DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 05/15/2023 has been entered.
Status of Claims
The following is a Non-Final Office Action in response to applicant’s filing on March 16, 2026. Claims 3, 5, 12 and 14 were canceled. Claims 1-2, 7-10, and 16-20 were amended. Claims 1-2, 4, 6-11, 13, and 15-20 are pending, of which claims 1, 8, and 10 are in independent form.
Response to Arguments
Applicant’s arguments with respect to claim(s) are rejected, under 35 USC 103(a), have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter.
On Pages 8-10 of remarks, Applicant argues that Russell does not disclose “the sharing of a data model tree structure with a remote collection component for collection of log data for an event, nor the traversal by the remote collection component of the data model tree structure using a pre-order traversal algorithm to identify a lowest matching node, as described in amended claim 1”. Applicant further argues that Russell merely generated XML configuration files and operators without teaching hierarchical traversal or node matching. The Applicant’s arguments are not persuasive. Russell expressly teaches generation and distribution of XML-based configuration materials for target side processing. XML documents are inherently hierarchical structures comprised of nested parent-child relationships and commonly represented and processed as tree structures. Russell’s disclosure of generating XML configuration documents and distributing term to remote collection components therefore reasonably suggests sharing a hierarchical data model structure with remote collection components for processing log data. See figures 7-8 and generated XML configuration documents.
However, regarding the amended claim limitations “wherein the remote collection component traverses the data model tree structure using a pre-order traversal algorithm to identify a matching node for the log data of an event and collects data of variable attributes of the matching node;” Applicant’s arguments, with respect to the rejection(s) of claim(s) 1, 11 and 18 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Chen et al. (US 2006/0106758 A1).
As to the dependent claims 2, 4, 6-7, 9, 11, 13, and 15-20, these claims remain rejected by virtue of dependency to their independent claims.
Accordingly, the examiner maintains the rejection under 35 USC § 103.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-2, 4, 6-11, 13, and 15-20 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AlA), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AlA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claim 1 recites “receiving collected data from the remote collection component in a form of a node identifier and the collected data of the variable attributes of the lowest matching node”.
In the instant application, the disclosure of the application relies on essential matter which fails to convey to those skilled in the art that the inventor had possession of the claimed subject matter as of the filing date. The instant application’s specification fails to provide structure support for the claim limitations of “receiving collected data from the remote collection component in a form of a node identifier and the collected data of the variable attributes of the lowest matching node”. The specification repeatedly discusses “matching nodes”, however, there is no disclosure that explains how the system determines that the node id the “lowest” matching node, what “lowest” means structurally and how the lowest node is distinguished from other matching nodes. Further, no disclosure as to what are the variable attributes of the lowest matching node (i.e. the remote log collection component traverses 204 the data model to find a branch of matching nodes for the collected logged event. The remote collection component may use a pre-order traversal algorithm to identify the lowest node matching the logged event, see Paragraph [0028]). Thus, the specification fails to provide adequate written description to support the limitation “receiving collected data …the collected data of the variable attributes of the lowest matching node”.
Further, claim 1 recites “wherein the remote collection component traverses the data model tree structure using a pre-order traversal algorithm to identify a matching node for the log data of an event and collects data of variable attributes of the matching node;”. The limitation “using a pre-order traversal algorithm” is repeated in the specification (i.e. the remote log collection component traverses 204 the data model to find a branch of matching nodes for the collected logged event. The remote collection component may use a pre-order traversal algorithm to identify the lowest node matching the logged event, see Paragraph [0028]).
However, there is no structure as to how the remote collection component uses a pre-order traversal algorithm the data model tree structure to identify a matching node. The specification fails to describe the pre-order traversal logic, or how results in identification of the claimed matching node. Therefore, the specification fails to provide adequate written description to support the limitation “the remote collection component traverses the data model tree structure using a pre-order traversal algorithm to identify a matching node…”.
Independent claims 8 and 10 are similarly rejected. As to claims 2, 4, 6-7, 9, 11, 13, and 15-20, these claims are rejected by virtue of dependency to independent claims 1, 8, and 10.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 3-4, 7-10, 12-13, and 16-20 are rejected under 35 U.S.C. 103 as being unpatentable over Srivatsa et al. (US 2022/0171670 A1), hereinafter Srivatsa in view of Russell et al. (US 2020/0097466 A1), hereinafter Russell and further in view of Chen et al. (US 2006/0106758 A1), hereinafter Chen.
In regards to claim 1, Srivatsa discloses a computer-implemented method for efficient data collection in security information and event management systems, the method comprising: generating a data model tree structure for a log type for collection of variable attributes (Srivatsa, Para. 0006, in some embodiments, existing templates are used as a seed to create new templates. In some embodiments, the log analyzer groups a set of related log messages and identifies a set of templates that the set of related log messages fall within as a template model. The log analyzer may add a particular template to the template model when one or more log messages of the set of related log messages fall within the particular template. The log analyzer may also remove a particular template from the template model when no log message of the set of related log messages fall within the particular template) and paragraphs [0004], [0006], [0023-0026], wherein the data model tree structure includes nodes representing static content with each node having a set of attribute names for which respective variable attribute values are to be collected from log records (Srivatsa, Paras. 0031-0033, the example templates 221-224 are generated based on (or extracted from) the patterns of the log messages 211-214, respectively. Various portions of the messages 211-214 are identified as variable or static by the log analyzer 100. For example, in the message 211, “error” and “Found log configuration_id:” are identified as static portions of the message 211 and are reproduced in the extracted template 221. On the other hand, the string “TransactionID-AE12345678” and the string “20191016-011111-777-szM1ABab” are identified as variable portions of the message 211 and are replaced by a notation “<*>” in the extracted template 221); and wherein generating the data model tree structure includes designating variable attributes as static values based on variance of their respective variable attribute values (Srivatsa, Para. 0004, a log analyzer receives log messages generated by a monitored system. The log analyzer identifies static and variable portions in the received log messages. The log analyzer generates a template based on the identified static and variable portions of the received log messages. The log analyzer computes a metric for the generated template based on a number of log messages that fall within the template. The log analyzer reports a status in the monitored system based on the computed metric) and (Srivatsa, Para. 0040, Each template model is a collection of templates that correspond to a set of (related) log messages that are generated within a same time frame (as divided by the time slicing module 130). The log messages are analyzed to detect occurrence of changes and unusual events. Subsequent log messages arriving at the log analyzer 100 may fall into templates belonging to different template models),
wherein generating the data model tree structure includes providing levels of the data model tree structure as thresholds of data transfer efficiency (Srivatsa, Para. 0040, the extracted templates are stored in a template library 142. The template library 142 stores one or more template models. Each template model is a collection of templates that correspond to a set of (related) log messages that are generated within a same time frame (as divided by the time slicing module 130). The log messages are analyzed to detect occurrence of changes and unusual events. Subsequent log messages arriving at the log analyzer 100 may fall into templates belonging to different template models. In some embodiments, a template may newly appear in an existing template model when there is one or more log messages that fall within the new template, which did not exist in the template model) and (Srivatsa, Para. 0051, the log analyzer measures the performance metrics of the templates with regard to the log messages in order to further refine the templates. The log analyzer therefore improves the efficiency of system monitoring) and paragraphs [0034-0037] and setting a minimum percentage a sample set representation where a variable attribute is designated as a static value (Srivatsa, Paras. 0037, token at index i is considered a variable if sum over all j!=i, Pr(i|j)/(n−1)<threshold, where n is the length of the log expressed in number of tokens. The variables identified are replaced by a static token $VARIABLE and the algorithm is repeated to identify more variables, until none can be found) and paragraphs [0007], and [0042]; and
receiving collected data from the remote collection component in a form of a node identifier and the collected data of the variable attributes of the lowest matching node (Srivatsa, Fig. 4, Para. 0040, the extracted templates are stored in a template library 142. The template library 142 stores one or more template models) and (Srivatsa, Para. 0042, the template matching module 134 applies the extracted templates to the log messages 120 from the system 110 and computes a metric for each extracted template. Computing metrics for templates allows changes to templates over time to be quantified. In some embodiments, the metric of a template is a matching score that is determined based on a number of log messages that fall within the template, i.e., a number of log messages having content that fits the pattern described by the template. FIG. 4 illustrates example templates and the corresponding number of log messages that fall within the template).
Sirvatsa does not explicitly disclose sharing the data model tree structure with a remote collection component for collection of log data for an event of the log type,
However, Russell teaches sharing the data model tree structure with a remote collection component for collection of log data for an event of the log type (Russell, Para. 0038, the next action at 122 is to capture the log data according to the user configurations. The association between the log rules 111 and the target representations is sent to the customer network 104 for processing. An agent of the log analytics system is present on each of the hosts 109 to collect data from the appropriate logs on the hosts 109) and (Russell, Para. 0029, One or more gateways 108 are provided in each customer network to communicate with the log analytics system 101) and (Russell, Figs. 4A-4C, Para. 0056, In this model the “Log Type” 406 defines how the system reads the log file, as well as how to decompose the log file into its parts),
Sirvatsa and Russell are both considered to be analogous to the claim invention because they are in the same field of for efficient data gathering in security information. Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa to incorporate the teachings of Russell to include sharing the data model tree structure with a remote collection component for collection of log data for an event of the log type (Russell, Para. 0038) and (Russell, Para. 0029) and (Russell, Figs. 4A-4C, Para. 0056). Doing so would aid to provide an architecture having a combination of components that can handle collection and analysis of a massive amount of log data, particularly in a cloud-based and/or SaaS-based platform. The architecture includes portions at the customer location to efficiently collect log data from customer servers, and to then process the collected data within a pipeline at a cloud-based server. This permits, for example, multiple versions of each service to support parallel processing specific to particular stages (Russell, Para. 0027).
Sirvatsa and Russell do not explicitly teach wherein the remote collection component traverses the data model tree structure using a pre-order traversal algorithm to identify a matching node for the log data of an event and collects data of variable attributes of the matching node;
However, Chen teaches wherein the remote collection component traverses the data model tree structure using a pre-order traversal algorithm to identify a matching node for the log data of an event and collects data of variable attributes of the matching node (Chen, Para. 0022, a tree of query nodes for an XPath expression is built, via step 101. FIG. 3 illustrates an example query tree 302 for an XPath expression 301) and (Chen, Para. 0034, then there is a match for the query node in the previous step of the query) and (Chen, Para. 0046, the internal nodes are consecutively numbered by their pre-order sequence numbers (ids), as is known in the art);
Sirvatsa, Russell and Chen are all considered to be analogous to the claim invention because they are in the same field of for efficient data gathering in security information. Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa and Russell to incorporate the teachings of Chen to include wherein the remote collection component traverses the data model tree structure using a pre-order traversal algorithm to identify a matching node for the log data of an event and collects data of variable attributes of the matching node (Chen, Para. 0022) and (Chen, Para. 0034) and (Chen, Para. 0046). Doing so would aid to use transitivity properties among matches to reduce the number of states that need to be tracked and to improve the evaluation of path expressions significantly (Chen, Para. 0009).
In regards to claim 4, the combination of Srivatsa and Russell in view of Chen teaches the method of claim 1, wherein a variance of variable attribute values is analyzed from historic log data and updated periodically with collected log data (Russell, Para. 0043, The inference or extraction of templates is therefore an iterative process, where existing templates may be used to create newer templates, and the existing templates may be incrementally updated as data from newer log messages (from the same domain as the log messages used to extract the original existing template) become available). Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa and Chen to incorporate the teachings of Russell to include wherein the variance of attribute values is analyzed from historic log data and updated periodically with collected log data (Russell, Para. 0043). Doing so would aid to provide an architecture having a combination of components that can handle collection and analysis of a massive amount of log data, particularly in a cloud-based and/or SaaS-based platform. The architecture includes portions at the customer location to efficiently collect log data from customer servers, and to then process the collected data within a pipeline at a cloud-based server. This permits, for example, multiple versions of each service to support parallel processing specific to particular stages (Russell, Para. 0027).
In regards to claim 7, the combination Srivatsa and Russell in view of Chen teaches the method of claim 1, including using the data model tree structure to reconstruct a log record from the node identifier and the collected data of the variable attributes of the lowest matching node (Russell, Para. 0024, The log analyzer treats log data as a multi-variate timeseries, recursively learning templates by obtaining input to create custom variables. The identified static and variable portions are used to form new templates. The learned templates can in turn be viewed as a time series that shows events and issues occurring in the system at various time intervals. In some embodiments, the log analyzer incrementally learns new templates through seeding of an original model template. The log analyzer determines a ratio or percentage of log messages for each template as a metric for the template). Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa and Chen to incorporate the teachings of Russell to include the method of claim 1, including using the data model tree structure to reconstruct a log record from the node identifier and the collected data of the variable attributes of the lowest matching node (Russell, Para. 0024). Doing so would aid to provide an architecture having a combination of components that can handle collection and analysis of a massive amount of log data, particularly in a cloud-based and/or SaaS-based platform. The architecture includes portions at the customer location to efficiently collect log data from customer servers, and to then process the collected data within a pipeline at a cloud-based server. This permits, for example, multiple versions of each service to support parallel processing specific to particular stages (Russell, Para. 0027).
In regards to claim 8, the computer-implemented method of claim 8 is similarly analyzed and rejected as the method claim 1.
In regards to claim 9, the combination Srivatsa and Russell in view of Chen teaches the method of claim 8, wherein matching the log data to the lowest matching node includes matching to a node at a level of the data model for a defined transfer efficiency (Russell, Para. 0066, one possible action is to capture a complete log entry as an observation when matching conditions of the rule. This approach lets the system/user, when monitoring a log from any source and when a single entry is seen that matches the conditions of this rule, to save that complete entry and store it in the repository as an observation. Observations are stored for later viewing through the log observations UI or other reporting features. Another possible action is to create an event entry for each matching condition. When a log entry is seen as matching the specified conditions, these approaches raise an event. In some embodiments, the event will be created directly at the agent. The source definition will define any special fields that may be needed for capturing events if there are any. An additional option for this action is to have repeat log entries bundled at the agent and only report the event at most only once for the time range the user specified. The matching conditions can be used to help identify the existence of a repeat entry. Another example action is to create a metric for the rule to capture each occurrence of a matching condition). Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa and Chen to incorporate the teachings of Russell to include wherein matching the log data to the lowest matching node includes matching to a node at a level of the data model for a defined transfer efficiency (Russell, Para. 0066). Doing so would aid to provide an architecture having a combination of components that can handle collection and analysis of a massive amount of log data, particularly in a cloud-based and/or SaaS-based platform. The architecture includes portions at the customer location to efficiently collect log data from customer servers, and to then process the collected data within a pipeline at a cloud-based server. This permits, for example, multiple versions of each service to support parallel processing specific to particular stages (Russell, Para. 0027).
In regards to claim 10, the system claim 10 is similarly analyzed and rejected as the method claim 1 and the computer-implemented method of claim 8.
In regards to claim 13, the system claim 13 is similarly analyzed and rejected as the method claim 4.
In regards to claim 16, the system claim 16 is similarly analyzed and rejected as the method claim 7.
In regards to claim 17, the combination Srivatsa and Russell in view of Chen teaches the system of claim 10, wherein the processor and the memory are further configured to provide computer program instructions to the processor to execute a function of a log collection component including: a data model receiving component for receiving a data model tree structure from the central component for collection of log data for an event of the log type (Russell, Para, 0087, As noted above, the target version includes configuration details that are pertinent to log collection efforts, and is passed to the customer environment to be used by the agent in the customer environment to collect the appropriate log data from the customer environment); Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa and Chen to incorporate the teachings of Russell to include wherein the processor and the memory are further configured to provide computer program instructions to the processor to execute a function of a log collection component including: a data model receiving component for receiving a data model tree structure from the central component for collection of log data for an event of the log type (Russell, Para, 0087). Doing so would aid to provide an architecture having a combination of components that can handle collection and analysis of a massive amount of log data, particularly in a cloud-based and/or SaaS-based platform. The architecture includes portions at the customer location to efficiently collect log data from customer servers, and to then process the collected data within a pipeline at a cloud-based server. This permits, for example, multiple versions of each service to support parallel processing specific to particular stages (Russell, Para. 0027).
and
a traversing component for traversing the data model tree structure using a pre-order traversal algorithm to select the lowest matching node for the log data of an event (Chen, Para. 0022, a tree of query nodes for an XPath expression is built, via step 101. FIG. 3 illustrates an example query tree 302 for an XPath expression 301) and (Chen, Para. 0034, then there is a match for the query node in the previous step of the query) and (Chen, Para. 0046, the internal nodes are consecutively numbered by their pre-order sequence numbers (ids), as is known in the art);
Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa and Russell to incorporate the teachings of Chen to include a traversing component for traversing the data model tree structure using a pre-order traversal algorithm to select the lowest matching node for the log data of an event (Chen, Para. 0022) and (Chen, Para. 0034) and (Chen, Para. 0046). Doing so would aid to use transitivity properties among matches to reduce the number of states that need to be tracked and to improve the evaluation of path expressions significantly (Chen, Para. 0009).
In regards to claim 18, the system claim 18 is similarly analyzed and rejected as the method claim 9.
In regards to claim 19, the system claim 19 is similarly analyzed and rejected as the method claim 7.
In regards to claim 20, the combination Srivatsa and Russell in view of Chen teaches the system of claim 17, further comprising: a transmitting component for transmitting the collected log data in a form including a node identifier and the collected log data of the variable attributes of the lowest matching node (Srivatsa, Para. 0050, the reported status of the monitored system is identified based on a template having a highest metric among multiple templates in the template library. The log analyzer may determine a time frame of occurrence for the reported status based on one or more time stamps in the incoming log messages that fall within a template model that is related to the reported status).
Claims 2 and 11 are rejected under 35 U.S.C. 103 as being unpatentable over Srivatsa et al. (US 2022/0171670 A1), hereinafter Srivatsa in view of Russell et al. (US 2020/0097466 A1), hereinafter Russell in view of Chen et al. (US 2006/0106758 A1), hereinafter Chen and further in view of Tiefenbrun et al. (US 2003/0105771 A1), hereinafter Tiefenbrun.
In regards to claim 2, the combination of Srivatsa and Russell in view of Chen does not explicitly teach the method of claim 1, wherein generating a data model includes building a hierarchy of nodes with each node representing a set of static content of a log record with nodes at lower levels of the hierarchy including fewer variable attributes.
However, Tiefenbrun teaches wherein generating a data model includes building a hierarchy of nodes with each node representing a set of static content of a log record with nodes at lower levels of the hierarchy including fewer variable attributes (Tiefenbrun, Para. 0051, update process in the case where an object (an order in this case) is added. In this example, the addition of a new object causes a new navigation tree node to be added to the tree structure; if it already existed this step is not required. We note that in the same way that the static behavior (a.k.a. tree construction) is generic, the event handling is also non-specific as to object type, that is, it is up to the concrete finder instance to provide support for the necessary object type, in this case, the order set finder provides this facility) and (Tiefenbrun, Para. 0032, the tree structure is dynamically updated based on real-time information that changes the tree structure, for example, as objects such as orders in a financial trading system are entered into the system or as the attributes related to the orders in the system change) and (Tiefenbrun, Para. 0033, The enhanced efficiency derives from the fact that the node of a tree structure of the present invention includes not only the objects that match a particular node, but also the combined set of all the objects that appear in the lower nodes of the tree structure).
Sirvatsa, Russell, Chen and Tiefenbrun are all considered to be analogous to the claim invention because they are in the same field of for efficient data gathering in security information. Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa, Russell and Chen to incorporate the teachings of Tiefenbrun to include wherein generating a data model includes building a hierarchy of nodes with each node representing a set of static content of a log record with nodes at lower levels of the hierarchy including fewer variable attributes (Tiefenbrun, Para. 0051) and (Tiefenbrun, Para. 0032) and (Tiefenbrun, Para. 0033). Doing so would aid the ability for the user to alternate between different tree structures, facilitates more efficient and speedy organization, navigation, selection and operating upon a collection of arbitrary objects in a database based on attributes of those objects. It also allows different users within the context of a multi-user environment to either share a means of organizing the information in the database and thus, allows the different users to collaborate more effectively, and, alternatively, to have a different means of organizing the objects in the database to facilitate different tasks or responsibilities (Tiefenbrun, Para. 0033).
In regards to claim 11, the system claim 11 is similarly analyzed and rejected as the method claim 2.
Claims 6 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Srivatsa et al. (US 2022/0171670 A1), hereinafter Srivatsa in view of Russell et al. (US 2020/0097466 A1), hereinafter Russell in view of Chen et al. (US 2006/0106758 A1), hereinafter Chen and further in view of Ezrielev et al. (US 2023/0344779 A1), hereinafter Ezrielev.
In regards to claim 6, the combination of Srivatsa and Russell in view of in view of Chen does not explicitly teach the method of claim 1, including configuring a required data transfer efficiency as a threshold percentage of a sample set representation where an attribute is represented as a static value.
However, Ezrielev teaches including configuring a required data transfer efficiency as a threshold percentage of a sample set representation where an attribute is represented as a static value (Ezrielev, Para. 0061, the threshold may be any static or dynamic threshold, may be set by a user, and/or may be obtained from another entity through a communication system (e.g., communication system 101). For example, the threshold may be a ratio of 5:1, the ratio indicating that there should be a 5:1 ratio of total bits to reduced bits. This ratio may be monitored by data collectors 100 and/or data aggregator 102. Therefore, any reduced-size data transmitted to data aggregator 102 with a data reduction ratio lower than 5:1 may fall below the threshold (e.g., less efficient data compression). In contrast, any reduced-size data transmitted to data aggregator 102 with a data reduction ratio of 5:1 or higher may fall above the threshold (e.g., more efficient data compression). The threshold may be intended to maintain a data reduction rate throughout the distributed environment in order to minimize the amount of data transmitted over communication system 101 during data collection).
Sirvatsa, Russell, Chen and Ezrielev are all considered to be analogous to the claim invention because they are in the same field of for efficient data gathering in security information. Therefore, it would have been obvious to someone ordinary skill in the art before the effective filling date of the claimed invention to have modified Sirvatsa, Russell and Chento incorporate the teachings of Ezrielev to include including configuring a required data transfer efficiency as a threshold percentage of a sample set representation where an attribute is represented as a static value (Ezrielev, Para. 0061). Doing so would aid to manage data collection, the system may include a data aggregator and a data collector. The data aggregator may obtain a consensus sequence, a consensus sequence being a representation of frequent patterns that may appear in a data set, in order to facilitate data reduction by the data collector (Ezrielev, Para. 0014).
In regards to claim 15, the system claim 15 is similarly analyzed and rejected as the method claim 6.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTO-892.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GITA FARAMARZI whose telephone number is (571)272-0248. The examiner can normally be reached Monday- Friday 9:00 am- 6:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge L. Ortiz-Criado can be reached at (571)272-7624. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/GITA FARAMARZI/Examiner, Art Unit 2496
/JORGE L ORTIZ CRIADO/Supervisory Patent Examiner, Art Unit 2496
Prosecution Insights