DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
This is in response to an amendment/response filed 12/17/2025.
No claims have been cancelled.
No claims have been added.
Claims 1-20 are now pending.
Applicant’s amendments to the claims have overcome each and every rejection under 35 U.S.C. 112(b) previously set forth in the Non-Final Office Action mailed 9/17/2025.
Response to Arguments
Applicant’s arguments with respect to the independent claims (pages 9-10) in a reply filed 12/17/2025 have been considered but are moot because the arguments are based on newly changed limitations in the amendment and new ground of rejections using newly introduced references or a newly introduced portion of an existing reference are applied in the current rejection.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1, 16, and 20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Wetterwald et al. US 20190349392 (hereinafter “Wetterwald”).
As to claim 1, 16, and 20 (claim 1 is the method claim for the non-transitory computer-readable medium in claim 16 and apparatus in claim 20):
Wetterwald discloses:
A method, comprising: observing periodic communications in a communication network with automated systems for packet inter-arrival times (“According to one or more embodiments of the disclosure, a device receives data indicative of packet arrival times at a plurality of nodes along a path in a deterministic network.”, Wetterwald [0012]) of the periodic communications between devices of the communication network; (“In one embodiment, an OAM packet may be sent along the deterministic path, to capture timestamps at each of the receiving devices, which can then be compared hop-by-hop with a reference. Such an OAM packet may be sent periodically or on demand, in various cases. For example, in FIG. 4A, device 200a may send OAM packet 402 to device 200b, according to the deterministic communication schedule for path 400. In turn, in FIG. 4B, device 200b may timestamp OAM packet 402 and forward it on to device 200c during its own scheduled communication interval. This process may be repeated any number of times as packet 402 propagates along path 400. In turn, a device detecting an anomaly in OAM packet 402 may use OAM packet 402 as a time base for the flow. In other words, the device may consider that OAM packet 402 was received in due time and skew its sense of time as OAM packet 402 indicates for that particular flow.”, Wetterwald [0066])
modeling, based at least in part on the observing, a distribution of the packet inter-arrival times between the devices; (“According to various embodiments, time synchronization anomaly detection process 248 may include one or more machine learning-based models that take as input any or all of the following input data: [0070] Timestamp data 502 from OAM probes—e.g., the per-hop timestamps added to an OAM packet sent along a deterministic path.”, Wetterwald [0069]) (“In a simple case, time synchronization anomaly detection process 248 may detect a time synchronization anomaly using models 514-516 by assessing the statistical deviation of arrival times at each hop. In further embodiments, time synchronization anomaly detection process 248 may use model 514-516 to perform regression of quantile on the expected times at each hop. Since the time scheduled is known to process 248 (e.g., from deterministic communication schedule 512), and timestamped of arrival of packets are provide by OAM probing (e.g., timestamp data 502), it becomes possible for process 248 to compute for each packet the delta between the effective arrival and expected delivery interval according to the schedule. In a perfect world, the difference between the arrival time and scheduled delivery time, delta, (where I is the packet index), should always be equal to zero in a deterministic network. An alternative approach to detecting time synchronization anomalies entails extending path-level model 514 to cover the total transit time along the deterministic path, e.g., (departure_time−arrival_time), to take into account the device delays.”, Wetterwald [0077])
detecting, based at least in part on the distribution, a change in a period of the packet inter-arrival times between the devices, where the change is from a periodic interval to a non-periodic interval; (“FIG. 5 illustrates an example architecture 500 for detecting time synchronization attacks in a deterministic network, according to various embodiments. At the core of architecture 500 is time synchronization anomaly detection process 248, which may be executed by a node/device 200 in a network, such as a hop along a deterministic network path, path endpoint, or a device in communication therewith. According to various embodiments, time synchronization anomaly detection process 248 may include one or more machine learning-based models that take as input any or all of the following input data: [0070] Timestamp data 502 from OAM probes—e.g., the per-hop timestamps added to an OAM packet sent along a deterministic path.”, Wetterwald [0069])
and mitigating the change in the packet inter-arrival times between the devices. (“At step 625, as described in greater detail above, the device may cause the performance of a mitigation action in the network based on the detected time synchronization anomaly. Such a mitigation action may be selected based on the type of anomaly, in some cases (e.g., whether the anomaly is suspected of being indicative of an actual attack). For example, the mitigation action may include any or all of the following: blocking traffic from one or more of the nodes along the path, sending an anomaly detection alert, adjusting the deterministic communication schedule, or clock re-synchronization of the nodes along the path. Procedure 600 then ends at step 630.”, Wetterwald [0088])
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 2 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald, as applied to claim 1 above, and further in view of Liu et al. US 20220150143 (hereinafter “Liu”)
As to claim 2 and 17 (claim 2 is the method claim for the non-transitory computer-readable medium in claim 17):
Wetterwald as described above does not explicitly teach:
The method as in claim 1, wherein the problematic change is a change in periodicity of the packet inter-arrival times above a certain threshold.
However, Liu further teaches determining that a traffic flow is new if the IAT is over the period threshold which includes:
The method as in claim 1, wherein the problematic change is a change in periodicity of the packet inter-arrival times above a certain threshold. (“For instance, a packet having a particular 5-tuple that is the same as a last seen packet with the same 5-tuple, may be assigned to the same traffic flow if the inter-arrival time is below a threshold period of time (e.g., within 5 minutes, within 10 minutes, etc.), but may be considered to be a new traffic flow if the inter-arrival time is at or over the threshold period of time.”, Liu [0016])
Wetterwald and Liu are analogous because they pertain to monitoring IAT.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include determining that a traffic flow is new if the IAT is over the period threshold as described in Liu into Wetterwald. By modifying the method to include determining that a traffic flow is new if the IAT is over the period threshold as taught by Liu, the benefits of improved network monitoring (Liu [0016] and Wetterwald [0088]) are achieved.
Claim(s) 3, 6, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald, as applied to claim 1 above, and further in view of Teslenko et al. US 20200193999 (hereinafter “Teslenko”)
As to claim 3 and 18 (claim 3 is the method claim for the non-transitory computer-readable medium in claim 18):
Wetterwald as described above does not explicitly teach:
The method as in claim 1, wherein the problematic change is an unlikely jitter of the packet inter-arrival times accordingly to a probability threshold.
However, Teslenko further teaches determining inter-arrival jitter to be a statistical variance of the data packet inter-arrival time where the arrival time is above a threshold which includes:
The method as in claim 1, wherein the problematic change is an unlikely jitter of the packet inter-arrival times accordingly to a probability threshold. (“The inter arrival jitter could be estimated as the statistical variance of the data packet inter arrival time, where a data packet inter arrival time being higher than a threshold indicates poor audio quality. The last received timestamp of a sender report and the delay since the last sender report can be used to estimate the total round-trip-time, where a total round-trip-time higher than a threshold indicates poor audio quality.”, Teslenko [0064])
Wetterwald and Teslenko are analogous because they pertain to monitoring IAT.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include determining inter-arrival jitter to be a statistical variance of the data packet inter-arrival time where the arrival time is above a threshold as described in Teslenko into Wetterwald. By modifying the method to include determining inter-arrival jitter to be a statistical variance of the data packet inter-arrival time where the arrival time is above a threshold as taught by Teslenko, the benefits of improved network monitoring (Teslenko [0064] and Wetterwald [0088]) are achieved.
As to claim 6:
Wetterwald as described above does not explicitly teach:
The method as in claim 1, wherein the problematic change is based on a determined threshold.
However, Teslenko further teaches determining inter-arrival jitter to be a statistical variance of the data packet inter-arrival time where the arrival time is above a threshold which includes:
The method as in claim 1, wherein the problematic change is based on a determined threshold. (“The device can identify, via the selected predictor of the health of the link, that the link has high jitter based on a predetermined jitter threshold, and move one or more connections with a difference in inter-arrival time into the device and inter-departure time of a queue of the device is above a predetermined threshold.”, Gupta [0018])
Wetterwald and Teslenko are analogous because they pertain to monitoring IAT.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include determining inter-arrival jitter to be a statistical variance of the data packet inter-arrival time where the arrival time is above a threshold as described in Teslenko into Wetterwald. By modifying the method to include determining inter-arrival jitter to be a statistical variance of the data packet inter-arrival time where the arrival time is above a threshold as taught by Teslenko, the benefits of improved network monitoring (Teslenko [0064] and Wetterwald [0088]) are achieved.
Claim(s) 4 is rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald, as applied to claim 1 above, and further in view of Matsunaga et al. WO 2023105705 (hereinafter “Matsunaga”)
As to claim 4:
Wetterwald as described above does not explicitly teach:
The method as in claim 1, wherein detecting the problematic change comprises: filtering out isolated jitter events.
However, Matsunaga further teaches filtering jitter component which includes:
The method as in claim 1, wherein detecting the problematic change comprises: filtering out isolated jitter events. (“Further, in the time stamp correction system 121, by configuring the moving average filter 1215 in multiple stages, the slope 154 of the low-pass filter characteristic of the moving average filter 1215 becomes steeper, the jitter component can be reduced, and the jitter component can be reduced with higher accuracy and stability. Can block high frequency signals. On the other hand, there is a delay in tracking the variation of T .sub.packet , but this delay is not a problem in a biological data measurement system that cuts DC components.”, Matsunaga [page 5, line 28])
Wetterwald and Matsunaga are analogous because they pertain to monitoring IAT.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include filtering jitter component as described in Matsunaga into Wetterwald. By modifying the method to include filtering jitter component as taught by Matsunaga, the benefits of improved network monitoring (Matsunaga [page 5, line 28] and Wetterwald [0088]) are achieved.
Claim(s) 5 and 19 is rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald, as applied to claims 1 and 16 above, and further in view of Kaneko et al. US 20190356564 (hereinafter “Kaneko”)
As to claim 5 (claim 5 is the method claim for the non-transitory computer-readable medium in claim 19):
Wetterwald as described above does not explicitly teach:
The method as in claim 1, wherein the problematic change is an observation of intermittent disconnections between the particular devices.
However, Matsunaga further teaches monitoring for disconnections between devices which includes:
The method as in claim 1, wherein the problematic change is an observation of intermittent disconnections between the particular devices. (“Further, nodes are disconnected by performing four handshakes setting a FIN (Finish) bit and an ACK bit of TCP headers, monitoring of which allows to detect a disconnection of the session.”, Kaneko [0018])
Wetterwald and Kaneko are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include monitoring for disconnections between devices as described in Kaneko into Wetterwald. By modifying the method to include monitoring for disconnections between devices as taught by Kaneko, the benefits of improved network monitoring (Kaneko [0018] and Wetterwald [0088]) are achieved.
Claim(s) 7 is rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald, as applied to claim 1 above, and further in view of Ganesan et al. US 20230198855 (hereinafter “Ganesan”)
As to claim 7:
Wetterwald as described above does not explicitly teach:
The method as in claim 1, wherein modeling the distribution uses a mixture of Gaussians.
However, Ganesan further teaches Gaussian mixture model which includes:
The method as in claim 1, wherein modeling the distribution uses a mixture of Gaussians. (“Any of a variety of ML model types may be used. For example, the ML model 132 may be a neural network, a support vector machine, a classifier, a regression model, a clustering model, a decision tree, a random forest model, a genetic algorithm, a generative adversarial network, a reinforcement learning model, a Bayesian model, or a Gaussian mixture model. The training process can be performed using iterative, incremental adjustments to the value of model parameters to shift the nature of inference predictions of the model toward the labeled data.”, Ganesan [0045])
Wetterwald and Ganesan are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include Gaussian mixture model as described in Ganesan into Wetterwald. By modifying the method to include Gaussian mixture model as taught by Ganesan, the benefits of improved network monitoring (Ganesan [0045] and Wetterwald [0088]) are achieved.
Claim(s) 8-10 are rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald, as applied to claim 1 above, and further in view of Ahmed et al. WO 2022015246 (hereinafter “Ahmed”)
As to claim 8:
Wetterwald as described above does not explicitly teach:
The method as in claim 1 wherein the communication network comprises an industrial network.
However, Ahmed further teaches anomaly detection in IAT in an industrial network which includes:
The method as in claim 1 wherein the communication network comprises an industrial network. (“However, various example embodiments note that anomaly or attack detection in inter arrival time of packets alone does not work well in practice. Accordingly, various example embodiments advantageously provide a PLC fingerprinting method to fingerprint PLCs by exploiting scan cycle timing information and a PLC watermarking method to detect a powerful cyber attacker that is aware of timing profiles used for fingerprinting, for example, replay attacks.”, Ahmed [0075])
Wetterwald and Ahmed are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include anomaly detection in IAT in an industrial network as described in Ahmed into Wetterwald. By modifying the method to include anomaly detection in IAT in an industrial network as taught by Ahmed, the benefits of improved network monitoring (Ahmed [0075] and Wetterwald [0088]) are achieved.
As to claim 9:
Wetterwald as described above does not explicitly teach:
The method as in claim 1, wherein the particular devices of the communication network comprise low-level autonomous devices.
However, Ahmed further teaches anomaly detection in IAT in an industrial network using low-level autonomous devices which includes:
The method as in claim 1, wherein the particular devices of the communication network comprise low-level autonomous devices. (“In various example embodiments, experiments were performed on a total of six Allen Bradley PLCs available in the SWaT testbed and four Wago PLCs, four Siemens IEDs in EPIC testbed.”, Ahmed [0074])
Wetterwald and Ahmed are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include anomaly detection in IAT in an industrial network using low-level autonomous devices as described in Ahmed into Wetterwald. By modifying the method to include anomaly detection in IAT in an industrial network using low-level autonomous devices as taught by Ahmed, the benefits of improved network monitoring (Ahmed [0075] and Wetterwald [0088]) are achieved.
As to claim 10:
Wetterwald as described above does not explicitly teach:
The method as in claim 1, wherein the particular devices of the communication network comprise one or more of programmable logic controllers or input/output modules.
However, Ahmed further teaches anomaly detection in IAT in an industrial network using low-level autonomous devices including PLCs which includes:
The method as in claim 1, wherein the particular devices of the communication network comprise one or more of programmable logic controllers or input/output modules. (“In various example embodiments, experiments were performed on a total of six Allen Bradley PLCs available in the SWaT testbed and four Wago PLCs, four Siemens IEDs in EPIC testbed.”, Ahmed [0074])
Wetterwald and Ahmed are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include anomaly detection in IAT in an industrial network using low-level autonomous devices including PLCs as described in Ahmed into Wetterwald. By modifying the method to include anomaly detection in IAT in an industrial network using low-level autonomous devices including PLCs as taught by Ahmed, the benefits of improved network monitoring (Ahmed [0075] and Wetterwald [0088]) are achieved.
Claim(s) 11-13 are rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald, as applied to claim 1 above, and further in view of Kushnir et al. US 20160162346 (hereinafter “Kushnir”)
As to claim 11:
Wetterwald as described above does not explicitly teach:
The method as in claim 1, further comprising: performing root cause analysis on the problematic change.
However, Kushnir further teaches root cause analysis which includes:
The method as in claim 1, further comprising: performing root cause analysis on the problematic change. (“Various exemplary embodiments relate to a method of determining the root cause of service degradation in a network, the method including determining a window of time; determining one or more abnormal Key Quality Indicators (KQIs) in the window; determining one or more abnormal Key Performance Indicators (KPIs) in the window; calculating a conditional probability that each of one or more KPIs is abnormal when a Key Quality Indicator (KQI) is normal; calculating a conditional probability that the each of one or more KPIs is abnormal when the KQI is abnormal”, Kushnir [0004])
Wetterwald and Ahmed are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include root cause analysis as described in Kushnir into Wetterwald. By modifying the method to include root cause analysis as taught by Kushnir, the benefits of improved network monitoring (Kushnir [0004] and Wetterwald [0088]) are achieved.
As to claim 12:
Wetterwald as described above does not explicitly teach:
The method as in claim 11, wherein performing root cause analysis comprises: correlating the problematic change with CPU load.
However, Kushnir further teaches root cause analysis which includes:
The method as in claim 11, wherein performing root cause analysis comprises: correlating the problematic change with CPU load. (“FIG. 1 illustrates an exemplary system 100 for inferring the root causes of network issues. A system which may include a network 105 may include a number of components such as network elements and devices which may sampled for Key Performance Indicators (KPIs) and for Key Quality Indicators (KQIs), which may differ depending on the type of network or system. In a telecommunications network, for example, KPIs may include metrics such as, for example, buffer size load, device power consumption, CPU, memory, hard disk utilization, interface utilization, packet drop rate, buffer occupancy, counters, call success rate, channel congestion, call drop rate, data packet loss rate, call setup time, and handover success rate. KQIs may include, for example, data rates, voice call quality measures, average call failures per network node, throughput, web page response time, latency, packet loss rate, jitter, voice MOS, call accessibility, call retainability, mobility, and data throughput. KQIs for user connection sessions and network KPIs may be collected from the components of network 105 and sent 110, 115 to an inference engine 120 for processing. Key Quality Indicators may be measured on a network level, on a device level, or in some cases on a device or system component level, such that each KQI be at least associated with a particular device or group of devices.”, Kushnir [0021])
Wetterwald and Ahmed are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include root cause analysis as described in Kushnir into Wetterwald. By modifying the method to include root cause analysis as taught by Kushnir, the benefits of improved network monitoring (Kushnir [0004] and Wetterwald [0088]) are achieved.
As to claim 13:
Wetterwald as described above does not explicitly teach:
The method as in claim 11, wherein performing root cause analysis comprises: correlating the problematic change with interface utilization.
However, Kushnir further teaches root cause analysis which includes:
The method as in claim 11, wherein performing root cause analysis comprises: correlating the problematic change with interface utilization. (“FIG. 1 illustrates an exemplary system 100 for inferring the root causes of network issues. A system which may include a network 105 may include a number of components such as network elements and devices which may sampled for Key Performance Indicators (KPIs) and for Key Quality Indicators (KQIs), which may differ depending on the type of network or system. In a telecommunications network, for example, KPIs may include metrics such as, for example, buffer size load, device power consumption, CPU, memory, hard disk utilization, interface utilization, packet drop rate, buffer occupancy, counters, call success rate, channel congestion, call drop rate, data packet loss rate, call setup time, and handover success rate. KQIs may include, for example, data rates, voice call quality measures, average call failures per network node, throughput, web page response time, latency, packet loss rate, jitter, voice MOS, call accessibility, call retainability, mobility, and data throughput. KQIs for user connection sessions and network KPIs may be collected from the components of network 105 and sent 110, 115 to an inference engine 120 for processing. Key Quality Indicators may be measured on a network level, on a device level, or in some cases on a device or system component level, such that each KQI be at least associated with a particular device or group of devices.”, Kushnir [0021])
Wetterwald and Ahmed are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include root cause analysis as described in Kushnir into Wetterwald. By modifying the method to include root cause analysis as taught by Kushnir, the benefits of improved network monitoring (Kushnir [0004] and Wetterwald [0088]) are achieved.
Claim(s) 14 is rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald in view of Kushnir, as applied to claim 11 above, and further in view of Kaluza et al. US 20170213142 (hereinafter “Kaluza”)
As to claim 14:
The combination of Wetterwald and Kushnir as described above does not explicitly teach:
The method as in claim 11, wherein performing root cause analysis comprises: correlating the problematic change with network reconfiguration or device reprogramming
However, Kaluza further teaches performing root cause analysis and correlating the incident to system changes over time which includes:
The method as in claim 11, wherein performing root cause analysis comprises: correlating the problematic change with network reconfiguration or device reprogramming. (“An aspect of an embodiment of the disclosure relates to a system and method for locating a root cause for incidents in an information technology system. The system collects configuration items and other system parameters, then identifies changes over time in these items. When an incident occurs the system collects changes from a predetermined time prior to the incident for analysis. For each change the system determines a lifetime value representing the time that the change could have an effect on the system and be the cause of the incident. Some changes can affect the system indefinitely and some changes may be limited to affect the system only for a specific time, for example a day or two, whereas after that the incident is clearly not the result of that change.”, Kaluza [0007])
Wetterwald and Ahmed are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include performing root cause analysis and correlating the incident to system changes over time as described in Kaluza into Wetterwald as modified by Kushnir. By modifying the method to include performing root cause analysis and correlating the incident to system changes over time as taught by Kaluza, the benefits of improved network monitoring (Kaluza [0007], Kushnir [0004], and Wetterwald [0088]) are achieved.
Claim(s) 15 is rejected under 35 U.S.C. 103 as being unpatentable over Wetterwald in view of Kushnir, as applied to claim 11 above, and further in view of Breitgand et al. US 7489639 (hereinafter “Breitgand”)
As to claim 15:
The combination of Wetterwald and Kushnir as described above does not explicitly teach:
The method as in claim 11, wherein performing root cause analysis comprises: correlating the problematic change with one or more physical connectivity issues.
However, Breitgand further teaches performing root cause analysis and correlating the incident to physical connectivity issues which includes:
The method as in claim 11, wherein performing root cause analysis comprises: correlating the problematic change with one or more physical connectivity issues. (“When a performance problem is reported by a consumer of a resource in such a network, such as an application running on a server, it is likely that the root cause of the problem can be found at some node along an I/O path connecting the consumer to a provider of the resource to this consumer, such as a storage logical unit located on a back-end disk controller. Therefore, embodiments of the present invention first locate the I/O paths within the network that serve the consumer in question, and then focus the search for problematic nodes along these paths.”, Breitgand [10]) (“Each edge in the graph SG represents a link connecting a pair of nodes or super-nodes. The link may represent a physical connection (such as a communication link) or a logical relationship (such as an address mapping) between the nodes. The address mappings recorded in the mapping tables in database 44, for example, are represented by the logical links between the nodes in the SAN graph. In contrast to the physical links, the logical links may connect nodes that are not directly connected in the physical topology of the SAN. Logical links are represented in the graph by directed edges. For example, the logical link between LV1 of HOST 1 and LU1 of the disk controller labeled DISK 1 in FIG. 3 represents address mapping 86 between the storage consumer and the provider.”, Breitgand [23])
Wetterwald and Ahmed are analogous because they pertain to network monitoring.
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include performing root cause analysis and correlating the incident to physical connectivity issues as described in Breitgand into Wetterwald as modified by Kushnir. By modifying the method to include performing root cause analysis and correlating the incident to physical connectivity issues as taught by Breitgand, the benefits of improved network monitoring (Breitgand [10], Kushnir [0004], and Wetterwald [0088]) are achieved.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ANDREW C KIM whose telephone number is (703)756-5607. The examiner can normally be reached M-F 9AM - 5PM (PST).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sujoy K Kundu can be reached at (571) 272-8586. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/A.C.K./
Examiner
Art Unit 2471
/SUJOY K KUNDU/Supervisory Patent Examiner, Art Unit 2471