Further, Applicant argues that the rationale for combining the references is insufficient because the reasoning allegedly does not address structural and functional differences between the systems, and alleges that the combination would require substantial redesign of both systems (pages 14-15 of the present response, no evidence cited). In response to applicant’s argument that there is no teaching, suggestion, or motivation to combine the references, the examiner recognizes that obviousness may be established by combining or modifying the teachings of the prior art to produce the claimed invention where there is some teaching, suggestion, or motivation to do so found either in the references themselves or in the knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988), In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992), and KSR International Co. v. Teleflex, Inc., 550 U.S. 398, 82 USPQ2d 1385 (2007). In this case, motivation was explicitly cited from Reybok, to allow sharing of intelligence to better detect threats (citing Reybok, column 3, lines 16-32, and column 13, lines 30-52). In response to applicant's argument that the combination would require substantial redesign of the systems, the test for obviousness is not whether the features of a secondary reference may be bodily incorporated into the structure of the primary reference; nor is it that the claimed invention must be expressly suggested in any one or all of the references. Rather, the test is what the combined teachings of the references would have suggested to those of ordinary skill in the art. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981). Applicant’s arguments here and throughout the remarks largely appear to be speculative and unsupported by citations to any particular evidence made of record.
Therefore, for the reasons detailed above, the Examiner maintains the rejections as set forth below.
Drawings
The objection to Figure 6 is withdrawn in light of the amendments to the drawings.
Specification
The objection to the abstract for informalities is withdrawn in light of the amendments thereto. The objection to the disclosure is withdrawn in light of Applicant’s statement that the summary was omitted (see page 11 of the present response). Applicant’s cooperation is again requested in correcting any other errors of which applicant may become aware in the specification.
The specification is objected to as failing to provide proper antecedent basis for the claimed subject matter. See 37 CFR 1.75(d)(1) and MPEP § 608.01(o). Correction of the following is required: Independent Claims 1 and 11 have been amended to recite “dynamically reassigning interceptors” and that “detectors receiving the shared knowledge modify subsequent detection operations based on the shared knowledge”, and new Claim 21 recites similar limitations. Further, Claims 8 and 18 have been amended to recite “increasing a scope or depth of analysis based on metadata associated with a detected threat”, and Claims 10 and 20 have been amended to recite “analyzing additional data, metadata, or a larger portion of a storage volume relative to a prior scan”. There appears to be no mention of any of the above such features in the specification. Therefore, there is not clearly proper antecedent basis for the claimed subject matter in the specification. For further detail, see below with respect to the rejection under 35 U.S.C. 112(a) for failure to comply with the written description requirement.
Claim Rejections - 35 USC § 112
The rejections of Claims 15-17 under 35 U.S.C. 112(b) and (d) are moot in light of the cancellation of the claims. The rejection of Claims 1-8, 11, 13, and 14 under 35 U.S.C. 112(b) is withdrawn in light of the amendments to the claims. The rejection of Claims 10, 12, and 18-20 under 35 U.S.C. 112(b) is NOT withdrawn, because not all issues have been clearly addressed and/or because the amendments have raised new issues, as detailed below.
The following is a quotation of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-14 and 18-22 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claims contain subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Independent Claims 1 and 11 have been amended to recite “dynamically reassigning interceptors” and that “detectors receiving the shared knowledge modify subsequent detection operations based on the shared knowledge”, and new Claim 21 recites similar limitations. However, there appears to be no mention in the specification of reassigning interceptors, whether performed dynamically or not, nor is there any mention of performing any actions dynamically. Additionally, there appears to be no mention in the specification of modifying subsequent detection operations based on shared knowledge. Further, Applicant has not pointed out where the new and amended claims are supported. See MPEP § 2163.04. Therefore, there is not clearly sufficient written description of the claimed subject matter in the specification.
Claims 8 and 18 have been amended to recite “increasing a scope or depth of analysis based on metadata associated with a detected threat”. However, there appears to be no mention in the specification of the scope or depth of analysis, and therefore, there is also no mention of increasing such scope or depth based on such metadata. Further, Applicant has not pointed out where the new and amended claims are supported. See MPEP § 2163.04. Therefore, there is not clearly sufficient written description of the claimed subject matter in the specification.
Claims 10 and 20 have been amended to recite “analyzing additional data, metadata, or a larger portion of a storage volume relative to a prior scan”. However, there appears to be no mention in the specification of analyzing additional data or analyzing a larger portion of a volume. There is also no mention of a larger portion of a volume in general, or anything being relative to a prior scan. Further, Applicant has not pointed out where the new and amended claims are supported. See MPEP § 2163.04. Therefore, there is not clearly sufficient written description of the claimed subject matter in the specification.
Claims not explicitly referred to above are rejected due to their dependence on a rejected base claim.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 10, 12, and 18-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 10 recites “analyzing additional data, metadata, or a larger portion of a storage volume relative to a prior scan” in lines 2-3. It is not clear whether the metadata is also additional or if this may be intended to refer to the metadata recited in Claim 1. Further, it is not clear whether “relative to a prior scan” only modifies the “larger portion” or if it is also intended to modify the additional data and/or metadata.
Claim 12 recites “further comprising detecting failure… and redirecting” in lines 1-2. It is not clear how the medium would comprise the steps of detecting and redirecting, rather than the operations performed by the processors comprising this operation.
Claim 18 recites “further comprising performing target scanning escalation” in lines 1-2. It is not clear how the medium would comprise the step of performing the target scanning escalation, rather than the operations performed by the processors comprising this operation.
Claim 19 recites “further comprising performing a scan” in lines 1-2. It is not clear how the medium would comprise the step of performing the scan, rather than the operations performed by the processors comprising this operation.
Claim 20 recites “further comprising performing a scan that is more robust” in lines 1-2. It is not clear how the medium would comprise the step of performing the scan, rather than the operations performed by the processors comprising this operation. The claim further recites “analyzing additional data, metadata, or a larger portion of a storage volume relative to a prior scan” in lines 2-3. It is not clear whether the metadata is also additional or if this may be intended to refer to the metadata recited in Claim 11. Further, it is not clear whether “relative to a prior scan” only modifies the “larger portion” or if it is also intended to modify the additional data and/or metadata.
Claims not explicitly referred to above are rejected due to their dependence on a rejected base claim.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-14 and 18-22 are rejected under 35 U.S.C. 103 as being unpatentable over Cohen et al, US Patent 9438565, in view of Reybok, Jr. et al, US Patent 11575703.
In reference to Claim 1, Cohen discloses a method that includes associating one or more detectors configured to perform threat detection operations on data or metadata with one or more interceptors that positioned are in a data path of a computing system, where the data or metadata is received at the detectors from interceptors (see column 9, lines 38-43; column 11, lines 32-34 and 56-61), and configuring the detectors as a cluster that is configured to redirect an interceptor to a different detector when the interceptor is connected to a failed detector in response to a detected failure (see column 8, lines 14-23, and column 8, line 56-column 9, line 21) and perform load balancing on the interceptors (see column 8, lines 30-55). However, Cohen does not explicitly disclose sharing knowledge.
Reybok discloses a method that includes detectors performing threat detection operations (column 10, line 63-column 11, line 18; column 11, lines 44-60, analyzing threat intelligence analytics to detect threats) and configuring the detectors as a cluster that is configured to redirect and load balance when a detector fails (column 10, line 63-column 11, line 18; column 8, lines 11-27, failover) and share knowledge gained during threat detection operations (see throughout, for example, column 11, line 44-column 15, line 6). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Cohen to include the knowledge sharing of Reybok, in order to allow sharing of intelligence to better detect threats (see Reybok, column 3, lines 16-32, and column 13, lines 30-52).
In reference to Claim 2, Cohen and Reybok further disclose detecting the failure and redirecting the interceptors connected to the failed detector (see Cohen, column 8, line 56-column 9, line 21, and Reybok, column 8, lines 11-27).
In reference to Claims 3 and 4, Cohen and Reybok further disclose triggering the load balancing based on a threshold and disconnecting from an overloaded detector (see Cohen, column 8, lines 30-55, and Reybok, column 8, lines 11-27, failover).
In reference to Claims 5-7, Cohen and Reybok further disclose the detectors operating independently and prioritizing detection based on the shared knowledge including detecting an identified threat and looking for specified data such as phrases or strings (see Reybok, column 11, line 44-column 15, line 6).
In reference to Claims 8-10, Cohen and Reybok further disclose performing escalations of more robust scans focused on specific locations (see Reybok, column 10, line 63-column 11, line 18; column 11, lines 44-60).
Claims 11-14 and 18-20 are directed to software implementations of the methods of Claims 1-4 and 8-10, and are rejected by a similar rationale.
Claim 21 is directed to a system having functionality corresponding to the method of Claim 1, and Claim 22 is directed to a system having functionality corresponding to the combination of Claims 5-7, and Claims 21 and 22 are rejected by a similar rationale, mutatis mutandis.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Zachary A Davis whose telephone number is (571)272-3870. The examiner can normally be reached Monday-Friday, 9:00am-5:30pm, Eastern Time.
Examiner interviews are available via telephone and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal D Dharia can be reached at (571) 272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Zachary A. Davis/Primary Examiner, Art Unit 2492
