Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Detailed Action
1. This action is responsive to communication filed on: 22 July 2026 with acknowledgement of an original application filed on 28 February 2025 and that this application is a continuation of application 17/365,448 now patent 12,267,336 which was filed on 1 July 2021.
2. Claims 1-20 are currently pending. Claims 1, 11, and 18 are independent claims. Claims 1-3, 5-8, 10-13, and 15-20 have been amended.
Response to Arguments
3. Applicant's arguments filed 22 July 2026 have been fully considered however they are moot due to new grounds of rejection necessitated by applicant’s amendments to the claims.
The Examiner notes the 112 rejection as well as the objections to the specification are removed due to amendment.
Double Patenting
4. The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A statutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the conflicting application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement.
Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/forms/.
The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens.
An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, please refer to - http://www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp
5. Claims 1-20 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over claims 1-20 of application 17/365,448 now patent 12,267.336. Although the conflicting claims are not identical, they are not patentably distinct from each other because all the elements/features of claimed method/system of receiving a malicious network traffic report that identifies a source of malicious traffic and prevents transmission of malicious traffic for a defined time interval exist in the pending application in similar or different names, essentially performing the same tasks. The table below is a comparison of the pending claim 1 with the patented claim 1. The difference between the claim set is that the pending claims contain the same details but sometimes in different order. The Examiner notes limitations from dependent claim 2-5 of the patent were incorporated into the independent claims of the pending application, these details are underlined below.
PENDING CLAIM 1
PATENTED 12,267,336 CLAIMs 1 & 5
1. A method, comprising: receiving, by a processing system including a processor, a report of malicious network traffic observed by a first communication device operating in a first communication networkwherein the report indicates that the malicious network traffic originates from a second communication network that is distinct from the first communication network, wherein receiving the report comprises receiving the report from security software executing on the first communication device, the security software being selected from a group of software comprising anti-malware software and intrusion detection software;
identifying, by the processing system and based on the receiving, a second communication device operating in the second communication network as a source of the malicious network traffic;
verifying, by the processing system and based on the report, that the malicious network traffic satisfies one or more criteria to be classified as malicious; and
blocking, by the processing system, network traffic from the second communication network, via a control device, for a defined time interval, based on the identifying and verifying of the second communication device as the source of the malicious network traffic, wherein the blocking the network traffic comprises causing the control device to add an address of the second communication device to a dynamic access control list entry that includes an expiration time corresponding to an end of the defined time interval, and
wherein the blocking the network traffic further comprises blocking the network traffic originating from the second communication device from reaching the first communication network via an additional control device associated with the first communication network for the defined time interval by facilitating the additional control device to add the address of the second communication device to an additional dynamic access control list entry that includes an additional expiration time corresponding to an end of the defined time interval
1. A method, comprising: receiving a report of malicious network traffic observed by first network equipment operating in a first communication network,
wherein the report indicates a second communication network distinct from the first communication network as an originating network of the malicious network traffic;
in response to the receiving of the report, identifying second network equipment operating in the second communication network as a source of the malicious network traffic;
based on the identifying, blocking, via a network controller device of a third communication network, first communications from the second network equipment from reaching the first communication network via a first link directly coupling the first communication network and the second communication network for a first defined time interval, wherein the third communication network is distinct from each of the first communication network and the second communication network; based on the identifying, blocking, via the network controller device of the third communication network, second communications from the second network equipment from reaching the third communication network for the first defined time interval; and in response to determining that the malicious network traffic from the second network equipment has not discontinued at an expiration of the first defined time interval, blocking the second network equipment from transmitting network traffic outside of the second communication network for a second defined time interval, wherein a duration of the second defined time interval as measured from the expiration of the first defined time interval is longer than a duration of the first defined time interval.
2. The method of claim 1, further comprising: in further response to the receiving of the report, verifying the malicious network traffic, wherein the blocking of the first communications is based on the verifying.
3. The method of claim 1, wherein the blocking of the first communications from the second network equipment from reaching the first communication network for the first defined time interval is based on an addition of an internet protocol address of the second network equipment to an access control list.
4. The method of claim 1, further comprising: in response to an expiration of the second defined time interval, determining that the malicious network traffic from the second network equipment has discontinued; and in response to determining that the malicious network traffic from the second network equipment has discontinued, permitting the second network equipment to transmit network traffic outside of the second communication network.
5. The method of claim 1, wherein the receiving of the report of the malicious network traffic comprises receiving the report of the malicious network traffic from software executing on the first network equipment, the software being selected from a group of software comprising anti-malware software and intrusion detection software.
Claim Rejections – 35 USC § 103
6. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
7. Claims 1-9 and 11-20, are rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. U.S. Patent Application Publication No. 2016/0381070 (hereinafter ‘070) in view of Baldonado et al. U.S. Patent Application Publication No. 2015/0106876 (hereinafter ‘876).
As to independent claim 1, “A method, comprising: receiving, by a processing system including a processor, a report of malicious network traffic observed by a first communication device operating in a first communication network, wherein the report indicates that the malicious network traffic originates from a second communication network that is distinct from the first communication network, wherein receiving the report comprises receiving the report from security software executing on the first communication device, the security software being selected from a group of software comprising anti-malware software and intrusion detection software” is taught in ‘070 paragraphs 28-30 and 35;
“identifying, by the processing system and based on the receiving, a second communication device operating in the second communication network as a source of the malicious network traffic; verifying, by the processing system and based on the report, that the malicious network traffic satisfies one or more criteria to be classified as malicious; and” is shown in ‘070 paragraphs 36 and 39;
the following is not explicitly taught in ‘070:
“blocking, by the processing system, network traffic from the second communication network, via a control device, for a defined time interval, based on the identifying and verifying of the second communication device as the source of the malicious network traffic” however ‘876 teaches determining if a packet is part of a created accepted rules list as well as a network security device connected to the frontend of a network to help stop cyber hacking attempts in paragraphs 7, 19, and 21;
“wherein the blocking the network traffic comprises causing the control device to add an address of the second communication device to a dynamic access control list entry that includes an expiration time corresponding to an end of the defined time interval, and” however ‘876 teaches assigning escalating time-based IP traffic blocks against black lists packets as well as entering received threats into the auto-blacklist in paragraphs 33, and 39-40;
“wherein the blocking the network traffic further comprises blocking the network traffic originating from the second communication device from reaching the first communication network via an additional control device associated with the first communication network for the defined time interval by facilitating the additional control device to add the address of the second communication device to an additional dynamic access control list entry that includes an additional expiration time corresponding to an end of the defined time interval” however ‘876 teaches ‘the auto-blacklist is configured to effect the dropping of all packets from a host on the list until the block time expires, wherefore the host is de-listed’ in paragraph 40.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention of protocol based detection of suspicious network traffic taught in ‘070 to include a means to set an expiration time for filtering the suspicious network traffic as well as adding the IP address to an access control list. One of ordinary skill in the art would have been motivated to perform such a modification to because computer network are consistently under cyber-attacks and the millions of cyber hack attempts may congest a company’s bandwidth improvements are needed see ‘876 paragraphs 3-4.
As to dependent claim 2, “The method of claim 1, wherein the blocking is performed via an internet protocol (IP) network” is taught in ‘070 paragraph 31
As to dependent claim 3, “The method of claim 1, wherein the receiving of the report of the malicious network traffic comprises receiving the report via an internet protocol (IP) network being coupled to the first communication network” is shown in ‘070 paragraphs 29-30.
As to dependent claim 4, “The method of claim 1, wherein the second communication network is a private network” is disclosed in ’070 Abstract.
As to dependent claim 5, “The method of claim 1, further comprising: based on the receiving of the report of the malicious network traffic, verifying the malicious network traffic, wherein the blocking is based on the verifying” is taught in ‘876 paragraphs 36 and 39.
As to dependent claim 6, “The method of claim 1, wherein the blocking the network traffic is based on an addition of an address of the second communication device to the dynamic access control list entry that includes an expiration time corresponding to an end of the defined time interval” is shown in ‘876 paragraph 39.
As to dependent claim 7, “The method of claim 1, further comprising: subsequent to the blocking of the network traffic, determining, by the processing system, that the second communication device has discontinued transmitting malicious network traffic; and in response to the determining, permitting, by the processing system, via the control device, the second communication device to transmit new network traffic from the second communication network” is disclosed in ‘876 paragraph 37
As to dependent claim 8, “The method of claim 1, wherein the security software is configured to generate the report based on a detection of encrypted malicious network traffic” is taught in ‘070 paragraph 59.
As to dependent claim 9, “The method of claim 1, wherein the receiving of the report comprises receiving a first report from a security controller device associated with the first communication network, and wherein the first report is generated based on a second report of the malicious network traffic provided to the security controller device by the first communication device” is shown in ‘876 paragraphs 36 and 39.
As to independent claim 11, this claim is directed to a system executing the method of claim 1; therefore, it is rejected along similar rationale.
As to dependent claims 12-17, these claims contain substantially similar subject matter as claims 2-7; therefore, they are rejected along similar rationale.
As to independent claim 18, this claim is directed to a non-transitory machine-readable medium executing instructions that execute the method of claim 1; therefore, it is rejected along similar rationale.
As to dependent claims 19-20, these claims contain substantially similar subject matter as claims 2-3; therefore, they are rejected along similar rationale.
8. Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. U.S. Patent Application Publication No. 2016/0381070 (hereinafter ‘070) in view of Baldonado et al. U.S. Patent Application Publication No. 2015/0106876 (hereinafter ‘876) in further view of Anderson et al. U.S. Patent Application Publication No. 2003/0014665 (hereinafter ‘665).
As to dependent claim 10, the following is not explicitly taught in ‘070 and ‘876: “The method of claim 1, wherein the blocking the network traffic further comprises controlling a network router equipment that manages network traffic flows involving the second communication network” however ‘665 teaches in the Abstract and paragraphs 25-26.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention of protocol based detection of suspicious network traffic taught in ‘070 and ‘876 to include a means to controlling a network router to prevent suspicious network traffic. One of ordinary skill in the art would have been motivated to perform such a modification to improve upon the known filtering mechanisms for distributed denial of service (DDoS) attacks see ‘665 paragraphs 5-7.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
9. Any inquiry concerning this communication or earlier communications from the examiner should be directed to ELLEN C TRAN whose telephone number is (571) 272-3842. The examiner can normally be reached Monday-Friday.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeff Pwu can be reached at 571-272-6798. The fax phone number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ELLEN TRAN/Primary Examiner, Art Unit 2433 2 October 2026
Prosecution Insights