Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed 5/26/2026 have been fully considered but they are not persuasive. Applicant argues that Lotem does not teach or suggest “simulating network traffic to and from a set of nodes”. The examiner respectfully disagrees. Lotem discloses in paragraph 135 that security measures can be determined by applying an attack simulation to a model of the network (for example, in a manner illustrated in U.S. Pat. No. 6,952,779 of Cohen et al., which is incorporated herein by reference).” Cohen states that each attack route has a start point and an end point and col 6, line 54 to col 7, line 8 states:
“To generate the start points automatically, the system finds the perimeters of the network by analyzing all of the ACLs and filtering rule sets collected by the information discovery agents from network routers and firewalls or use information gathered from an Intrusion Detection System. These lists of IP addresses are concatenated to calculate all possible ranges of inbound and outbound IP traffic which represent the possible starting points for an attack on the network.
End points are automatically generated by examining the network topology model and calculating the role of each component of the network. Business rules detailing network threats, damages, and dependencies for various components are interpreted to determine, according to role, which components represent logical end points for attacks.
The system then simulates attacks through the network topology from each start point to each end point by performing attack simulations, step 120. In some embodiments, all attacks from any starting point are simulated without guidance to a certain end point. Attack simulation is the process of creating attack simulation attack graphs for a given network identifying possible attacks through attack paths of the graph.” This indicates that the simulation is run on
Paragraph 135 goes on to further state “The attack simulation can determine the possible multi step attacks from source nodes on which an attacker might reside to nodes and business assets within the network. The feasibility of each attack step to be added to the reported multi-step attacks is examined using the process described in steps 40 and 50, taking in account the effectiveness of one or more IDP devices. In the network example, the attack simulation can find for example a multi-step attack from the Internet to h4 of network n1. At the first attack step, the attacker takes control on h2 within the DMZ by exploiting v3 (which was found to be non-protected by IPS rules). In the next step, the attacker compromises h4 of network n2 by exploiting vulnerability v6. The attack simulation does not report on an attack on h1 from the Internet as the two vulnerabilities of h1 are protected by IPS rules. The attack simulation first invokes feasibility checks of attacks from the Internet. After finding that the attacker can take control on h2, attack feasibility checks are performed from h2. The attack simulation can include risk calculation which takes computes the probability to succeed in the attacks, and combines it with the expected damage to business assets.” To take control of a node and proceed to attempt to take control of another node, it is implicit that there is communication both to and from that node.
It is clear that Lotem, with Cohen incorporated by reference) discloses network traffic to and from the identified set of the plurality of nodes.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over the claims of U.S. Patent No. 10,142,364. Although the claims at issue are not identical, they are not patentably distinct from each other because they are anticipated by U.S. Patent No. 10,142,364.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over the claims of U.S. Patent No. 10,440,045. Although the claims at issue are not identical, they are not patentably distinct from each other because they are anticipated by U.S. Patent No. 10,440,045.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over the claims of U.S. Patent No. 11,075,940. Although the claims at issue are not identical, they are not patentably distinct from each other because they are anticipated by U.S. Patent No. 11,075,940.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over the claims of U.S. Patent No. 11,575,701. Although the claims at issue are not identical, they are not patentably distinct from each other because they are anticipated by U.S. Patent No. 11,575,701.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over the claims of U.S. Patent No. 11,729,205. Although the claims at issue are not identical, they are not patentably distinct from each other because they are anticipated by U.S. Patent No. 11,729,205.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over the claims of U.S. Patent No. 11,962,613. Although the claims at issue are not identical, they are not patentably distinct from each other because they are anticipated by U.S. Patent No. 11,962,613.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over the claims of U.S. Patent No. 12,244,633. Although the claims at issue are not identical, they are not patentably distinct from each other because they are anticipated by U.S. Patent No. 12,244,633.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim(s) 1-2, 5-6, 8-9, 12-13, 16-17, and 19-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Radlein et al. (US 9,742,795) hereafter Radlein in view of Lotem et al. (US 2006/0218640) hereafter Lotem.
1. Radlein discloses a method comprising:
responsive to determining that network traffic detected by the internal network introduces an above-threshold level of risk to an internal network (col 24:33-67, threshold less than or equal to the threshold number of accessing computing devices is inverse of risk, therefore an amount less than or equal to is considered above-threshold level of risk):
identifying a set of the plurality of nodes corresponding to the network traffic that introduces the above-threshold level of risk (col 24:46-col 26:12); and
isolating the set of nodes by instructing a DNS server of the internal network to prevent resolution of DNS requests for IP addresses corresponding to the set of nodes until the risk introduced by the network traffic falls below the threshold level of risk (col 24:46-col 26:12; col 29:15-col 30:16) until the attack is mitigated (col 28, 42-col 29, 14; figure 6).
Radlein does not explicitly disclose “until a simulation of the network traffic and effects of the network traffic to and from the identified set of the plurality of nodes indicates that the risk introduced by the network traffic falls below the threshold level of risk”. However, in an analogous art, Lotem discloses evaluating a security characteristic including a simulation of the network traffic and effects of the network traffic to and from the identified set of the plurality of nodes indicates that the risk introduced by the network traffic falls below the threshold level of risk (para 128, 135, 173). It would have been obvious to a person of ordinary skill in the art before the effective filing date to modify the implementation of Radlein with the implementation of Lotem in order to evaluate a sequence of attack attempts (para 128).
2. Radlein and Lotem disclose the method of claim 1, wherein the DNS server is located within the internal network (Radlein, figure 1).
5. Radlein and Lotem disclose the method of claim 1, wherein the set of nodes are reconfigured based on the above-threshold level of risk (Radlein, col 24:46-col 26:12; col 29:15-col 30:16).
6. Radlein and Lotem disclose the method of claim 5, wherein reconfiguring the set of nodes comprises implementing one or more reconfiguration policies on the set of nodes (Radlein, col 24:46-col 26:12; col 29:15-col 30:16).
Claims 8-9, 12-13, 16-17, and 19-20 are similar in scope to claims 1-2 and 5-6 and are rejected under similar rationale.
Claim(s) 3, 4, 10-11, 17-18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Radlein and Lotem as applied to claims 1, 8, and 15 above, and further in view of He et al. (US 2013/0338990) hereafter He.
3. Radlein and Lotem disclose the method of claim 1, but do not explicitly disclose wherein the simulated network traffic comprises network traffic received in a time interval immediately preceding the isolation of the set of nodes. However, in an analogous art, He discloses network traffic simulation including disclose wherein the simulated network traffic comprises network traffic received in a time interval immediately preceding the isolation of the set of nodes (para 25-47). It would have been obvious to a person of ordinary skill in the art before the effective filing date to modify the implementation of Radlein and Lotem with the implementation of He in order to increase flexibility and emulation degree of traffic simulation (para 4).
4. Radlein, Lotem, and He disclose the method of claim 3, wherein the above-threshold level of risk is computed based on previously received network traffic (Radlein, col 24:33-67).
Claims 10-11, 17-18 are similar in scope to claims 3-4 and are rejected under similar rationale.
Claim(s) 7, 14 is/are rejected under 35 U.S.C. 103 as being unpatentable over Radlein and Lotem as applied to claims 1, 8 above, and further in view of Teeple et al. (US 2016/0308898) hereafter Teeple.
7. Radlein and Lotem disclose the method of claim 1, but do not explicitly disclose further comprising logging network traffic associated with the set of nodes. However, in an analogous art, Teeple discloses tracking, analyzing, and mitigating security threats including logging network traffic associated with the set of nodes (para 7, 9, 68). It would have been obvious to a person of ordinary skill in the art before the effective filing date to modify the implementation of Radlein and Lotem with the implementation of Teeple in order to track, analyze and mitigate security threats (para 7, 9).
Claim 14 is similar in scope to claim 7 and is rejected under similar rationale.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAMES R TURCHEN whose telephone number is (571)270-1378. The examiner can normally be reached Monday-Friday: 7-3.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached at 571-270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JAMES R TURCHEN/Primary Examiner, Art Unit 2439
Prosecution Insights