Evgeny Beskrovny et al.

Patent Trials and Appeals Board

Apr 28, 2020

14023559 - (D) (P.T.A.B. Apr. 28, 2020)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
14/023,559 09/11/2013 Evgeny Beskrovny IL920120050US2_8150-0436 1636
73109 7590 04/28/2020
Cuenot, Forsythe & Kim, LLC
20283 State Road 7
Ste. 300
Boca Raton, FL 33498
EXAMINER
ABRISHAMKAR, KAVEH
ART UNIT PAPER NUMBER
3649
NOTIFICATION DATE DELIVERY MODE
04/28/2020 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
ibmptomail@iplawpro.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte EVGENY BESKROVNY and OMER TRIPP
Appeal 2018-0087401
Application 14/023,559
Technology Center 3600
Before THU A. DANG, BETH Z. SHAW, and JOYCE CRAIG,
Administrative Patent Judges.
CRAIG, Administrative Patent Judge.
DECISION ON APPEAL
STATEMENT OF THE CASE
Pursuant to 35 U.S.C. § 134(a), Appellant2 appeals from the
Examiner’s decision to reject claims 25–34. See Final Act. 1. We have
jurisdiction under 35 U.S.C. § 6(b).
We reverse.

1 This appeal is related to PTAB 2018-008771, stemming from co-pending
application 13/623,067. Appeal Br. 1.
2 We use the word Appellant to refer to “applicant” as defined in 37 C.F.R.
§ 1.42. Appellant identifies the real party in interest as IBM Corporation.
Appeal Br. 1.
Appeal 2018-008740
Application 14/023,559

2
CLAIMED SUBJECT MATTER
The claims are directed to mining attack vectors for black-box
security testing. Claim 25, reproduced below, is illustrative of the claimed
subject matter:
25. A computer-implemented method of updating a testing
system that performs vulnerability testing on a Web application,
comprising:
identifying, for the Web application to be tested,
infrastructure data characterizing an infrastructure of the Web
application;
submitting, to an external data source unaffiliated with the
testing system or the Web application and using the identified
infrastructure data, a search request that specifies the
infrastructure data;
receiving, from the external data source, search results
derived from the infrastructure and including vulnerability data
indicating recently discovered vulnerabilities to Web
applications;
deriving, from the vulnerability data, a test payload;
updating a test sequence configured to test the Web
application using the test payload derived from the vulnerability
data; and
testing the Web Application using the updated test
sequence.
REJECTIONS3
Claims 25–35 stand provisionally rejected on the ground of
nonstatutory obviousness-type double patenting (OTDP) as unpatentable
over claims 25–44 of copending Application No. 13/623,067. Final Act. 6.

3 In the Answer, the Examiner withdrew the rejection of claims 25–34 under
35 U.S.C. § 101. Ans. 3.
Appeal 2018-008740
Application 14/023,559

3
Claims 25–28 and 31 stand rejected under pre-AIA 35 U.S.C. § 103(a)
as unpatentable over the combination of Zaninotti (US 7,984,501 B2, issued
July 19, 2011) and Xiong, P. et al., “A Model-Driven Penetration Test
Framework for Web Applications,” 2010 Eighth Annual International
Conference on Privacy, Security and Trust, Aug. 17–19, 2010 (“Xiong”).
Final Act. 8.
Claims 29, 30, 32, and 33 stand rejected under 35 U.S.C. § 103(a) as
unpatentable over the combination of Zaninotti, Xiong, and Mendelev et al.
(US 2013/0160130 A1, published June 20, 2013) (“Mendelev”). Final Act.
13.
Claim 34 stands rejected under 35 U.S.C. § 103(a) as unpatentable
over the combination of Zaninotti, Xiong, Mendelev, and Hugard, IV et al.
(US 2013/0247206 A1, published Sept. 19, 2013) (“Hugard”). Final Act. 16.
ANALYSIS
Rejection of Claims 25–34 under 35 U.S.C. § 103(a)
With respect to independent claim 25, Appellant contends the
Examiner erred because the cited portions of Zaninotti and Xiong do not
teach or suggest “updating a test sequence configured to test the Web
application using the test payload derived from the vulnerability data,” as
recited in claim 25. Appeal Br. 18. Appellant argues that, while Zaninotti
teaches the creation of a test procedure, Zaninotti is silent regarding the
updating of a testing sequence, as claimed. Id. Appellant further argues that
the Examiner’s reliance on the finding that the databases in Xiong “are kept
updated and maintained” does not establish that a test sequence is updated,
as claimed. Reply Br. 7.
Appeal 2018-008740
Application 14/023,559

4
We are persuaded that the Examiner erred. The Examiner found that
Zaninotti does not explicitly disclose updating a test sequence configured to
test the Web application using the test payload derived from the
vulnerability data. Final Act. 11. The Examiner found that Zaninotti teaches
using a set of patterns from a database, and a component based vulnerability
analysis in which the system determines the type of technology and looks for
a database of attacks to be constructed against the web component’s set of
URLs. Id. (citing Zaninotti, col. 4:35–60). The Examiner further found that
Xiong teaches that such databases are kept updated and maintained. Id.
(citing Xiong, p. 174, § II, ¶ 2). Therefore, the Examiner found that the test
payloads, which are derived from the vulnerability data, are updated and
used to generate new test sequences in order to substantiate the
vulnerabilities reported during vulnerability assessment. Id. at 11–12 (citing
Xiong, p. 174, § II, ¶ 1).
We agree with Appellant that the cited portions of Xiong, in
combination with the cited teachings of Zaninotti, do not teach or suggest
updating a test sequence using the test payload derived from the
vulnerability data, as claim 25 requires. Moreover, the Examiner’s findings
with regard to updating test payloads and creating test sequences are not
sufficiently supported by Xiong’s teachings of vulnerability assessment in
general, and vulnerability databases that are kept updated and maintained.
See Final Act. 11 (citing Xiong, p. 174, § II, ¶¶ 1, 2).
For these reasons, on the record before us, we are persuaded that the
Examiner erred in finding that the combined teachings of Zaninotti and
Xiong teach or suggest the disputed limitation of claim 25.
Appeal 2018-008740
Application 14/023,559

5
Accordingly, we reverse the Examiner’s § 103(a) rejection of
independent claim 25, as well as dependent claims 26–28 and 31, which
depend from and stand rejected with claim 25. We also reverse the
Examiner’s rejections of dependent claims 29, 30, and 32–34, as the
Examiner did not rely on Mendelev or Hugard to teach or suggest the
disputed limitations that are missing from Zaninotti and Xiong.
Because we find it dispositive that the Examiner has not shown by a
preponderance of evidence that the cited prior art teaches or reasonably
suggests the claimed “updating” limitation, we do not address other issues
raised by Appellant’s arguments related to these claims. See Beloit Corp. v.
Valmet Oy, 742 F.2d 1421, 1423 (Fed. Cir. 1984) (finding an administrative
agency is at liberty to reach a decision based on “a single dispositive issue”).

Provisional OTDP Rejection of Claims 25–34
When all other rejections on appeal have been reversed, and the only
remaining rejections are provisional non-statutory OTDP rejections, it is
premature to address the provisional rejections. Ex Parte Moncla, 95
USPQ2d 1884, 1885 (BPAI 2010) (precedential). Here, we reverse the
Examiner’s §103(a) rejections of claims 25–34 over the cited prior art, for
the reasons discussed above. Therefore, the only remaining rejection on
appeal is the provisional non-statutory OTDP rejection of claims 25–34.
Thus, we do not reach the provisional OTDP rejection of claims 25–34 to
decide this appeal, following the precedential authority of Moncla, 95
USPQ2d at 1885.
DECISION
We reverse the decision of the Examiner rejecting claims 25–34.
Appeal 2018-008740
Application 14/023,559

6
DECISION SUMMARY
Claims
Rejected
35 U.S.C. § Reference(s)/Basis Affirmed Reversed
25–28, 31 103(a) Zaninotti, Xiong 25–28, 31
29, 30, 32,
33
103(a) Zaninotti, Xiong,
Mendelev
29, 30,
32, 33
34 103(a) Zaninotti, Xiong,
Mendelev, Hugard
34
Overall
Outcome
25–34

REVERSED