Brandon S. Dixon et al.

Patent Trials and Appeals Board

Sep 30, 2019

15293963 - (D) (P.T.A.B. Sep. 30, 2019)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
15/293,963 10/14/2016 Brandon S. DIXON SIGN0044USC1 3527
138770 7590 09/30/2019
Artegis Law Group, LLP-VERISIGN, INC.
7710 Cherry Park Drive Suite T #104
Houston, TX 77095
EXAMINER
CHAI, LONGBIT
ART UNIT PAPER NUMBER
2431
NOTIFICATION DATE DELIVERY MODE
09/30/2019 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
algdocketing@artegislaw.com
jmatthews@artegislaw.com
kcruz@artegislaw.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
____________________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________________

Ex parte BRANDON S. DIXON and
GREGORY S. SINCLAIR
____________________

Appeal 2018-008587
Application 15/293,963
Technology Center 2400
____________________

Before DANIEL N. FISHMAN, ADAM J. PYONIN, and
DAVID J. CUTITTA II, Administrative Patent Judges.

PYONIN, Administrative Patent Judge.

DECISION ON APPEAL
Pursuant to 35 U.S.C. § 134(a), Appellant1 appeals from the
Examiner’s rejection. We have jurisdiction under 35 U.S.C. § 6(b).
We affirm.

1 We use the word “Appellant” to refer to “applicant” as defined in
37 C.F.R. § 1.42. Appellant identifies the real party in interest as
VERISIGN, INC. Appeal Brief 2.
Appeal 2018-008587
Application 15/293,963

2
STATEMENT OF THE CASE
Introduction
The Application is directed to “malware defense, and more
particularly, to creating and using an incubator environment to host and
study malware and malware operators.” Spec. ¶ 2. Claims 1–20 are
pending; claims 1, 13, and 17 are independent. App. Br. 21–25; Final
Act. 10. Claim 1 is reproduced below for reference (emphasis added):
1. A system for tracking malware operator behavior patterns
in a simulated network environment, the system comprising:
a memory storing instructions; and
a processor device that is coupled to the memory and,
when executing the instructions, is configured to:
receive organizational data that describes a virtual
organization and comprises a plurality of simulated users that
are logged into a plurality of simulated machines;
create user profiles for the plurality of simulated users;
provide a simulated computer network of the virtual
organization based at least partially on the organizational data
and the user profiles, wherein after the simulated computer
network is provided, malware is installed on the simulated
computer network to create an incubator;
monitor one or more interactions between the simulated
computer network and an operator of the malware, wherein the
one or more interactions comprise the operator of the malware
illicitly gathering information related to the user profiles; and
build a malware operator profile based on the one or
more interactions.

Appeal 2018-008587
Application 15/293,963

3
References and Rejections2
Claims 1–20 stand rejected under the judicially created doctrine of
obviousness-type double patenting as being unpatentable over claim 1–20 of
U.S. Patent No. 9,473,520 B2. Final Act. 5.3
Claims 1–17, 19, and 20 stand rejected under 35 U.S.C. § 103 as
being unpatentable over Arnold (US 5,440,723; Aug. 8, 1995) and
Chiruvolu (US 8,327,420 B2; Dec. 4, 2012). Final Act. 6.

ANALYSIS
Appellant argues “the combination of the cited references cannot
teach or suggest each and every limitation of claim 1.” App. Br. 15.
Particularly, Appellant contends “the directories, data, and files disclosed in
Arnold are associated with a single decoy program executing on a single
computing system of a single user,” so that “Arnold is completely silent
about multiple simulated users that are logged into multiple simulated
machines, much less that such simulated users and simulated machines are
part of a virtual organization.” Id. at 11, 13.
We are persuaded by Appellant’s argument. The Examiner finds that
Arnold teaches a “plurality of simulated users are logged into the infected
computer(s) as the simulator(s)).” Final Act. 6 (citing Arnold 26:34–35); see
also Ans. 11. The cited portions of Arnold, however, only disclose running
a simulator program; there is no mention of any users, let alone simulated
users as required by the claim. See, e.g., Arnold 26:32–36 (“[E]ach virus

2 The Examiner has withdrawn the rejection of the claims as being patent
ineligible under 35 U.S.C. § 101. See Ans. 3.
3 Appellant does not challenge the Examiner’s double patenting rejection.
See App. Br. 9. Accordingly, we summarily affirm this rejection.
Appeal 2018-008587
Application 15/293,963

4
sample is executed on a simulator of the operating system calls. This
simulator can be executed by the infected computer, or can be executed by
the dedicated processor.”). That is, without speculation, we see no support
for the Examiner’s determination that Arnold teaches the claimed “plurality
of simulated users that are logged into a plurality of simulated machines.”
See App. Br. 11; see also In re Warner, 379 F.2d 1011, 1017 (CCPA 1967)
(“A rejection based on section 103 clearly must rest on a factual basis.”).
Based on the foregoing, we agree with Appellant that Arnold does not
teach or suggest all limitations of claim 1. We additionally agree that
Chiruvolu—directed to methods of user authentication by presenting both
actual and decoy data to a user—also does not teach or suggest a plurality of
simulated users. See App. Br. 15; Chiruvolu 2:23–24 (“Fig. 3a illustrates a
display screen having authentication data sets and decoy data sets.”).
Accordingly, we are persuaded the Examiner errs in finding the limitations
of independent claim 1 to be taught or suggested by the cited references.

CONCLUSION
We summarily sustain the Examiner’s rejection of claims 1–20 under
the judicially created doctrine of obviousness-type double patenting.
We are persuaded the Examiner errs in finding the limitations of
independent claim 1 to be obvious in view of the cited references.
Independent claims 13 and 17 recite similar limitations. See App. Br. 23–
24. Thus, we do not sustain the Examiner’s obviousness rejection of
independent claims 1, 13, 17, or the claims that depend thereon.

Appeal 2018-008587
Application 15/293,963

5
DECISION
The Examiner’s decision rejecting claims 1–20 under the judicially
created doctrine of obviousness-type double patenting is affirmed.
The Examiner’s decision rejecting claims 1–17, 19, and 20 under
35 U.S.C. § 103 is reversed.
The Examiner’s decision is affirmed because we have affirmed at
least one ground of rejection with respect to each claim on appeal.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a). See 37 C.F.R. §
41.50(a)(1).
AFFIRMED