11106286 (P.T.A.B. Dec. 19, 2012)

Ex Parte Fosdick

Patent Trial and Appeal BoardDec 19, 2012

11106286 (P.T.A.B. Dec. 19, 2012)

UNITED STATES PATENT AND TRADEMARK OFFICE ____________________ BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________________ Ex parte NICOLAS E. FOSDICK ____________________ Appeal 2010-006936 Application 11/106,286 Technology Center 2400 ____________________ Before ROBERT E. NAPPI, DEBRA K. STEPHENS, and HUNG H. BUI, Administrative Patent Judges. Per curiam. DECISION ON APPEAL Appeal 2010-006936 Application 11/106,286 2 Appellant appeals under 35 U.S.C. § 134(a) (2002) from a final rejection of claims 1-5 and 18-30. We have jurisdiction under 35 U.S.C. § 6(b). Claims 6-17 have been cancelled. We AFFIRM. Introduction According to Appellant, the invention relates to a system, method, and computer program product for detecting a denial of service attack on a plurality of computers. (Abstract). STATEMENT OF THE CASE Exemplary Claim(s) Claim 1 is an exemplary claim and is reproduced below: 1. A method for detecting a denial of service attack on a plurality of computers, the plurality of computers having respective, different IP addresses, the method comprising the steps of: a management server obtaining from the plurality of computers records of respective requests sent to the plurality of computers, the plurality of computers having respective, different IP addresses, each of the records including a source IP address of the respective request; the management server identifying and grouping together a first multiplicity of the requests addressed to different computers of the plurality of computers from a first source IP address or a first plurality of source IP addresses which differ from each other but originated from a first subnet, totaling the first multiplicity, comparing the total of the first multiplicity to a first predetermined threshold, and if the total of the first multiplicity exceeds the first predetermined threshold, making a Appeal 2010-006936 Application 11/106,286 3 record that the first source IP address or the first subnet has sent an excessive number of requests to the plurality of computers and notifying an operator that the first source IP address or the first subnet has sent an excessive number of requests to the plurality of computers; and the management server identifying and grouping together a second multiplicity of requests addressed to different computers of the plurality of computers from a second source IP address or a second plurality of the source IP addresses which differ from each other but originated from a second subnet, totaling the second multiplicity, comparing the total of the second multiplicity to a second predetermined threshold, and if the total of the second multiplicity exceeds the second predetermined threshold, making a record that the second source IP address or the second subnet has sent an excessive number of requests to the plurality of computers and notifying an operator that the second source IP address or the second sub net has sent an excessive number of requests to the plurality of computers. References Chesla US 2004/0250124 A1 Dec. 9, 2004 Petry US 6,941,348 B2 Sep. 6, 2005 Wu US 2006/0077964 A1 Apr. 13, 2006 Rejections (1) Claims 1-5 and 18-30 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over Wu, Petry, and Chesla. Appeal 2010-006936 Application 11/106,286 4 We have only considered those arguments that Appellant actually raised in the Briefs. Arguments Appellant could have made but chose not to make in the Briefs have not been considered and are deemed to be waived. See 37 C.F.R. § 41.37(c)(1)(vii)(2011). ISSUE 1 35 U.S.C. § 103(a): claims 1-5 and 18-30 Claims 1, 18, 19, 24, 25, and 30 Appellant asserts their invention is not obvious over Wu, Petry, and Chesla since the references, alone or in combination, do not teach: the management server identifying and grouping together a first multiplicity of the requests addressed to different computers of the plurality of computers from a first source IP address or a first plurality of source IP addresses which differ from each other but originated from a first subnet, totaling the first multiplicity, comparing the total of the first multiplicity to a first predetermined threshold, and if the total of the first multiplicity exceeds the first predetermined threshold, making a record that the first source IP address or the first subnet has sent an excessive number of requests to the plurality of computers and notifying an operator that the first source IP address or the first subnet has sent an excessive number of requests to the plurality of computers. (App. Br. 6-11)(emphasis added). Specifically, Appellant contends Wu does not combine requests from one source IP address destined for different computers with different IP addresses (App. Br. 6). Instead, Wu’s network interfaces are in the same computer and reflect the same destination IP address of voice servers (App. Br. 7). Further, Appellant contends Petry does not disclose collecting message data from different computers having different IP addresses (App. Appeal 2010-006936 Application 11/106,286 5 Br. 9). According to Appellant, Petry discloses a subjective, manual process whereas the present invention recites an objective, automated process (Reply Br. 13). Appellant asserts Petry does not disclose identifying when a source IP address has sent a number of requests to the plurality of computers that exceeds a threshold and notifying an operator that an excessive number of requests has been sent from the source IP address (Reply Br. 13). Appellant additionally maintains Chesla does not cure the deficiencies of Wu and Petry (App. Br. 10-11). Issue 1: Has the Examiner erred in finding the combination of Wu, Petry, and Chesla teaches or suggests: the management server identifying and grouping together a first multiplicity of the requests addressed to different computers of the plurality of computers from a first source IP address or a first plurality of source IP addresses which differ from each other but originated from a first subnet, totaling the first multiplicity, comparing the total of the first multiplicity to a first predetermined threshold, and if the total of the first multiplicity exceeds the first predetermined threshold, making a record that the first source IP address or the first subnet has sent an excessive number of requests to the plurality of computers and notifying an operator that the first source IP address or the first subnet has sent an excessive number of requests to the plurality of computers (emphasis added) as recited in claim 1? ANALYSIS We agree with the Examiner’s findings and conclusions and adopt them as our own (Ans. 4-11). We emphasize Appellant seems to be arguing the references individually while the Examiner has relied on the combination of references as teaching or suggesting the present invention as recited. Appeal 2010-006936 Application 11/106,286 6 Additionally, we are not convinced that Petry discloses a manual process, relying on “visual inspection” based on the teachings cited by Appellant (Reply Br. 12-13; see e.g. col. 11, l. 58 – col. 12, l. 6). Accordingly, the Examiner did not err in finding the combination of Wu, Petry, and Chesla teaches or suggests the invention as recited in independent claim 1. Appellant did not separately argue independent claims 19 and 25, instead relying on the arguments set forth with respect to claim 1. Therefore, independent claims 19 and 25 fall with claim 1. Further, Appellants did not separately argue dependent claims 18, 24, and 30 and thus, these claims also fall with claim 1. With respect to dependent claims 2-5, 20-23, and 26-29, Appellant merely recites the claim limitation and indicate the limitation is not taught by the prior art (App. Br. 11-12). Appellant has not presented sufficient evidence or argument to persuade us of error in the Examiner’s findings. Therefore, dependent claims 2-5, 20-23, and 26-29 fall with their respective independent claims. We note in the Reply Brief, Appellant, for the first time, presents additional and new arguments as to why the prior art as recited in various dependent claims does not teach the recited limitations of the respective dependent claims. We find these arguments to be untimely (Reply Br. 14- 17). “Considering an argument advanced for the first time in a reply brief . . . is not only unfair to an appellee but also entails the risk of an improvident or ill-advised opinion on the legal issues tendered.” McBride v. Merrell Dow and Pharms., Inc., 800 F.2d 1208, 1211 (D.C. Cir. 1986) (internal citations omitted). Appellant has not explained why these arguments were necessitated by any circumstance constituting “good cause” for its belated Appeal 2010-006936 Application 11/106,286 7 presentation. See Ex parte Borden, 93 USPQ2d 1473, 1473-74 (BPAI 2010) (“informative” 1 ) (absent a showing of good cause, Board not required to address argument in Reply Brief that could have been presented in the principal Brief). Accordingly, we are not persuaded the Examiner erred in finding the combination of Wu, Petry, and Chesla teaches or suggests the invention as recited in claims 1-5 and 18-30. Therefore, the Examiner did not err in rejecting claims 1-5 and 18-30 under 35 U.S.C. § 103(a) for obviousness over Wu, Petry, and Chesla. DECISION The Examiner’s rejection of claims 1-5 and 18-30 under 35 U.S.C. § 103(a) as being unpatentable over Wu, Petry, and Chesla is affirmed. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a)(1)(iv) (2011). AFFIRMED ELD 1 The “informative” status of this opinion is noted at the following Board website: http://www.uspto.gov/ip/boards/bpai/decisions/inform/index.jsp.