DETAILED ACTION
Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Double Patenting
2. The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP §§ 706.02(l)(1) - 706.02(l)(3) for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
3. Claims 1-16 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-3, 5-7, 9-14 of U.S. Patent No. 12,166,640. Although the claims at issue are not identical, they are not patentably distinct from each other because
Instant application
U.S. Patent No. 12,166,640
1. A method comprising: detecting, using metadata of a captured packet traffic, a communication pattern within each of one or more levels in a network stack by:
1. A method comprising: receiving captured packet traffic, the captured packet traffic including a plurality of packets transmitted over a network; detecting, using metadata of the captured packet traffic, one or more communication patterns within each of one or more levels in a network stack, wherein each of the one or more communication patterns is detected by:
identifying a context among an identified packet involved in a network conversation; and
identifying one or more packets from the captured packet traffic forming a network conversation between two components in the network, each of the one or more packets having a protocol corresponding to the level in the network stack; identifying a context among the identified one or more packets involved in the network conversation;
detecting a communication pattern based on the network conversation, the context
among the identified packet, and a payload of the packet; and
detecting the communication pattern based on the network conversation, the context among the identified one or more packets, and a payload of each of the one or more packets, wherein the metadata of the captured packet traffic includes a source address, a destination address, and a protocol name for each packet of the captured packet traffic;
generating, by a processing device, a topology of the network in view of the
communication pattern detected within each of the one or more levels in the network stack
generating, by a processing device, a topology of the network in view of the one or more communication patterns detected within each of the one or more levels in the network stack.
2. The method of claim 1, wherein the metadata of the captured packet traffic
includes at least one of a source address, a destination address, or a protocol name for each
packet of the captured packet traffic.
Claim 1: wherein the metadata of the captured packet traffic includes a source address, a destination address, and a protocol name for each packet of the captured packet traffic.
3. The method of claim 1, wherein the topology of the network indicates for each component in the network: a type of the component and a connection between the component
and one or more other components in the network.
2. The method of claim 1, wherein the topology of the network indicates for each component in the network: a type of the component and a connection between the component and one or more other components in the network.
4. The method of claim 3, wherein generating the topology of the network comprises: determining a type of each component in the network and a connection between each component
and one or more other components in the network in view of the communication pattern
detected within each of the one or more levels in the network stack.
3. The method of claim 2, wherein generating the topology of the network comprises: determining a type of each component in the network and a connection between each component and one or more other components in the network in view of the one or more communication patterns detected within each of the one or more levels in the network stack.
5. The method of claim 1, wherein the topology of the network further indicates a probability that the type of each component is correct and a probability that each connection is
correct.
9. The system of claim 8, wherein the topology of the network further indicates a probability that the type of each component is correct and a probability that each connection is correct.
6. A system comprising:
a memory to store metadata of a captured packet traffic; and
a processing device, operatively coupled with the memory, to:
5. A system comprising: a memory to store metadata; and a processing device to:
detect, using the metadata of the captured packet traffic, a communication pattern within each of one or more levels in a network stack wherein to detect the processing device is to:
receive captured packet traffic from a network device, the captured packet traffic including a plurality of packets transmitted over a network; detect, using metadata of the captured packet traffic, one or more communication patterns within each of one or more levels in a network stack, wherein each of the one or more communication patterns is detected by:
identify a context among an identified packet involved in a network
conversation; and
identifying one or more packets from the captured packet traffic forming a network conversation between two components in the network, each of the one or more packets having a protocol corresponding to the level in the network stack; identifying a context among the identified one or more packets involved in the network conversation;
detect a communication pattern based on the network conversation, the
context among the identified packet, and a payload of the packet; and
detecting the communication pattern based on the network conversation, the context among the identified one or more packets, and a payload of each of the one or more packets, wherein the metadata of the captured packet traffic includes a source address, a destination address, and a protocol name for each packet of the captured packet traffic;
generate a topology of the network in view of the communication pattern
detected within each of the one or more levels in the network stack.
generate a topology of the network in view of the one or more communication patterns detected within each of the one or more levels in the network stack.
7. The system of claim 6, wherein the topology of the network indicates for each component in the network: a type of the component and a connection between the
component and one or more other components in the network.
6. The system of claim 5, wherein the topology of the network indicates for each component in the network: a type of the component and a connection between the component and one or more other components in the network.
8. The system of claim 7, wherein to generate the topology of the network, the processing device is further to determine a type of each component in the network and a
connection between each component and one or more other components in the network in view of the communication pattern detected within each of the one or more levels in the
network stack.
7. The system of claim 6, wherein to generate the topology of the network, the processing device is further to: determine a type of each component in the network and a connection between each component and one or more other components in the network in view of the one or more communication patterns detected within each of the one or more levels in the network stack.
9. The system of claim 8, wherein the metadata of the captured packet traffic includes
at least one of a source address, a destination address, or a protocol name for each packet of
the captured packet traffic.
Claim 5: wherein the metadata of the captured packet traffic includes a source address, a destination address, and a protocol name for each packet of the captured packet traffic;
10. The system of claim 6, wherein the topology of the network further indicates a
probability that the type of each component is correct and a probability that each connection
is correct.
9. The system of claim 8, wherein the metadata of the captured packet traffic includes at least one of a source address, a destination address, or a protocol name for each packet of
the captured packet traffic.
11. A non-transitory computer-readable storage medium including instructions that,
when executed by a processing device, cause the processing device to:
10. A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:
detect, using metadata of a captured packet traffic, a communication
pattern within each of one or more levels in a network stack wherein to detect the processing device is to:
receive captured packet traffic, the captured packet traffic including a plurality of packets transmitted over a network; detect, using metadata of the captured packet traffic, one or more communication patterns within each of one or more levels in a network stack, wherein each of the one or more communication patterns is detected by:
identify a context among an identified packet involved in a network
conversation; and
identifying one or more packets from the captured packet traffic forming a network conversation between two components in the network, each of the one or more packets having a protocol corresponding to the level in the network stack; identifying a context among the identified one or more packets involved in the network conversation;
detect a communication pattern based on the network conversation, the
context among the identified packet, and a payload of the packet; and
detecting the communication pattern based on the network conversation, the context among the identified one or more packets, and a payload of each of the one or more packets, wherein the metadata of the captured packet traffic includes a source address, a destination address, and a protocol name for each packet of the captured packet traffic;
generate a topology of the network in view of the communication pattern
detected within each of the one or more levels in the network stack.
generate, by the processing device, a topology of the network in view of the one or more communication patterns detected within each of the one or more levels in the network stack.
12. The non-transitory computer-readable storage medium of claim 11, wherein the
topology of the network indicates for cach component in the network: a type of the component
and a connection between the component and one or more other components in the network.
11. The non-transitory computer-readable storage medium of claim 10, wherein the topology of the network indicates for each component in the network: a type of the component and a connection between the component and one or more other components in the network.
13. The non-transitory computer-readable storage medium of claim 12, wherein to generate the topology of the network, the processing device is further to: determine a type of each component in the network and a connection between each component and one or more other components in the network in view of the communication pattern detected within each of the one or more levels in the
network stack.
12. The non-transitory computer-readable storage medium of claim 11, wherein to generate the topology of the network, the processing device is further to: determine a type of each component in the network and a connection between each component and one or more other components in the network in view of the one or more communication patterns detected within each of the one or more levels in the network stack.
14. The non-transitory computer-readable storage medium of claim 13, wherein to
determine the type of each component in the network and the connection between each
component and one or more other components, the processing device is further to: map the detected one or more communication patterns within each of the one or more levels in the network stack to a network topology from a data set of known network topologies using a neural network, the neural network being trained on the data set of known network topologies.
13. The non-transitory computer-readable storage medium of claim 12, wherein to determine the type of each component in the network and the connection between each component and one or more other components, the processing device is further to: map the detected one or more communication patterns within each of the one or more levels in the network stack to a network topology from a data set of known network topologies using a neural network, the neural network being trained on the data set of known network topologies.
15. The non-transitory computer-readable storage medium of claim 11, wherein the topology of the network further indicates for each component in the network a probability that
the type of the component is correct and a probability that each connection between the component and one or more other components in the network is correct.
14. The non-transitory computer-readable storage medium of claim 11, wherein the topology of the network further indicates for each component in the network a probability that the type of the component is correct and a probability that each connection between the component and one or more other components in the network is correct.
16. The non-transitory computer-readable storage medium of claim 11, wherein the metadata of the captured packet traffic includes at least one of a source address, a destination
address, or a protocol name for each packet of the captured packet traffic.
Claim 10: wherein the metadata of the captured packet traffic includes a source address, a destination address, and a protocol name for each packet of the captured packet traffic
Claim Rejections - 35 USC § 112
4. The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
5. Claims 5, 10, and 15 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 5 recites the limitation "the type of each component" in line 2. There is insufficient antecedent basis for this limitation in the claim.
Claim 10 recites the limitation "the type of each component" in line 2. There is insufficient antecedent basis for this limitation in the claim.
Claim 15 recites the limitation "the type of the component" in line 3. There is insufficient antecedent basis for this limitation in the claim.
Claim Rejections - 35 USC § 102
6. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
7. Claims 1-4, 6-9, 11-13, and 16 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Taylor (US 20170317899, hereinafter referred to as Taylor).
Re claim 1, Taylor teaches a method (Fig. 1-2) comprising:
(i) detecting, using metadata (source, destination address, protocol, port number etc.) of a captured packet traffic (captured flow data), a communication pattern (identifying source node, destination node, next hop node involved in communication among host A, host B, Host C, “the topology generator 115 may identify each of the routers and the hosts based on the fact that those entities appear as source and destination addresses and/or next hop addresses”—Par 0024; type of devices involved in the communication among the hosts, WAN traffic, amount of traffic generated/received at each device) within each of one or more levels in a network stack (transport layer protocol, Par 0010) (Fig. 1-2, Par 0010, Par 0012, Par 0014, Par 0018-0019, Par 0022, Par 0024-0027, Par 0032, Par 0034-0039) by:
(ii) identifying a context among an identified packet (aggregating flow data in view of router, next Hop, Source, destination etc.,Fig. 1, step 111 (table)) involved in a network conversation (flow data captured from the communication among the hosts A-C) (Fig. 1-2, Fig. 4, Par 0014, Par 0017-0023, ; and
(iii) detecting a communication pattern (identifying source node, destination node, next hop node involved in communication among host A, host B, Host C, “the topology generator 115 may identify each of the routers and the hosts based on the fact that those entities appear as source and destination addresses and/or next hop addresses”—Par 0024; type of devices involved in the communication among the hosts, WAN traffic, amount of traffic generated/received at each device) based on the network conversation (flow data captured from the communication among the hosts A-C, detecting high traffic device, low traffic device), the context among the identified packet (aggregating flow data in view of router, next Hop, Source, destination etc., Fig. 1, step 111 (table)), and a payload of the packet (amount of traffic generated by each node includes the data amount in the payload of each packet; high traffic device, low traffic device detections include data amount in the payload of each packet) (Fig. 1-2, Par 0018-0019, Par 0022-0027, Par 0032-0039, Par 0046-0049); and
(iv) generating, by a processing device, a topology of the network (generating network topology, Fig. 1-3) in view of the communication pattern (identifying source node, destination node, next hop node involved in communication among host A, host B, Host C, “the topology generator 115 may identify each of the routers and the hosts based on the fact that those entities appear as source and destination addresses and/or next hop addresses”—Par 0024; type of devices involved in the communication among the hosts, WAN traffic, amount of traffic generated/received at each device, high traffic device, low traffic device) detected within each of the one or more levels in the network stack (transport layer) (Fig. 1-3, Par 0010, Par 0020-0027, Par 0032-0040, Par 0046-0047).
Claim 6 recites a system performing the steps recited in claim 1 and thereby, is rejected for the reasons discussed above with respect to claim 1. Taylor further teaches that the system comprises a memory to store metadata of a captured packet traffic (memory, 507) (Fig. 5, Par 0061-0062, Par 0067); and a processing device (Processor Unit, 501), operatively coupled with the memory (Fig. 5, Par 0067).
Claim 11 recites a non-transitory computer-readable storage medium storing instructions to be executed by a processing device to perform the steps recited in claim 1 and thereby, is rejected for the reasons discussed above with respect to claim 1. Taylor further teaches a non-transitory computer-readable storage medium storing instructions (Fig. 5, Par 0061-0062, Par 0067).
Re claims 2, 9, 16, Taylor teaches that the metadata of the captured packet traffic includes at least one of a source address, a destination address, or a protocol name for each packet of the captured packet traffic (aggregated flow data includes (a source address, a destination address, a protocol name) (Fig. 1-2, Fig. 4, Par 0022-0025, Par 0034, Par 0039).
Re claims 3, 7, 12, Taylor teaches the topology of the network (topology diagram, Fig. 1, Fig. 4) indicates for each component in the network: a type of the component (device type) and a connection between the component and one or more other components in the network (topology diagram showing the connections between the network components) (Par 0025-0027, Par 0034, Par 0039-0040).
Re claims 4, 8, 13, Taylor teaches to determine a type of each component in the network (device type) and a connection between each component and one or more other components in the network (topology diagram showing the connections between the network components) in view of the communication pattern (identifying source node, destination node, next hop node involved in communication among host A, host B, Host C, “the topology generator 115 may identify each of the routers and the hosts based on the fact that those entities appear as source and destination addresses and/or next hop addresses”—Par 0024; type of devices involved in the communication among the hosts, WAN traffic, amount of traffic generated/received at each device, high traffic device, low traffic device) detected within each of the one or more levels in the network stack (transport layer) (Fig. 1-3, Par 0010, Par 0020-0027, Par 0032-0040, Par 0046-0049).
Claim Rejections - 35 USC § 103
8. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
9. Claims 5, 10, and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Taylor as applied to claim 1 above and further in view of Yuan et al (US 20170155556, hereinafter referred to as Yuan).
Re claims 5, 10, 15, Taylor does not explicitly disclose that the topology of the network further indicates a probability that the type of each component is correct and a probability that each connection is correct.
Yuan teaches that the topology of the network further indicates a probability (a threshold level (0.7) of confidence of accuracy, Par 0080-0083) that the type of each component is correct (network element port) and a probability (a threshold level (0.7) of confidence of accuracy, Par 0080-0083) that each connection is correct (link between the ports) (Fig. 2-3, Par 0047, Par 0053, Par 0056-0060, Par 0063, Par 0077-0083).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Taylor by including the step that the topology of the network further indicates a probability that the type of each component is correct and a probability that each connection is correct, as taught by Yuan for the purpose of improving accuracy of network topology discovery, as taught by (Par 0006).
10. Claim 14 is rejected under 35 U.S.C. 103 as being unpatentable over Taylor as applied to claim 1 above and further in view of Cardente et al (US 9621431 B1, hereinafter referred to as Cardente).
Re claim 14, Taylor does not explicitly disclose to map the detected one or more communication patterns within each of the one or more levels in the network stack to a network topology from a data set of known network topologies using a neural network, the neural network being trained on the data set of known network topologies.
Cardente teaches to map the detected one or more communication patterns (communication patterns of different endpoints of known types) within each of the one or more levels in the network stack((layers of the OSI protocol stack) to a network topology from a data set of known network topologies (trained network topology classification models) using a neural network (machine learning classification), the neural network being trained on the data set of known network topologies (machine learning classification is trained using communication patterns data of different endpoints of known types) (Fig. 1-4, Table 1, Col 2, Line 1-12, Col 4, Line 47-67, Col 5, Line 1-15, Col 6, Line 56-67, Col 7, Line 1-67, Col 8, Line 26-57, Col 9, Line 29-43, Col 10, Line 66-67, Col 11, Line 1-6, Col 11, Line 37-61, Col 12, Line 1-6, Col 12, Line 45-67, Col 13, Line 1-12, Claim 1).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Taylor by including the step to map the detected one or more communication patterns within each of the one or more levels in the network stack to a network topology from a data set of known network topologies using a neural network, the neural network being trained on the data set of known network topologies, as taught by Cardente for the purpose of efficiently discovering and tracking “the behavior of the network entities within the system to ensure that the network entities are behaving appropriately in terms of performance, security, and other expected or desired behaviors”, as taught by Cardente (Col 1, Line 30-35).
Relevant Prior Art
Gourlay et al (US 20250267063 A1) discloses to determine a network topology based on LLDPDU exchanged between different nodes/switches (Fig. 3-6, Par 0003-0004).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HARUN UR R CHOWDHURY whose telephone number is (571)270-3895. The examiner can normally be reached Monday-Friday 9AM-5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kwang B Yao can be reached at 5712723182. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HARUN CHOWDHURY/Examiner, Art Unit 2473
Prosecution Insights