Ex Parte Barford et al

Patent Trial and Appeal Board

Nov 21, 2016

12516766 (P.T.A.B. Nov. 21, 2016)

UNITED STA TES p A TENT AND TRADEMARK OFFICE
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR
12/516,766 05/28/2009 Paul R. Barford
72088 7590 11/23/2016
WISCONSIN ALUMNI RESEARCH FOUNDATION
C/O BOYLE FREDRICKSON S.C
840 North Plankinton A venue
Milwaukee, WI 53203
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www .uspto.gov
ATTORNEY DOCKET NO. CONFIRMATION NO.
1512.187 1771
EXAMINER
PHUNG,LUAT
ART UNIT PAPER NUMBER
2468
NOTIFICATION DATE DELIVERY MODE
11/23/2016 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address( es):
docketing@boylefred.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte PAUL R. BARFORD, JEFFERY THOMAS KLINE,
SANGNAM NAM, DAVID JOHN PLONKA,
and AMOS RON
Appeal2016-002240
Application 12/516,766
Technology Center 2400
Before ST. JOHN COURTENAY III, THU A. DANG, and
LARRY J. HUME, Administrative Patent Judges.
COURTENAY, Administrative Patent Judge.
DECISION ON APPEAL
STATEMENT OF THE CASE
This is a decision on appeal under 35 U.S.C. § 134(a) from the
Examiner's Final Rejection of claims 1-13 and 24. Appellants have
withdrawn claims 14--16, 18-23, and 25. Claim 17 is cancelled. We have
jurisdiction under 35 U.S.C. § 6(b ).
We affirm-in-part
The Invention
The claimed invention relates to a "Method and Apparatus for
Network Anomaly Detection" (Title).
Appeal2016-002240
Application 12/516,766
Claim 1, is representative of the subject matter on appeal:
1. A network traffic anomaly detector comprising:
a network interface connecting to a network to be
monitored [L 1] to extract multiple network traffic statistics, each
as a time series, the network statistics being extracted by
performing a count over a time window of a given type of network
activity at a given location;
[L2] a first analyzer receiving the network traffic statistics
to characterize a variability with respect to time of the network
traffic statistics;
[L3] a second analyzer rece1vmg the network traffic
statistics to characterize a correspondence with respect to time
between different network traffic statistics, the correspondence
reflecting a statistical dependence between the different network
statistics; and
a detection unit rece1vmg the variability and
correspondence characterizations from the first and second
analyzer to provide an output indicating a likelihood of a network
anomaly
[L4] wherein the network traffic statistics include at least
two different measures of rates of data flow on the network.
(Contested limitations lettered and emphasized.)
Rejection
Claims 1-13 and 24 are rejected under 35 U.S.C. § 103(a) as being
obvious over the combined teachings and suggestions of Day (US
2004/0025044 Al, pub. Feb. 5, 2004), Partridge et. al. ("Partridge") (US
2003/0097595 Al, pub. May 22, 2003), and Barford et. al. ("Barford") ("A
Signal Analysis of Network Traffic Anomalies," In Proceedings of ACM
SIGCOMM Internet Measurement Workshop, 2002).
2
Appeal2016-002240
Application 12/516,766
Claim Grouping
Based on Appellants' arguments (App. Br. 8-26), we decide the
appeal of the rejection of claims 1-3, 13, and 24 on the basis of
representative independent claim 1. We address dependent claims 4--12
separately, infra. To the extent Appellants have not advanced separate,
substantive arguments for particular claims and/ or particular claim
limitations on appeal, such arguments are considered waived. See 37 C.F.R.
§ 41.37(c)(l)(iv).
ANALYSIS
We have considered all of Appellants' arguments and any evidence
presented. We find Appellants' arguments regarding claims 1, 4--6, 8, 11,
and 12 unpersuasive for the reasons discussed infra. Regarding separately
argued claims 1, 4, 5, 6, and 8, we adopt as our own: (1) the findings and
legal conclusions set forth by the Examiner in the action from which this
appeal is taken, and (2) the findings, legal conclusions, and explanations set
forth in the Answer in response to Appellants' arguments. We address the
Examiner's rejection of claims 11 and 12 separately, infra. However, for
essentially the same reasons argued by Appellants, we reverse the
Examiner's rejection of dependent claims 9 and 10. We highlight and
address specific findings and arguments for emphasis in our analysis below.
3
Appeal2016-002240
Application I2/5I6,766
Rejection of Claim 1 under§ 103
Issue: Under 35 U.S.C. § I03(a), did the Examiner err in finding the
cited combination of Day, Partridge, and Barford would have taught or
suggested contested limitations LI, L2, L3, and L4, within the meaning of
claim I? 1
Claim Construction
At the outset, we broadly but reasonably construe the claim language
"a network interface . .. to extract, ... , a first analyzer . .. to characterize, .
. . [and], a second analyzer . .. to characterize ... ; and a detection unit . ..
to provide" as a statements of intended use. 2 Because claim I does not
positively recite that contested functional limitations LI, L2, and L3 are
actually performed, we conclude the contested claim language is directed to
1 We give the contested claim limitations the broadest reasonable
<....-
interpretation consistent with the Specification. See In re Morris, I27 F.3d
I048, I054 (Fed. Cir. I997). See Spec. il 60 ("It is specifically intended that
the present invention not be limited to the embodiments and illustrations
contained herein, but include modified forms of those embodiments
including portions of the embodiments and combinations of elements of
different embodiments as come within the scope of the following claims.")
(Emphasis added).
2 "An intended use or purpose usually will not limit the scope of the claim
because such statements usually do no more than define a context in which
the invention operates."' Boehringer Ingelheim Vetmedica, Inc. v. Schering-
Plough Corp., 320 F.3d I339, I345 (Fed.Cir. 2003). Although "[s]uch
statements often ... appear in the claim's preamble," In re Stencel, 828 F.2d
75I, 754 (Fed.Cir. I987), a statement of intended use or purpose can appear
elsewhere in a claim. Id. "It is well settled that the recitation of a new
intended use for an old product does not make a claim to that old product
patentable." In re Schreiber, I28 F.3d I473, I477 (Fed. Cir. I997) (citations
omitted).
4
Appeal2016-002240
Application 12/516,766
intended future uses of the respective components of the "network traffic
anomaly detector" (apparatus), which are not required to be performed
within the scope of claim 1. 3
Nor does claim 1 recite limitations such as "configured to" or
"adapted to" that might impose a structural limitation, such that the
structural components of the apparatus must be "capable of' performing the
contested functions. Thus, we conclude contested functional limitations
L 1-L3 do not further limit the structure of the apparatus of claim 1, under a
broad but reasonable interpretation. 4
We additionally note functional limitation L4 ("two different
measures of rates of data flow") is recited within a "wherein" clause that
does not further limit the structure of the apparatus of claim 1. See n.9
(infra) and MPEP § 2111.04 regarding "wherein" clauses: "Claim scope is
not limited by claim language that suggests or makes optional but does not
require steps to be performed, or by claim language that does not limit a
claim to a particular structure." (Emphasis added).
To the extent that our reviewing court may give patentable weight to
the contested functional language (L 1-L4 ), and to the extent that Appellants
substantively contest limitations Ll-L4, we are not persuaded by
3 Because "applicants may amend claims to narrow their scope, a broad
construction during prosecution creates no unfairness to the applicant or
patentee." In re ICON Health and Fitness, Inc., 496 F.3d 1374, 1379 (Fed.
Cir. 2007) (citation omitted).
4 Regarding apparatus claims generally, our reviewing court guides the
patentability of an apparatus claim "depends on the claimed structure, not on
the use or purpose of that structure." Catalina Marketing Int 'l., Inc. v.
Coolsavings.com, Inc., 289 F.3d 801, 809 (Fed. Cir. 2002).
5
Appeal2016-002240
Application 12/516,766
Appellants' arguments, because they are not directly responsive to the
Examiner's specific findings. In reviewing the administrative record, we
find the Examiner's legal conclusion of obviousness is supported by a
preponderance of the evidence, for at least the following reasons:
Claim 1 - Limitation LI
Regarding contested limitation L 1 ("to extract multiple network traffic
statistics, each as a time series ... "), Appellants contend: "Day fails to teach
extracting any data as 'a time series,' let alone extracting such data by
performing a count over a time window of a 'given type of network activity'
at a 'given location."' App. Br. 9.
Appellants admit Day's "'packet sniffer' ... can extract network
traffic," but contend, "there is no indication that Day analyzes a time series
of this data to measure a variation in the statistics of this data over time."
App. Br. 10. Although Appellants acknowledge Day describes
"multidimensional data," Appellants contend this "does not suggest or
necessarily include a time series." App. Br. 10.
We agree with the Examiner's finding that Day's process of collecting
and analyzing data to detect an anomaly over time requires extracting
multiple network traffic statistics, each as a time series. (Ans. 3--4 (citing
Day i-fi-135-37, 42--45)). We agree with the Examiner's finding because we
find Day's wavelet analysis (i-f 48), which performs analysis within a time
series, teaches or at least suggests the contested limitation "time series."
Partridge (i-f 83) further describes that"[ w ]avelet analysis decomposes a time
series into time-frequency space, so that the dominant modes of variability
can be determined, as well as how those modes vary with time." (Emphasis
added).
6
Appeal2016-002240
Application 12/516,766
Claim 1 - Limitations L2 and L3
Regarding contested limitation L2 5 ("characterize a variability with
respect to time of the network traffic statistics"), Appellants contend:
there is no indication in Day that this wavelet analysis is applied
to a time series in its intended capacity for clustering data. A
wavelet transform, like a Fourier transform, may be applied to
any dimension (not simply time), and is plausibly here applied to
the multidimensional vectors of Day which are not time series.
App. Br. 11 (citing Day i-f 48).
We are not persuaded by Appellants' contentions, which are premised
on arguing the references separately. The Examiner's rejection is based on
the combined teachings and suggestions of Day and Partridge (and
Barford). 6 Ans. 4--5. Appellants fail to address the Examiner's specific
findings related to Partridge (i-f 83), regarding both limitations L2 and L3.
App. Br. 15-17. Although Appellants argue in the Reply Brief that
"[ w ]avelet analysis is a general mathematical technique" and assert, "this
combination relies on hindsight," we are not persuaded by Appellants'
arguments (Reply Br. 2-3).7 We find wavelet analysis, as described in Day
(i-f 48) and Partridge (i-f 83, "Wavelet analysis decomposes a time series"),
5 We note contested limitations L2 and L3 share the temporal language:
"with respect to time."
6 One cannot show nonobviousness by attacking references individually
where the rejections are based on combinations of references. In re Merck,
800 F.2d 1091, 1097 (Fed. Cir. 1986).
7 Appellants have not provided any objective evidence of secondary
considerations, which our reviewing court guides "operates as a beneficial
check on hindsight." Cheese Systems, Inc. v. Tetra Pak Cheese and Powder
Systems, Inc., 725 F.3d 1341, 1352 (Fed. Cir. 2013).
7
Appeal2016-002240
Application 12/516,766
teaches or at least suggests limitations L2 and L3 (i.e., "with respect to
time"). Ans. 5.
We agree with the Examiner's finding that an artisan of ordinary skill
in the art at the time of the invention would have been motivated to identify
a network anomaly at a particular time and thus would have been motivated
to combine the wavelet analysis of Partridge with the system of Day. Ans.
5. We find Day's wavelet analysis (i-f 48), when combined with Partridge's
wavelet analysis (i-f 83, decomposing a time series), would have taught or
suggested contested L3 limitation: "to characterize a variability with respect
to time." Thus, we find the Examiner (Final Act. 6) has set forth sufficient
"articulated reasoning with some rational underpinning to support the legal
conclusion of obviousness." KSR Int'! Co. v. Teleflex Inc., 550 U.S. 398,
418 (2007) (quoting In re Kahn, 441F.3d977, 988 (Fed. Cir. 2006)).
Claim 1 - Limitation L4
Regarding limitation L4 ("wherein the network traffic statistics
include at least two different measures of rates of data flow on the
network"), Appellants acknowledge:
[T]he concepts of time series and the analysis of time series are
known in the art, and agrees that Partridge teaches analyzing a
time series with wavelet analysis for the purpose of detecting
encrypted data signals and ensuring that encrypted data signals
are securely transmitted.
App. Br. 17.
However, Appellants urge:
[T]his use is both non-analogous [art] to the problem of detecting
anomalies in network traffic according to the present invention,
and fails to provide any teaching or suggestion for the
combination proposed by the Examiner, let alone any sufficient
8
Appeal2016-002240
Application 12/516,766
guidance to those of ordinary skill in the art as to how to combine
these references.
App. Br. 17-18.
We are not persuaded by Appellants' arguments because Appellants
are again arguing the references separately, as the Examiner relies on
Barford, not Partridge, for teaching or suggesting limitation L4. Final Act.
7. We are also not persuaded by Appellants' non-analogous art argument,
because, for example, both Day (i-f 48) and Partridge (i-f 83) are directed to
wavelet analysis. 8 App. Br. 17.
Appellants further contend, "Barford does not teach an analysis that
separately compares the correspondence of two different network statistics."
App. Br. 19.
However, we find Appellants' arguments are not commensurate with
the scope of the claim. Limitation L4 does not recite "two different network
statistics" as Appellants argue, but instead recites "statistics include at least
two different measures of rates of data flow on the network." (Emphasis
added).
For these reasons, and on this record, we find a preponderance of the
evidence supports the Examiner's underlying factual findings and ultimate
legal conclusion of obviousness regarding the contested limitations L 1-L4
of independent claim 1. Because Appellants have not persuaded us the
Examiner erred, we sustain the§ 103 rejection of representative claim 1, and
8 It is sufficient that the references suggest the claim limitations, although
the Appellant's particular purpose was different from that of the references.
In re Heck, 699F.2d1331, 1333 (Fed. Cir. 1983) (citing In re Gershon, 372
F.2d 535, 538-39 (CCPA 1967)). "Obviousness is not to be determined on
the basis of purpose alone." In re Graf, 343 F.2d 774, 777 (CCPA 1965).
9
Appeal2016-002240
Application 12/516,766
the rejection of the associated grouped claims 2, 3, 13, and 24, over the
combination of Day, Partridge, and Barford. See Grouping of Claims,
supra.
Rejection of Dependent Claim 4 under§ 103
Claim 4 recites functional language within a "wherein" clause: "The
network traffic anomaly detector of claim 1 wherein the detection unit
operates to equate greater variability with increased likelihood of a network
anomaly."
The Examiner finds the subject matter of claim 4 was "well known in
the art." Final Act. 7. Appellants contend the Examiner's use, as a
rejection basis, of "well known in the art" is incorrect. App. Br. 20.
Appellants specifically contend "there appears to be no evidence on the
record that it was known in the art that network anomalies are associated
with greater variability." Id.
However, we find Appellants have not adequately traversed the
official notice taken by the Examiner. In particular, Appellants have not
specifically identified the supposed error in the Examiner's action, which
would include stating why the noticed fact is not considered to be common
knowledge or well-known in the art. See Manual of Patent Examining
Procedure (MPEP) § 2144.03. Because Appellants have not met their
burden, on this record, we are not persuaded the Examiner erred. Therefore,
we sustain the rejection of dependent claim 4.
Rejection of Dependent Claim 5 under§ 103
Claim 5 recites, in pertinent part: "wherein the second analyzer
evaluates a correlation between the multiple network traffic statistics."
10
Appeal2016-002240
Application 12/516,766
Appellants, in referencing the Examiner's citation to paragraph 42 of Day,
contend: "[t]he Examiner's analysis, however, ignores the definition of the
terms of this claim required by its dependency on claim 1." App. Br. 21.
The Examiner finds Day's traffic from multiple domains and
networks teaches or at least suggests the disputed limitation "wherein the
second analyzer evaluates a correlation between the multiple network traffic
statistics." Final Act. 8 (citing Day i-f 42). Paragraph 42 of Day is
reproduced below.
[0042] Significantly, it is a distinct advantage of the IDS 200 of
the present invention that the sniffer 180 and logger 190, in
concert, can extract and store the constituent components of
network packets stemming from network traffic for multiple
private networks. In particular, by populating the database 100
with granular packet values from multiple private networks, the
IDS 200 can undertake a correlative analysis not only in regard
to traffic stemming from a single protected private network 150
such as that illustrated in FIG. 1, but also in regard to traffic
stemming from multiple, independently operated private
networks 150 as shown in FIG. 3. Accordingly, the IDS 200 can
be deployed in the context of a managed service provider (MSP)
model. In the MSP model, however, wide-scale network
anomalies, including multi-domain attacks, can be detected
inasmuch as anomalous behavior can be detected across multiple
networks which heretofore would not be possible in reference to
conventional IDS technology.
We agree with the Examiner, because we find Day's IDS 200, which
performs a correlative analysis on traffic from multiple private networks,
teaches or at least suggests the contested functional limitation: "evaluates a
correlation between the multiple network traffic statistics." Day i-f 42. See
also n.9, infra. Therefore, on this record, we are not persuaded of error
regarding the Examiner's underlying factual findings and legal conclusion of
11
Appeal2016-002240
Application 12/516,766
obviousness for claim 5. Accordingly, we sustain the rejection of dependent
claim 5.
Rejection of Dependent Claim 6 under§ 103
Dependent claim 6 recites: "The network traffic anomaly detector of
claim 1 wherein the second analyzer evaluates how successfully different
time-series of the multiple network traffic statistics can be expressed in a
single time series." Appellants address the Examiner's citation to Day (i-f
47), in support of the rejection, and contend:
[T]his reduction in dimensionality, which expresses multiple
dimensions as a single dimension, is not analyzed as required by
the claims to quantify a deviation between the different statistics
that is used to detect a network anomaly as required in claim 1.
Paragraph [004 7] of Day clearly indicates that the reduction in
dimensionality is simply used to remove dimensions which are
"redundant, irrelevant, or otherwise insignificant." This is in
contrast to the present invention in which each dimension
contributes equally in the detection of a network anomaly, both
when they are similar and dissimilar.
App. Br. 22.
We are not persuaded by Appellants' contentions because Appellants
do not address the Examiner's specific findings. Final Act. 8. The
Examiner cites the first sentence of Day's paragraph 47 in rejecting claim 6
("reduce the dimensionality to simplify subsequent multi-variate analysis"),
whereas Appellants ignore this citation and instead argue the second
sentence of paragraph 47. The first sentence of Day's paragraph 47
describes:
In block 260, a vector separation system can reduce the
dimensionality of the multi-dimensional vectors in order to
simplify a subsequent multi-variate analysis.
12
Appeal2016-002240
Application 12/516,766
Day if 47.
We agree with the Examiner's finding, because we find Day's
description of reducing dimensionality teaches or at least suggests the
contested limitation "multiple network traffic statistics can be expressed in a
single time series." Id.
We note claim 6 (like the previous claims) recites contested functional
limitations within a "wherein" clause, which we conclude does not further
limit the structure of the apparatus of claim 6 (a network traffic anomaly
detector). 9 We further conclude the claim term "successfully" is a subjective
term of degree, which may be construed under BRI according to two or
more plausible interpretations. 10
9 See MPEP § 2111.04 regarding "wherein" clauses: Claim scope is not
limited by claim language that suggests or makes optional but does not
require steps to be performed, or by claim language that does not limit a
claim to a particular structure. However, examples of claim language,
although not exhaustive; that may raise a question as to the limiting effect of
the language in a claim are:
(A) "adapted to" or "adapted for" clauses;
(B) "wherein" clauses; and
(C) "whereby" clauses.
MPEP § 2111.04 (Ninth Ed., Nov. 2015) (emphasis added).
10 In the event of further prosecution of this application, we leave it to the
Examiner to consider whether at least claim 6 should be rejected under
35 U.S.C. § 112, second paragraph, as being indefinite. Specifically, it
appears the claim 6 language "evaluates how success/ ully ... can be
expressed in a single time series" (emphasis added) is a subjective term of
degree, subject to plural plausible interpretations under a broad but
reasonable interpretation. See Ex parte Miyazaki, 89 USPQ2d 1207, 1211
(BPAI 2008) (precedential). Claim scope cannot depend solely on the
unrestrained, subjective opinion of a particular individual purported to be
practicing the invention. See Datamize LLC v. Plumtree Software, Inc., 417
13
Appeal2016-002240
Application 12/516,766
Therefore, on this record, we are not persuaded of error regarding the
Examiner's underlying factual findings and legal conclusion of obviousness
for claim 6. Accordingly, we sustain the rejection of dependent claim 6.
Rejection of Dependent Claim 7 under§ 103
Appellants advance no separate, substantive arguments regarding
claim 7 rejected under 35 U.S.C. § 103. Arguments not made are waived.
See 37 C.F.R. § 41.37(c)(l)(iv). Accordingly, we sustain the rejection of
dependent claim 7.
Rejection of Dependent Claim 8 under§ 103
Claim 8 recites, in pertinent part: "wherein the detection unit operates
to equate lesser correspondence with increased likelihood of a network
anomaly."
The Examiner finds Day's deviation exceeding a threshold value
teaches or at least suggests the contested wherein clause. Final Act. 8 (citing
Day iT 51).
Appellants contend, "This claim is analogous to claim 4 discussed
above, but concerns the correspondence analysis rather than the variability
analysis." App. Br. 22.
Appellants further contend, "Paragraph [0051] ... is silent with
respect to this relationship between correspondence and network anomaly."
App. Br. 23.
F.3d 1342, 1350 (Fed. Cir. 2005); see also MPEP § 2173.05(b)(IV).
Although the Board is authorized to reject claims under 37 C.F.R.
§ 41.50(b), no inference should be drawn when the Board elects not to do so.
See MPEP § 1213.02.
14
Appeal2016-002240
Application 12/516,766
Appellants additionally contend:
The Examiner's argument appears to be that Day, in this
paragraph, effectively enables all possible methods of analyzing
network data to detect a network attack. However, this overstates
the teachings of Day and ignores the requirements that a
reference enable its teachings.
App. Br. 23.
We are not persuaded by Appellants' arguments because, as
Appellants admit, claim 8 recites an opposite alternative to claim 4: where
claim 4 recites "to equate greater variability with increased likelihood of a
network anomaly," claim 8 recites "to equate lesser correspondence with
increased likelihood of a network anomaly" (emphasis added). We observe
there is only a finite set of two possibilities: greater variability or lesser
variability (i.e., "correspondence"). Therefore, we conclude selecting either
option from such a restricted set of options would have been obvious for an
artisan to try. 11 Given Appellants' arguments (App. Br. 22-23), and given
the combined teachings of the cited references, on this record, we are not
persuaded the Examiner erred.
We find a preponderance of the evidence supports the Examiner's
underlying factual findings and ultimate legal conclusion of obviousness
regarding dependent claim 8. Accordingly, we sustain the rejection of claim
8.
11 Where "the problem is known, the possible approaches to solving the
problem are known and finite, and the solution is predictable through use of
a known option,'' a solution that is obvious to try may indeed be obvious.
Abbott Labs. v. Sandoz, Inc., 544 F.3d 1341, 1351 (Fed. Cir. 2008) (citing
KSR, 550 U.S. at 421 ). See also Ortho-McNeil Pharm., Inc. v. Mylan Labs.,
Inc., 520 F.3d 1358, 1364 (Fed. Cir. 2008) (stating the nurnber of options
must be "small or easily traversed").
15
Appeal2016-002240
Application 12/516,766
Rejection of Dependent Claims 9 and 10 under§ 103
Claim 9 recites:
The network traffic anomaly detector of claim 1 wherein the
network interface extracts network traffic statistics in pairs of
symmetrical counts that structurally tend to be proportionally
related. (emphasis added).
The Examiner finds Barford' s byte and packet rates teach or at least
suggest the disputed "wherein" clause. Final Act. 9 (citing Barford, page 3,
left col.). The Examiner further concludes: "it would have been obvious to
one of ordinary skill in the art at the time of the invention to select those
rates as among the statistics to be analyzed for the purpose of detecting
network anomalies." Final Act. 9. However, we find the Examiner fails to
present sufficient evidence to support the legal conclusion of obviousness.
For essentially the same reasons argued by Appellants (App. Br. 23-
24), which we find persuasive, we reverse the Examiner's rejection of
dependent claim 9; and dependent claim 10; which depends from claim 9.
Rejection of Dependent Claims 11 and 12 under§ 103
Claims 11 and 12 recite:
11. The network traffic anomaly detector of claim 1 wherein the
first and second analyzers use different time windows of analysis
and wherein the time window of the second analyzer is longer
than the time window of the first analyzer.
12. The network traffic anomaly detector of claim 1 wherein the
first analyzer uses a time window of less than 5 minutes.
Regarding claims 11 and 12, the Examiner finds these claims' features
"are merely design choice as is well known in the art." Final Act. 9.
16
Appeal2016-002240
Application 12/516,766
Appellants disagree:
For each of these claims [11 and 12], the Examiner does not cite
prior art, but instead relies on the conclusion that "such features
are merely design choice," and that "it would have been obvious
to one of ordinary skill in the art at the time of the invention to
adapt duration of the windows of analysis as needed for fault
management." See January 14, 2015 Final Office Action at page
9.
App. Br. 24.
We note the temporal limitations contested in claims 11 and 12 are
recited in "wherein" clauses within each claim and do not further limit the
claims to a particular structure. See n.9 (supra) and MPEP § 2111.04
regarding "wherein" clauses.
As discussed above, our reviewing court guides the patentability of an
apparatus claim "depends on the claimed structure, not on the use or purpose
of that structure." Catalina Marketing Int'!, 289 F.3d at 809 (Fed. Cir.
2002). As addressed by the court in Paragon Solutions, LLC v. Timex
Corp., 566 F.3d 1075, 1090 (Fed. Cir. 2009),
The problem with construing "displaying real-time data"
as used in the claims of the '759 patent to preclude "contextually
meaningful delay" is that such a construction injects a use
limitation into a claim written in structural terms. "[A ]pparatus
claims cover what a device is, not what a device does." Hewlett-
Packard Co. v. Bausch & Lomb, Inc., 909 F.2d 1464, 1468 (Fed.
Cir. 1990) .... Absent an express limitation to the contrary, any
use of a device that meets all of the limitations of an apparatus
claim written in structural terms infringes that apparatus
claim .... [S]ee also Roberts v. Ryer, 91 U.S. 150, 157, 23 L.Ed.
267 (1875) ("The inventor of a machine is entitled to the benefit
of all the uses to which it can be put, no matter whether he had
conceived the idea of the use or not."). Construing a non-
functional term in an apparatus claim in a way that makes direct
infringement tum on the use to which an accused apparatus is
17
Appeal2016-002240
Application 12/516,766
later put confuses rather than clarifies, frustrates the ability of
both the patentee and potential infringers to ascertain the
propriety of particular activities, and is inconsistent with the
notice function central to the patent system.
Id. at 1090-1091.
Applying this guidance here, we conclude the recited temporal
functional limitations do not further limit the structure of the apparatus (i.e.,
the network traffic anomaly detector of claims 11 and 12). As an analogy,
two identical automobiles are not patentably distinct if operated for different
periods of time (i.e., "different time windows"), or if one automobile
operates for "a time window of less than 5 minutes" because such temporal
constraints do not further limit the structure of the apparatus (claims 11, 12).
Therefore, because the contested temporal limitations recited in claims 11
and 12 do not change or otherwise distinguish the apparatus of the "network
traffic anomaly detector" over the corresponding structures found in the
prior art (Final Act. 5-7), we sustain the Examiner's rejection of these
claims.
DECISION
We reverse the Examiner's decision rejecting claims 9 and 10 under
35 U.S.C. § 103.
We affirm the Examiner's decision rejecting claims 1-8, 11-13, and
24 under 35 U.S.C. § 103.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(l). See 37 C.F.R.
§ 41.50(±).
AFFIRMED-IN-PART
18