Ex Parte ALY et al

Patent Trial and Appeal Board

May 24, 2016

13426205 (P.T.A.B. May. 24, 2016)

UNITED STA TES p A TENT AND TRADEMARK OFFICE
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR
13/426,205 03/21/2012 HOSAMALY
73109 7590 05/26/2016
Cuenot, Forsythe & Kim, LLC
20283 State Road 7
Ste. 300
Boca Raton, FL 33498
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www .uspto.gov
ATTORNEY DOCKET NO. CONFIRMATION NO.
CA920100030US2_8150-0202 4377
EXAMINER
W ALIULLAH, MOHAMMED
ART UNIT PAPER NUMBER
2496
NOTIFICATION DATE DELIVERY MODE
05/26/2016 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address( es):
ibmptomail@iplawpro.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte HOSAM ALY, CRAIG R. CONBOY,
IOSIF V. ONUT, and GUY PODJARNY
Appeal2014-009110
Application 13/426,205 1
Technology Center 2400
Before DEBRA K. STEPHENS, JASON V. MORGAN, and
DAVID J. CUTITTA, Administrative Patent Judges.
CUTITTA, Administrative Patent Judge.
DECISION ON APPEAL
This is an appeal under 35 U.S.C. § 134(a) from the Examiner's
decision rejecting claims 21-27. We have jurisdiction over this appeal
under 35 U.S.C. § 6(b) (2015).
We AFFIRM.2
1 According to Appellants, the real party in interest is IBM Corporation (see
Appeal Br. 1).
2 Throughout this Opinion, we refer to ( 1) Appellants' Specification filed
March 21, 2012 ("Spec."), (2) the Final Rejection ("Final Act.") mailed
November 29, 2013, (3) the Appeal Brief ("Appeal Br.") filed February 28,
Appeal2014-009110
Application 13/426,205
SUMMARY OF THE INVENTION
According to Appellants, the application relates to a computer-
implemented process for two-tier deep analysis of hypertext transport
protocol data that monitors Web traffic. Spec. if 83. The process receives a
packet of Web traffic from a network to form a received packet, determines
whether the Web traffic is suspicious using a first tier analysis and
responsive to a determination that the Web traffic is suspicious, consumes
the stored Web traffic using a deep analysis module. Id. The computer-
implemented process further determines whether the stored Web traffic is a
case of misuse using a second tier analysis and responsive to a determination
that the stored Web traffic is a case of misuse, and feeds back data about a
malicious connection to an intrusion protection system before returning to
monitor the Web traffic. Id.
Claim 21 is the only independent claim and is reproduced with key
limitations emphasized below:
21. A method for performing a two-tier deep analysis of
Web traffic, comprising:
receiving, using a intrusion prevention system, a packet of
the Web traffic from a network;
performing, using the intrusion prevention system, a first
tier analysis on the received packet;
causing, based upon a result of the first tier analysis, a
second tier analysis to be performed on the received packet; and
receiving, using the intrusion prevention system, data
based upon the second tier analysis.
2014, (4) the Examiner's Answer ("Ans.") mailed June 25, 2014, and (5) the
Reply Brief ("Reply Br.") filed August 20, 2014.
3 On page 1 of the Appeal Brief, Appellants identify a related appeal-
namely, Appeal No. 2014-009293 (Application No. 13/213,595).
2
Appeal2014-009110
Application 13/426,205
REFERENCES
The prior art relied upon by the Examiner in rejecting the claims on
appeal:
Son et al. ("Son")
Waisman et al. ("Waisman")
Kapoor et al. ("Kapoor")
US 2005/0182950 Al
US 2005/0262556 Al
US 2008/0134330 Al
REJECTIONS
Aug. 18, 2005
Nov. 24, 2005
June 5, 2008
Claims 21, 23, and 26 are rejected under 35 U.S.C. § 102(b) as being
anticipated by Son.
Claims 22-26 are rejected under 35 U.S.C. § 103(a) as being
unpatentable over Son in view of Kapoor.
Claim 27 is rejected under 35 U.S.C. § 103(a) as being unpatentable
over Son in view of Kapoor and in further view of Waisman.
Claims 21-27 are rejected for obviousness-type double patenting
based on claims 21-'27 of U.S. Patent Application No. 13/213,595.
Our review in this appeal is limited only to the above rejections and
issues raised by the Examiner and Appellants. We have not considered other
possible issues including compliance with 35 U.S.C. § 101 that have not
been raised by the Examiner and which are therefore not before us.
ISSUES
Did the Examiner err by finding Son discloses a method in which a
second tier analysis is performed based upon a result of a first tier analysis,
as recited in claim 21?
Did the Examiner err by finding the combination of Son in view of
Kapoor teaches or suggests a method wherein the first tier analysis is a
3
Appeal2014-009110
Application 13/426,205
network level analysis, and the second tier analysis is an application level
analysis, as recited in claim 22?
Did the Examiner err by finding the combination of Son in view of
Kapoor teaches or suggests a method comprising causing a connection
profile to be constructed using the result of the second tier analysis, as
recited in claim 25?
Did the Examiner err by finding the combination of Son in view of
Kapoor and in further view of Waisman teaches or suggests a method
wherein the second tier analysis is only performed upon the first tier analysis
identifying the received packet as being suspicious, as recited in
representative claim 27?
FINDINGS OF FACT
1. Son discloses blocking system 24 that sequentially performs
hardware filtering (relied upon by the Examiner to disclose a first
tier analysis as claimed) and software filtering (relied upon by the
Examiner to disclose a second tier analysis as claimed) on traffic
attacks through the packet-dedicated processor and the host
system. Son i-f 36. Son further discloses that the hardware filtering
is primarily performed on network packets and the software
filtering is secondarily performed on the network packets. Son
i-f 42. Figure 3 illustrates that a packet is processed sequentially by
going through the hardware filter first and the software filtering
second.
4
Appeal2014-009110
Application 13/426,205
2. Son teaches performing static hardware filtering and sending good
and abnormal traffic to the software filter for further screening.
Son i-f 42.
3. Kapoor teaches analyzing packets associated with application layer
behavior. Kapoor i-f 56 and i-f 520.
4. Kapoor teaches constructing a connection profile using an analysis
result. Kapoor i-f 169 and i-f 514.
5. Waisman teaches sending only abnormal traffic for second tier
analysis. Waisman i-f 21.
ANALYSIS
Rejections Under 35 U.S.C. § 102(b) & § 103(a)
Claims 21 and 26
The Examiner finds that Son discloses every limitation of claim 21.
Ans. 3-5, 9-11; Final Act. 3-5. Specifically, the Examiner finds that Son
discloses "causing, based upon a result of the first tier analysis, a second tier
analysis to be performed on the received packet" (emphasis added), as
recited in claim 21. See Ans. 9-11. In disclosing the first and second tier
analysis, the Examiner finds that in Son "hardware filtering and software
filtering are analyzed on network traffic (packet/packets) in succession
without others coming in between." Ans. 10 (citing Son i-f 21andi-f36).
Appellants argue that the Examiner "has not established that Son
teaches that the software filtering is caused to be performed based upon a
result of the hardware filtering." Reply Br. 3.
Appellants' arguments do not persuade us of any reversible error in
the Examiner's rejection. In re Jung, 637 F.3d 1356, 1365 (Fed. Cir.
5
Appeal2014-009110
Application 13/426,205
2011 ). During examination, "the PTO must give claims their broadest
reasonable construction consistent with the specification . . . . Therefore, we
look to the specification to see if it provides a definition for claim terms, but
otherwise apply a broad interpretation." In re ICON Health & Fitness, Inc.,
496 F.3d 1374, 1379 (Fed. Cir. 2007). "[A]s applicants may amend claims to
narrow their scope, a broad construction during prosecution creates no
unfairness to the applicant or patentee." Id.
Initially, we note "based on," as recited in claim 21, has not been
defined explicitly in Appellants' Specification. In fact, Appellants'
Specification fails to even mention "based on" in the context of performing
the first and second tier analysis.
Consistent with the Examiner's finding (Ans. 10), we find Son's
disclosure of sequentially performing hardware and then software filtering
on network packets (i-f 36) as disclosing "causing, based upon a result of the
first tier analysis, a second tier analysis to be performed on the received
packet" (emphasis added), as set forth below.
Appellants appear to concede Son discloses sequentially performing
software filter after hardware filtering is equivalent to causing a second tier
analysis, based upon the first tier analysis, as Appellants offer no specific
arguments to the contrary. Reply Br. 2-3. Appellants instead argue that the
Examiner "has not established that Son teaches that the software filtering is
caused to be performed based upon a result of the hardware filtering" (i.e.,
the first tier analysis). Reply Br. 3.
We disagree, because as the Examiner finds, Son discloses:
[t]he blocking system 14 performs secondary software filtering
on dynamic attacks by selectively transmitting processing
6
Appeal2014-009110
Application 13/426,205
results, including information on blocking results related to
incoming packets, information on packets primarily filtered out
by the packet-dedicated processor, information on all the packets
incoming to the packet-dedicated processor and partial
information of packets according to a specific condition (for
example, header information of all the packets) to the software
filter.
Ans. 10 (citing Son i-f 42) (emphasis added).
In addition, we find Son indicates that hardware filtering is performed
by the packed-dedicated processor and that "the software filtering is
performed by selectively transmitting processing results of the packet-
dedicated processor to the software filter." Son i-fi-1 16 -17 (emphasis
added)(see also Son i-fi-141--43). Thus, because Son discloses performing
secondary software filtering on data primarily filtered by the packet-
dedicated processor (hardware filtered packets) the Examiner correctly finds
that Son discloses the software filtering is caused to be performed based
upon a result of the hardware filtering.
Appellants further argue that as claimed, the same received packet
undergoes a two-tier analysis (i.e., the same packet is analyzed twice),
whereas Son teaches analyzing a packet in one instance and a packet stream
in another instance and therefore in Son the same packet is not analyzed
twice. Appeal Br. 12.
We disagree with Appellants' argument, because, as noted by the
Examiner, in Son, "blocking system 14 performs secondary software
filtering on dynamic attacks by selectively transmitting processing results,
including ... information on packets primarily filtered out by the packet-
dedicated processor [and] information on all the packets incoming to the
packet-dedicated processor." Ans. 10 (citing Son i-f 42). Thus Son's
7
Appeal2014-009110
Application 13/426,205
"software filtering considers each and every packet under consideration for
analysis purpose." Ans. 10.
Accordingly, we sustain the Examiner's 3 5 U.S. C. § 102(b) rejection
of claim 21 and of claim 26, which Appellants do not argue separately.
Appeal Br. 10.
Claims 22, 23, and 24
Claim 22 recites "[t ]he method of claim 21, wherein the first tier
analysis is a network level analysis, and the second tier analysis is an
application level analysis."
The Examiner does not rely on Son to teach "the second tier analysis
is an application level analysis," but instead relies upon Kapoor to teach the
limitation at issue. Ans. 11-12.
Appellants argue that Kapoor fails to teach performing application
level analysis because "the fact that a packet is associated with one layer
does not establish the type of analysis that is being performed.'' Appeal
Br. 14--15.
We disagree, noting Appellants fail to establish the Examiner's
finding that analyzing packets associated with application layer behavior
suggests an application level analysis (Ans. 12), is contrary to the plain
meaning of "application level" or is inconsistent with the Specification. In
re Zletz, 893 F.2d 319, 321 (Fed. Cir. 1989).
Appellants further argue that the Examiner's proposed modification of
Son based on Kapoor would impermissibly change the core principle of Son
because Son teaches two types of analysis, which would be substantively
changed by the Examiner's proposed modification. Appeal Br. 16.
8
Appeal2014-009110
Application 13/426,205
We do not find Appellants' arguments persuasive. It is well settled
that mere attorney arguments and conclusory statements, which are
unsupported by factual evidence, are entitled to little probative value. In re
Geisler, 116 F.3d 1465, 1470 (Fed. Cir. 1997); In re De Blauwe, 736 F.2d
699, 705 (Fed. Cir. 1984). Attorney argument is not evidence. In re
Hamilton, 882 F.2d 1576, 1582 (Fed. Cir. 1989) (citing In re Pearson, 494
F.2d 1399, 1405 (CCPA 1974)). Nor can such argument take the place of
evidence lacking in the record. Meitzner v. Mindick, 549 F.2d 775, 782
(CCP A 1977).
Here, Appellants provide only unsupported assertions that fail to
identify persuasive evidence. That is, Appellants do not explain why
modifying Son based on Kapoor would impermissibly change the core
principle of Son by changing Son's two types of analysis.
Therefore, we are not persuaded by Appellants' arguments that the
proposed combination of Son and Kapoor would impermissibly change the
core principle of Son and therefore we sustain the rejection of claim 22.
Claims 23 and 24, which depend from and include all of the limitations of
claim 22, are not argued separately and therefore the rejections of these
claims are also sustained.
Claim 25
Claim 25 recites "[t ]he method of claim 21, further comprising
causing a connection profile to be constructed using the result of the second
tier analysis."
The Examiner does not rely on Son to teach "causing a connection
profile to be constructed," but instead relies upon Kapoor at paragraphs 169
and 514. Final Act. 7; Ans. 13.
9
Appeal2014-009110
Application 13/426,205
Appellants contend that the cited portions of Kapoor fails to suggest
"a connection profile," as claimed. Appeal Br. 17. Specifically, Appellants
state "completely absent from the Examiner's cited passage or reproduced
language is any mention of the claimed 'connection profile' or that this
connection profile is construed using the result of the second tier analysis."
Id.
Appellants' arguments are unpersuasive. As found by the Examiner
Kapoor teaches constructing a connection profile using a result of an
analysis. Final Act. 11; Ans. 13. For example, Kapoor describes associating
a subject of a training process with a networking behavior of a data flow
and/or a content behavior of a data flow. Kapoor i-fi-f 169 and 514. In the
case where the subject is associated with the content behavior, features may
be extracted by using sequential one byte or two byte chunks that are
normalized and then sorted, resulting in a profile. Id. Kapoor further
indicates the networking behavior may be associated with a connection time,
an inter-connection time, a request time, a response time, a count of a
number of bytes in a connection. Id.
Hence, we find no reversible error in the Examiner's finding that
Kapoor teaches causing a connection profile to be constructed based on an
analysis result. Likewise, the Examiner relies upon Son's teaching of
secondary software filtering as the claimed "second tier analysis." Ans. 13.
In essence, the Examiner finds that applying Kapoor' s constructing of a
connection profile to Son's second tier analysis improves one known data
analysis process for another yielding no more than predictable results. See
KSR Int'! Co. v. Teleflex Inc., 550 U.S. 398, 416 (2007); Final Act. 11;
Ans. 13.
10
Appeal2014-009110
Application 13/426,205
In arguing against the Examiner's proposed combination of Son and
Kapoor, Appellants fail to demonstrate that combining Kapoor's teaching of
constructing a connection profile based on an analysis result with Son's
teaching of a second tier analysis would yield anything more than a
predictable result. Accordingly, we sustain the Examiner's rejection of
claim 25.
Claim 27
Claim 2 7 recites " [ t] he method of claim 21, wherein the second tier
analysis is only performed upon the first tier analysis identifying the
received packet as being suspicious."
The Examiner notes that "Son does not teaches [sic] exclusively,
sending suspicious packet for next level analysis, but Waisman teaches
based on risk level control logic send traffic to second level analysis
[0021]." Ans. 13.
Appellants contend:
the Examiner's proposed modification [of Son based on
Waisman] would impermissibly change the core principle of
operation of Son. If the analysis of the alleged first tier analysis
is that the received packet is suspicious, then Son teaches
filtering out the packet. If so, it cannot be subject to a second tier
analysis. Thus, a second tier analysis is inconsistent with the
core principle of operation of Son.
Appeal Br. 18.
We disagree because, contrary to Appellants' contention, the
Examiner finds that Son teaches performing static hardware filtering and
sending good and abnormal traffic to the software filter for further
screening, while relying on Waisman to teach only sending abnormal traffic
for second tier analysis. Ans. 13.
11
Appeal2014-009110
Application 13/426,205
We therefore do not find Appellants' arguments persuasive of error,
because Appellants fail to provide evidence demonstrating Examiner error
by showing that Son exclusively discloses that a suspicious packet cannot be
subject to a second tier analysis because it is always filtered out in a first tier
analysis.
Appellants further argue for the first time in the Reply Brief that the
Examiner's proposed modification of Son based on Waisman would not
achieve the results described by the Examiner. Reply Br. 10.
That argument is untimely and will not be considered in the absence
of any good faith showing why it could not have been timely presented in
Appellants' Appeal Brief. 37 C.F.R. § 41.41(b)(2) (2012).
Accordingly, we sustain the rejection of dependent claim 27 under 35
U.S.C. § 103(a) as being obvious over Son in view of Waisman.
Claim 23
The Examiner rejects claim 23 under 35 U.S.C. § 102(b) as
anticipated by Son. Final Act. 6. The rejection of claim 23 under 35 U.S.C.
§ 102(b) is improper. Claim 23 depends from claim 22 and includes all the
limitations recited therein. Claim 22, however, is rejected under 35 U.S.C. §
103(a) as being unpatentable over Son and Kapoor. Final Act. 9. Claim 23,
therefore, cannot properly be rejected under 35 U.S.C. § 102(b) based on
Son.
Accordingly, we summarily reverse the Examiner's 35 U.S.C. §
102(b) rejection of claim 23.
12
Appeal2014-009110
Application 13/426,205
Obviousness-type Double Patenting Rejections
The Examiner rejected all of the claims on appeal for obviousness-
type double patenting based on claims 21-27 of U.S. Patent Application No.
13/213,595. Final Act. 4-7.
Appellants do not provide arguments disputing this rejection in the
Appeal Brief. Therefore, we affirm it. See Hyatt v. Dudas, 551F.3d1307,
1314 (Fed. Cir. 2008).
When the appellant fails to contest a ground of rejection to the
Board, ... the Board may treat any argument with respect to that
ground of rejection as waived. In the event of such a waiver, the
PTO may affirm the rejection of the group of claims that the
examiner rejected on that ground without considering the merits
of those rejections.
DECISION
We reverse the Examiner's decision rejecting claim 23 under 35
U.S.C. § 102(b).
We affirm the Examiner's decision rejecting claims 21 and 26 under
35 U.S.C. § 102(b).
We affirm the Examiner's decision rejecting claim 22-27 under 35
U.S.C. § 103(a).
We affirm the Examiner's obviousness-type double patenting
rejection of claims 21-27.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(l )(iv).
AFFIRMED
13