Ex Parte Reams

Patent Trial and Appeal Board

Feb 27, 2014

11294979 (P.T.A.B. Feb. 27, 2014)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
11/294,979 12/06/2005 Orin Paul Reams III 3645/SPRI.126001 9446
32423 7590 02/27/2014
SPRINT COMMUNICATIONS COMPANY L.P.
6391 SPRINT PARKWAY
KSOPHT0101-Z2100
OVERLAND PARK, KS 66251-2100
EXAMINER
DADA, BEEMNET W
ART UNIT PAPER NUMBER
2435
MAIL DATE DELIVERY MODE
02/27/2014 PAPER
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
PTOL-90A (Rev. 04/07)

UNITED STATES PATENT AND TRADEMARK OFFICE
_____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
_____________

Ex parte ORIN PAUL REAMS III
_____________

Appeal 2011-007401
Application 11/294,979
Technology Center 2400
______________

Before JEFFREY S. SMITH, JOHNNY A. KUMAR, and
DANIEL N. FISHMAN, Administrative Patent Judges.

Per Curiam

DECISION ON APPEAL
Appeal 2011-007401
Application 11/294,979

2

STATEMENT OF CASE
This is a decision on appeal under 35 U.S.C. § 134(a) from the
Examiner’s Final Rejection of claims 1 through 17. We have jurisdiction
under 35 U.S.C. § 6(b).
We affirm.
INVENTION
Appellant’s invention involves a network-based DDoS detection
service. Data is sampled from various customer networks and delivered to a
collector. The collector filters the data for those customers that implement
or subscribe to the detection service. The filtered data is delivered to an
analyzer to determine if the filtered data contains DDoS packets. See
Abstract.
Claim 1 is representative of the invention and reproduced below, with
bracketed matter added:
1. A computer system having a processor and a memory,
the computer system operable to execute a method for
providing a scalable detection for a distributed denial of service
(DDoS) attack, the method comprising:
[1] sampling a set of packets, in one or more routers,
destined for one or more entities connected to a packet network
wherein the sampled set of packets is delivered to one or more
regional collectors wherein the one or more regional collectors
compare destination IP addresses to a defined list of IP subnets
for one or more customers;
[2] filtering the sampled set of packets wherein the
filtered sampled set of packets is associated with the one or
more customers wherein the one or more regional collectors
filter unwanted IP subnets and allow IP packets associated with
a targeted customer to pass through to one or more analyzers;
Appeal 2011-007401
Application 11/294,979

3

[3] providing the filtered sampled set of packets from the
one or more regional collectors to the one or more analyzers;
[4] determining at the one or more analyzers if one or
more members of the filtered sampled set of packets are one or
more DDoS packets wherein the one or more analyzers
compare IP packets to a statistical heuristic engine to determine
if IP traffic is abnormal; and
[5] performing at least one of a notification or a
mitigation if the one or more members of the filtered sampled
set of packets are one or more DDoS packets.

REJECTION AT ISSUE1
The Examiner rejected claims 1-17 under 35 U.S.C. § 103(a) as being
unpatentable over Malan (US 6,944,673 B2, Sept. 13, 2005) and Rawlins
(US 2002/0194369 A1, Dec. 19, 2002). Ans. 3-6.

ISSUE
Appellant has presented several arguments as to why the combination
of the references does not teach or suggest the features recited in
independent claims 1, 10, and 17.2
These contentions present us with the issue: did the Examiner err in
finding that the combination of Malan and Rawlins teaches or suggests the
features recited in limitations [1] to [4] of representative claim 1, supra, and
similarly recited in independent claims 10 and 17?

1 Throughout this opinion we refer to the Examiner’s Answer mailed on
January 25, 2011.
2 Throughout this opinion we refer to the Appeal Brief dated October 11,
2010, and Reply Brief dated March 25, 2011.
Appeal 2011-007401
Application 11/294,979

4

ANALYSIS
We have reviewed the Examiner’s rejections in light of Appellant’s
contentions that the Examiner has erred. The Examiner cited Malan for all
the claim limitations except for limitation [3], and Rawlins for the element
missing in Malan. Ans. 3, 4.
Further, we have reviewed the Examiner’s response to Appellant’s
arguments. The Examiner has provided a comprehensive response to each
argument presented by the Appellant on pages 6 through 15 of the Answer.
We have reviewed this response and concur with the Examiner’s findings
and conclusions. We adopt as our own (1) the findings and reasons set forth
by the Examiner in the action from which this appeal is taken and (2) the
reasons set forth by the Examiner in the Examiner’s Answer in response to
Appellant’s Appeal Brief. Ans. 3-15. We have considered Appellant’s
Reply Brief but find it unpersuasive to rebut the Examiner’s responses.

DECISION
The decision of the Examiner to reject claims 1 through 17 is
affirmed.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(1)(iv).

AFFIRMED

msc