Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This office action is in response to application filed on August 3, 2026, in which claims 1-20 are presented for further examination.
Response to Arguments
Applicant’s arguments, filed on August 3, 2026, with respect to the rejection(s) of claim(s) 1-20 under Porras et al. (US 6484203 B1) (hereinafter Porras) in view of Zhang et al. (US 20120197934 A1) (hereinafter Zhang) have been fully considered and are persuasive. However, upon further consideration, a new ground(s) of rejection is made in view of Porras et al. (US 6484203 B1) (hereinafter Porras) in view of Zhang et al. (US 20120197934 A1) (hereinafter Zhang) further in view of
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 USC 103(a) (a) as being unpatentable over Porras et al. (US 6484203 B1) (hereinafter Porras) in view of Chen et al. (US 20120239660 A1) (hereinafter Chen) and further in view of Patel et al. (US 20120239660 A1) (hereinafter Patel).
As per claims 1, 11 and 15, Porras discloses causing display, via a graphical user interface, including a set of event streams and a set of statistics representing statistics for network traffic corresponding with the set of event streams [Referring to FIG. 5, a monitor may also "deinterleave." That is, the monitor may create and update 74, 76 more than one short-term profile for comparison 78 against a single long-term profile by identifying one of the multiple short-term profiles that will be updated by an event record in an event stream, Col. 13, line 51 (It is understood that the reference teaches a monitor that processes event stream is to create and update multiple short-term profiles, which are statistical representations of network traffic, and presents them for comparison with a long-term profile, thereby meeting or rendering obvious the claimed display of a set of event streams together with corresponding traffic statistics in a graphical user interface)], the set of statistics generated based on timestamped event data of the set of event streams received from at least one remote capture agent without subsequently processing and storing the timestamped event data used to generate the statistics in a data store [The monitor may distinguish between network packets based on the time such packets were received by the network entity, permitting statistical analysis to distinguish between a normal data transfer during a workday and an abnormal data transfer on a weekend evening, col. 12, line 35, (it is understood that the reference teaches generating statistics from timestamped network events by distinguishing packets based on time of receipt, and since it performs this analysis without disclosing storage of the underlying timestamped data, it reasonably meets or renders obvious the claimed limitation)]. However Porras does not disclose a set of event streams generated via at least one remote capture agent and comprising timestamped event data and an indication of a set of statistics representing statistics for network traffic corresponding with the set of event streams, the set of statistics generated based on the timestamped event data of the set of event streams received from the at least one remote capture agent without subsequently indexing and storing the timestamped event data used to. On the other hand, Chen discloses a set of event streams generated via at least one remote capture agent and comprising timestamped event data and an indication of a set of statistics representing statistics for network traffic corresponding with the set of event streams, the set of statistics generated based on the timestamped event data of the set of event streams received from the at least one remote capture agent without subsequently indexing and storing the timestamped event data used to [An SSF can listen to or read data/event sequences and continuously generate stream elements, tuple by tuple. An SSF can be called multiple (or potentially an infinite) number of times during the execution of a continuous query, paragraph 22; the buffered data is retained temporarily in memory without storing the data on a disk. This allows access to the data from memory without retrieval from a disk. In this approach, each tuple inserted into memory can be marked appropriately (the mark may vary from DBMS to DBMS) such that when the DBMS sees such a mark, the DBMS will not persist the tuple to the disk., paragraph 28, also see paragraph 29]. Chen Expressly identifies the technical reason for streaming data can be extremely large, and its architecture enables efficient real-time analysis through memory access without storing the incoming data on disk, thereby reducing storage and latency associated with conventional persistent. Applying Chen’s nonpersistent stream-analysis technique to Porras’s network event streams therefore would have been a predictable use of a known stream processing technique to improve Porras’s network monitoring system by reducing unnecessary persistence/storage of underlying packet derived event information while retaining useful statistical results. However the combination of Porras and Chen does not disclose “indexing”. On the other hand, Patel discloses “indexing” [Fig. 4, indexers 406-410 and license Master 402]. It therefore would have been obvious to further configure the Porras and Chen system to determine and expose an index volume associated with respective event streams or stream/source types, as taught by Patel, because Patel teaches that tracking indexed-data volume by time interval and source/data type permits management of storage/indexing resources across distributed indexers. The combination merely applies Patel’s known indexed-volume measurement to Porras’s known network-event streams.
As per claims 2 and 12, Chen discloses wherein the set of statistics includes one or more of a total number of events, a total incoming traffic, a total outgoing traffic, a total traffic, or an index volume for the timestamped event data in the set of event streams [Each reading constitutes an event for the system. Computation of the segment statistics, paragraph 19].
As per claims 3 and 13, Chen discloses wherein the graph comprises a bar chart of index volumes of the set of event streams [Fig. 4].
As per claims 4 and 14, Porras discloses wherein the graph comprises a pie chart of index volumes across the set of event streams [identifying one of the multiple short-term profiles that will be updated by an event record in an event stream, Col. 13, line 54].
As per claims 5 and 16, Porras discloses causing display, via the graphical user interface, of a user-interface element to filter the set of statistics by a host from which the set of event streams are collected [A long-term and short-term statistical profile can be generated for each event stream. Thus, different event streams can "slice" network packet data in different ways, col. 13, line 33].
As per claims 6 and 17, Porras discloses wherein the graph is updated in real-time as new timestamped event data is received [The monitor may distinguish between network packets based on the time such packets were received by the network entity, permitting statistical analysis to distinguish between a normal data transfer during a workday and an abnormal data transfer on a weekend evening, col. 12, line 35].
As per claim 7, Porras discloses wherein in response to detecting an indicated portion associated with the graph, modifying the appearance of the graph [a monitor can analyze anonymous FTP sessions to ensure that the file retrievals and uploads/modifications are limited to specific directories, col. 7, line 18].
As per claims 8 and 19, Porras discloses wherein in response to detecting the indicated portion associated with the graph, a search term or other data associated with an even stream is displayed [Fig. 2, an event data stream].
As per claims 9, 18 and 20, Patel discloses causing display, via the graphical user interface, of a legend corresponding with the graph, wherein in response to detection an indicated portion associated with the legend, modifying the appearance of the graph [Data Storage 308 may further store a search index].
As per claim 10, Patel discloses causing display, via the graphical user interface, of a user-interface element including options used to configure a search term [Network device 300 includes processor unit 302, an input/output interface 332, video display adapter 336, and a mass memory, all in communication with each other via bus 326., paragraph 48].
Remarks
In view of Applicant’s amendment and arguments filed April 3, 2026, the rejection of claims 1–20 under 35 U.S.C. §101 is withdrawn. In particular, amended claim 1 recites generation of network traffic statistics from timestamped event data of event streams received from at least one remote capture agent without subsequently indexing and storing the timestamped event data used to generate the statistics. When considered as a whole and in view of the technological improvement described in the Specification, the claim integrates any recited judicial exception into a practical application under Step 2A, Prong Two of the USPTO subject matter eligibility analysis.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NOOSHA ARJOMANDI whose telephone number is (571)272-9784. The examiner can normally be reached 8:00am to 4:30pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sanjiv Shah can be reached at 571-272-4098. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
October 8, 2026
/NOOSHA ARJOMANDI/Primary Examiner, Art Unit 2166
