Ex Parte Seminaro et al

Patent Trial and Appeal Board

Apr 30, 2014

11151665 (P.T.A.B. Apr. 30, 2014)

UNITED STATES PATENT AND TRADEMARK OFFICE
____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________

Ex parte MICHAEL D. SEMINARO, CHRISTOPHER E. MAR and
JON D. GREAVES
____________

Appeal 2011-013163
Application 11/151,665
Technology Center 2400
____________

Before CHARLES N. GREENHUT, MICHAEL L. HOELTER and
ANNETTE R. REIMERS, Administrative Patent Judges.

REIMERS, Administrative Patent Judge.

DECISION ON APPEAL

Appeal 2011-013163
Application 11/151,665

2
STATEMENT OF THE CASE
Michael D. Seminaro et al. (Appellants) appeal under 35 U.S.C. §
134(a) from the Examiner’s decision to reject: (1) claims 7 and 33-39 under
35 U.S.C. § 102(e) as anticipated by Njemanze (US 7,376,969 B1; iss. May
20, 2008); and (2) claims 2-4 and 21-32 under 35 U.S.C. § 103(a) as
unpatentable over Njemanze and Alsberg (US 4,672,572; iss. Jun. 9, 1987).
Claims 1, 5, 6 and 8-20 have been canceled. We have jurisdiction under 35
U.S.C. § 6(b).
We REVERSE.

CLAIMED SUBJECT MATTER
The claimed subject matter “relates to the monitoring and
management of devices or appliances using a network management system
and the like.” Spec., para. [002]; fig. 1. Claims 21, 33 and 34 are
independent.
Claim 33 is illustrative of the claimed invention and recites:
33. A processor-readable medium having
instructions stored thereon, the instructions configured to
perform a method, the method comprising:
filtering, at a client receiver platform
communicatively coupled to one or more managed
devices within the network, the event data at a local level
to produce local event filtered data;
filtering, at a server communicatively coupled to
the client receiver platform, the local event filtered data
at a global level to produce global event filtered data,
wherein the global event filtered data differs from the
local event filtered data and wherein the filtering at the
Appeal 2011-013163
Application 11/151,665

3
server includes applying at least one global deny that
eliminates events matching a first pre-defined event from
inclusion in the global event filtered data and further
applying at least one global permit causing inclusion of
events matching a second pre-defined event in the global
event filtered data;
probe filtering the global event filtered data at a
network management system to produce probe filtered
event data, the network management system being
distinct from the server, and communicatively coupled to
the server; and
filtering, at the network management system, the
probe filtered event data to produce control center
filtered data.

ANALYSIS
Anticipation by Njemanze
Claims 7 and 33
Independent claim 33 is directed to a processor-readable medium
having instructions stored thereon, the instructions configured to perform a
method including the step of “probe filtering the global event filtered data at
a network management system to produce probe filtered event data, the
network management system being distinct from the server.” Br. 23, Clms.
App’x. The Examiner found that Njemanze teaches
probe filtering the global event filtered data
at a network management system (manager, 14 of
Fig. 1) to produce probe filtered event data
(manager employs rules engine and a centralized
events database to filter and cross-correlate events)
[Njemanze: Col. 4 / lines 55-64], the network
management system being distinct from the server,
Appeal 2011-013163
Application 11/151,665

4
and communicatively coupled to, the server
[Njemanze: Col. 5 / lines 4-7; use of multiple
managers].
Ans. 13.
Appellants contend that
there is no disclosure or even suggestion in
Njemanze that a first manager 14, which filters
event data received from an agent 12, passes the
filtered event data to second manager 14 which
then further filters the already filtered event data.
In contrast, Njemanze only discloses that
managers 14 “can forward information to other
rnanagers” (see Njemanze at column 5, lines 5-6)
without any discussion of further filtering of the
already filtered data being performed at subsequent
managers 14.

Br. 16-17; see also id. at 10.

Appellants’ arguments are persuasive. Njemanze teaches: (1)
“[a]gents 12 are software programs that provide efficient, real-time (or near
real-time) local event data capture and filtering from a variety of network
security devices and/or applications” (Njemanze, col. 4, ll. 36-39); (2)
“[m]anagers 14 are server-based components that further consolidate, filter
and cross-correlate events received from the agents, employing a rules
engine 18 and a centralized event database 20” (Id. at col. 4, ll. 55-58); and
(3) “[i]n some installations, managers 14 may act as concentrators for
multiple agents 12 and can forward information to other managers (e.g.,
deployed at a corporate headquarters)” (Id. at col. 5, ll. 4-7).

Appeal 2011-013163
Application 11/151,665

5
While Njemanze teaches client (agent 12) filtering and server
(manager 14) filtering, Njemanze gives no indication that further filtering of
the already filtered event data takes place. In addition, the Examiner does
not articulate sufficient technical reasoning to establish a reasonable basis
for belief that Njemanze necessarily includes instructions to cause the
already filtered event data of Njemanze to undergo additional filtering. See
Ans. 13, 18-19. Moreover, claim 33 recites that “the network management
system [is] distinct from the server.” Br. 23, Clms. App’x (emphasis added);
see also Br. 15-16. The Examiner found the server and the network
management system to be the same (i.e., “manager, 14 of Fig. 1”). Ans. 13.
The Examiner further cited Njemanze col. 5, lines 4-7, for disclosure of the
network management system being distinct from the server. Id. As shown
above, column 5, lines 4-7 of Njemanze, merely discusses forwarding of
information between managers. The Examiner has failed to show how the
network management system is distinct from the server. Thus, for the
foregoing reasons, the Examiner has failed to establish that Njemanze
teaches the medium of claim 33.
Accordingly, the Examiner’s rejection of independent claim 33 and its
respective dependent claim 7 as anticipated by Njemanze cannot be
sustained.
Claims 34-39
Independent claim 34 recites a method including the step of
“performing probe filtering based on [a] probe filter rules [set] differing
Appeal 2011-013163
Application 11/151,665

6
from the global rules set.” Br. 23, Clms. App’x. The Examiner cited
Njemanze column 10, lines 30-33, for teaching this step. Ans. 15.
Appellants contend that the portion of Njemanze cited by the
Examiner “describ[es] the same processing at the managers 14 to determine
actionable events (whereby the rules engine 18 of the managers 14 processes
events against the same rules set) instead of multiple distinct filtering steps
utilizing different rules sets.” Br. 8-9 (emphasis omitted).
Appellants’ arguments are persuasive. Njemanze teaches “[a]s part of
the process of generating meta-events, rules engine 18 examines the received
events to determine which (if any) of the various rules being processed in the
system may be implicated by a particular event or events.” Njemanze, col.
10, ll. 30-33. We agree with Appellants that this portion of Njemanze
merely “discusses how the rules engine 18 processes the rules against event
data to create meta-events and thereby trigger actions.” See Br. 8. Column
10, lines 30-33 of Njemanze fails to mention anything about filtering, let
alone, performing probe filtering based on a probe filter rules set that differs
from a global rules set. As such, the Examiner has failed to establish that
Njemanze teaches the step of “performing probe filtering based on [a] probe
filter rules [set] differing from the global rules set,” as required by claim 34.
Accordingly, the Examiner’s rejection of independent claim 34 and its
respective dependent claims 35-39 as anticipated by Njemanze cannot be
sustained.

Appeal 2011-013163
Application 11/151,665

7
Obviousness over Njemanze and Alsberg
Claims 2-4 and 21-32
The Examiner again relies on Njemanze as disclosing the claim 21
limitation similar to that discussed above with regard to claim 33: “probe
filtering the global event filtered data at a network management system to
produce probe filtered event data, the network management system being
distinct from the server.” Ans. 5; see also Br. 21, Clms. App’x. The
Examiner relied on Alsberg for its disclosure of modifying at least one of the
filtering at client receiver platform or filtering at server or probe filtering in
case of a benign event. See Ans. 6-7. This does not cure the above-
discussed deficiency in the Examiner’s citation of Njemanze as meeting the
aforementioned claim limitation.
Accordingly, we do not sustain the Examiner’s rejection of
independent claim 21 and its respective dependent claims 2-4 and 22-32 as
unpatentable over Njemanze and Alsberg.

DECISION
We REVERSE the decision of the Examiner to reject claims 2-4, 7
and 21-39.
REVERSED

hh