Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Detailed Action
This is an Office Action for application 18/226,771 in response to arguments and amendments filed on 10/02/2025. Claim 18 is currently amended. Claims 1-17 are cancelled. Claims 18-37 are pending and examined below.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 10/02/2025 has been entered.
Response to Arguments
Applicant's arguments filed 10/02/2025 have been fully considered but they are not persuasive.
Applicant argues that currently applied reference arts John and Deen do not teach newly added claim 1 language
and combining, by a flow aggregator, two or more unidirectional flows into a single set of flow data based at least on the analysis.
However, previously uncited portion of Deen (Par. [0075-6]) discloses combining the directed acyclic graphs (i.e. unidirectional flows) in Figs. 5A-5D all into a single graph (i.e. a single set of flow data) 5E based on probabilistic analysis or some other statistical calculation (e.g. the analysis as taught by John). Therefore, argument is unpersuasive.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 18-29, 33-34 and 36 is/are rejected under 35 U.S.C. 103 as being unpatentable over John et al. (WO 2016/018181) in view of Deen et al. (US Pub. 2016/0359914).
Regarding claim 18, John teaches
A method for analyzing attributes of data flows associated with a set of machines executing on a set of host computers, the method comprising: providing definitions of keys to the set of host computers to use to associate individual flows into groups of flows, each host computer in the set identifying for each group of flows a set of attributes; (Par. [0011, 35-7, 46-7] one or more nodes (i.e. host computers; #12-14) contain microflow selection criterion (i.e. definition of keys) starting at an ingress node that checks aggregate workflow entries for devolvement actions associated with the entry)
analyzing sets of attributes collected from the host computers for the identified groups of flows; (Par. [0011, 35-7, 46-7] one or more nodes contain microflow selection criterion starting at an ingress node that checks (i.e. analyzes) aggregate workflow entries for devolvement actions associated with the entry)
in response to the analysis, generating at least one new definition for at least one new key to provide the set of host computers to use to associate individual flows into one new group of flows. (Par. [0011, 35-7, 46-7] one or more nodes contain microflow selection criterion starting at an ingress node that checks aggregate workflow entries for devolvement actions (i.e. generate new definition for at least one new key) associated with the entry)
John does not explicitly teach
using a distributed machine learning processing system configured to identify grouping of data compute nodes by analyzing contextual attributes comprising hashes and user identifiers;
and combining, by a flow aggregator, two or more unidirectional flows into a single set of flow data based at least on the analysis.
However, from the same field Deen teaches
using a distributed machine learning processing system configured to identify grouping of data compute nodes by analyzing contextual attributes comprising hashes and user identifiers; (Par. [0021, 32, 41] an identifier that can be associated with a user is used as part of a one-way hash function as part of input for machine learning used for identifying unusual traffic patterns)
and combining, by a flow aggregator, two or more unidirectional flows into a single set of flow data based at least on the analysis. (Par. [0075-6] directed acyclic graphs (i.e. unidirectional flows) from Figs. 5A-5D are all combined into a single graph (#505; i.e. a single set of flow data) 5E based on probabilistic analysis or some other statistical calculation (e.g. the analysis as taught by John))
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to combine the machine learning identification and stream combination techniques of Deen into the workflow environment of John. The motivation for this combination would have been to improve clock skew as explained in Deen (Pars. [0003-5]).
Regarding claim 19, John and Deen teach claim 18 as shown above, and John further teaches
The method of claim 18 further comprising providing, with the new definition of the new key, instructions to each host computer in the set of host computers to discard a prior key. (Par. [0066] if a microflow is not found, it can be removed (i.e. deleted) from the OVSDB or APM tables via message)
Regarding claim 20, John and Deen teach claim 19 as shown above, and John further teaches
The method of claim 19, wherein generating the definition of the new key comprising: selecting the prior key; and (Fig. 3; Par. [0011, 35-7, 46-7] one or more nodes contains microflow entries that checks aggregate workflow entries (#20-1) for devolvement actions (i.e. generate new definition for at least one new key; #20-2) associated with the entry)
modifying the definition of the prior key. (Fig. 3; Par. [0011, 35-7, 43, 46-7] one or more nodes contains microflow selection criterion that checks aggregate workflow entries for devolvement actions associated with the entry, including generating aa microflow entry (i.e. modifying the definition of the prior key; #20-2))
Regarding claim 21, John and Deen teach claim 20 as shown above, and John further teaches
The method of claim 20 further comprising generating a definition of another new key by modifying the definition of the prior key and providing this other new key to the set of host computers. (Par. [0043] a node (#14-1) sends the controller node (#12) a microflow generation information message including field values (i.e. new keys))
Regarding claim 22, John and Deen teach claim 19 as shown above, and John further teaches
The method of claim 19, wherein the new key specifies an attribute to include in the set of attributes that was not included in the set of attributes based on the discarded prior key. (Fig. 3; Par. [0011, 35-7, 43, 46-7] one or more controller nodes sends microflow selection criterion to an ingress nodes that checks aggregate workflow entries for devolvement actions associated with the entry, including generating a microflow entry (i.e. modifying the definition of the prior key with new information; #20-2))
Regarding claim 23, John and Deen teach claim 19 as shown above, and John further teaches
The method of claim 19, wherein the new key does not specify at least one attribute to include in the set of attributes that was specified in the discarded prior key. (Fig. 3; Par. [0011, 35-7, 43, 46-7] ingress nodes that checks aggregate workflow entries for devolvement actions associated with the entry, including generating aa microflow entry (i.e. modifying the definition of the prior key with new information; #20-2))
Regarding claim 24, John and Deen teach claim 19 as shown above, and John further teaches
The method of claim 19, wherein associating individual flows into groups of flows comprises generating for each group of flows a key value that is used to identify the individual flows that are grouped into the group of flows, a key value comprising a set of attribute values for each attribute in a set of attributes specified by an associated key. (Par. [0050-3] the devolved action contains any number of microflow selection criteria (i.e. key values containing a set of attribute values for each attribute))
Regarding claim 25, John and Deen teach claim 18 as shown above, and John further teaches
The method of claim 18, wherein each host computer uses the new key to identify the new group of flows, to collect a set of attributes for the new group, and to provide the collected set of attributes for the new group for analysis. (Par. [0066, 70-1] each devolved microflow is inherited (i.e. each host computer can use the new key) and capable of being associated with an aggregate flow entry (i.e. set of attributes for analysis))
Regarding claim 26, John and Deen teach claim 18 as shown above, and John further teaches
The method of claim 18, wherein at least one particular key specifies at least one condition that must be met for an attribute value of an individual flow in order for the individual flow to be grouped into a group of flows. (Par. [0066, 70-1] each devolved microflow is inherited and capable of being associated with an aggregate flow entry (i.e. set of attributes for analysis including conditions))
Regarding claim 27, John and Deen teach claim 9 as shown above, and John further teaches
The method of claim 26, wherein the condition specifies at least one range of values for the attribute value. (Par. [0050] the selection criteria (i.e. conditions) includes a range of values)
Regarding claim 28, John and Deen teach claim 18 as shown above, and John further teaches
The method of claim 18, wherein at least one particular key specifies at least one condition that must not be met for an attribute value of an individual flow in order for the individual flow to be grouped into a group of flows. (Par. [0050] the microflow selection criteria can comprise any desirable criteria for determining whether or not (i.e. condition not met) to devolve/generate a new microflow that would otherwise be aggregated into an aggregated flow)
Regarding claim 29, John and Deen teach claim 18 as shown above, and John further teaches
The method of claim 28, wherein the condition specifies a plurality of attribute values, wherein individual flows comprising any of the specified plurality of attribute values are not grouped into any group of flows for the key. (Par. [0050] the microflow selection criteria can comprise any desirable criteria for determining whether or not (i.e. condition not met) to devolve/generate a new microflow that would otherwise be aggregated (i.e. be grouped) into an aggregated flow)
Regarding claim 33, John and Deen teach claim 18 as shown above, and John further teaches
The method of claim 18, wherein at least one particular key specifies a manner of combining, for each attribute, attribute values in each individual flow into a set of attributes for the group of flows. (Par. [0050] the selection criteria (i.e. conditions) includes a range of values)
Regarding claim 34, John and Deen teach claim 18 as shown above, and John further teaches
The method of claim 33, wherein for a particular attribute, attribute values are combined by identifying unique values for the attribute in the individual flows in the group of flows. (Par. [0050] the selection criteria includes a range (i.e. unique values) of values)
Regarding claim 36, John and Deen teach claim 18 as shown above, and John further teaches
The method of claim 33, wherein for a particular attribute, attribute values are combined by summing the attribute values for the attribute from each individual flow in the group of flows. (Par. [0092] one of the additional attributes can include a sum of bytes/packets)
Claim(s) 30-32 and 37 is/are rejected under 35 U.S.C. 103 as being unpatentable over John et al. (WO 2016/018181) in view of Deen et al. (US Pub. 2016/0359914), and further in view of Gill et al. (US Pub. 2018/0309637).
Regarding claim(s) 30, John and Deen teach claim 18 as shown above, but do not explicitly teach
The method of claim 18, wherein at least one particular key specifies that a set of values for a particular attribute are considered equivalent when identifying, for an individual flow, a group of flows.
However, from the same field Gill teaches
The method of claim 18, wherein at least one particular key specifies that a set of values for a particular attribute are considered equivalent when identifying, for an individual flow, a group of flows. (Par. [0003, 5, 69] in this instance, a service is monitored by grouping functionally equivalent service-level objectives)
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to combine the functional groups of Gill into the aggregation criteria of John. The motivation for this combination would have been to improve scalability of real-time analysis as explained in Gill (Par. [0083]).
Regarding claim(s) 31, John and Gill teach claim 30 as shown above, and Gill further teaches
The method of claim 30, wherein the set of values is a first set of values and is specified by specifying a second set of values that are not in the first set. (Par. [0003, 5, 69] in this instance, a service is monitored by grouping functionally equivalent (i.e. different sets) service-level objectives)
Regarding claim(s) 32, John and Gill teach claim 31 as shown above, and Gill further teaches The method of claim 31, wherein at least one of the first and second sets is specified using at least one range of values. (Par. [0003, 5, 69] in this instance, a service is monitored by grouping functionally equivalent service-level objectives (i.e. range of values))
Regarding claim(s) 37, John and Gill teach claim 31 as shown above, and Gill further teaches
The method of claim 33, wherein for a particular attribute, attribute values are combined by keeping an extreme attribute value for the attribute from the individual flows in the group of flows.
However, from the same field Gill teaches
The method of claim 33, wherein for a particular attribute, attribute values are combined by keeping an extreme attribute value for the attribute from the individual flows in the group of flows. (Par. [0094] composite logs summarize a set of events, including information associated with the standard deviation (i.e. extreme attribute values))
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to combine the statistical groups of Gill into the aggregation criteria of John. The motivation for this combination would have been to improve scalability of real-time analysis as explained in Gill (Par. [0083]).
Claim(s) 35 is/are rejected under 35 U.S.C. 103 as being unpatentable over John et al. (WO 2016/018181) in view of Deen et al. (US Pub. 2016/0359914), and further in view of Mehta et al. (US Pub. 2014/0129700).
Regarding claim(s) 35, John and Deen teach claim 18 as shown above, but not explicitly teach
The method of claim 33, wherein for a particular attribute, attribute values are combined by concatenating attribute values for the attribute from individual flows in the group of flows.
However, from the same field Mehta teaches
The method of claim 33, wherein for a particular attribute, attribute values are combined by concatenating attribute values for the attribute from individual flows in the group of flows. (Par. [0156] the user-visible entry allows a user to define the manner in which to aggregate data, including concatenation)
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to combine concatenation of Mehta into the aggregation criteria of John. The motivation for this combination would have been to improve tracing as explained in Mehta (Par. [0026]).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to J MITCHELL CURRAN whose telephone number is (469)295-9081. The examiner can normally be reached M-F 8:00am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sherief Badawi can be reached on (571) 272-9782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J MITCHELL CURRAN/Examiner, Art Unit 2161
/SHERIEF BADAWI/Supervisory Patent Examiner, Art Unit 2169