Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Response to Arguments
Applicant's arguments filed 2/26/2026 have been fully considered, but cannot be held as persuasive. On page 9, Applicant begins by arguing that the previously relied upon prior art combinations fail to disclose the subject matter claimed, and that the combinations of references made under 35 USC 103 are invalid. To support these assertions, on page 10, Applicant argues that Maroulis fails to “disclose or suggest ‘obtain telemetry data’” and fails to show to “obtain telemetry data of a plurality of network devices in a network” and fails to show “extract entity and connectivity information for an application session”. In response to the arguments regarding telemetry data, Applicant’s position appears to rely on an unstated but particular definition of what can comprise “telemetry” data. Applicant’s specification contains no definition of “telemetry”, and only provides a general discussion containing non-limiting examples of what may be considered telemetry data (e.g., [62] of the PG-Pub reciting that telemetry comes from “network data” and [64] noting it contains “entity and connectivity information”). However, Maroulis, relied upon to teach the claimed telemetry data, contains disclosure directly in line with the description provided in Applicant’s specification. In addition, the Examiner notes the broadest reasonable definition of what may be considered “telemetry” data includes any measurements from a device (such as speed, pressure, temperature), as supported by the standard definition of “telemetry” (telemetry definition. m-w.com. (Year: 2026)). In the context of computer networking, telemetry would thus include networking-related measurements made by a device (or measurements made by a networking-related device). The citations made to Maroulis discuss telemetry data such as measurements of latency and other connectivity information (Maroulis, col. 8 line 62 – col. 9 line 5) as well as measurements related to device performance such as “signal strength”, “connection type”, “location”, “memory performance”, and “operational state”. These examples additional align with the claim language related to “entity” and “connectivity” data that the claims recite as being extracted from the telemetry data. Applicant continues on pages 11 – 12 to address the citations made to Madsen and the claim language directed to “topology” during a time period of an “application session”. In response to applicant's arguments against the references individually, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). In this case, Madsen was relied upon to show the claimed generation of topology representations; that data utilized is related to an “application session” corresponds to teachings Maroulis is relied upon to show (rather than Madsen). That neither Maroulis or Madsen alone teach the claimed subject matter cannot be treated as a persuasive argument when the grounds of rejection relies upon what a combination of Maroulis in view of Madsen would have suggested. Maroulis, for example, discusses collection, storage, and utilization of application session data multiple times in their disclosure, e.g., col. 7 lines 33-44 and col. 9 lines 22-31 discussing tracking session IDs (as well as col. 24 lines 8-14, col. 26 lines 42-65, col. 27 lines 8-18, and col. 29 line 59 – col. 30 line 12). Maroulis suggests the utility of the gathered application session data in, e.g., col. 30 lines 22-44 noting that storing and tracking this information can enable improved correlation capabilities. Madsen is then utilized in the 103 combination to show the utility of the claimed topology generation; said generation utilizing the application session data gathered by Maroulis via the 103 combination presently relied upon and relied upon in the prior Office Action. Applicant’s argument thus cannot be held as persuasive. Applicant’s remaining arguments rely on the rationale addressed above, and thus are similarly unpersuasive.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 21 – 24, 28, 32, 33, 36, and 40 are rejected under 35 U.S.C. 103 as being unpatentable over Maroulis (US-10469346-B2) in view of Madsen (US-20170358111-A1) in view Wu (US-11184403-B1). Regarding claim 21, Maroulis shows a computing system comprising: memory (Fig. 12, items 1206, 1208, 1210); and one or more processors coupled to the memory (Fig. 12 item 1204) and configured to:
obtain telemetry data of a plurality of network devices in a network (col. 7 line 63 – col. 8 line 30, where the telemetry data includes entity and connectivity information from client devices); extract entity (col. 7 line 63 – col. 8 line 30 discussing entity information such as location, signal strength, memory performance and other “device performance information”) and connectivity information (col. 8 line 62 – col. 9 line 5 discussing connectivity information such as latency) from an application session of an application for a client device (col. 9 lines 23-31 discussing the data is in regards to an “application session” and includes an identifier for the particular session) from the telemetry data of a set of network devices associated with the application session (col. 9 lines 23-31, col. 10 lines 20-26 and 40-50, col. 26 lines 10-46, discussing collection of client and host performance data, including a “sessionIdentifier field storing a value that identifies a particular application session”, the information be stored “in one or more data stores” as event records) wherein the application session includes communication between the set of network devices over a time period prior to a current time (col. 9 line 52 – col. 10 line 5, discussing where event records are created and stored for review “possibly at a later time; further discussion in col. 16 lines 25-35, which discusses review of time ranges including “yesterday” and “next week”), wherein the entity and connectivity information represents the set of network devices and connections between the set of network devices used to transmit traffic through the network between the client device and the application for the application session (col. 3 lines 44-50, col. 26 lines 10-46),
store the entity and connectivity information for the application session in a database wherein the database is configured to store entity and connectivity information (col. 9 lines 31-37 and 60-67, col. 10 lines 40-46, col. 11 lines 28-31) that represents a history of at least a portion of the network at application session-level granularity (col. 9 lines 24-32, col. 14 lines 60-67, col. 24 lines 9-14) over time prior to the current time (col. 7 lines 33-38, col. 8 lines 65-68), which includes the time period (col. 13 lines 50-60 discussing a “specific time range”) of the application session (col. 30 lines 23-43, col. 34 lines 33-54); generate, based on the entity and connectivity information for the application session, data representative of the network during the time period of the application session (col. 7 lines 33-44, col. 8 lines 24-30, col. 9 line 60 – col. 10 line 5, discussing collection and generation of a variety of “network performance data”); identify, based at least on the telemetry data of the set of network devices for the application session, at least one event (col. 16 lines 17-23) associated with the set of network devices that occurred during the time period of the application session (col. 9 lines 24-32, col. 14 lines 15-27 and 60-68 discussing to return all events across a specified matching time range via, e.g., searching for events matching particular values over that time range such as those having a particular application session identifier); and generate data representative of the network during the time period of the application session including an indication of the at least one event (col. 8 lines 65-68 discussing “the network performance information may relate to one or more network events. . .”; see also col. 9 lines 24-32, col. 14 lines 15-27 and 60-68).
Maroulis does not show: generation of data representative of a topology, wherein the topology represents a historical arrangement of the set of network devices and the connections during the time period,
generate data representative of a user interface including a visualization of the topology of the network during the a period including an indication of the at least one event.
Madsen show: generation of data representative of a topology, wherein the topology represents a historical arrangement of the set of network devices and the connections during the time period ([24, 26-27, 42-44] discussing a “network topology database” which includes “historical network topology data” and “real-time network topology data” which is leveraged to ”visualize a particular network state” including “a network state as it evolves over time”),
generate data representative of a user interface including a visualization of the topology of the network during the a period including an indication of the at least one event ([23,37-38] discussing a “user interface” that uses visualization techniques including “labels and color coding” used to “represent network elements”). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the network data collection and event storage and analysis of Maroulis, including Maroulis suggestions to gather, store, and utilize application and session identification information (Maroulis, col. 30 lines 22-44), with the data collection and visualization techniques of Madsen in order to improve the ease with which system administrators can review and analyze network state, simplifying and improving network maintenance. The above combination does not show: where the information is related to a cloud-based application. Wu shows information related to a cloud-based application (col. 10 lines 36-39, col. 27 lines 53-63).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the cloud-based techniques of the above combination with the cloud-application execution of Wu in order to ensure robust support for additional operating environments, particularly the increasingly common trend of leveraging cloud-based application execution, thus facilitating use of the network monitoring techniques for additional system administrators.
Regarding claim 22, the above combination further shows wherein the set of network devices includes one or more of access point devices, switches, routers, gateway devices, or service provider servers (Madsen, [13,44]).
Regarding claim 23, the above combination further shows wherein the one or more processors are configured to receive a query (Madsen, [57]) identifying the application session (Maroulis, col. 9 lines 24-32, col. 14 lines 15-27 and 60-68) of the cloud-based application (Wu, col. 10 lines 36-39, col. 27 lines 53-63) for troubleshooting the at least one event associated with the set of network devices that occurred during the time period of the application session (Madsen, [63] discussing “failure analysis”) with respect to the topology of the network during the time period of the application session (Maroulis, col. 9 lines 24-32, col. 14 lines 15-27 and 60-68, discussing time-bounded queries as well as queries bounded by other recorded data fields such as those identifying an application session).
Regarding claim 24, the above combination further shows wherein the information for the application session (Maroulis, col. 9 lines 24-32, col. 14 lines 15-27 and 60-68 and Wu, col. 10 lines 36-49 and col. 27 lines 53-63) is stored in the database as nodes representative of network devices of the set of network devices and edges representative of the connections between the network devices of the set of network devices (Madsen, Figs. 5A-5C, [33-35, 38]).
Regarding claim 28, the above combination further shows wherein the one or more processors are configured to perform root cause analysis to determine a root cause (Maroulis col. 19 lines 29-49, col. 22 lines 10-15 and 29-36) of the at least one event within the set of network devices during the time period of the application session (Maroulis, col. 9 lines 24-32, col. 14 lines 15-27 and 60-68).
Regarding claims 32 and 40, the limitations of said claims are addressed in the analysis of claim 21.
Regarding claim 33, the limitations of said claim are addressed in the analysis of claim 23.
Regarding claim 36, the limitations of said claim are addressed in the analysis of claim 28.
Claims 26, 29, 34, and 37 are rejected under 35 U.S.C. 103 as being unpatentable over Maroulis in view of Madsen and Wu, as applied to claim 21 above, further in view of Taylor (Taylor, Teryl, et al. "Flovis: Flow visualization system." 2009 Cybersecurity Applications & Technology Conference for Homeland Security. IEEE. (Year: 2009)).
Regarding claim 26, the above combination shows evaluation and consideration of application session data (Maroulis, col. 9 lines 24-32, col. 14 lines 15-27 and 60-68, and Wu, col. 10 lines 36-49 and col. 27 lines 53-63), as well as obtaining entity (col. 7 line 63 – col. 8 line 30 discussing entity information such as location, signal strength, memory performance and other “device performance information”) and connectivity information (col. 8 line 62 – col. 9 line 5 discussing connectivity information such as latency) for the application session (col. 9 lines 23-31 discussing the data is in regards to an “application session” and includes an identifier for the particular session and connectivity information for the application session). The above combination does not show wherein the one or more processors are configured to: correlate data from multiple application flows; and identify the set of network devices from a plurality of network devices of the network as being used to transmit traffic based on the data correlated from the multiple application flows,
wherein to obtain the information, the one or more processors are configured to obtain the information from the database based on the identified set of network devices. Taylor shows wherein the one or more processors are configured to: correlate data from multiple application flows (pg. 2, L42 – R14); and identify the set of network devices from a plurality of network devices of the network as being used to transmit traffic based on the data correlated from the multiple application flows (pg. 2 L42-L43, R52-R57, and pg. 3 R29-R32),
wherein to obtain the information, the one or more processors are configured to obtain the information from the database based on the identified set of network devices (pg. 2 R5-R14, R35-R41, pg. 4 L17-L60).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the above combination with the monitoring and analysis techniques of Taylor improve the visualization options provided to the system administrator, improving their ability to extrapolate connections or review proposed connections between system state and events occurring within the system.
Regarding claim 29, the above combination shows evaluation and consideration of application session data, including session time periods (Maroulis, col. 9 lines 24-32, col. 14 lines 15-27 and 60-68, and Wu, col. 10 lines 36-49 and col. 27 lines 53-63). The above combination does not show wherein to generate the data representative of the user interface including the visualization of the topology, the one or more processors are configured to generate one or more icons representative of at least a portion of the set of network devices and the connections between the at least a portion of the set of network devices used to transmit traffic for the at a given time within the time period. Taylor shows wherein to generate the data representative of the user interface including the visualization of the topology, the one or more processors are configured to generate one or more icons representative of at least a portion of the set of network devices and the connections between the at least a portion of the set of network devices used to transmit traffic for the at a given time within the time period (Figs. 2-5, pg. 5 R42-R57, pg. 6 L41-R55).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the above combination with the monitoring and analysis techniques of Taylor improve the visualization options provided to the system administrator, improving their ability to extrapolate connections or review proposed connections between system state and events occurring within the system.
Regarding claim 34, the limitations of said claim are addressed in the analysis of claim 26.
Regarding claim 37, the limitations of said claim are addressed in the analysis of claim 29.
Claims 30, 31, 38 and 39 are rejected under 35 U.S.C. 103 as being unpatentable over Maroulis in view of Madsen and Wu, as applied to claim 21 above, further in view of Taylor and Haddow (US-11032124-B1).
Regarding claim 30, the above combination shows evaluation and consideration of application session data (Maroulis, col. 9 lines 24-32, col. 14 lines 15-27 and 60-68, and Wu, col. 10 lines 36-49 and col. 27 lines 53-63), as well as the use of color to emphasize features of importance (Madsen, [38]).
The above combination does not show wherein to generate the data representative of the user interface, the one or more processors are configured to generate an icon representative of a network device during a particular time period. Taylor shows wherein to generate the data representative of the user interface, the one or more processors are configured to generate an icon representative of a network device (Figs. 2 – 5, pg. 2 L52-L60) during a particular time period (pg. 3, L55-R41, pg. 6, L41-L46, pg. 11, R53-R56).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the above combination to modify the above combination with the time-based analysis of Taylor in order to allow the system (or the system administrator) to focus on particular intervals of interest in order to improve diagnostic capabilities.
The above combination does not show generation of a representation of a network device of the set of network devices having the indication of at least one event wherein the indication of the at least one event comprises at least one of a color, a shape, or a symbol. Haddow shows generation of a representation of a network device of the set of network devices having the indication of at least one event wherein the indication of the at least one event comprises at least one of a color, a shape, or a symbol (col. 10 lines 17-42, col. 12 lines 33-53, col. 13 lines 27-54, col. 14 lines 20-35). It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the above combination with the monitoring and performance analysis of Haddow in order to more effectively and efficiently diagnose the underlying cause of performance concerns and issues in specific network devices (Haddow, col. 2 lines 52- 58).
Regarding claim 31, the above combination further shows wherein the user interface comprises a first user interface, and wherein the one or more processors are configured to, based on receipt of user input selecting the icon representative of the network device having the indication of the at least one event, generate data representative of a second user interface (Haddow, col. 15 lines 25 – 57) including at least one indication of a root cause of the at least one event at the network device (Haddow, col. 15 line 57 – col. 16 line 24).
Regarding claim 38, the limitations of said claim are addressed in the analysis of claim 30.
Regarding claim 39, the limitations of said claim are addressed in the analysis of claim 31.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOHN M MACILWINEN whose telephone number is (571)272-9686. The examiner can normally be reached Monday - Friday, 9:00 - 5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Glenton B Burgess can be reached at (571) 272 - 3949. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
JOHN MACILWINEN
Primary Examiner
Art Unit 2442
/JOHN M MACILWINEN/Primary Examiner, Art Unit 2454