Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Applicant’s claim for the benefit of U.S. Provisional Application 63/419825, filed on 27 October 2022, is acknowledged.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4, 7-9, 10-13, 16-18, 19-22, and 25-27 are rejected under 35 U.S.C. 103 as being unpatentable over Madden Pub. No. US 2023/0074799 A1 in view of Poirel et al. Pub. No. US 2021/0271740 A1 (hereafter Poirel).
Regarding the method of claim 1, Madden teaches “A method, comprising: detecting, by one or more data processing apparatus, an event on a communications network (Fig. 1 & [Abs] teaches a method for detecting flapping events in a computer system by a flapping detection component);
extracting, by the one or more data processing apparatus, two or more fields of event data of the event ([0049] teaches obtaining a plurality of metrics within a time window such that the time window represents the events that may be occurring);
creating, by the one or more data processing apparatus, a given event signature that … represents characteristics of the event … ([0049-0051] teaches the plurality of metric values indicate a state of a computer system at various times in a window such that each time window may represent a different event; [0014] teaches of multiple overlapping time windows;
tracking, in a tracking data structure, a magnitude of instances of the given event … that are encountered over a tracking period ([0051-0052] teaches storing timestamps in a data storage of when flapping occurred in the system);
classifying, by the one or more data processing apparatus the event as a flapping event based on a determination that the magnitude indicates that the given event … has been encountered at least a threshold number of times within a specified amount of time ([0053-0054] teaches that if a computer system has been flapping for longer than a predefined threshold, it triggers a remedial action such that it has been defined as a flapping event that needs attention);
and excluding, by the one or more data processing apparatus, one or more event processing operations from being performed for one or more events having event[s] … matching the given event … based on the classification of the event as a flapping event ([0054] teaches of triggering remedial action in response to the system being determined as a flapping event after exceeding a threshold, and such actions include generating an alert, killing off running database queries, signaling clients and users to back off, etc. such that it excludes/stops the processing of the event).”
Madden teaches of multiple time windows in [0014] which may represent a timeframe of the event being monitored for flapping.
Madden does not explicitly teach a function for generating a unique event signature from the event metrics gathered.
Poirel teaches generating a hash from metrics of an event such that it teaches the limitation “creating, by the one or more data processing apparatus, a given event signature that uniquely represents characteristics of the event using a function that generates the given event signature as an output in response to receiving the two or more fields of event data as input ([0174] teaches of event data segments being extracted, concatenated, then generated into a hash, which may be globally unique identifiers (GUIDS); it represents the two or more fields of event data being turned into a unique event signature).”
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the claimed invention to have implemented the hashing functions of Poirel to the invention of Madden to generate a unique event signature from the plurality of metrics gathered. A person having ordinary skill in the art would have been motivated to make this combination for the purpose of precisely tracking events, especially if they are required to record multiple instances of the same event occurring for future comparison operations. (Poirel [0175-0176]).
Regarding the system of claim 10, it is similar to claim 1 and is rejected for the same reasons. Claim 10 is directed towards “A system comprising: a data structure; and a network management system comprising one or more data processing apparatus configured to interact with the data structure and execute instructions that cause the one or more data processing apparatus to perform operations (Madden [0061-0074] Figs. 1, 6A, 6B teach of a system comprising services; Multi-tenant Database(s) being where the flapping detection component may be used).”
Regarding the non-transitory computer readable medium of claim 19, it is similar to claim 1, and is rejected for the same reasons. Claim 19 is directed towards “A non-transitory computer readable medium storing instructions that, upon execution by one or more data processing apparatus, cause the one or more data processing apparatus to perform operations (Madden [0061]).”
Regarding the method claim 2, the combination teaches “The method of claim 1, wherein excluding one or more event processing operations from being performed comprises: encountering an additional event signature; determining that (i) the additional event signature matches the given event signature, and (ii) the event is currently classified as a flapping event; and preventing processing of the one or more events corresponding to the additional event signature based on the determination that (i) the additional event signature matches the given event signature, and (ii) the event is currently classified as a flapping event (Madden [0052-0054] teaches that flapping timestamps associated with time windows that overlap may trigger remedial action such that multiple of the same event signatures are detected, causing the combined length of flapping to be longer than a threshold, and triggering remedial action such as signaling to clients/users to back off from the flapping event. Poirel [0176] teaches that if a hash value of the event is currently present in a repository, then it is designated as a duplicate, a deduplicated event such that it represents the same event flapping multiple times, then may be sent for additional processing).”
Regarding the system of claim 11, it is similar to claim 2, and is rejected for the same reasons.
Regarding the non-transitory computer readable medium of claim 20, it is similar to claim 2, and is rejected for the same reasons.
Regarding the method of claim 3, wherein the combination, Poirel teaches “The method of claim 1, wherein creating the given event signature that uniquely represents characteristics of the detected event comprises computing a given hash of a concatenation of the two or more fields of event data of the event ([0174] teaches event data segments being concatenated and then computed into a hash value, creating a GUID).”
Regarding the system of claim 12, it is similar to claim 3, and is rejected for the same reasons.
Regarding the non-transitory computer readable medium of claim 21, it is similar to claim 3, and is rejected for the same reasons.
Regarding the method of claim 4, wherein the combination, Poirel teaches “The method of claim 3, further comprising: generating a subsequent hash of a concatenation of the two or more fields of event data for each subsequent event ([0174] teach generating a hash value from concatenated event data segments); and tracking the subsequent hashes generated for the subsequent events ([0175-0176] teach tracking the hash values such that it determines if the hash values are already in a repository, and if they are then indicate that the event is a deduplicated event, resulting in additional processing required).”
Regarding the system of claim 13, it is similar to claim 4, and is rejected for the same reasons.
Regarding the non-transitory computer readable medium of claim 22, it is similar to claim 4, and is rejected for the same reasons.
Regarding the method of claim 7, the combination teaches “The method of claim 4, wherein: tracking the subsequent hashes comprises: searching a time log structure for the subsequent hash of each of the subsequent events (Madden [0042-0047] teaches storing timestamps of time windows in a data storage. Poirel [0176] teaches searching hashes such that they are the time windows with the timestamps; event data may contain timestamp information as described in Poirel [0061]);
in response to not identifying an entry in the time log structure that matches the subsequent hash: creating an entry in the time log structure corresponding to the subsequent hash; and adding a timestamp corresponding to the subsequent hash to the entry (Poirel [0176] teaches adding a hash into the repository when no matches are found, such that timestamps related to the hash would be added if no previous values were present); after creating the entry in the time log structure corresponding to the subsequent hash, adding an additional timestamp corresponding to each subsequent hash that is identified as a match to the entry; and classifying the event as a flapping event comprises determining that a number of stored timestamps for the entry has reached a threshold level (Madden [0014] teaches storing timestamps associated with time windows when the system was determined to be flapping such that it may store multiple timestamps corresponding to subsequent hashes, and when the computer system has been flapping for longer than a threshold time, it triggers remedial action such that it may be classified as a flapping event).”
Regarding the system of claim 15, it is similar to claim 7, and is rejected for the same reasons.
Regarding the non-transitory computer readable medium of claim 24, it is similar to claim 7, and is rejected for the same reasons.
Regarding the method of claim 8, wherein the combination, Madden teaches “The method of claim 7, further comprising: in response to identifying the entry in the time log structure, removing one or more timestamps that are more than a specified amount of time prior to a current time ([0042-0047] teaches sliding time windows and timestamps that are recorded within these time windows, and would result in removing timestamps as a result of determining that the system has been flapping for longer than the threshold and requires remediation. Fig. 4 also shows times of flapping incidents stored within a sliding time window such that duplicate timestamps would be replaced by the following same timestamp of the next sliding window, thus removing and adding timestamps as seen in Fig. 3).”
Regarding the system of claim 17, it is similar to claim 8, and is rejected for the same reasons.
Regarding the non-transitory computer readable medium of claim 26, it is similar to claim 8, and is rejected for the same reasons.
Regarding the method of claim 9, the combination teaches “The method of claim 1, further comprising: comparing a subsequent timestamp of a subsequent instance of the given event signature to a prior timestamp of a prior instance of the given event signature that is stored in the tracking data structure (Madden [0042], Poirel [0176]); removing the prior timestamp from the tracking data structure based on a determination that the subsequent timestamp is more than the specified amount of time after the prior timestamp (Madden [0044] teaches deleting timestamps after remediation and moving onto the next sliding time window which may include the same event but at a later time than the previous);
adding the subsequent timestamp to the tracking data structure (Madden [0042], Poirel [0176]); and updating a classification of the event represented by the given event signature based on an updated magnitude of instances of the given event signature determined following removal of the prior timestamp and addition of the subsequent timestamp, wherein updating the classification of the event comprises reclassifying the event as a non-flapping event. (Madden [0044-0046] teach removing a timestamp, representing a return to a non-flapping state following the remedial action triggered by the threshold being met).”
Regarding the system of claim 18, it is similar to claim 9, and is rejected for the same reasons.
Regarding the non-transitory computer readable medium of claim 27, it is similar to claim 9, and is rejected for the same reasons.
Claims 5-6, 14-15, and 23-25 are rejected under 35 U.S.C. 103 as being unpatentable over Madden and Poirel as applied in claims 1, 4, 10, 13, 19, and 22 above, and in further view of Solter et al. Pub. No. US 2004/0088716 A1 (hereafter Solter).
Regarding the method of claim 5, the combination teaches “The method of claim 4, wherein: tracking the subsequent hashes comprises: searching a … structure for the subsequent hash of each of the subsequent events (Poirel [0176] teaches hash comparison in a database such that it teaches searching a structure for the hash of a duplicated event);
in response to not identifying an entry in the … structure that matches the subsequent hash, creating an entry in the … structure corresponding to the subsequent hash (Poirel [0176] teaches adding the hash into the repository when there is no matching hash already present);
and classifying the event as a flapping event comprises determining that the … entry has reached a threshold level (Madden [0044] teaches triggering action when a threshold is met such that it can be classified as a flapping event that needs remediation).”
The combination teaches identifying matching hashes of subsequent events and flagging them as duplicated events, however does not explicitly teach a counter structure used to keep track of how many times the hash is detected such that it may represent a threshold.
Solter teaches a counter structure with hashes such that it teaches the limitation “and after creating the entry in the counter structure corresponding to the subsequent hash, incrementing a counter corresponding to the entry in response to identifying the entry as a match another of the subsequent hashes ([0014-0015] teaches a hash lookup table, and incrementing a counter every time a name/value pair is found for the event)”.
It would have been obvious to a person having ordinary skill in the art prior to the effective filing date of the claimed invention to have implemented counter structure of Solter to the combination of Madden and Poirel keep track of repeated occurring events. A person having ordinary skill in the art would have been motivated to make this combination for the purpose of keeping track of events for future threshold comparison.
Regarding the system of claim 14, it is similar to claim 5, and is rejected for the same reasons.
Regarding the non-transitory computer readable medium of claim 23, it is similar to claim 5, and is rejected for the same reasons.
Regarding the method of claim 6, the combination teaches “The method of claim 5, further comprising: determining that a given timestamp corresponding to a given subsequent hash is more than a specified amount of time after a reference timestamp corresponding to the entry (Madden [0014] teaches a baseline length within a time window, and a combined length; they are then compared to determine whether the system flapped such that it stores timestamps associated with time windows during which the computer was flapping, and having multiple overlapping time windows (sliding time window) would cause a timestamp to be more than a specified time if a later time window was determined to be flapping compared to the baseline time window);
and updating the reference timestamp based on the given timestamp in response to determining that the given timestamp is more than the specified amount of time after the reference timestamp (Madden [0044] teaches deleting the timestamp for a certain time window given it has been flapping longer than a threshold length of time, and then moving onto the next time window. Madden [0030] talks about taking a timestamp associated with the most recent time window and subtracting it against the first timestamp such that the timestamp is more than the specified amount of time after the original reference timestamp, and causes a new timestamp for when flapping occurred).”
Regarding the system of claim 15, it is similar to claim 6, and is rejected for the same reasons.
Regarding the non-transitory computer readable medium of claim 24, it is similar to claim 6, and is rejected for the same reasons.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRANDON A NGUYEN whose telephone number is (571)272-6074. The examiner can normally be reached Mon-Fri (10am-6pm).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Aimee Li can be reached at (571) 272-4169. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRANDON NGUYEN/Examiner, Art Unit 2195
/Aimee Li/Supervisory Patent Examiner, Art Unit 2195