Ex Parte Barford et alDownload PDFPatent Trial and Appeal BoardNov 21, 201612516766 (P.T.A.B. Nov. 21, 2016) Copy Citation UNITED STA TES p A TENT AND TRADEMARK OFFICE APPLICATION NO. FILING DATE FIRST NAMED INVENTOR 12/516,766 05/28/2009 Paul R. Barford 72088 7590 11/23/2016 WISCONSIN ALUMNI RESEARCH FOUNDATION C/O BOYLE FREDRICKSON S.C 840 North Plankinton A venue Milwaukee, WI 53203 UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www .uspto.gov ATTORNEY DOCKET NO. CONFIRMATION NO. 1512.187 1771 EXAMINER PHUNG,LUAT ART UNIT PAPER NUMBER 2468 NOTIFICATION DATE DELIVERY MODE 11/23/2016 ELECTRONIC Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the following e-mail address( es): docketing@boylefred.com PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD Ex parte PAUL R. BARFORD, JEFFERY THOMAS KLINE, SANGNAM NAM, DAVID JOHN PLONKA, and AMOS RON Appeal2016-002240 Application 12/516,766 Technology Center 2400 Before ST. JOHN COURTENAY III, THU A. DANG, and LARRY J. HUME, Administrative Patent Judges. COURTENAY, Administrative Patent Judge. DECISION ON APPEAL STATEMENT OF THE CASE This is a decision on appeal under 35 U.S.C. § 134(a) from the Examiner's Final Rejection of claims 1-13 and 24. Appellants have withdrawn claims 14--16, 18-23, and 25. Claim 17 is cancelled. We have jurisdiction under 35 U.S.C. § 6(b ). We affirm-in-part The Invention The claimed invention relates to a "Method and Apparatus for Network Anomaly Detection" (Title). Appeal2016-002240 Application 12/516,766 Claim 1, is representative of the subject matter on appeal: 1. A network traffic anomaly detector comprising: a network interface connecting to a network to be monitored [L 1] to extract multiple network traffic statistics, each as a time series, the network statistics being extracted by performing a count over a time window of a given type of network activity at a given location; [L2] a first analyzer receiving the network traffic statistics to characterize a variability with respect to time of the network traffic statistics; [L3] a second analyzer rece1vmg the network traffic statistics to characterize a correspondence with respect to time between different network traffic statistics, the correspondence reflecting a statistical dependence between the different network statistics; and a detection unit rece1vmg the variability and correspondence characterizations from the first and second analyzer to provide an output indicating a likelihood of a network anomaly [L4] wherein the network traffic statistics include at least two different measures of rates of data flow on the network. (Contested limitations lettered and emphasized.) Rejection Claims 1-13 and 24 are rejected under 35 U.S.C. § 103(a) as being obvious over the combined teachings and suggestions of Day (US 2004/0025044 Al, pub. Feb. 5, 2004), Partridge et. al. ("Partridge") (US 2003/0097595 Al, pub. May 22, 2003), and Barford et. al. ("Barford") ("A Signal Analysis of Network Traffic Anomalies," In Proceedings of ACM SIGCOMM Internet Measurement Workshop, 2002). 2 Appeal2016-002240 Application 12/516,766 Claim Grouping Based on Appellants' arguments (App. Br. 8-26), we decide the appeal of the rejection of claims 1-3, 13, and 24 on the basis of representative independent claim 1. We address dependent claims 4--12 separately, infra. To the extent Appellants have not advanced separate, substantive arguments for particular claims and/ or particular claim limitations on appeal, such arguments are considered waived. See 37 C.F.R. § 41.37(c)(l)(iv). ANALYSIS We have considered all of Appellants' arguments and any evidence presented. We find Appellants' arguments regarding claims 1, 4--6, 8, 11, and 12 unpersuasive for the reasons discussed infra. Regarding separately argued claims 1, 4, 5, 6, and 8, we adopt as our own: (1) the findings and legal conclusions set forth by the Examiner in the action from which this appeal is taken, and (2) the findings, legal conclusions, and explanations set forth in the Answer in response to Appellants' arguments. We address the Examiner's rejection of claims 11 and 12 separately, infra. However, for essentially the same reasons argued by Appellants, we reverse the Examiner's rejection of dependent claims 9 and 10. We highlight and address specific findings and arguments for emphasis in our analysis below. 3 Appeal2016-002240 Application I2/5I6,766 Rejection of Claim 1 under§ 103 Issue: Under 35 U.S.C. § I03(a), did the Examiner err in finding the cited combination of Day, Partridge, and Barford would have taught or suggested contested limitations LI, L2, L3, and L4, within the meaning of claim I? 1 Claim Construction At the outset, we broadly but reasonably construe the claim language "a network interface . .. to extract, ... , a first analyzer . .. to characterize, . . . [and], a second analyzer . .. to characterize ... ; and a detection unit . .. to provide" as a statements of intended use. 2 Because claim I does not positively recite that contested functional limitations LI, L2, and L3 are actually performed, we conclude the contested claim language is directed to 1 We give the contested claim limitations the broadest reasonable <....- interpretation consistent with the Specification. See In re Morris, I27 F.3d I048, I054 (Fed. Cir. I997). See Spec. il 60 ("It is specifically intended that the present invention not be limited to the embodiments and illustrations contained herein, but include modified forms of those embodiments including portions of the embodiments and combinations of elements of different embodiments as come within the scope of the following claims.") (Emphasis added). 2 "An intended use or purpose usually will not limit the scope of the claim because such statements usually do no more than define a context in which the invention operates."' Boehringer Ingelheim Vetmedica, Inc. v. Schering- Plough Corp., 320 F.3d I339, I345 (Fed.Cir. 2003). Although "[s]uch statements often ... appear in the claim's preamble," In re Stencel, 828 F.2d 75I, 754 (Fed.Cir. I987), a statement of intended use or purpose can appear elsewhere in a claim. Id. "It is well settled that the recitation of a new intended use for an old product does not make a claim to that old product patentable." In re Schreiber, I28 F.3d I473, I477 (Fed. Cir. I997) (citations omitted). 4 Appeal2016-002240 Application 12/516,766 intended future uses of the respective components of the "network traffic anomaly detector" (apparatus), which are not required to be performed within the scope of claim 1. 3 Nor does claim 1 recite limitations such as "configured to" or "adapted to" that might impose a structural limitation, such that the structural components of the apparatus must be "capable of' performing the contested functions. Thus, we conclude contested functional limitations L 1-L3 do not further limit the structure of the apparatus of claim 1, under a broad but reasonable interpretation. 4 We additionally note functional limitation L4 ("two different measures of rates of data flow") is recited within a "wherein" clause that does not further limit the structure of the apparatus of claim 1. See n.9 (infra) and MPEP § 2111.04 regarding "wherein" clauses: "Claim scope is not limited by claim language that suggests or makes optional but does not require steps to be performed, or by claim language that does not limit a claim to a particular structure." (Emphasis added). To the extent that our reviewing court may give patentable weight to the contested functional language (L 1-L4 ), and to the extent that Appellants substantively contest limitations Ll-L4, we are not persuaded by 3 Because "applicants may amend claims to narrow their scope, a broad construction during prosecution creates no unfairness to the applicant or patentee." In re ICON Health and Fitness, Inc., 496 F.3d 1374, 1379 (Fed. Cir. 2007) (citation omitted). 4 Regarding apparatus claims generally, our reviewing court guides the patentability of an apparatus claim "depends on the claimed structure, not on the use or purpose of that structure." Catalina Marketing Int 'l., Inc. v. Coolsavings.com, Inc., 289 F.3d 801, 809 (Fed. Cir. 2002). 5 Appeal2016-002240 Application 12/516,766 Appellants' arguments, because they are not directly responsive to the Examiner's specific findings. In reviewing the administrative record, we find the Examiner's legal conclusion of obviousness is supported by a preponderance of the evidence, for at least the following reasons: Claim 1 - Limitation LI Regarding contested limitation L 1 ("to extract multiple network traffic statistics, each as a time series ... "), Appellants contend: "Day fails to teach extracting any data as 'a time series,' let alone extracting such data by performing a count over a time window of a 'given type of network activity' at a 'given location."' App. Br. 9. Appellants admit Day's "'packet sniffer' ... can extract network traffic," but contend, "there is no indication that Day analyzes a time series of this data to measure a variation in the statistics of this data over time." App. Br. 10. Although Appellants acknowledge Day describes "multidimensional data," Appellants contend this "does not suggest or necessarily include a time series." App. Br. 10. We agree with the Examiner's finding that Day's process of collecting and analyzing data to detect an anomaly over time requires extracting multiple network traffic statistics, each as a time series. (Ans. 3--4 (citing Day i-fi-135-37, 42--45)). We agree with the Examiner's finding because we find Day's wavelet analysis (i-f 48), which performs analysis within a time series, teaches or at least suggests the contested limitation "time series." Partridge (i-f 83) further describes that"[ w ]avelet analysis decomposes a time series into time-frequency space, so that the dominant modes of variability can be determined, as well as how those modes vary with time." (Emphasis added). 6 Appeal2016-002240 Application 12/516,766 Claim 1 - Limitations L2 and L3 Regarding contested limitation L2 5 ("characterize a variability with respect to time of the network traffic statistics"), Appellants contend: there is no indication in Day that this wavelet analysis is applied to a time series in its intended capacity for clustering data. A wavelet transform, like a Fourier transform, may be applied to any dimension (not simply time), and is plausibly here applied to the multidimensional vectors of Day which are not time series. App. Br. 11 (citing Day i-f 48). We are not persuaded by Appellants' contentions, which are premised on arguing the references separately. The Examiner's rejection is based on the combined teachings and suggestions of Day and Partridge (and Barford). 6 Ans. 4--5. Appellants fail to address the Examiner's specific findings related to Partridge (i-f 83), regarding both limitations L2 and L3. App. Br. 15-17. Although Appellants argue in the Reply Brief that "[ w ]avelet analysis is a general mathematical technique" and assert, "this combination relies on hindsight," we are not persuaded by Appellants' arguments (Reply Br. 2-3).7 We find wavelet analysis, as described in Day (i-f 48) and Partridge (i-f 83, "Wavelet analysis decomposes a time series"), 5 We note contested limitations L2 and L3 share the temporal language: "with respect to time." 6 One cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. In re Merck, 800 F.2d 1091, 1097 (Fed. Cir. 1986). 7 Appellants have not provided any objective evidence of secondary considerations, which our reviewing court guides "operates as a beneficial check on hindsight." Cheese Systems, Inc. v. Tetra Pak Cheese and Powder Systems, Inc., 725 F.3d 1341, 1352 (Fed. Cir. 2013). 7 Appeal2016-002240 Application 12/516,766 teaches or at least suggests limitations L2 and L3 (i.e., "with respect to time"). Ans. 5. We agree with the Examiner's finding that an artisan of ordinary skill in the art at the time of the invention would have been motivated to identify a network anomaly at a particular time and thus would have been motivated to combine the wavelet analysis of Partridge with the system of Day. Ans. 5. We find Day's wavelet analysis (i-f 48), when combined with Partridge's wavelet analysis (i-f 83, decomposing a time series), would have taught or suggested contested L3 limitation: "to characterize a variability with respect to time." Thus, we find the Examiner (Final Act. 6) has set forth sufficient "articulated reasoning with some rational underpinning to support the legal conclusion of obviousness." KSR Int'! Co. v. Teleflex Inc., 550 U.S. 398, 418 (2007) (quoting In re Kahn, 441F.3d977, 988 (Fed. Cir. 2006)). Claim 1 - Limitation L4 Regarding limitation L4 ("wherein the network traffic statistics include at least two different measures of rates of data flow on the network"), Appellants acknowledge: [T]he concepts of time series and the analysis of time series are known in the art, and agrees that Partridge teaches analyzing a time series with wavelet analysis for the purpose of detecting encrypted data signals and ensuring that encrypted data signals are securely transmitted. App. Br. 17. However, Appellants urge: [T]his use is both non-analogous [art] to the problem of detecting anomalies in network traffic according to the present invention, and fails to provide any teaching or suggestion for the combination proposed by the Examiner, let alone any sufficient 8 Appeal2016-002240 Application 12/516,766 guidance to those of ordinary skill in the art as to how to combine these references. App. Br. 17-18. We are not persuaded by Appellants' arguments because Appellants are again arguing the references separately, as the Examiner relies on Barford, not Partridge, for teaching or suggesting limitation L4. Final Act. 7. We are also not persuaded by Appellants' non-analogous art argument, because, for example, both Day (i-f 48) and Partridge (i-f 83) are directed to wavelet analysis. 8 App. Br. 17. Appellants further contend, "Barford does not teach an analysis that separately compares the correspondence of two different network statistics." App. Br. 19. However, we find Appellants' arguments are not commensurate with the scope of the claim. Limitation L4 does not recite "two different network statistics" as Appellants argue, but instead recites "statistics include at least two different measures of rates of data flow on the network." (Emphasis added). For these reasons, and on this record, we find a preponderance of the evidence supports the Examiner's underlying factual findings and ultimate legal conclusion of obviousness regarding the contested limitations L 1-L4 of independent claim 1. Because Appellants have not persuaded us the Examiner erred, we sustain the§ 103 rejection of representative claim 1, and 8 It is sufficient that the references suggest the claim limitations, although the Appellant's particular purpose was different from that of the references. In re Heck, 699F.2d1331, 1333 (Fed. Cir. 1983) (citing In re Gershon, 372 F.2d 535, 538-39 (CCPA 1967)). "Obviousness is not to be determined on the basis of purpose alone." In re Graf, 343 F.2d 774, 777 (CCPA 1965). 9 Appeal2016-002240 Application 12/516,766 the rejection of the associated grouped claims 2, 3, 13, and 24, over the combination of Day, Partridge, and Barford. See Grouping of Claims, supra. Rejection of Dependent Claim 4 under§ 103 Claim 4 recites functional language within a "wherein" clause: "The network traffic anomaly detector of claim 1 wherein the detection unit operates to equate greater variability with increased likelihood of a network anomaly." The Examiner finds the subject matter of claim 4 was "well known in the art." Final Act. 7. Appellants contend the Examiner's use, as a rejection basis, of "well known in the art" is incorrect. App. Br. 20. Appellants specifically contend "there appears to be no evidence on the record that it was known in the art that network anomalies are associated with greater variability." Id. However, we find Appellants have not adequately traversed the official notice taken by the Examiner. In particular, Appellants have not specifically identified the supposed error in the Examiner's action, which would include stating why the noticed fact is not considered to be common knowledge or well-known in the art. See Manual of Patent Examining Procedure (MPEP) § 2144.03. Because Appellants have not met their burden, on this record, we are not persuaded the Examiner erred. Therefore, we sustain the rejection of dependent claim 4. Rejection of Dependent Claim 5 under§ 103 Claim 5 recites, in pertinent part: "wherein the second analyzer evaluates a correlation between the multiple network traffic statistics." 10 Appeal2016-002240 Application 12/516,766 Appellants, in referencing the Examiner's citation to paragraph 42 of Day, contend: "[t]he Examiner's analysis, however, ignores the definition of the terms of this claim required by its dependency on claim 1." App. Br. 21. The Examiner finds Day's traffic from multiple domains and networks teaches or at least suggests the disputed limitation "wherein the second analyzer evaluates a correlation between the multiple network traffic statistics." Final Act. 8 (citing Day i-f 42). Paragraph 42 of Day is reproduced below. [0042] Significantly, it is a distinct advantage of the IDS 200 of the present invention that the sniffer 180 and logger 190, in concert, can extract and store the constituent components of network packets stemming from network traffic for multiple private networks. In particular, by populating the database 100 with granular packet values from multiple private networks, the IDS 200 can undertake a correlative analysis not only in regard to traffic stemming from a single protected private network 150 such as that illustrated in FIG. 1, but also in regard to traffic stemming from multiple, independently operated private networks 150 as shown in FIG. 3. Accordingly, the IDS 200 can be deployed in the context of a managed service provider (MSP) model. In the MSP model, however, wide-scale network anomalies, including multi-domain attacks, can be detected inasmuch as anomalous behavior can be detected across multiple networks which heretofore would not be possible in reference to conventional IDS technology. We agree with the Examiner, because we find Day's IDS 200, which performs a correlative analysis on traffic from multiple private networks, teaches or at least suggests the contested functional limitation: "evaluates a correlation between the multiple network traffic statistics." Day i-f 42. See also n.9, infra. Therefore, on this record, we are not persuaded of error regarding the Examiner's underlying factual findings and legal conclusion of 11 Appeal2016-002240 Application 12/516,766 obviousness for claim 5. Accordingly, we sustain the rejection of dependent claim 5. Rejection of Dependent Claim 6 under§ 103 Dependent claim 6 recites: "The network traffic anomaly detector of claim 1 wherein the second analyzer evaluates how successfully different time-series of the multiple network traffic statistics can be expressed in a single time series." Appellants address the Examiner's citation to Day (i-f 47), in support of the rejection, and contend: [T]his reduction in dimensionality, which expresses multiple dimensions as a single dimension, is not analyzed as required by the claims to quantify a deviation between the different statistics that is used to detect a network anomaly as required in claim 1. Paragraph [004 7] of Day clearly indicates that the reduction in dimensionality is simply used to remove dimensions which are "redundant, irrelevant, or otherwise insignificant." This is in contrast to the present invention in which each dimension contributes equally in the detection of a network anomaly, both when they are similar and dissimilar. App. Br. 22. We are not persuaded by Appellants' contentions because Appellants do not address the Examiner's specific findings. Final Act. 8. The Examiner cites the first sentence of Day's paragraph 47 in rejecting claim 6 ("reduce the dimensionality to simplify subsequent multi-variate analysis"), whereas Appellants ignore this citation and instead argue the second sentence of paragraph 47. The first sentence of Day's paragraph 47 describes: In block 260, a vector separation system can reduce the dimensionality of the multi-dimensional vectors in order to simplify a subsequent multi-variate analysis. 12 Appeal2016-002240 Application 12/516,766 Day if 47. We agree with the Examiner's finding, because we find Day's description of reducing dimensionality teaches or at least suggests the contested limitation "multiple network traffic statistics can be expressed in a single time series." Id. We note claim 6 (like the previous claims) recites contested functional limitations within a "wherein" clause, which we conclude does not further limit the structure of the apparatus of claim 6 (a network traffic anomaly detector). 9 We further conclude the claim term "successfully" is a subjective term of degree, which may be construed under BRI according to two or more plausible interpretations. 10 9 See MPEP § 2111.04 regarding "wherein" clauses: Claim scope is not limited by claim language that suggests or makes optional but does not require steps to be performed, or by claim language that does not limit a claim to a particular structure. However, examples of claim language, although not exhaustive; that may raise a question as to the limiting effect of the language in a claim are: (A) "adapted to" or "adapted for" clauses; (B) "wherein" clauses; and (C) "whereby" clauses. MPEP § 2111.04 (Ninth Ed., Nov. 2015) (emphasis added). 10 In the event of further prosecution of this application, we leave it to the Examiner to consider whether at least claim 6 should be rejected under 35 U.S.C. § 112, second paragraph, as being indefinite. Specifically, it appears the claim 6 language "evaluates how success/ ully ... can be expressed in a single time series" (emphasis added) is a subjective term of degree, subject to plural plausible interpretations under a broad but reasonable interpretation. See Ex parte Miyazaki, 89 USPQ2d 1207, 1211 (BPAI 2008) (precedential). Claim scope cannot depend solely on the unrestrained, subjective opinion of a particular individual purported to be practicing the invention. See Datamize LLC v. Plumtree Software, Inc., 417 13 Appeal2016-002240 Application 12/516,766 Therefore, on this record, we are not persuaded of error regarding the Examiner's underlying factual findings and legal conclusion of obviousness for claim 6. Accordingly, we sustain the rejection of dependent claim 6. Rejection of Dependent Claim 7 under§ 103 Appellants advance no separate, substantive arguments regarding claim 7 rejected under 35 U.S.C. § 103. Arguments not made are waived. See 37 C.F.R. § 41.37(c)(l)(iv). Accordingly, we sustain the rejection of dependent claim 7. Rejection of Dependent Claim 8 under§ 103 Claim 8 recites, in pertinent part: "wherein the detection unit operates to equate lesser correspondence with increased likelihood of a network anomaly." The Examiner finds Day's deviation exceeding a threshold value teaches or at least suggests the contested wherein clause. Final Act. 8 (citing Day iT 51). Appellants contend, "This claim is analogous to claim 4 discussed above, but concerns the correspondence analysis rather than the variability analysis." App. Br. 22. Appellants further contend, "Paragraph [0051] ... is silent with respect to this relationship between correspondence and network anomaly." App. Br. 23. F.3d 1342, 1350 (Fed. Cir. 2005); see also MPEP § 2173.05(b)(IV). Although the Board is authorized to reject claims under 37 C.F.R. § 41.50(b), no inference should be drawn when the Board elects not to do so. See MPEP § 1213.02. 14 Appeal2016-002240 Application 12/516,766 Appellants additionally contend: The Examiner's argument appears to be that Day, in this paragraph, effectively enables all possible methods of analyzing network data to detect a network attack. However, this overstates the teachings of Day and ignores the requirements that a reference enable its teachings. App. Br. 23. We are not persuaded by Appellants' arguments because, as Appellants admit, claim 8 recites an opposite alternative to claim 4: where claim 4 recites "to equate greater variability with increased likelihood of a network anomaly," claim 8 recites "to equate lesser correspondence with increased likelihood of a network anomaly" (emphasis added). We observe there is only a finite set of two possibilities: greater variability or lesser variability (i.e., "correspondence"). Therefore, we conclude selecting either option from such a restricted set of options would have been obvious for an artisan to try. 11 Given Appellants' arguments (App. Br. 22-23), and given the combined teachings of the cited references, on this record, we are not persuaded the Examiner erred. We find a preponderance of the evidence supports the Examiner's underlying factual findings and ultimate legal conclusion of obviousness regarding dependent claim 8. Accordingly, we sustain the rejection of claim 8. 11 Where "the problem is known, the possible approaches to solving the problem are known and finite, and the solution is predictable through use of a known option,'' a solution that is obvious to try may indeed be obvious. Abbott Labs. v. Sandoz, Inc., 544 F.3d 1341, 1351 (Fed. Cir. 2008) (citing KSR, 550 U.S. at 421 ). See also Ortho-McNeil Pharm., Inc. v. Mylan Labs., Inc., 520 F.3d 1358, 1364 (Fed. Cir. 2008) (stating the nurnber of options must be "small or easily traversed"). 15 Appeal2016-002240 Application 12/516,766 Rejection of Dependent Claims 9 and 10 under§ 103 Claim 9 recites: The network traffic anomaly detector of claim 1 wherein the network interface extracts network traffic statistics in pairs of symmetrical counts that structurally tend to be proportionally related. (emphasis added). The Examiner finds Barford' s byte and packet rates teach or at least suggest the disputed "wherein" clause. Final Act. 9 (citing Barford, page 3, left col.). The Examiner further concludes: "it would have been obvious to one of ordinary skill in the art at the time of the invention to select those rates as among the statistics to be analyzed for the purpose of detecting network anomalies." Final Act. 9. However, we find the Examiner fails to present sufficient evidence to support the legal conclusion of obviousness. For essentially the same reasons argued by Appellants (App. Br. 23- 24), which we find persuasive, we reverse the Examiner's rejection of dependent claim 9; and dependent claim 10; which depends from claim 9. Rejection of Dependent Claims 11 and 12 under§ 103 Claims 11 and 12 recite: 11. The network traffic anomaly detector of claim 1 wherein the first and second analyzers use different time windows of analysis and wherein the time window of the second analyzer is longer than the time window of the first analyzer. 12. The network traffic anomaly detector of claim 1 wherein the first analyzer uses a time window of less than 5 minutes. Regarding claims 11 and 12, the Examiner finds these claims' features "are merely design choice as is well known in the art." Final Act. 9. 16 Appeal2016-002240 Application 12/516,766 Appellants disagree: For each of these claims [11 and 12], the Examiner does not cite prior art, but instead relies on the conclusion that "such features are merely design choice," and that "it would have been obvious to one of ordinary skill in the art at the time of the invention to adapt duration of the windows of analysis as needed for fault management." See January 14, 2015 Final Office Action at page 9. App. Br. 24. We note the temporal limitations contested in claims 11 and 12 are recited in "wherein" clauses within each claim and do not further limit the claims to a particular structure. See n.9 (supra) and MPEP § 2111.04 regarding "wherein" clauses. As discussed above, our reviewing court guides the patentability of an apparatus claim "depends on the claimed structure, not on the use or purpose of that structure." Catalina Marketing Int'!, 289 F.3d at 809 (Fed. Cir. 2002). As addressed by the court in Paragon Solutions, LLC v. Timex Corp., 566 F.3d 1075, 1090 (Fed. Cir. 2009), The problem with construing "displaying real-time data" as used in the claims of the '759 patent to preclude "contextually meaningful delay" is that such a construction injects a use limitation into a claim written in structural terms. "[A ]pparatus claims cover what a device is, not what a device does." Hewlett- Packard Co. v. Bausch & Lomb, Inc., 909 F.2d 1464, 1468 (Fed. Cir. 1990) .... Absent an express limitation to the contrary, any use of a device that meets all of the limitations of an apparatus claim written in structural terms infringes that apparatus claim .... [S]ee also Roberts v. Ryer, 91 U.S. 150, 157, 23 L.Ed. 267 (1875) ("The inventor of a machine is entitled to the benefit of all the uses to which it can be put, no matter whether he had conceived the idea of the use or not."). Construing a non- functional term in an apparatus claim in a way that makes direct infringement tum on the use to which an accused apparatus is 17 Appeal2016-002240 Application 12/516,766 later put confuses rather than clarifies, frustrates the ability of both the patentee and potential infringers to ascertain the propriety of particular activities, and is inconsistent with the notice function central to the patent system. Id. at 1090-1091. Applying this guidance here, we conclude the recited temporal functional limitations do not further limit the structure of the apparatus (i.e., the network traffic anomaly detector of claims 11 and 12). As an analogy, two identical automobiles are not patentably distinct if operated for different periods of time (i.e., "different time windows"), or if one automobile operates for "a time window of less than 5 minutes" because such temporal constraints do not further limit the structure of the apparatus (claims 11, 12). Therefore, because the contested temporal limitations recited in claims 11 and 12 do not change or otherwise distinguish the apparatus of the "network traffic anomaly detector" over the corresponding structures found in the prior art (Final Act. 5-7), we sustain the Examiner's rejection of these claims. DECISION We reverse the Examiner's decision rejecting claims 9 and 10 under 35 U.S.C. § 103. We affirm the Examiner's decision rejecting claims 1-8, 11-13, and 24 under 35 U.S.C. § 103. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a)(l). See 37 C.F.R. § 41.50(±). AFFIRMED-IN-PART 18 Copy with citationCopy as parenthetical citation