Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
Claims 1-17 are presented for examination.
Information Disclosure Statement
No information disclosure statement (IDS) is submitted.
Drawings
The drawings filed on 05/27/2025 are accepted by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the conflicting application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement.
Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b).
Claims of Patent # 12,314821 contains every element of claims of the instant application. Claims of the instant application therefore are not patently distinct from the earlier patent claims and as such are unpatentable over obvious-type double patenting. A later patent claim is not patentably distinct from an earlier claim if the later claim is anticipated by the earlier claim. See the claim comparison below.
“A later patent claim is not patentably distinct from an earlier patent claim if the later claim is obvious over, or anticipated by, the earlier claim. In re Longi, 759 F.2d at 896, 225 USPQ at 651 (affirming a holding of obviousness-type double patenting because the claims at issue were obvious over claims in four prior art patents); In re Berg, 140 F.3d at 1437, 46 USPQ2d at 1233 (Fed. Cir. 1998) (affirming a holding of obviousness-type double patenting where a patent application claim to a genus is anticipated by a patent claim to a species within that genus). “ELI LILLY AND COMPANY v BARR LABORATORIES, INC., United States Court of Appeals for the Federal Circuit, ON PETITION FOR REHEARING EN BANC (DECIDED: May 30, 2001).
Claim Comparison
Instant Application # 19/219,022
US Patent # 12,314821
1. A method, comprising:
obtaining request data for a computing interface;
applying a machine learning model to one or more features extracted from the request data, the machine learning model having been trained to classify one or more portions of a request including a specific value as either indicating or not indicating a parameter associated with the computing interface; based on the output of the machine learning model, identifying portions of requests in the request data indicating parameters associated with the computing interface; based on the indicated parameters, identifying one or more dependencies of the computing interface; and
based on the identified one or more dependencies, identifying a vulnerability in the computing interface, the vulnerability being identified outside of a runtime operation of the computing interface.
2. The method as described in claim 1, wherein the computing interface is an application programming interface (API).
3. The method as described in claim 1, wherein the vulnerability in the computing interface is identified in a pre-production environment.
4. The method as described in claim 1, wherein the vulnerability in the computing interface is identified without access to a specification of the computing interface.
5. The method as described in claim 1, wherein the vulnerability in the computing interface is identified without an exposure of the computing interface to external programs and systems.
6. The method as described in claim 1, further including extracting one or more features from the request data, wherein at least one feature is a value included in a request.
7. The method as described in claim 1, wherein the machine learning model is trained per value using a training set including a plurality of training values of a plurality of training requests.1
8. The method as described in claim 1, further including creating a specification of the computing interface based on the identified portions of requests indicating parameters associated with the computing interface.
9. The method as described in claim 1, wherein multiple instances of multiple requests are included in the request data.
10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:obtaining request data for a computing interface;applying a machine learning model to one or more features extracted from the request data, the machine learning model having been trained to classify one or more portions of a request including a specific value as either indicating or not indicating a parameter associated with the computing interface;based on the output of the machine learning model, identifying portions of requests in the request data indicating parameters associated with the computing interface;based on the indicated parameters, identifying one or more dependencies of the computing interface; andbased on the identified one or more dependencies, identifying a vulnerability in the computing interface, the vulnerability being identified outside of a runtime operation of the computing interface.2
11. A system, comprising:a processing circuitry; anda memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:obtain request data for the computing interface;apply a machine learning model to one or more features extracted from the request data, the machine learning model having been trained to classify one or more portions of a request including a specific value as either indicating or not indicating a parameter;based on the output of the machine learning model, identify portions of requests in the request data indicating parameters associated with the computing interface;based on the indicated parameters, identify one or more dependencies of the computing interface; andbased on the identified one or more dependencies, identify a vulnerability in the computing interface, the vulnerability being identified outside of a runtime operation of the computing interface.
12. The system as described in claim 11, wherein the computing interface is an application programming interface (API).
13. The system as described in claim 11, wherein the vulnerability in the computing interface is identified in a pre-production environment.
14. The system as described in claim 11, wherein the vulnerability in the computing interface is identified without access to a specification of the computing interface.
15. The system as described in claim 11, wherein the vulnerability in the computing interface is identified without an exposure of the computing interface to an external program.
16. The system as described in claim 11, wherein the instructions are further configured to create a specification of the computing interface based on the identified portions of requests indicating parameters associated with the computing interface.
17. The system as described in claim 11, wherein multiple instances of multiple requests are included in the request data.
1. A method for active parameter identification, comprising:
applying a machine learning model to features extracted from each of at least one request to a computing interface, wherein the machine learning model is trained per value using a training set including a plurality of training values of a plurality of training requests, wherein the machine learning model is trained to output an indicator as to whether each portion of a request containing a respective value indicates a parameter when applied to the request; and
identifying at least one parameter-indicating portion of each request to the computing interface based on outputs of the machine learning model.
2. The method of claim 1, further comprising: creating a specification for the computing interface based on the identified at least one parameter-indicating portion of each request to the computing interface.
3. The method of claim 2, wherein each of the at least one request to the computing interface is an example request having an entropy above a threshold.
4. The method of claim 3, wherein multiple instances of each of the at least one request to the computing interface is included in traffic to the computing interface.
5. The method of claim 2, further comprising: detecting at least one vulnerability of the computing interface using the specification created for the computing interface.
6. The method of claim 5, wherein the at least one request to the computing interface is at least one first request, wherein detecting the at least one vulnerability further comprises: consuming the computing interface by sending at least one second request based on the identified at least one parameter-indicating portion of each first request to the computing interface.
7. The method of claim 6, further comprising: determining at least one value to be included in the at least one second request such that each of the at least one value corresponds to one of the at least one parameter-indicating portion of one of the at least one first request to the computing interface.
8. The method of claim 7, wherein the at least one value is determined based on at least one dependency of the computing interface.
9. The method of claim 1, wherein the computing interface is an application programming interface.
10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising: applying a machine learning model to features extracted from each of at least one request to a computing interface, wherein the machine learning model is trained per value using a training set including a plurality of training values of a plurality of training requests, wherein the machine learning model is trained to output an indicator as to whether each portion of a request containing a respective value indicates a parameter when applied to the request; and identifying at least one parameter-indicating portion of each request to the computing interface based on outputs of the machine learning model.
11. A system for active parameter identification, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: apply a machine learning model to features extracted from each of at least one request to a computing interface, wherein the machine learning model is trained per value using a training set including a plurality of training values of a plurality of training requests, wherein the machine learning model is trained to output an indicator as to whether each portion of a request containing a respective value indicates a parameter when applied to the request; and identify at least one parameter-indicating portion of each request to the computing interface based on outputs of the machine learning model.
12. The system of claim 11, wherein the system is further configured to: create a specification for the computing interface based on the identified at least one parameter-indicating portion of each request to the computing interface.
13. The system of claim 12, wherein each of the at least one request to the computing interface is an example request having an entropy above a threshold.
14. The system of claim 13, wherein multiple instances of each of the at least one request to the computing interface is included in traffic to the computing interface.
15. The system of claim 12, wherein the system is further configured to: detect at least one vulnerability of the computing interface using the specification created for the computing interface.
16. The system of claim 15, wherein the at least one request to the computing interface is at least one first request, wherein the system is further configured to: consume the computing interface by sending at least one second request based on the identified at least one parameter-indicating portion of each first request to the computing interface.
17. The system of claim 16, wherein the system is further configured to: determine at least one value to be included in the at least one second request such that each of the at least one value corresponds to one of the at least one parameter-indicating portion of one of the at least one first request to the computing interface.
18. The system of claim 17, wherein the at least one value is determined based on at least one dependency of the computing interface.
19. The system of claim 11, wherein the computing interface is an application programming interface.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US Patent No. 10,681,012 (Subbarayan et al.), “an … invention is to secure API/Application/Web servers/Message Queues, which may use different types of APIs. Another objective of the present invention concerns machine learning based API security. The objective of the implemented invention is to provide an automated approach to threat and/or attack detection by machine learning based accumulation and/or interpretation of various API/application traffic patterns, identifying and mapping characteristics of normal traffic for each API, and thereafter identifying any deviations from the normal traffic parameter baselines, which deviations may be classified as anomalies or attacks”.
US Patent No. 10,437,712 (Tyler et al.), “obtaining a model of an application program interface (“API”); receiving a request to generate a functional-test specification for the API; detecting sets of functionality identified by the model of the API and respective sets of parameters corresponding to the detected sets of functionality by parsing the model of the API; in response to receiving the request, generating the functional-test specification for the API by, for at least some respective detected sets of functionality, specifying respective sets of functional tests based on corresponding sets of parameters”.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MORSHED MEHEDI whose telephone number is (571) 270-7640. The examiner can normally be reached on M - F, 8:00 am to 4:00 pm EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Linglan Edwards can be reach on (571) 270-5440. The fax number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from their Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (In USA or Canada) or 571-272-1000.
/MORSHED MEHEDI/Primary Examiner, Art Unit 2408
