Evgeny Beskrovny et al.

Patent Trials and Appeals Board

Apr 28, 2020

13623067 - (D) (P.T.A.B. Apr. 28, 2020)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
13/623,067 09/19/2012 EVGENY BESKROVNY IL920120050US1_8150-0259 9307
73109 7590 04/28/2020
Cuenot, Forsythe & Kim, LLC
20283 State Road 7
Ste. 300
Boca Raton, FL 33498
EXAMINER
ABRISHAMKAR, KAVEH
ART UNIT PAPER NUMBER
3649
NOTIFICATION DATE DELIVERY MODE
04/28/2020 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
ibmptomail@iplawpro.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte EVGENY BESKROVNY and OMER TRIPP
Appeal 2018-0087711
Application 13/623,067
Technology Center 3600
Before THU A. DANG, BETH Z. SHAW, and JOYCE CRAIG,
Administrative Patent Judges.
CRAIG, Administrative Patent Judge.
DECISION ON APPEAL
STATEMENT OF THE CASE
Pursuant to 35 U.S.C. § 134(a), Appellant2 appeals from the
Examiner’s decision to reject claims 25–44. See Final Act. 1. We have
jurisdiction under 35 U.S.C. § 6(b).
We reverse.

1 This appeal is related to PTAB 2018-008740, stemming from co-pending
application 14/023,559. Appeal Br. 1.
2 We use the word Appellant to refer to “applicant” as defined in 37 C.F.R.
§ 1.42. Appellant identifies the real party in interest as IBM Corporation.
Appeal Br. 1.
Appeal 2018-008771
Application 13/623,067

2
CLAIMED SUBJECT MATTER
The claims are directed to mining attack vectors for black-box
security testing. Claim 25, reproduced below, is illustrative of the claimed
subject matter:
25. A computer hardware system configured to update a testing
system that performs vulnerability testing on a Web application,
comprising:
a hardware processor configured to initiate the following
executable operations:
identifying, for the Web application to be tested,
infrastructure data characterizing an infrastructure of the Web
application;
submitting, to an external data source unaffiliated with the
testing system or the Web application and using the identified
infrastructure data, a search request that specifies the
infrastructure data;
receiving, from the external data source, search results
derived from the infrastructure and including vulnerability data
indicating recently discovered vulnerabilities to Web
applications;
deriving, from the vulnerability data, a test payload;
updating a test sequence configured to test the Web
application using the test payload derived from the vulnerability
data; and
testing the Web Application using the updated test
sequence.
REJECTIONS3
Claims 25–44 stand provisionally rejected on the ground of
nonstatutory obviousness-type double patenting (OTDP) as unpatentable

3 In the Answer, the Examiner withdrew the rejection of claims 25–44 under
35 U.S.C. § 101. Ans. 3.
Appeal 2018-008771
Application 13/623,067

3
over claims 25–34 of copending Application No. 14/023,559. Final Act. 6.
Claims 25–38, 31, 35–38, and 41 stand rejected under pre-AIA
35 U.S.C. § 103(a) as unpatentable over the combination of Zaninotti (US
7,984,501 B2, issued July 19, 2011) and, Xiong, P. et al., “A Model-Driven
Penetration Test Framework for Web Applications,” 2010 Eighth Annual
International Conference on Privacy, Security and Trust, Aug. 17–19, 2010
(“Xiong”). Final Act. 9.
Claims 23, 30, 32, 33, 39, 40, 42, and 43 stand rejected under
35 U.S.C. § 103(a) as unpatentable over the combination of Zaninotti,
Xiong, and Mendelev et al. (US 2013/0160130 A1, published June 20, 2013)
(“Mendelev”). Final Act. 14.
Claims 34 and 44 stand rejected under 35 U.S.C. § 103(a) as
unpatentable over the combination of Zaninotti, Xiong, Mendelev, and
Hugard, IV et al. (US 2013/0247206 A1, published Sept. 19, 2013)
(“Hugard”). Final Act. 17–18.
ANALYSIS
Rejection of Claims 25–44 under 35 U.S.C. § 103(a)
With respect to independent claim 25, Appellant contends the
Examiner erred because the cited portions of Zaninotti and Xiong do not
teach or suggest “updating a test sequence configured to test the Web
application using the test payload derived from the vulnerability data,” as
recited in claim 25. Appeal Br. 18. Appellant argues that, while Zaninotti
teaches the creation of a test procedure, Zaninotti is silent regarding the
updating of a testing sequence, as claimed. Id. at 19. Appellant further
argues that the Examiner’s finding that the databases in Xiong “are kept
Appeal 2018-008771
Application 13/623,067

4
updated and maintained” does not establish that a test sequence is updated,
as claimed. Reply Br. 7.
We are persuaded that the Examiner erred. The Examiner found that
Zaninotti does not explicitly teach updating a test sequence configured to
test the Web application using the test payload derived from the
vulnerability data. Final Act. 12. The Examiner found that Zaninotti teaches
using a set of patterns from a database, and a component based vulnerability
analysis in which the system determines the type of technology and looks for
a database of attacks to be constructed against the web component’s set of
URLs. Id. (citing Zaninotti, col. 4:35–60). The Examiner further found that
Xiong teaches that such databases are kept updated and maintained. Id.
(citing Xiong, p. 174, § II, ¶ 2).Therefore, the Examiner found that the test
payloads, which are derived from the vulnerability data, are updated and
used to generate new test sequences in order to substantiate the
vulnerabilities reported during vulnerability assessment. Id. at 12–13 (citing
Xiong, p. 174, § II, ¶ 1).
We agree with Appellant that the cited portions of Xiong, in
combination with the cited teachings of Zaninotti, do not teach or suggest
updating a test sequence using the test payload derived from the
vulnerability data, as claim 25 requires. Moreover, the Examiner’s findings
with regard to updating test payloads and creating test sequences are not
sufficiently supported by Xiong’s teachings of vulnerability assessment in
general, and vulnerability databases that are kept updated and maintained.
See Final Act. 12–13 (citing Xiong, p. 174, § II, ¶¶ 1, 2).
Appeal 2018-008771
Application 13/623,067

5
For these reasons, on the record before us, we are persuaded that the
Examiner erred in finding that the combined teachings of Zaninotti and
Xiong teach or suggest the disputed limitation of claim 25.
Accordingly, we reverse the Examiner’s § 103(a) rejection of
independent claim 25, as well as independent claim 35 and dependent claims
26–28, 31, 36–38, and 41. We also reverse the Examiner’s rejections of
dependent claims 23, 30, 32–34, 39, 40, and 42–44, as the Examiner did not
rely on Mendelev or Hugard to teach or suggest the disputed limitations that
are missing from Zaninotti and Xiong.
Because we find it dispositive that the Examiner has not shown by a
preponderance of evidence that the cited prior art teaches or reasonably
suggests the claimed “updating” limitation, we do not address other issues
raised by Appellant’s arguments related to these claims. See Beloit Corp. v.
Valmet Oy, 742 F.2d 1421, 1423 (Fed. Cir. 1984) (finding an administrative
agency is at liberty to reach a decision based on “a single dispositive issue”).

Provisional OTDP Rejection of Claims 25–44
When all other rejections on appeal have been reversed, and the only
remaining rejections are provisional non-statutory OTDP rejections, it is
premature to address the provisional rejections. Ex Parte Moncla,
95 USPQ2d 1884, 1885 (BPAI 2010) (precedential). Here, we reverse the
Examiner’s §103(a) rejections of claims 25–44 over the cited prior art, for
the reasons discussed above. Therefore, the only remaining rejection on
appeal is the provisional non-statutory OTDP rejection of claims 25–44.
Thus, we do not reach the provisional OTDP rejection of claims 25–44 to
Appeal 2018-008771
Application 13/623,067

6
decide this appeal, following the precedential authority of Moncla,
95 USPQ2d at 1885.
DECISION
We reverse the decision of the Examiner rejecting claims 25–44.
DECISION SUMMARY
Claims
Rejected
35 U.S.C. § Reference(s)/Basis  Affirmed Reversed
25–38, 31,
35–38, 41
103(a) Zaninotti, Xiong 25–38, 31,
35–38, 41
23, 30, 32,
33, 39, 40,
42, 43
103(a) Zaninotti, Xiong,
Mendelev
23, 30, 32,
33, 39, 40,
42, 43
34, 44 103(a) Zaninotti, Xiong,
Mendelev, Hugard
34, 44
Overall
Outcome:
  25–44

REVERSED