Ex Parte Wen et al

Patent Trial and Appeal Board

Sep 18, 2012

11001985 (P.T.A.B. Sep. 18, 2012)

UNITED STATES PATENT AND TRADEMARK OFFICE
________________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
________________

Ex parte HAN WEN, GEORGE ZIOULAS,
STEPHEN GUARINI, MASOOD AHMED, and
ERIK SEILNACHT
________________

Appeal 2010-003091
Application 11/001,985
Technology Center 2400
________________

Before JOSEPH F. RUGGIERO, JOHN A. JEFFERY, and
STANLEY M. WEINBERG, Administrative Patent Judges.

WEINBERG, Administrative Patent Judge.

DECISION ON APPEAL

Appeal 2010-003091
Application 11/001,985

2
SUMMARY
Appellants appeal under 35 U.S.C. § 134(a) from the Examiner’s
rejection of claims 1-6 and 9-29.1
Claims 1-6, 9, 10, 13-17, and 19-29 stand rejected under 35 U.S.C.
§ 102(e) as anticipated by Moran (US 6,801,940 B1; Oct. 5, 2004; filed Jan.
11, 2002).
Claims 11, 12, and 18 stand rejected under 35 U.S.C. § 103(a) as
obvious over Moran.
We affirm.

STATEMENT OF CASE
Appellants’ invention relates to network application performance
monitoring and, more particularly, to a process for discovering and/or
troubleshooting problems with such performance. Problems are detected
regarding network application usage/performance and the problems are
isolated to specific contributors such as users, applications, or network
resources. More specifically, anomalous conditions are correlated across
one or more metrics and groups to identify symptoms of problems
experienced in the network and the anomalous conditions are isolated to one
or more related members. Examples of anomalous conditions are
usage/throughput, retransmission delay, application response rate, and

1 Throughout this opinion, we refer to (1) the Appeal Brief filed June 5,
2009; (2) the Examiner’s Answer mailed September 25, 2009; and (3) the
Reply Brief filed November 24, 2009. Although the first part of the Answer
does not refer to claims 28 and 29 (Ans. 1-9), both the Examiner and
Appellants agree that claims 28 and 29 are subject to this appeal. App. Br.
2, n.1; 9-10; Ans. 2, 11-12. See also March 9, 2009, Advisory Action.
Appeal 2010-003091
Application 11/001,985

3
application response time. See generally Spec. ¶¶ 0002, 0016, 0029, 0039,
0044.
Independent claim 1 is illustrative with key disputed limitations
emphasized:
1. A method comprising:
extracting, during monitoring of network traffic made up of Internet
protocol (IP) packets, network application monitoring metrics;
aggregating the metrics into logical group types; and
analyzing logically grouped and aggregated metrics by identifying a
plurality of the logical group types, correlating anomalous conditions across
the logically grouped and aggregated metrics, and isolating the anomalous
conditions to one or more related members of the logical group types.

THE ANTICIPATION REJECTION
The Examiner finds that Moran discloses every recited feature of
representative claim 1 including correlating anomalous conditions across
logically grouped metrics and isolating the anomalous conditions to one or
more related members of the logical group types.

ISSUES
Under § 102, has the Examiner erred by finding that Moran discloses:
(1) correlating anomalous conditions across logically grouped
metrics as recited in claim 1?
(2) isolating the anomalous conditions to one or more related
members of the logical group types as recited in claim 1?

Appeal 2010-003091
Application 11/001,985

4
FINDINGS OF FACT
1. Appellants’ method aggregates metrics into logical groups called
group types, which are users and sets of users, the latter being referred to as
a business group. Spec. ¶ 0030.
2. Appellants’ connected user group can comprise (1) another user (e.g.,
a person computer); (2) a user that is using a particular application (e.g.,
Microsoft Outlookâ„¢); (3) a business group (e.g., a personal computer
communicating with a home office); and (4) a business group that is using a
particular application (e.g., a personal computer communicating with the
home office via a particular application). Spec. ¶ 0033.
3. Appellants’ connected business group can comprise (1) a remote
office communicating with a home office; (2) a remote office
communicating with a home office using a particular application; (3) a
remote office communicating with a particular resource such as a file
server; (4) a remote office communicating with a particular resource
through a particular application; (5) a remote office communicating with a
particular resource in the home office; and (6) a remote office
communicating with a particular resource in a home office through the use
of a particular application. Spec. ¶ 0034.
4. To troubleshoot, Appellants’ process correlates anomalous conditions
across one or more metrics and groups to identify symptoms of problems
being experienced in the network. Spec. ¶ 0039. Monitored metrics
include throughput, retransmission delay, application response rate, and
application response time. Spec. ¶ 0029.
5. Appellants then isolate the anomalous conditions to one or more
related members of the group types. Spec. ¶¶ 0007, 0044. That is, the
Appeal 2010-003091
Application 11/001,985

5
detected problem is isolated to specific contributors such as users,
applications, or network resources. Spec. ¶ 0016.
6. Moran’s system uses Media Modules to monitor and correlate
multiple network segments 308 allowing monitoring of individual branch
segments in a system and providing a complete network view from a single
administrative point. Fig. 3; col. 5, l. 60–col. 6, l.4.
7. Moran’s system allows users to create groupings based on location,
using a range of network addresses, subnets, and multiple subnets. The
system allows users to view metrics and statistics for applications from a
grouping’s perspective. Col. 55, l. 63–col. 56, l. 12.
8. Moran’s Application Performance Monitoring Correlation Expert
interprets differences in performance between different parts of the
network. Col. 40, ll. 18-24.
9. Moran’s Application Performance Monitoring Experts monitor
specific protocols/application subclasses to determine the performance of
the specific protocol/application from a client’s perspective, the server’s
perspective, and/or the network’s perspective. The subclasses evaluate
performance for a single server, a set of servers, a client, a set of clients,
and a set of client/server flows. Col. 35, ll. 28-32, 40-42.
10. Moran’s system identifies conditions such as network congestion,
queries that take a long time to process, applications that take the most time
to respond, and which client or set of clients have the worst response for a
particular application. Col. 37, l. 50–col. 38, l. 17, Table 50. These
performance metrics can be measured from a client perspective, a server
perspective, or a network perspective. Col. 37, ll. 42-44.
Appeal 2010-003091
Application 11/001,985

6
11. Moran’s system performs fault isolation in multi-site configurations
(col. 7, ll. 24-25) and gathers troubleshooting information during fault
isolation monitoring when a specific problem exists and a user is searching
for an exact cause of the problem. Col. 33, ll. 9-12.
12. A user of Moran’s system can isolate a specific server, set of servers,
a client, or set of clients. Col. 38, ll. 38-39, 50-51.

ANALYSIS
Claims 1-6, 10, 13-17, 19, and 23-27
According to Appellants’ Specification, their method aggregates
metrics such as throughput, retransmission delay, application response rate,
and application response time into logical groups which may include
particular users, particular personal computers, and particular resources such
as file servers. FF 1-3. The method troubleshoots anomalous conditions
across one or more of the metrics and groups to identify symptoms of
problems in the network. FF 4. When the problems have been identified,
they are isolated to specific users on the network. FF 5.
Citing column 5, lines 35-39 and column 37, line 37 to column 38,
line 19, including Table 50, the Examiner finds that Moran correlates
anomalous conditions across logically grouped and aggregated metrics.
Ans. 3. See also FF 6-10. Appellants make two responsive arguments.
First, they contend that even though Moran teaches multi-segment network
monitoring and correlation, Moran does so with a focus on application
performance, thereby demonstrating that Moran does not teach aggregating
and processing metrics on a segment-by-segment basis. App. Br. 7, ¶ 1. In
response, the Examiner specifically finds that Moran monitors traffic on
Appeal 2010-003091
Application 11/001,985

7
individual branch segments from the same system. Ans. 9, ¶ 6 (citing col. 5,
l. 60–col. 6, l. 4). Appellants’ Reply Brief does not challenge this specific,
latter finding. We find that the Examiner’s finding has a reasonable
underpinning and we agree with it.
Second, Appellants contend that Table 50 does not address
determining anomalous behavior per se. App. Br. 7, ¶ 5. More specifically,
they contend, although Table 50 identifies areas of concern, there is no
indication as to whether or not its described measurements are typical within
a particular group. Id. In response, the Examiner specifically points to
column 37’s portion of Table 50 and finds that they include examples of
anomalous conditions. Ans. 10:7-10. Appellants reply that the Examiner
has failed to identify any element in Table 50 that corresponds to an
anomalous condition. Reply Br. 2-3.
Although we agree that the Examiner does not point to specific
elements of Table 50, we nevertheless find that Table 50 does, in fact,
identify anomalous conditions. Appellants have expressly identified some
of the anomalous conditions that their system monitors: throughput,
retransmission delay, application response rate, and application response
time. FF 4. Moran’s Table 50 identifies analogous conditions: network
congestion, queries that take a long time to process, and identifying which
applications take the most time to respond relative to other applications. FF
10. Similarly, the portion of Table 50 contained in column 38, previously
cited by the Examiner (Ans. 3), identifies additional monitored conditions
that fall within Appellants’ examples of anomalous conditions: which
servers take the most time to respond for a particular application (col. 8, ll.
6-7), which servers take the most time to respond for any application (col. 8,
Appeal 2010-003091
Application 11/001,985

8
ll. 9-10), which client or set of clients have the worst response for a
particular application (col. 8, ll. 13-14), and which part of the transaction
was the most time spent for a particular application (col. 8, ll. 15-16).
Comparing Table 50 with Appellants’ exemplary anomalous conditions (FF
4), we find that Table 50 identifies anomalous conditions.
Regarding the isolating step, Appellants contend that the Examiner’s
citations to various parts of Moran do not demonstrate isolating anomalous
conditions to one or more related members of logical group types. App. Br.
8; Reply Br. 3-4. We disagree. First, Table 50 does describe anomalous
conditions as shown above.
Second, although Table 50, standing alone, does not discuss isolating
anomalous conditions to related members of logical group types, Moran is
replete with other discussions, cited by the Examiner, that demonstrate this
limitation: performance of the application is measured from a network
perspective (col. 37, ll. 42-45, cited at Ans. 3); Moran’s Application
Performance Monitoring Experts monitor specific applications to determine
performance of a specific application from a network’s perspective (col. 35,
ll. 28-32, cited at Ans. 11); each application subclass has a set of metrics that
it can use to measure performance for a set of servers, a set of clients, and a
set of client/server flows (col. 35, ll. 40-42, cited at Ans. 11); fault isolation
is used in multi-site configurations (Table 2, cited at Ans. 11). See also FF
11, 12.
Accordingly, because we find that the Examiner has demonstrated by
a preponderance of the evidence that Moran teaches the isolating step, we
are not persuaded that the Examiner erred in rejecting (1) representative
Appeal 2010-003091
Application 11/001,985

9
claim 1; and (2) dependent claims 2-6, 10, 13-17, 19, and 23-27, not argued
with particularity.

Claim 20
Claim 20 recites, in part, that results of analysis are presented “using
one or more visual indicators to highlight anomalous conditions.”
Appellants contend that Table 50 does not teach identifying anomalous
conditions (which we have shown above to be incorrect) and does not
address presenting results using visual indicators to highlight anomalous
conditions. App. Br. 8, ¶ 7. The Examiner finds that Moran discloses UI
servers that create reports and graphs that can be viewed. Ans. 11, ¶ 3
(citing col. 15, ll. 26-33). Appellants’ Reply Brief does not assert that the
Examiner’s reliance on column 15 is in error. We find that there is a
reasonable underpinning for the Examiner’s finding and that the Examiner
did not err in rejecting claim 20.

Claims 21 and 22
Appellants contend that Moran does not disclose “the logical group
types comprise users and business groups,” recited in claim 21. App. Br. 9.
The Examiner finds that Moran discloses the logical group types comprise
users (“a set of clients) and that Moran discloses the logical group types
comprise business groups (“domestic enterprise management”). Ans. 11.
We also note that Moran discloses its system provides “business critical
application and network performance information to administrators such as
CIOs and enterprise network managers.” Col. 5, ll. 23-25. Appellants’
Reply Brief does not assert that the Examiner’s reliance on column 5 is in
Appeal 2010-003091
Application 11/001,985

10
error. We find that there is a reasonable underpinning for the Examiner’s
finding and that the Examiner did not err in rejecting claim 21 or claim 22,
not separately argued.

Claims 28, 29, and 9
Although the first part of the Answer does not explain a rejection for
claims 28 and 29 for the reasons stated in footnote 1, supra (Ans. 3-7), both
Appellants and the Examiner treat these claims as having been rejected as
anticipated by Moran under 35 U.S.C. § 102(e). See App. Br. 9-10; Ans. 11-
12. Appellants contend that Table 50 does not disclose the limitations in
claim 28. The Examiner finds that Moran discloses those limitations. Ans.
12. Appellants’ Reply Brief does not assert that the Examiner’s citations to
Moran fail to disclose the recited limitations. We find there is a reasonable
underpinning for the Examiner’s finding and that the Examiner did not err in
rejecting claim 28 or dependent claims 29 and 9, not separately argued with
particularity.

THE OBVIOUSNESS REJECTION
We also sustain the Examiner’s obviousness rejection of claims
11, 12, and 18. Ans. 7-9. Although Appellants reiterate similar arguments
made previously regarding Moran’s alleged shortcomings (App. Br. 10), we
are not persuaded by these arguments for the reasons previously discussed.

CONCLUSION
The Examiner did not err in rejecting (1) claims 1-6, 9, 10, 13-17, and
19-29 under § 102, and (2) claims 11, 12, and 18 under §103.
Appeal 2010-003091
Application 11/001,985

11

DECISION
The Examiner’s decision rejecting claims 1-6 and 9-29 is affirmed.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(1). See 37 C.F.R.
§ 1.136(a)(1)(iv) (2010).

AFFIRMED

babc