Evgeny Beskrovny et al.Download PDFPatent Trials and Appeals BoardApr 28, 202013623067 - (D) (P.T.A.B. Apr. 28, 2020) Copy Citation UNITED STATES PATENT AND TRADEMARK OFFICE UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www.uspto.gov APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO. 13/623,067 09/19/2012 EVGENY BESKROVNY IL920120050US1_8150-0259 9307 73109 7590 04/28/2020 Cuenot, Forsythe & Kim, LLC 20283 State Road 7 Ste. 300 Boca Raton, FL 33498 EXAMINER ABRISHAMKAR, KAVEH ART UNIT PAPER NUMBER 3649 NOTIFICATION DATE DELIVERY MODE 04/28/2020 ELECTRONIC Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the following e-mail address(es): ibmptomail@iplawpro.com PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD Ex parte EVGENY BESKROVNY and OMER TRIPP Appeal 2018-0087711 Application 13/623,067 Technology Center 3600 Before THU A. DANG, BETH Z. SHAW, and JOYCE CRAIG, Administrative Patent Judges. CRAIG, Administrative Patent Judge. DECISION ON APPEAL STATEMENT OF THE CASE Pursuant to 35 U.S.C. § 134(a), Appellant2 appeals from the Examiner’s decision to reject claims 25–44. See Final Act. 1. We have jurisdiction under 35 U.S.C. § 6(b). We reverse. 1 This appeal is related to PTAB 2018-008740, stemming from co-pending application 14/023,559. Appeal Br. 1. 2 We use the word Appellant to refer to “applicant” as defined in 37 C.F.R. § 1.42. Appellant identifies the real party in interest as IBM Corporation. Appeal Br. 1. Appeal 2018-008771 Application 13/623,067 2 CLAIMED SUBJECT MATTER The claims are directed to mining attack vectors for black-box security testing. Claim 25, reproduced below, is illustrative of the claimed subject matter: 25. A computer hardware system configured to update a testing system that performs vulnerability testing on a Web application, comprising: a hardware processor configured to initiate the following executable operations: identifying, for the Web application to be tested, infrastructure data characterizing an infrastructure of the Web application; submitting, to an external data source unaffiliated with the testing system or the Web application and using the identified infrastructure data, a search request that specifies the infrastructure data; receiving, from the external data source, search results derived from the infrastructure and including vulnerability data indicating recently discovered vulnerabilities to Web applications; deriving, from the vulnerability data, a test payload; updating a test sequence configured to test the Web application using the test payload derived from the vulnerability data; and testing the Web Application using the updated test sequence. REJECTIONS3 Claims 25–44 stand provisionally rejected on the ground of nonstatutory obviousness-type double patenting (OTDP) as unpatentable 3 In the Answer, the Examiner withdrew the rejection of claims 25–44 under 35 U.S.C. § 101. Ans. 3. Appeal 2018-008771 Application 13/623,067 3 over claims 25–34 of copending Application No. 14/023,559. Final Act. 6. Claims 25–38, 31, 35–38, and 41 stand rejected under pre-AIA 35 U.S.C. § 103(a) as unpatentable over the combination of Zaninotti (US 7,984,501 B2, issued July 19, 2011) and, Xiong, P. et al., “A Model-Driven Penetration Test Framework for Web Applications,” 2010 Eighth Annual International Conference on Privacy, Security and Trust, Aug. 17–19, 2010 (“Xiong”). Final Act. 9. Claims 23, 30, 32, 33, 39, 40, 42, and 43 stand rejected under 35 U.S.C. § 103(a) as unpatentable over the combination of Zaninotti, Xiong, and Mendelev et al. (US 2013/0160130 A1, published June 20, 2013) (“Mendelev”). Final Act. 14. Claims 34 and 44 stand rejected under 35 U.S.C. § 103(a) as unpatentable over the combination of Zaninotti, Xiong, Mendelev, and Hugard, IV et al. (US 2013/0247206 A1, published Sept. 19, 2013) (“Hugard”). Final Act. 17–18. ANALYSIS Rejection of Claims 25–44 under 35 U.S.C. § 103(a) With respect to independent claim 25, Appellant contends the Examiner erred because the cited portions of Zaninotti and Xiong do not teach or suggest “updating a test sequence configured to test the Web application using the test payload derived from the vulnerability data,” as recited in claim 25. Appeal Br. 18. Appellant argues that, while Zaninotti teaches the creation of a test procedure, Zaninotti is silent regarding the updating of a testing sequence, as claimed. Id. at 19. Appellant further argues that the Examiner’s finding that the databases in Xiong “are kept Appeal 2018-008771 Application 13/623,067 4 updated and maintained” does not establish that a test sequence is updated, as claimed. Reply Br. 7. We are persuaded that the Examiner erred. The Examiner found that Zaninotti does not explicitly teach updating a test sequence configured to test the Web application using the test payload derived from the vulnerability data. Final Act. 12. The Examiner found that Zaninotti teaches using a set of patterns from a database, and a component based vulnerability analysis in which the system determines the type of technology and looks for a database of attacks to be constructed against the web component’s set of URLs. Id. (citing Zaninotti, col. 4:35–60). The Examiner further found that Xiong teaches that such databases are kept updated and maintained. Id. (citing Xiong, p. 174, § II, ¶ 2).Therefore, the Examiner found that the test payloads, which are derived from the vulnerability data, are updated and used to generate new test sequences in order to substantiate the vulnerabilities reported during vulnerability assessment. Id. at 12–13 (citing Xiong, p. 174, § II, ¶ 1). We agree with Appellant that the cited portions of Xiong, in combination with the cited teachings of Zaninotti, do not teach or suggest updating a test sequence using the test payload derived from the vulnerability data, as claim 25 requires. Moreover, the Examiner’s findings with regard to updating test payloads and creating test sequences are not sufficiently supported by Xiong’s teachings of vulnerability assessment in general, and vulnerability databases that are kept updated and maintained. See Final Act. 12–13 (citing Xiong, p. 174, § II, ¶¶ 1, 2). Appeal 2018-008771 Application 13/623,067 5 For these reasons, on the record before us, we are persuaded that the Examiner erred in finding that the combined teachings of Zaninotti and Xiong teach or suggest the disputed limitation of claim 25. Accordingly, we reverse the Examiner’s § 103(a) rejection of independent claim 25, as well as independent claim 35 and dependent claims 26–28, 31, 36–38, and 41. We also reverse the Examiner’s rejections of dependent claims 23, 30, 32–34, 39, 40, and 42–44, as the Examiner did not rely on Mendelev or Hugard to teach or suggest the disputed limitations that are missing from Zaninotti and Xiong. Because we find it dispositive that the Examiner has not shown by a preponderance of evidence that the cited prior art teaches or reasonably suggests the claimed “updating” limitation, we do not address other issues raised by Appellant’s arguments related to these claims. See Beloit Corp. v. Valmet Oy, 742 F.2d 1421, 1423 (Fed. Cir. 1984) (finding an administrative agency is at liberty to reach a decision based on “a single dispositive issue”). Provisional OTDP Rejection of Claims 25–44 When all other rejections on appeal have been reversed, and the only remaining rejections are provisional non-statutory OTDP rejections, it is premature to address the provisional rejections. Ex Parte Moncla, 95 USPQ2d 1884, 1885 (BPAI 2010) (precedential). Here, we reverse the Examiner’s §103(a) rejections of claims 25–44 over the cited prior art, for the reasons discussed above. Therefore, the only remaining rejection on appeal is the provisional non-statutory OTDP rejection of claims 25–44. Thus, we do not reach the provisional OTDP rejection of claims 25–44 to Appeal 2018-008771 Application 13/623,067 6 decide this appeal, following the precedential authority of Moncla, 95 USPQ2d at 1885. DECISION We reverse the decision of the Examiner rejecting claims 25–44. DECISION SUMMARY Claims Rejected 35 U.S.C. § Reference(s)/Basis Affirmed Reversed 25–38, 31, 35–38, 41 103(a) Zaninotti, Xiong 25–38, 31, 35–38, 41 23, 30, 32, 33, 39, 40, 42, 43 103(a) Zaninotti, Xiong, Mendelev 23, 30, 32, 33, 39, 40, 42, 43 34, 44 103(a) Zaninotti, Xiong, Mendelev, Hugard 34, 44 Overall Outcome: 25–44 REVERSED Copy with citationCopy as parenthetical citation