Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Art Rejection
2. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
3. Claims 1, 5-10, 12, 14 and 18-20 are rejected under 35 U.S.C. 102(a)(2) as being clearly anticipated by Mortensen, U.S. pat. Appl. Pub. No. 2020/0014714.
Per claim 1, Mortensen discloses a system comprising a processor and a memory coupled to the processor and configured to provide the processor with instructions to:
a) aggregate DNS traffic from one or more networks (see par 0029);
b) automatically classify the aggregated DNS traffic to detect DNS tunneling activity (see par 0039); and
c) perform an action based on the detected DNS tunneling activity based on a policy (see par 0036).
Per claim 5, Mortensen teaches that the aggregated DNS traffic is collected from a plurality of monitored enterprises or networks (see par 0029).
Per claim 6, Mortensen teaches that a new threat domain or subdomain is identified based on being associated with the detected DNS tunneling activity (see par 0036).
Per claims 7-8, Mortensen teaches when the domain or subdomain is identified as associated with the detected DNS tunneling activity, performing an action based on the policy (see par 0036, 0045).
Per claims 9-10, Mortensen teaches reporting and blocking the domain associated with the detected DNS tunneling activity for at least a predetermined period of time, i.e., until forensic investigation is possible (see par 0036).
Per claim 12, Mortensen teaches quarantining the domain, i.e., source address, associated with the detected DNS tunneling activity (see par 0036).
Claims 14 and 18-20 are similar in scope as that of claims 1, 5-10 and 12 and hence are rejected for the same reason set forth for claims 1, 5-10 and 12.
4. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
5. Claims 2-3 and 15-16 are rejected under 35 U.S.C. 103 as being unpatentable over Mortensen and further in view of Israel, U.S. pat. Appl. Pub. No. 2024/0220613.
Mortensen does not teach detecting tunneling activity using a classifier trained by autoencoder of a neutral network. However such use of neural network autoencoder for detecting tunneling activity is well known in the art as disclosed by Israel (see Israel, par 0015-0016).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Mortensen with Israel teaching because use of neural network autoencoder would have provided more efficient detection of such tunneling activity for large dataset.
6. Claims 4, 11, 13 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Mortensen and further in view of Liu, U.S. pat. Appl. Pub. No.2021/0266293.
Per claims 4 and 17, Mortensen does not teach detecting tunneling activity using a classifier trained for n-gram anomaly detection. However such use of n-gram model for detecting tunneling activity is well known in the art as disclosed by Liu (see Liu, par 0055, 0059).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Mortensen with Liu teaching because it would have provided more efficient detection of such tunneling activity for large dataset.
Per claim 11, Mortensen does not teach adding a domain to a block list. However, Liu also teaches a similar detection method wherein a domain (e.g., IP address) associated with detected tunneling activity is stored/added in a block/black list (see par 0044, 0062-0064).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Mortensen with Liu teaching because it would have provided an alternate method for detecting tunneling activity (see par 0044).
Per claim 13, Liu teaches that the similar detection method generates a new DNS signature or pattern for a domain associated with the detected DNS tunneling activity (see par 0044, 0061).
Conclusion
7. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Viet Vu whose telephone number is 571-272-3977. The examiner can normally be reached on Monday through Thursday from 8:00am to 6:00pm. The Group general information number is 571-272-2400. The Group fax number is 571-273-8300.
If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Emmanuel Moise, can be reached at 571-272-3865.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/Viet D Vu/
Primary Examiner, Art Unit 2455
1/12/26