Ex Parte Amit et alDownload PDFPatent Trial and Appeal BoardMar 22, 201613431808 (P.T.A.B. Mar. 22, 2016) Copy Citation UNITED STA TES p A TENT AND TRADEMARK OFFICE APPLICATION NO. FILING DATE FIRST NAMED INVENTOR 13/431,808 03/27/2012 Yair Amit 67046 7590 03/24/2016 HOLLAND & KNIGHT 10 ST. JAMES A VENUE BOSTON, MA 02116-3889 UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www .uspto.gov ATTORNEY DOCKET NO. CONFIRMATION NO. IL9201l0082US2/00273 7913 EXAMINER TRAN, TONGOC ART UNIT PAPER NUMBER 2434 NOTIFICATION DATE DELIVERY MODE 03/24/2016 ELECTRONIC Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the following e-mail address( es): patentdocketing@hklaw.com toni. sousa@hklaw.com PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD Ex parte Y AIR AMIT, LOTEM GUY, DANIEL KALMAN, ORI SEGAL, and OMRI WEISMAN Appeal2014-005670 Application 13/431,808 Technology Center 2400 Before LINZY T. McCARTNEY, MELISSA A. HAAPALA, and KAMRAN JIVANI, Administrative Patent Judges. JIV ANI, Administrative Patent Judge. DECISION ON APPEAL Appellants 1 seeks our review under 35 U.S.C. § 134(a) of the Examiner's final rejections of claims 1-7, which are the claims pending in the present patent application.2 We have jurisdiction under 35 U.S.C. § 6(b). We AFFIRM. 1 Appellants identify International Business Machines Corporation as the real party in interest. Br. 3. 2 Claims 8-21 are canceled. Br. 10. Appeal2014-005670 Application 13/431,808 STATEMENT OF THE CASE The present application relates to statically and dynamically analyzing source code of a plurality of web pages to identify vulnerabilities. Spec. i-f 3. Claim 1 is illustrative (disputed limitation emphasized): 1. A computer implemented method compnsmg: statically analyzing, on a computing device, source code of a plurality of web pages including script code; identifying, on the computing device, a web page including a potential vulnerability based on the static analysis; identifying, on the computing device, a web page not including a potential vulnerability based on the static analysis; dynamically analyzing, on the computing device, the web page including the potential vulnerability using a set of test payloads; and dynamically analyzing, on the computing device, the web page not including the potential vulnerability using a subset of the set of test payloads, the subset including fewer test payloads than the set of test payloads. The Rejections Claims 1-7 stand rejected under 35 U.S.C. § 103(a) over Huang (U.S. 2007/0074188 Al; published Mar. 29, 2007). Final Act. 5-8. Claims 1-7 stand provisionally rejected for obviousness-type double patenting over claims 8-21 of co-pending application 13/341,428 currently before this Board as Appeal No. 2014-005519. Final Act. 3--4. 2 Appeal2014-005670 Application 13/431,808 ANALYSIS We have considered Appellants' arguments in the Brief, the Examiner's Answer thereto, and the evidence of record. We are not persuaded by Appellants' arguments. Rather, we agree with and adopt as our own the Examiner's findings and reasons as set forth in the Final Action and Answer to the extent indicated below. 3 We further emphasize the following. Obviousness The Examiner finds the disputed limitation of independent claim 1 to be obvious as follows: Final Act. 6. Huang does not explicitly describe analyzing webpage not including the potential vulnerability using a subset of the set of test payloads, the subset including fewer test payloads than the set of test payloads. However, it would have been obvious to one of ordinary skill in the art at the time the invention was made to engage fewer test payloads in analyzing software program that is not vulnerable to reduce overhead. Appellants contend the Examiner errs because: it would not have been obvious to engage fewer test payloads in analyzing a software program that is not 3 We note that pages 2-8 of the Examiner's Answer incorrectly list the grounds of rejection for the currently pending claims in this application. The rejections set forth on these pages appear to be for co-pending application 13/341,428 (Appeal No. 2014-005519). Appellants do not raise any concerns with the error. For purposes of this appeal, we only consider the rejections as presented in the Final Office Action and disregard the incorrect rejections set forth in the Answer. 3 Appeal2014-005670 Application 13/431,808 App. Br. 5. vulnerable to reduce overhead for two reasons: (1) Huang is focused on enhancing static analysis by implementing a "lattice model"; (2) analyzing the "not potentially vulnerable web pages" would increase overhead during runtime analysis, however a significant goal of Huang is understood to be preventing increased overhead. We are not persuaded by Appellants' arguments. Appellants' argument (1) regarding Huang's "focus[] on enhancing static analysis by implementing a 'lattice model"' (App. Br. 5) is not responsive to the Examiner's findings. The Examiner finds, and we agree, Huang teaches or suggests the claimed dynamic analysis by teaching a combination of verification techniques (i.e., static analysis) and runtime instrumentation (i.e., dynamic analysis). Final Act 6 (citing Huang, i-fi-130, 31, and 34); Ans. 14--15 (citing Huang, i1 31 ). That "Huang appears to be focused on enhancing its static analysis in order to minimize unnecessary overhead" (App. Br. 5) does not rebut the teachings of runtime instrumentation (i.e., dynamic analysis) relied upon by the Examiner. We also find unpersuasive Appellants' argument (2) that the Examiner's finding dynamically analyzing web pages not including the potential vulnerability using a subset of the test payloads is contrary to Huang's purported goal. Huang seeks to "to provide methods and systems which enable vulnerabilities in Web applications to be identified while at the same time providing immediate security for those Web applications, and overcoming ... other limitations," which include (a) improving false positive rates and (b) limiting overhead with testing on vulnerable software applications. Huang, i-fi-f 14; 31. Thus Huang articulates dual goals. The 4 Appeal2014-005670 Application 13/431,808 Examiner finds Huang's goal (a) of improving false positive rates is furthered by the proposed modification because "by expanding test payload to web page[s] that are not vulnerable, [the process] will collect more runtime state information and have high detection accuracy." Ans. 16. Further, the Examiner finds, an increase in overhead contrary to goal (b) would be offset by "implement[ing] fewer test payload [, which] would improve security and reduce runtime overhead." Ans. 16. Appellants do not rebut these findings addressing goal (a). Accordingly, based on the record before us, we affirm the Examiner's 35 U.S.C. § 103(a) rejection of claim 1. Appellants argue claims 2-7 together. Consequently, we affirm the Examiner's 35 U.S.C. § 103(a) rejection of claims 2-7 for the same reasons stated above. Obviousness-type Double Patenting Appellants do not address the Examiner's provisional non-statutory obviousness-type double patenting rejection over claims 8-21 of the '428 Application. As of the date of our Decision, the '426 Application remains pending. Accordingly, we decline to reach this rejection in light of the continued prosecution of the '426 Application. See Ex parte Moncla, 95 USPQ2d 1884 (BPAI 2010) (precedential) (noting panels have flexibility when determining whether to reach provisional double-patenting rejections). DECISION We affirm the Examiner's decision rejecting claims 1-7 under 35 U.S.C. § 103(a). 5 Appeal2014-005670 Application 13/431,808 We decline to reach the Examiner's decision rejecting provisionally claims 1-7 for nonstatutory obviousness-type double patenting. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a)(l )(iv). AFFIRMED 6 Copy with citationCopy as parenthetical citation