DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
The following is a final office action in response to applicant’s amendment filed on 07/28/2025 for response of the office action mailed on 02/28/2025. Claims 1, 6, 8-11 have been amended. Claims 1-11 are pending in this application.
Response to Arguments
Applicant's arguments filed 07/30/2025 have been fully considered but they are not persuasive.
Main Argument:
However, Di Pietro and Chandrasekaran fail to teach or disclose the limitations as recited in claim 1. Namely, the references are completely silent with respect to the different connection phases. The claim and specification detail the connection phases as including association phase, the authentication phase and the DHCP phase. However, the mere appearance of terms does not amount to disclosure of functionality.
Response, Examiner has considered the applicant’s arguments and respectfully disagrees.
For further context, ¶0032 in Di Pietro states network assurance process 248 may use any number of predefined health status rules, to enforce policies and to monitor the health of the network, in view of the observed conditions of the network. Cited ¶0033 includes examples of health status rules such as client transition events in a wireless network, where the network assurance service may then group 150 failures into different “buckets” (e.g., Association, Authentication, Mobility, DHCP, WebAuth, Configuration, Infra, Delete, De-Authorization) and continue to increment these counters per service set identifier (SSID)… Therefore, Association, Authentication and DHCP are different states of the connection process that are monitored. For further context, cited earlier in Claim 1, ¶0100-¶0105 describe an issue characterization engine 410, which is used to describe the raised network issue. Examples include ¶0102 -Issue type (e.g., onboarding time, success rate of joining the network, application performance issues, etc.) and 0103 - Relevant KPIs such as onboarding times, DHCP/AAA times, etc. Thus, the issue characterization engine is designed to capture and use metrics such as onboarding times and DHCP/AAA times. Association, Authentication and DHCP are inherently covered under onboarding times, with the invention explicitly mentioning DHCP/AAA times. Therefore the invention suggests the system is tracking or at least capable of tracking the timing/intervals between packets or events in those phases as part of characterizing issues. Specifically, for the Association phase, ¶0102 mentions onboarding time and success rate of joining the network, where the onboarding time can include the association phase, and the success rate of joining the network covers whether association failed or succeeded. In ¶0103, authentication and DHCP are explicitly mentioned. In Fig. 5, (¶0134 for added context), such an issue may correspond to an anomalous amount of onboarding failures, onboarding times, delays, jitter, packet drops, client counts, or any other KPI regarding the network.
Applicant is reminded that obviousness may be established by combining or modifying the teachings of the prior art to produce the claimed invention where there is some teaching, suggestion, or motivation to do so found either in the references themselves or in the knowledge generally available to one of ordinary skill in the art. See in re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988), In re Jones, F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992), and KSR international Co. v. Teleflex, Inc., 550 U.S. 398, 82 USPQ2d 1385 (2007).
Claim Objections
Claims 1-11 are objected to because of the following informalities:
Claim 1: The phrase “including the association phase, the authentication phase and the DHCP phase of a connection” in Lines 12-14 include phases that all lack proper antecedent basis. Examiner advises applicant to either introduce all three phases before Lines 12-14 or change “including the association phase, the authentication phase and the DHCP phase of a connection” to “including an association phase, an authentication phase and a DHCP phase of the connection” for proper antecedent basis. Appropriate correction or clarification is required.
Also, the phrase “the tracked time differences” lacks proper antecedent basis. If “tracked time differences” refers back to “tracking a time interval between samples of the collected data packets”, Examiner advises applicant to keep claim elements consistent throughout the claim to avoid confusion and ambiguity. Examiner advises applicant to remove “the” in front of “the tracked time differences” if introducing a new claim element. Appropriate correction or clarification is required.
Next, clarification is needed on whether “the time difference” in Lines 22-23 refers back to “the tracked time differences” in Line 19-20. If so, it is advised to change “the time difference” to “the tracked time differences” for proper antecedent basis. Appropriate correction or clarification is required.
Claims 2-9: All dependent claims that depend on an independent/dependent claim that has been objected to are also objected to.
Claim 10: The phrase “The association phase, the authentication phase and the DHCP phase of a connection” in Lines 14-15 include phases that all lack proper antecedent basis. Examiner advises applicant to either introduce all three phases before Lines 14-15 or change “the association phase, the authentication phase and the DHCP phase of a connection” to “an association phase, an authentication phase and a DHCP phase of the connection” for proper antecedent basis. Appropriate correction or clarification is required.
Also, the phrase “the tracked time differences” lacks proper antecedent basis. If “tracked time differences” refers back to “tracking a time interval between samples of the collected data packets”, Examiner advises applicant to keep claim elements consistent throughout the claim to avoid confusion and ambiguity. Examiner advises applicant to remove “the” in front of “the tracked time differences” if introducing a new claim element. Appropriate correction or clarification is required.
Next, clarification is needed on whether “the time difference” in Lines 24-25 refers back to “the tracked time differences” in Line 21-22. If so, it is advised to change “the time difference” to “the tracked time differences” for proper antecedent basis. Appropriate correction or clarification is required.
Claim 11: The phrase “the hybrid wireless network” in Line 8 lacks proper antecedent basis. Examiner advises applicant to either introduce a hybrid wireless network before Line 8 or change “the hybrid wireless network” to “a hybrid wireless network” for proper antecedent basis. Appropriate correction or clarification is required.
The phrase “The association phase, the authentication phase and the DHCP phase of connecting” in Lines 20-21 include phases that all lack proper antecedent basis. Examiner advises applicant to either introduce all three phases before Lines 20-21 or change “The association phase, the authentication phase and the DHCP phase of connecting” to “an association phase, an authentication phase and a DHCP phase of connecting” for proper antecedent basis. Appropriate correction or clarification is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-11 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1: Examiner advises applicant to clarify whether “different phases” in Lines 4-5 refers back to “each connection phase” in Lines 2-3. If so, it is suggested to change “different phases” in Lines 4-5 to “each of the connection phases” for proper antecedent basis. Appropriate correction or clarification is required.
Examiner advises applicant to clarify whether “dynamic thresholds” in Line 21 are the same “thresholds” that appear in Line 2. If not, it is suggested to introduce dynamic thresholds prior to Line 21. If yes, then it is suggested to change “thresholds” to “dynamic thresholds” in Line 2 for consistency. Appropriate correction or clarification is required.
Claims 2-9: All dependent claims that depend on an independent claim that has been
rejected under 35 U.S.C. 112(b) are also rejected under 35 U.S.C. 112(b).
Claim 10: Examiner advises applicant to clarify whether “different phases” in Line 6 refers back to “each connection phase” in Line 4. If so, it is suggested to change “different phases” in Line 6 to “each of the connection phases” for proper antecedent basis. Appropriate correction or clarification is required.
Examiner advises applicant to clarify whether “network issues” in Line 27 refers back to “issues” in Line 5. If so, it is suggested to either (1) change “network issues” in Line 27 to “the issues” or (2) change “issues” in Line 5 to “network issues” and change “network issues” in Line 27 to “the network issues” for proper antecedent basis. Appropriate correction or clarification is required.
Claim 11: Examiner advises applicant to clarify whether “different phases” in Line 6 refers back to “each connection phase” in Line 4. If so, it is suggested to change “different phases” in Line 6 to “each of the connection phases” for proper antecedent basis. Appropriate correction or clarification is required.
Examiner advises applicant to clarify whether “network issues” in Line 35 refers back to “issues” in Line 3. If so, it is suggested to either (1) change “network issues” in Line 35 to “the issues” or (2) change “issues” in Line 3 to “network issues” and change “network issues” in Line 35 to “the network issues” for proper antecedent basis. Appropriate correction or clarification is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or non-obviousness.
Claims 1, 4, and 9-11 are rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro et al. (US 20210281492), Di Pietro hereinafter, and further in view of Chandrasekaran et al. (US 20210385143), Chandrasekaran hereinafter.
Re. Claim 1,
Di Pietro teaches a computer-implemented method in a network management device, for using unsupervised machine learning to derive thresholds for each connection phase, unique for an enterprise network (Fig. 1A), as a baseline for identifying issues for new connections at different phases, the method comprising: (Fig. 3-5 & ¶0060 - At the core of each machine learning model 406 may be a corresponding anomaly detection model, such as an unsupervised learning-based model… that identifies network issues in the network of entities 404. If the two values deviate by a predefined threshold, the model 406 may determine that an issue has been detected. Please also see ¶0100-0105);
monitoring a Service Set Identifier (SSID), (Fig. 3-5 & ¶0031 - …monitor the state of the network. Please also see ¶0033) with an exchange of data packets over the enterprise network between network devices associated with stations utilizing the SSID, to collect real-time network device connection statistics associated with the SSID as a whole and each station utilizing the SSID; (¶0010 - The nodes typically communicate over the network by exchanging discrete frames or packets of data. ¶0039 - Data collection from the various local networks/locations may be performed by a network data collection platform 304 that communicates with both cloud service 302 and the monitored network of the entity. Please also see ¶0033);
tracking a time interval between samples of the collected data packets for each phase of the connection, including the association phase, the authentication phase and the DHCP phase of a connection; (Fig. 3-5 & ¶0033 - Another example of a health status rule may involve client transition events in a wireless network. In such cases, whenever there is a failure in any of the transition events, the wireless controller may send a reason code to the assurance service. To evaluate a rule regarding these conditions, the network assurance service may then group 150 failures into different “buckets” (e.g., Association, Authentication, Mobility, DHCP, WebAuth, Configuration, Infra, Delete, De-Authorization) and continue to increment these counters per service set identifier (SSID). Please also see ¶0100-0105, ¶0134);
identifying cluster means for the tracked time differences for each of the connection phases; (Fig. 2 & ¶0036 - Example machine learning techniques that network assurance process 248 can employ may include… clustering techniques (e.g., k-means, mean-shift, etc.). Fig. 3-5 & ¶0048 - …in a Wi-Fi network, analyzer 312 may be configured to build predictive models for the joining/roaming time by taking into account a large plurality of parameters/observations (e.g., RF variables, time of day, number of clients, traffic load, DHCP/DNS/Radius time, AP/WLC loads, etc.). ¶0135 - the service may assign the detected network issue to an issue cluster by clustering the detected network issue and to a plurality of previously detected network issues … the service may represent the network issue and the other detected issues as feature vectors indicative of any number of observed KPIs in the telemetry data from the network, predicted KPIs by the machine learning model, a deviation between the two, or other information that can be used to represent the issues);
Yet, Di Pietro does not explicitly teach calculating weighted averages for each phase of the connection using the time difference, the cluster means and the number of samples in each cluster; deriving, with a processor of the network management device, the dynamic thresholds for each phase of connections from the weighted averages; detecting a specific dynamic threshold for phase of the connection that is out of range; and responsive to the out-of-range detection, checking for network issues corresponding to the phase of the specific dynamic threshold.
However, in the analogous art, Chandrasekaran explicitly discloses calculating weighted averages for each phase of the connection using the time difference, the cluster means and the number of samples in each cluster; (Fig. 10, 18 & ¶0005 - The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to reach a network connected state; after waiting a period of time, recording connectivity event information. Fig. 10, 18 & ¶0006 - the connectivity event comprises a connectivity event determined by looking for a…Dynamic Host Configuration Protocol (DHCP) discover message, or DHCP request packet… the connectivity event information includes: DHCP last state… Fig. 10, 18 & ¶0010 - the network services related Layer 7 information includes DHCP (Dynamic Host Configuration Protocol)… protocol information such as response times and failure codes, or combinations thereof) Fig. 6, 16-19 & ¶0097 - Mean, median and variance of packet inter-arrival times… ¶0177 - …the baseline standard deviation is a weighted standard deviation according to the same weights. Fig. 6, 16-19 & ¶0095 - receives sampled raw data streams identified by time and link (at 605) and extracts features from the received sampled raw data streams per instructions (at 606). ¶0173 - Accordingly, the network incident identification and analysis system can determine a distribution of systemic root causes that affects different groupings of the overall set of affected clients, by first clustering these affected clients and mapping them to a root cause together);
deriving, with a processor of the network management device, the dynamic thresholds for each phase of connections from the weighted averages; (Fig. 16-19 & ¶0157 - Next, the incident is detected over a longer period of time T as the condition of X(t) is less than some threshold q for a certain proportion of T);
detecting a specific dynamic threshold for phase of the connection that is out of range; (Fig. 16-19 & ¶0171 - regarding the outlier analysis aspect of the system, the group incident occurrence is analyzed for the presence of any “outlying subgroups.” An outlying subgroup is determined by first partitioning the total number of clients according to some grouping (e.g., by AP-Group, AP, generic Location, device type and/or OS, radio channel, and the like). Next, particular sub-partitions are identified as an outlying subgroup if the percent of affected clients is “much higher” than the overall percent of affected clients and infrastructure);
and responsive to the out-of-range detection, checking for network issues corresponding to the phase of the specific dynamic threshold (Fig. 16-19 & ¶0174 - …after a group incident is detected, the network incident identification and analysis system then prioritizes (in terms of importance) the network incident. The prioritization is performed based on many factors that may include: … (3) deviation from the ‘intra-company baseline’. Fig. 16-19 & ¶0170 - network incident identification and analysis system also include ability to: aggregate network incidents for a group of clients/infrastructure, map the network incidents to group root causes, and automatically determine and implement the proper remediation. Please also see ¶0117).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective
filling date of the claimed invention to add the teaching of Chandrasekaran to the teaching of Di Pietro. The motivation would be because traditional performance monitoring or analytics tools work in silos on individual layers of the network stack and do not analyze correlated information across the multiple layers of the network stack to provide a comprehensive view of the network performance from end-user perspective (¶0004, Chandrasekaran).
Re. Claim 4, Di Pietro and Chandrasekaran teach Claim 1.
Yet, Di Pietro does not explicitly teach the weighted averages are inversely proportional to the cluster means.
However, in the analogous art, Chandrasekaran explicitly teaches the weighted averages are inversely proportional to the cluster means (Fig. 16-19 & ¶0177 – The baseline average of the percent of clients having poor performance when approximately Y_t clients are present is equal to the weighted average of the (X_i/Y_i) values weighted inversely proportional to |Y_i-Y_t|).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective
filling date of the claimed invention to add the teaching of Chandrasekaran to the teaching of Di Pietro. The motivation would be because traditional performance monitoring or analytics tools work in silos on individual layers of the network stack and do not analyze correlated information across the multiple layers of the network stack to provide a comprehensive view of the network performance from end-user perspective (¶0004, Chandrasekaran).
Re. Claim 9, Di Pietro and Chandrasekaran teach Claim 1.
Yet, Di Pietro does not explicitly teach identifying at least one network issue of the network issues comprising at least one of: high access point density, Wi-Fi interference, high client density, slow cryptographic algorithm, poor uplink and high channel utilization.
However, in the analogous art, Chandrasekaran explicitly teaches identifying at least one network issue of the network issues comprising at least one of: high access point density, Wi-Fi interference, high client density, slow cryptographic algorithm, poor uplink and high channel utilization (Fig. 16-19 & ¶0009 - …the wireless metrics include SNR (signal to noise ratio), packet loss/retransmits, connected access points, channel utilization at the access points, neighboring access points information, rogue/outside-network access points information, interference information in the RF (Radio Frequency) bands… Fig. 16-19 & ¶0072 - For example at a particular time interval, a user/device may have poor page load times, high transmission control protocol (TCP) retransmits, low signal-to-noise ratio (SNR), high AP channel utilization. Examiner interprets that only one of the claimed features to be mapped because of the presence of “at least one of”).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective
filling date of the claimed invention to add the teaching of Chandrasekaran to the teaching of Di Pietro. The motivation would be because traditional performance monitoring or analytics tools work in silos on individual layers of the network stack and do not analyze correlated information across the multiple layers of the network stack to provide a comprehensive view of the network performance from end-user perspective (¶0004, Chandrasekaran).
Re. Claim 10,
Di Pietro teaches a non-transitory computer-readable medium storing instructions that, when executed by a processor (¶0030), perform a computer-implemented method for using unsupervised machine learning to derive thresholds for each connection phase, unique for an enterprise network (Fig. 1A), as a baseline for identifying issues for new connections at different phases, the method comprising: (Fig. 3-5 & ¶0060 - At the core of each machine learning model 406 may be a corresponding anomaly detection model, such as an unsupervised learning-based model… that identifies network issues in the network of entities 404. If the two values deviate by a predefined threshold, the model 406 may determine that an issue has been detected. Please also see ¶0100-0105);
monitoring a Service Set Identifier (SSID) (Fig. 3-5 & ¶0031 - …monitor the state of the network. Please also see ¶0033), with an exchange of data packets over the enterprise network between network devices associated with stations utilizing the SSID, to collect real-time network device connection statistics associated with the SSID as a whole and each station utilizing the SSID; (¶0010 - The nodes typically communicate over the network by exchanging discrete frames or packets of data. ¶0039 - Data collection from the various local networks/locations may be performed by a network data collection platform 304 that communicates with both cloud service 302 and the monitored network of the entity. Please also see ¶0033);
tracking a time interval between samples of the collected data packets for each phase of the connection, including the association phase, the authentication phase and the DHCP phase of a connection; (Fig. 3-5 & ¶0033 - Another example of a health status rule may involve client transition events in a wireless network. In such cases, whenever there is a failure in any of the transition events, the wireless controller may send a reason code to the assurance service. To evaluate a rule regarding these conditions, the network assurance service may then group 150 failures into different “buckets” (e.g., Association, Authentication, Mobility, DHCP, WebAuth, Configuration, Infra, Delete, De-Authorization) and continue to increment these counters per service set identifier (SSID). Please also see ¶0100-0105, ¶0134);
identifying cluster means for the tracked time differences for each of the connection phases; (Fig. 2 & ¶0036 - Example machine learning techniques that network assurance process 248 can employ may include… clustering techniques (e.g., k-means, mean-shift, etc.). Fig. 3-5 & ¶0048 - …in a Wi-Fi network, analyzer 312 may be configured to build predictive models for the joining/roaming time by taking into account a large plurality of parameters/observations (e.g., RF variables, time of day, number of clients, traffic load, DHCP/DNS/Radius time, AP/WLC loads, etc.). ¶0135 - the service may assign the detected network issue to an issue cluster by clustering the detected network issue and to a plurality of previously detected network issues … the service may represent the network issue and the other detected issues as feature vectors indicative of any number of observed KPIs in the telemetry data from the network, predicted KPIs by the machine learning model, a deviation between the two, or other information that can be used to represent the issues);
Yet, Di Pietro does not explicitly teach calculating weighted averages for each phase of the connection using the time difference, the cluster means and the number of samples in each cluster; deriving, with a processor of the network management device, the dynamic thresholds for each phase of connections from the weighted averages; detecting a specific dynamic threshold for phase of the connection that is out of range; and responsive to the out-of-range detection, checking for network issues corresponding to the phase of the specific dynamic threshold.
However, in the analogous art, Chandrasekaran explicitly teaches calculating weighted averages for each phase of the connection using the time difference, the cluster means and the number of samples in each cluster; (Fig. 10, 18 & ¶0005 - The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to reach a network connected state; after waiting a period of time, recording connectivity event information. Fig. 10, 18 & ¶0006 - the connectivity event comprises a connectivity event determined by looking for a…Dynamic Host Configuration Protocol (DHCP) discover message, or DHCP request packet… the connectivity event information includes: DHCP last state… Fig. 10, 18 & ¶0010 - the network services related Layer 7 information includes DHCP (Dynamic Host Configuration Protocol)… protocol information such as response times and failure codes, or combinations thereof) Fig. 6, 16-19 & ¶0097 - Mean, median and variance of packet inter-arrival times… ¶0177 - …the baseline standard deviation is a weighted standard deviation according to the same weights. Fig. 6, 16-19 & ¶0095 - receives sampled raw data streams identified by time and link (at 605) and extracts features from the received sampled raw data streams per instructions (at 606). ¶0173 - Accordingly, the network incident identification and analysis system can determine a distribution of systemic root causes that affects different groupings of the overall set of affected clients, by first clustering these affected clients and mapping them to a root cause together);
deriving, with a processor of the network management device, the dynamic thresholds for each phase of connections from the weighted averages; (Fig. 16-19 & ¶0157 - Next, the incident is detected over a longer period of time T as the condition of X(t) is less than some threshold q for a certain proportion of T);
detecting a specific dynamic threshold for phase of the connection that is out of range; (Fig. 16-19 & ¶0171 - regarding the outlier analysis aspect of the system, the group incident occurrence is analyzed for the presence of any “outlying subgroups.” An outlying subgroup is determined by first partitioning the total number of clients according to some grouping (e.g., by AP-Group, AP, generic Location, device type and/or OS, radio channel, and the like). Next, particular sub-partitions are identified as an outlying subgroup if the percent of affected clients is “much higher” than the overall percent of affected clients and infrastructure);
and responsive to the out-of-range detection, checking for network issues corresponding to the phase of the specific dynamic threshold (Fig. 16-19 & ¶0174 - …after a group incident is detected, the network incident identification and analysis system then prioritizes (in terms of importance) the network incident. The prioritization is performed based on many factors that may include: … (3) deviation from the ‘intra-company baseline’. Fig. 16-19 & ¶0170 - network incident identification and analysis system also include ability to: aggregate network incidents for a group of clients/infrastructure, map the network incidents to group root causes, and automatically determine and implement the proper remediation. Please also see ¶0117).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective
filling date of the claimed invention to add the teaching of Chandrasekaran to the teaching of Di Pietro. The motivation would be because traditional performance monitoring or analytics tools work in silos on individual layers of the network stack and do not analyze correlated information across the multiple layers of the network stack to provide a comprehensive view of the network performance from end-user perspective (¶0004, Chandrasekaran).
Re. Claim 11,
Di Pietro teaches a network device (Fig. 2) to use unsupervised machine learning to derive thresholds for each connection phase, unique for an enterprise network, as a baseline for identifying issues for new connections at different phases (Fig. 3-5 & ¶0060 - At the core of each machine learning model 406 may be a corresponding anomaly detection model, such as an unsupervised learning-based model… that identifies network issues in the network of entities 404. If the two values deviate by a predefined threshold, the model 406 may determine that an issue has been detected. Please also see ¶0100-0105), the network device comprising: a processor (Fig. 2); a network interface communicatively coupled to the processor (Fig. 2) and to the hybrid wireless network (Fig. 1A); and a memory, communicatively coupled to the processor (Fig. 2) and storing:
a monitoring module to track a Service Set Identifier (SSID), (Fig. 3-5 & ¶0031 - …monitor the state of the network. Please also see ¶0033) with an exchange of data packets over the enterprise network between network devices associated with stations utilizing the SSID, to collect real-time network device connections statistics associated with the SSID as a whole and each station utilizing the SSID; (Fig. 1A, 3-5 & ¶0010 - The nodes typically communicate over the network by exchanging discrete frames or packets of data. ¶0039 - Data collection from the various local networks/locations may be performed by a network data collection platform 304 that communicates with both cloud service 302 and the monitored network of the entity. Please also see ¶0033);
a time tracking module to measure a time interval between samples of the collected data packets for each phase of the connection, including the association phase, the authentication phase and the DHCP phase of a connection; (Fig. 3-5 & ¶0033 - Another example of a health status rule may involve client transition events in a wireless network. In such cases, whenever there is a failure in any of the transition events, the wireless controller may send a reason code to the assurance service. To evaluate a rule regarding these conditions, the network assurance service may then group 150 failures into different “buckets” (e.g., Association, Authentication, Mobility, DHCP, WebAuth, Configuration, Infra, Delete, De-Authorization) and continue to increment these counters per service set identifier (SSID). Please also see ¶0100-0105, ¶0134);
a cluster means identifying module to find cluster means for the tracked time differences for each of the connection phases; (Fig. 2 & ¶0036 - Example machine learning techniques that network assurance process 248 can employ may include… clustering techniques (e.g., k-means, mean-shift, etc.). Fig. 3-5 & ¶0048 - …in a Wi-Fi network, analyzer 312 may be configured to build predictive models for the joining/roaming time by taking into account a large plurality of parameters/observations (e.g., RF variables, time of day, number of clients, traffic load, DHCP/DNS/Radius time, AP/WLC loads, etc.). ¶0135 - the service may assign the detected network issue to an issue cluster by clustering the detected network issue and to a plurality of previously detected network issues … the service may represent the network issue and the other detected issues as feature vectors indicative of any number of observed KPIs in the telemetry data from the network, predicted KPIs by the machine learning model, a deviation between the two, or other information that can be used to represent the issues);
Yet, Di Pietro does not explicitly teach a weighted averages module to calculate weighted averages for each phase of the connection using the time difference, the cluster means and the number of samples in each cluster; a threshold module to derive the dynamic thresholds for each phase of connections from the weighted averages; and a threshold module to detect a specific dynamic threshold for phase of the connection that is out of range, and responsive to the out-of- range detection, and check for network issues corresponding to the phase of the specific dynamic threshold.
However, in the analogous art, Chandrasekaran explicitly teaches a weighted averages module to calculate weighted averages for each phase of the connection using the time difference, (Fig. 10, 18 & ¶0005 - The method includes: detecting when client devices initiate a connectivity event; after detecting a connectivity event, waiting a period of time for the client device to reach a network connected state; after waiting a period of time, recording connectivity event information. Fig. 10, 18 & ¶0006 - the connectivity event comprises a connectivity event determined by looking for a…Dynamic Host Configuration Protocol (DHCP) discover message, or DHCP request packet… the connectivity event information includes: DHCP last state… Fig. 10, 18 & ¶0010 - the network services related Layer 7 information includes DHCP (Dynamic Host Configuration Protocol)… protocol information such as response times and failure codes, or combinations thereof. Fig. 6, 16-19 & ¶0097 - Mean, median and variance of packet inter-arrival times… Fig. 10, 16-19 & ¶0177 - …the baseline standard deviation is a weighted standard deviation according to the same weights), the cluster means and the number of samples in each cluster; (Fig. 6, 16-19 & ¶0095 - receives sampled raw data streams identified by time and link (at 605) and extracts features from the received sampled raw data streams per instructions (at 606). Fig. 16-19 & ¶0173 - Accordingly, the network incident identification and analysis system can determine a distribution of systemic root causes that affects different groupings of the overall set of affected clients, by first clustering these affected clients and mapping them to a root cause together);
a threshold module to derive the dynamic thresholds for each phase of connections from the weighted averages; (Fig. 16-19 & ¶0157 - …the network incident identification and analysis system performs a mathematical analysis that involves inspecting for a pattern of parameters that persist over a period of time. Next, the incident is detected over a longer period of time T as the condition of X(t) is less than some threshold q for a certain proportion of T);
and a threshold module to detect a specific dynamic threshold for phase of the connection that is out of range, (Fig. 16-19 & ¶0171 - regarding the outlier analysis aspect of the system, the group incident occurrence is analyzed for the presence of any “outlying subgroups.” An outlying subgroup is determined by first partitioning the total number of clients according to some grouping (e.g., by AP-Group, AP, generic Location, device type and/or OS, radio channel, and the like). Next, particular sub-partitions are identified as an outlying subgroup if the percent of affected clients is “much higher” than the overall percent of affected clients and infrastructure);
and responsive to the out-of- range detection, and check for network issues corresponding to the phase of the specific dynamic threshold (Fig. 16-19 & ¶0174 - …after a group incident is detected, the network incident identification and analysis system then prioritizes (in terms of importance) the network incident. The prioritization is performed based on many factors that may include: … (3) deviation from the ‘intra-company baseline’. Fig. 16-19 & ¶0170 - network incident identification and analysis system also include ability to: aggregate network incidents for a group of clients/infrastructure, map the network incidents to group root causes, and automatically determine and implement the proper remediation. Please also see ¶0117).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective
filling date of the claimed invention to add the teaching of Chandrasekaran to the teaching of Di Pietro. The motivation would be because traditional performance monitoring or analytics tools work in silos on individual layers of the network stack and do not analyze correlated information across the multiple layers of the network stack to provide a comprehensive view of the network performance from end-user perspective (¶0004, Chandrasekaran).
Claim 2 is rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro and Chandrasekaran, and further in view of Liu et al. (US 20220358417), Liu hereinafter.
Re. Claim 2, Di Pietro and Chandrasekaran teach Claim 1.
Yet, Di Pietro and Chandrasekaran do not explicitly teach assigned weights for calculating the weighted averages comprises the number of samples for the connection phases divided by the cluster means for the connection phases.
However, in the analogous art, Liu explicitly discloses assigned weights for calculating the weighted averages comprises the number of samples for the connection phases divided by the cluster means for the connection phases (Fig. 1 & ¶0011 - calculating the quantity of samples, a sum of the samples, and an average value of each cluster in the total database by using a secure aggregation method, taking the average value obtained by calculation as a new cluster center of each cluster. Examiner interprets the number of samples divided by the cluster means as an average number of samples taken per cluster).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective
filling date of the claimed invention to add the teaching of Liu to the teachings of Di Pietro and Chandrasekaran. The motivation would be because it provides efficient learning methods for a k-means clustering algorithm (¶0002, Liu).
Claim 3 is rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro and Chandrasekaran, and further in view of Ding et al. (US 20040133395), Ding hereinafter.
Re. Claim 3, Di Pietro and Chandrasekaran teach Claim 1.
Yet, Di Pietro and Chandrasekaran do not explicitly teach the weighted averages are proportional to the number of samples.
However, in the analogous art, Ding explicitly discloses the weighted averages are proportional to the number of samples (Fig. 1-3 & ¶0012 - When a computer network system or enterprise comprises only a few nodes, the aggregation of the monitoring data from each of the few nodes may not be a problem. But when the system grows, the performance data collected from each computer or node will increase proportionally. Fig. 1-3 & ¶0052 - Most performance models and modeling formulas only use averages. Fig. 1-3 & ¶0053 - The average referred throughout this application may be many different kinds of average, including … weighted averages where some data are more important than others).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective filling date of the claimed invention to add the teaching of Ding to the teachings of Di Pietro and Chandrasekaran. The motivation would be because it is desirable to have a method or system to further reduce the growth of data quantity in order to maintain the ability to monitor the performance of each node (¶10, Ding).
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro and Chandrasekaran, and further in view of Alavudin et al. (US 20140254500), Alavudin hereinafter.
Re. Claim 5, Di Pietro and Chandrasekaran teach Claim 4.
Yet, Di Pietro and Chandrasekaran do not explicitly teach the association phase comprises association request and association request data packets, the authentication phase comprises Mi-handshake and M4- handshake data packets, and the DHCP phase comprises DHCP- Discover and DHCP-Acknowledge data packets.
However, in the analogous art, Alavudin explicitly discloses the association phase comprises association request and association request data packets (Fig. 2-3, 7 & ¶0017 - The Association Request may be transmitted by the wireless device to an access point for the WLAN. Fig. 2-3, 7 & ¶0022 - packet format 200 may represent an IEEE 802.11 WLAN frame or packet generated by a wireless device (e.g., wireless device 112-1) and used to transmit an Association Request to an access point for a WLAN), the authentication phase comprises Mi-handshake and M4- handshake data packets, (Fig. 3, 7 & ¶0030 - the security handshake may include the logic and/or features of wireless device 112-1 generating and transmitting a first Authentication Frame having identification information to initiate the security handshake to allow access point 114 to authenticate wireless device 112-1. In some other examples, the security handshake may include the logic and/or features of wireless device 112-1 initiating a more security intensive four-way handshake process to authenticate wireless device 112-1) and the DHCP phase comprises DHCP- Discover and DHCP-Acknowledge data packets (Fig. 3, 7 & ¶0100 - A DHCP discover message may then be sent to the DHCP server for the wireless device. A DHCP request message to indicate a request for a given IP address may then be sent and a DHCP ACK message may then be received from the DHCP server that grants the given IP address).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective
filling date of the claimed invention to add the teaching of Alavudin to the teachings of Chandrasekaran and Di Pietro. The motivation would be because it provides examples directed to improvements for wireless devices to couple to a WLAN and obtain an IP address using wireless technologies associated with Wi-Fi. These wireless technologies may include wireless technologies suitable for use with access points deployed in a WLAN (¶0013, Alavudin).
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro and Chandrasekaran, and further in view of Abraham (US 20050203978), Abraham hereinafter.
Re. Claim 6, Di Pietro and Chandrasekaran teach Claim 1.
Yet, Di Pietro and Chandrasekaran do not explicitly teach storing the cluster means and the weighted averages; tracking time intervals between data packets collected for new samples of collected data; and recalculating the dynamic thresholds using the stored cluster means and weighted averages with the new time intervals.
However, in the analogous art, Abraham explicitly discloses storing the cluster means and the weighted averages (Fig. 3 & ¶0012 - The mean can be calculated if the full set of data points is stored. Fig. 3 & ¶0021 - …an existing ongoing weighted average based upon at least one earlier data sample and stored in a memory of the computer); tracking time intervals between data packets collected for new samples of collected data; (Fig. 3 & ¶0069 - Therefore, it is useful if the processing means 210 monitors the data transfer rate by taking a data sample of the transfer rate at predetermined time intervals) and recalculating the dynamic thresholds using the stored cluster means and weighted averages with the new time intervals (Fig. 3 & ¶0021 - cause a computer to collect at least one new data sample and using the new data sample and an existing ongoing weighted average based upon at least one earlier data sample… to calculate a new ongoing weighted average. Fig. 3 & ¶0012 - With each new data point gathered, this weighted average will have to be recalculated using the full set of data points as the weight associated with each data point changes with each further data point collected. Further, the standard deviation would also have to be recalculated. Fig. 3 & ¶0069 - The data samples taken by the processing means 210 can then be applied to the method as described in relation to FIG. 3 to determine whether any of the data samples are outside the predetermined parameters).
Therefore, it would have been obvious to one of the ordinary skill in the art before the effective
filling date of the claimed invention to add the teaching of Abraham to the teachings of Chandrasekaran and Di Pietro. The motivation would be because the invention relates to an analysis apparatus arranged to analyse data and detect change and related methods, and an apparatus which detects significant changes in a system has many uses (¶0001-¶0002, Abraham).
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro and Chandrasekaran, and further in view of Sydir et al. (US 20140045536), Sydir hereinafter.
Re. Claim 7, Di Pietro and Chandrasekaran teach Claim 1.
Yet, Di Pietro and Chandrasekaran do not explicitly teach the SSID is configured to an access point.
However, in the analogous art, Sydir explicitly discloses the SSID is configured to an access point (Fig. 1 & ¶0022 - Each of the APs may have an associated service set identifier (SSID)…).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective
filling date of the claimed invention to add the teaching of Sydir to the teachings of Di Pietro and Chandrasekaran. The motivation would be because it provides systems and methods for providing location information, with the location information being determined based at least in part on service set identifiers (SSIDs) and/or basic service set identifiers (BSSIDs) associated with wireless communication access points (APs) (¶0011, Sydir).
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Di Pietro and Chandrasekaran, in further in view of Sydir, and in further view of Crandall et al (US 20060072502), Crandall hereinafter.
Re. Claim 8, Di Pietro and Chandrasekaran teach Claim 1.
Yet, Di Pietro and Chandrasekaran do not explicitly teach the SSID is configured to a plurality of access points, wherein throughput and multicast rate are monitored individually for each access point.
However, in the analogous art, Sydir explicitly discloses the SSID is configured to a plurality of access points (Fig. 1 & ¶0023 - Multiple APs 106 may share the same SSID. For example, if several APs 106 are controlled by the same entity, those APs 106 may share a common SSID);
Yet, Sydir does not explicitly teach throughput and multicast rate are monitored individually for each access point.
However, in the analogous art, Crandall explicitly discloses throughput and multicast rate are monitored individually for each access point (Fig. 2 & ¶0024 - By monitoring these multicasts, each AP will again have their own traffic load information and the traffic load information for any adjacent APs. Fig. 2 & ¶0017 - Every AP may then predict its potential throughput on each channel based on the traffic load information collected, and find a best channel which corresponds to a maximum predicted throughput).
Therefore, it would have been obvious to one of the ordinary skills in the art before the effective filling date of the claimed invention to add the teaching of Crandall to the teachings of Di Pietro, Chandrasekaran and Sydir. The motivation would be because deploying a plurality of APs in a WLAN, while minimizing interference and maximizing overall throughput, is desired (¶0004, Crandall).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of ti