Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This Office Action is in response to the U.S. patent application 19219658 filed on May 27, 2025.
Of original claims 1-9: no claims were amended, added or cancelled; claims 1 and 8 are independent claims. Accordingly, claims remain pending and have been examined in this application.
Information Disclosure Statements
The information disclosure statements (IDSs) submitted on August 15, 2025, and September 16, 2025, comply with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statements have been considered by the examiner.
Claim Interpretation - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as "configured to" or "so that"; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “monitor that at least monitors …,” “determiner that determines …,” and “outputter that outputs …” as recited in claims 1-7.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-9 are rejected under 35 USC 101 as being directed to an abstract idea without being integrated into a practical application or being significantly more.
Regarding independent claims 1 and 8, the claims are directed to an abstract idea as reciting the limitations “monitoring a first communication,” “determining whether the first communication monitored,” and “outputter that outputs”. Broadly interpreted, the aforementioned steps are directed to mental processes as said steps could be performed in the human mind. Therefore, the claims recite an abstract idea.
Said abstract idea and/or judicial exception is not integrated into a practical application as the claim does not recite any other active steps that could be considered that the abstract idea is being integrated into a practical application. It’s noted that the claim recite the step of “outputting information indicating a result.” However, said step is not sufficient to consider that the abstract idea is being interpreted into a practical application. Said step is recited at a high level of generality in gathering/processing/storing information, which are a form of insignificant extra-solution activity. Please note that “merely presenting the results of abstract processes of collecting and analyzing information, without more (such as identifying a particular tool for presentation), is abstract as an ancillary part of such collection and analysis.” See Elec. Power Grp., LLC V. Alstom S.A., 830 F.3d 1350, 1353, 1354 (Fed. Cir. 2016).
It’s also noted that the claims recite additional limitation/elements (i.e., a computer and a non-transitory computer-readable recording medium). However, said additional elements are recited at a high-level of generality (i.e., as a generic computing device performing a generic computer functions) such that it amounts no more than mere instructions to apply the exception or abstract idea using generic computer components. Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
The claims do not include additional elements/limitations/embodiments that are sufficient to amount to significantly more than the judicial exception because the additional elements when considered both individually and as an ordered combination do not amount to significantly more than the abstract idea. As mentioned above, although the claims recite additional elements, said elements taken individually or as a combination, do not result in the claim amounting to significantly more than the abstract idea because the additional elements perform generic computer content distributing functions routinely used in information technology field. As discussed above, the additional elements recited at a high-level of generality such that they amount no more than mere instructions to apply the exception using a generic computer component. Therefore, the claim is directed to non-statutory subject matter.
Claims 2-7 and 9 are also rejected under 35 U.S.C. 101 as being directed to non-statutory subject matter for the same reasons addressed above as the claims recite an abstract idea and the claims do not positively recite any other operations that could be considered as the abstract idea is being integrated into a practical application or significantly more. Steps recited are either directed to mental processes and/or in a form of insignificant extra-solution activities. Therefore, claims 2-7 and 9 are also rejected under 35 U.S.C. 101 as being directed to non-statutory subject matter.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-4 and 7-9 are rejected under 35 U.S.C. 103 as being unpatentable over Copeland (“Copeland”; US20070289017) in view of Poletto et al. (“Poletto”; US20060067220A1).
Per claim 1: Copeland discloses a detection system (Copeland FIG. 1) comprising:
a monitor that at least monitors a first communication performed from a terminal to a client device (Copeland para. [0020], “the port profiling system analyzes network communication traffic for unauthorized network activity”);
a determiner that determines whether the first communication monitored by the monitor includes an attack made on the client device by the terminal (Copeland para. [0021], “The system compares the allowed network services with observed network services. If the observed network service is not one of the allowed network services performed by that host as defined by the port profile for that host, an alarm signal is generated.”; Copeland para. [0061], “The port profiling engine 155 determines unauthorized network usage by comparing observed current network services with a stored profile of allowed network services for a particular host.”); and
an outputter that outputs information indicating a result of the determining by the determiner (Copeland para. [0021], “The system compares the allowed network services with observed network services. If the observed network service is not one of the allowed network services performed by that host as defined by the port profile for that host, an alarm signal is generated.”; Copeland para. [0145], “After the flow is analyzed, the host data structure is updated. The port display, as illustrated in FIG. 7, reflects the updated information. A black diamond indicator indicates that the service has been previously seen today and is an authorized network service. A gray diamond or a diamond with an internal cross for non color displays indicates the service is seen for the first time today and is an authorized service. A red diamond shown as a clear diamond in a non-color display is an alert indicating an Out of Profile network service has been observed.”).
Copeland does not disclose an arrangement wherein when the determiner determines that the first communication is from the terminal to an ephemeral port of the client device, the determiner determines that the first communication includes the attack.
However, in an analogous art, Poletto discloses an arrangement wherein when the determiner determines that the first communication is from the terminal to an ephemeral port of the client device, the determiner determines that the first communication includes the attack (Poletto para. [0031], “traffic on an ephemeral port might appear to a scan attack detector algorithm as a scan attack.”).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify Copeland to further include, as taught by Poletto, an arrangement wherein when the determiner determines that the first communication is from the terminal to an ephemeral port of the client device, the determiner determines that the first communication includes the attack. Motivation for modifying would have been to include an arrangement specifically monitoring ephemeral port traffic typically having a high incidence of attacks directed therethrough, in order to increase a versatility, attractiveness and broadened adoption of the Copeland/Poletto combination within the security field.
Per claim 2: The Copeland/Poletto combination discloses the detection system of claim 1. Copeland further discloses an arrangement wherein the monitor further monitors a second communication that is from the client device to a communication device that is connected via an external network, and when the second communication includes a communication from the client device to a predetermined authorized server, the determiner further obtains, from the client device, a port of the client device that is used in the second communication, and determines, based on the port as the ephemeral port, whether the first communication includes the attack (Copeland para. [0116], “The first flow illustrated would be Web traffic (HTTP protocol) between the client at IP ADDRESS1 and the server at IP ADDRESS0. The client Web browser opens a random ephemeral high port (51,132) as illustrated in the example. A high port is utilized because the low port numbers less than 1024 are preassigned for designated services. One these designated services is port 80 for HTTP, which transfers displayable Web pages and related files in the known manner. The Web browser sends the request to the server's port 80. The server port responds by sending the requested Web page data in packets wherein the port number in the packets transmitted to the client sets the destination port to 51,132 of the client. All communications by clients utilizing HTTP is sent to port 80 of the server. One flow would be the HTTP communications between port 51,132 of ADDRESS 1 and port 80 of ADDRESS0. However, the port profiling engine will update ADDRESS 1 as a client utilizing port 80 and ADDRESS0 as the server utilizing port 80 in the "seen today" structure. The port profiling engine compares the port profile of each host with the current activity for that host to determine unauthorized network usage.”).
Per claim 3: The Copeland/Poletto combination discloses the detection system of claim 2. Copeland further discloses an arrangement wherein the monitor further monitors a third communication between the terminal and a communication device that is connected via an external network, and the determiner further determines whether the third communication includes a communication performed from the terminal to an unauthorized server that is different from the predetermined authorized server, and determines that the third communication relates to the attack when the determiner determines that the third communication includes the communication performed from the terminal to the unauthorized server (Copeland para. [0082], “Likewise, Computer#2 134 has installed an authorized web page. When the web page is accessed, the host 134 is now acting like a server. The port usage as shown in the S_Profile for Computer#2 134 does not include port 80 as a server i.e. no bit is set in the 80-TCP column of the S_Profile. Consequently, an alarm will be generated. The system administrator can remove the unauthorized web page that may be monopolizing valuable band width.”).
Per claim 4: The Copeland/Poletto combination discloses the detection system of claim 1. Copeland further discloses an arrangement wherein the monitor further monitors an internal communication performed from the terminal to a destination having an address included in an internal network, and the determiner further determines whether the internal communication includes a packet relating to a host scan for the internal network (Copeland para. [0057], “The monitoring appliance 150 monitors the communications among the various "inside" hosts 132,134,136 on the network and outside hosts 120, 110 in the attempt to detect unauthorized network activity. Inside hosts are those hosts 132,134,136 of an organization in which a network administrator is concerned with unauthorized network usage. It will be recognized that the inside network includes a hub 135. Typically, inside hosts are behind a firewall 170.”; Copeland para. [0058], “The network monitoring appliance 150 connects to the network device 135 in a known manner such that the monitoring device 150 can scan all the packets 101 that get delivered to or sent from each host 132, 134, 136 on the internal network.”; Copeland para. [0008], “the controlled host can be used to attack other computers inside the firewall, or the controlled host can scan or attack computers anywhere in the world.”).
Per claim 7: The Copeland/Poletto combination discloses the detection system of claim 1. Copeland further discloses an arrangement wherein application software for performing the first communication is installed on the terminal, and when the determiner determines that the first communication includes the attack, the determiner determines that the application software has a function of making an attack (Copeland para. [0081], “Extending the example, software facilitating instant messaging or "chat" has been installed in Computer#2 134. Computer#2 134 sends chat messages to H2 120 on port 8080 at IP address 208.60.232.19. This chat service is also not one of the defined common services and is tracked in the table of non-standard services. Although computer#2 initiated the service and is acting like a client, the service is not in the C_Profile for Computer#2 134 as shown by UDP-8080 Point 186. Consequently, an alarm is generated. The system operator can remove the installed chat program, if desired, or take other appropriate action.”).
Per claim 8: Copeland discloses a detection method (Copeland para. [0084], “the disclosed methodology of unauthorized network usage detection is accomplished at least in part by comparing a predetermined port profile for a host against that host's recent activity. The addresses and port numbers of communications are easily discerned by analysis of the header information in a datagram.”) executed by a detection system (Copeland FIG. 1) to detect an attack, the detection method comprising:
at least monitoring a first communication performed from a terminal to a client device (Copeland para. [0020], “the port profiling system analyzes network communication traffic for unauthorized network activity”);
determining whether the first communication monitored in the monitoring includes an attack made on the client device by the terminal (Copeland para. [0021], “The system compares the allowed network services with observed network services. If the observed network service is not one of the allowed network services performed by that host as defined by the port profile for that host, an alarm signal is generated.”; Copeland para. [0061], “The port profiling engine 155 determines unauthorized network usage by comparing observed current network services with a stored profile of allowed network services for a particular host.”); and
outputting information indicating a result of the determining (Copeland para. [0021], “The system compares the allowed network services with observed network services. If the observed network service is not one of the allowed network services performed by that host as defined by the port profile for that host, an alarm signal is generated.”; Copeland para. [0145], “After the flow is analyzed, the host data structure is updated. The port display, as illustrated in FIG. 7, reflects the updated information. A black diamond indicator indicates that the service has been previously seen today and is an authorized network service. A gray diamond or a diamond with an internal cross for non color displays indicates the service is seen for the first time today and is an authorized service. A red diamond shown as a clear diamond in a non-color display is an alert indicating an Out of Profile network service has been observed.”).
Copeland does not disclose an arrangement wherein in the determining, when it is determined that the first communication is from the terminal to an ephemeral port of the client device, it is determined that the first communication includes the attack.
wherein in the determining, when it is determined that the first communication is from the terminal to an ephemeral port of the client device, it is determined that the first communication includes the attack (Poletto para. [0031], “traffic on an ephemeral port might appear to a scan attack detector algorithm as a scan attack.”).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the Copeland/Poletto combination to further include, as taught by Poletto, an arrangement wherein in the determining, when it is determined that the first communication is from the terminal to an ephemeral port of the client device, it is determined that the first communication includes the attack. Motivation for modifying would have been to include an arrangement specifically monitoring ephemeral port traffic typically having a high incidence of attacks directed therethrough, in order to increase a versatility, attractiveness and broadened adoption of the Copeland/Poletto combination within the security field.
Per claim 9: The Copeland/Poletto combination discloses the detection method of claim 8. Copeland further discloses an arrangement of a non-transitory computer-readable recording medium having recorded thereon a program for causing a computer to execute the detection method (Copeland para. [0127], “it may prove advantageous to construct a specialized apparatus to perform the method steps described herein by way of dedicated computer systems in a specific network architecture with hard-wired logic or programs stored in nonvolatile memory, such as read only memory.”).
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over Copeland (“Copeland”; US20070289017) in view of Poletto et al. (“Poletto”; US20060067220A1) and Roeh et al. (“Roeh”; US9756061B1).
Per claim 5: The Copeland/Poletto combination discloses the detection system of claim 4. Copeland further discloses an arrangement wherein when the determiner determines that the first communication includes the attack and that the internal communication does not include the packet relating to the host scan (Copeland para. [0053], “Port scans and some other illegitimate flows typically do not send data with the packets 101, or if they do, the packets are usually rejected by a TCP "Reject" packet or a ICMP "Unavailable" packet.”; [NOTE: The quoted passage is being interpreted as teaching that “packet” contents (or lack thereof) can be used to detect a host scan attack.]). The Copeland/Poletto combination does not teach an arrangement wherein the determiner determines that the terminal is suspected of a wiretapping attack.
However, in an analogous art, Roeh discloses an arrangement wherein the determiner determines that the terminal is suspected of a wiretapping attack (Roeh claim 4, “wherein the one or more attacks include one or more of Ransomware, man-in-the-middle, worm, Trojan, denial of service, spoofing, ARP (address resolution protocol) poison, Ping flood, Ping of death, Smurf, wiretapping, Port scan, Idle scan, buffer overflow, heap overflow, stack overflow, or format string attack.”; [NOTE: The quoted passage is being interpreted as teaching that numerous types of attacks (including host scans and wiretapping) were well known, and that it was well known that determinations could look for more than one type of attack ; Regarding the specific “host scan” and “wiretapping” attacks set forth within the claim, it would have been an obvious matter of design choice to choose any two (or even more) attack types in any implementation, since applicant has not disclosed that the specific “host scan” and “wiretapping” attacks recited, solve any stated problem or is for any particular purpose and it appears that the invention would perform equally well with other well-known attack types.]).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the Copeland/Poletto combination (which teaches including “host scans”) to further include, as taught by Roeh, an arrangement wherein the determiner determines that the terminal is suspected of a wiretapping attack. Motivation for modifying would have been to increase a range of attacks being determined, in order to increase a versatility, attractiveness and broadened adoption of the Copeland/Poletto/Roeh combination within the security field.
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Copeland (“Copeland”; US20070289017) in view of Jin et al. (“Jin”; CN111629003A).
Per claim 6: The Copeland/Poletto combination discloses the detection system of claim 2. Copeland further discloses an arrangement wherein the monitor further monitors an internal communication performed from the terminal to a destination having an address included in an internal network, and the determiner further determines whether the internal communication includes a packet relating to a host scan for the internal network (Copeland para. [0057], “The monitoring appliance 150 monitors the communications among the various "inside" hosts 132,134,136 on the network and outside hosts 120, 110 in the attempt to detect unauthorized network activity. Inside hosts are those hosts 132,134,136 of an organization in which a network administrator is concerned with unauthorized network usage. It will be recognized that the inside network includes a hub 135. Typically, inside hosts are behind a firewall 170.”; Copeland para. [0058], “The network monitoring appliance 150 connects to the network device 135 in a known manner such that the monitoring device 150 can scan all the packets 101 that get delivered to or sent from each host 132, 134, 136 on the internal network.”; Copeland para. [0008], “the controlled host can be used to attack other computers inside the firewall, or the controlled host can scan or attack computers anywhere in the world.”). The Copeland/Poletto combination does not teach an arrangement wherein when the determiner determines that the first communication includes the attack, that the internal communication does not include the packet relating to the host scan, and that a time difference between the communication from the client device to the predetermined authorized server and the attack included in the first communication is within a reference time period, determines that the terminal is suspected of a wiretapping attack.
However, in an analogous art, when the determiner determines that the first communication includes the attack, that the internal communication does not include the packet relating to the host scan, and that a time difference between the communication from the client device to the predetermined authorized server and the attack included in the first communication is within a reference time period, determines that the terminal is suspected of a wiretapping attack (Jin Abstract, “judging whether the wiretapping occurs according to the time difference”).
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the Copeland/Poletto combination (which teaches including “host scans”) to further include, as taught by Jin, an arrangement wherein a time difference between the communication from the client device to the predetermined authorized server and the attack included in the first communication is within a reference time period, determines that the terminal is suspected of a wiretapping attack. Motivation for modifying would have been to increase a range of attacks being determined, in order to increase a versatility, attractiveness and broadened adoption of the Copeland/Poletto/Roeh combination within the security field.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Paul J Skwierawski whose telephone number is (571)272-2642. The examiner can normally be reached 6:00am-3:30pm weekdays.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisory primary examiner (SPE) Luu Pham can be reached on (571) 270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Paul Skwierawski/
Patent Examiner, Art Unit 2439
/LUU T PHAM/Supervisory Patent Examiner, Art Unit 2439
Prosecution Insights