Verint Systems Ltd.

Patent Trials and Appeals Board

Mar 5, 2021

2019006433 (P.T.A.B. Mar. 5, 2021)

UNITED STATES PATENT AND TRADEMARK OFFICE
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O. Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
14/604,141 01/23/2015 Ofer Weisblum 53489-082US1 8024
122004 7590 03/05/2021
ISUS Intellectual Property PLLC
Anthony Jason Mirabito
1300 I Street, NW
Suite 400E
Washington, DC 20005
EXAMINER
MARCELO, MELVIN C
ART UNIT PAPER NUMBER
2463
NOTIFICATION DATE DELIVERY MODE
03/05/2021 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
admin@isusip.com
jason@isusip.com
officeus@isusip.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
____________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
____________

Ex parte OFER WEISBLUM, JACK ZEITUNE,
SOFIA ZILBERMAN, and RUTH FRANCO
____________

Appeal 2019-006433
Application 14/604,141
Technology Center 2400
____________

Before JOHN A. JEFFERY, STEVEN M. AMUNDSON, and
MICHAEL T. CYGAN, Administrative Patent Judges.

JEFFERY, Administrative Patent Judge.

DECISION ON APPEAL
Under 35 U.S.C. § 134(a), Appellant1 appeals from the Examiner’s
decision to reject claims 1, 3, 4, 6–8, 10, 11, 13–15, and 17–20. We have
jurisdiction under 35 U.S.C. § 6(b).
We AFFIRM.

1 We use the word “Appellant” to refer to “applicant” as defined in 37
C.F.R. § 1.42. Appellant identifies the real party in interest as Verint
Systems Ltd. Appeal Br. 3.
Appeal 2019-006433
Application 14/604,141

2

STATEMENT OF THE CASE
Appellant’s invention extracts identifiers from traffic of an unknown
protocol. To this end, a data item that matches a predefined pattern can be
identified in received communication traffic, irrespective of the
communication protocol. The identified data item is then extracted from the
communication traffic. See Abstract. Claim 1 is illustrative:
1. A method for extracting identifiers from traffic of an unknown
protocol, comprising:

receiving communication traffic to or from a user, which is transferred
over a communication network in accordance with an application-layer
communication protocol;

detecting in text of the communication traffic, without decoding or
parsing the application-layer communication protocol, an application-layer
data item that matches a predefined expression that uses one or more
operators to describe a string that includes a predetermined pattern of
characters, wherein detecting the application-layer data item includes
searching the text for an occurrence of the string, and wherein the predefined
expression is based on the direction of the communication traffic to or from
the user;

extracting the detected application-layer data item from the
communication traffic without decoding or parsing the application-layer
communication protocol, wherein the application-layer data item comprises
an application-layer identifier of the user;

extracting an additional identifier from metadata of the
communication traffic; and

correlating the application-layer identifier of the user and the
additional identifier for subsequent tracking of the user.

Appeal 2019-006433
Application 14/604,141

3

THE REJECTION
The Examiner rejected claims 1, 3, 4, 6–8, 10, 11, 13–15, and 17–202
under 35 U.S.C. § 103 as unpatentable over Warren (US 2013/0191917 Al;
published July 25, 2013), Horovitz (US 2011/0305141 Al; published Dec.
15, 2011), Antonio Gonzalez-Pardo & David Camacho, Analysis of
Grammatical Evolutionary Approaches to Regular Expression Induction,
IEEE CONG. EVOLUTIONARY COMPUTATION 639–46 (2011) (“Gonzalez-
Pardo”), and Ahrens (US 2012/0005224 Al; published Jan. 5, 2012). Non-
Final Act. 4–13.3

FINDINGS, CONCLUSIONS, AND CONTENTIONS
Regarding independent claim 1, the Examiner finds that Warren’s
method for extracting identifiers from traffic of an unknown protocol
includes (1) receiving communication traffic to or from a user that is
transferred over a communication network according to a communication
protocol; and (2) detecting in the traffic’s text, without decoding or parsing
the protocol, a data item matching a predefined expression that uses one or
more operators to describe a string including a predetermined pattern of
characters, where detecting the data item includes searching the text for a

2 Although the Examiner’s statement of the rejection includes cancelled
claims 5 and 12 (Non-Final Act. 4), we nonetheless omit those claims here
to clarify the record, and treat the Examiner’s error as harmless.
3 Throughout this opinion, we refer to (1) the Non-Final Rejection mailed
November 2, 2018 (“Non-Final Act.”); (2) the Appeal Brief filed April 1,
2019 (“Appeal Br.”); and (3) the Examiner’s Answer mailed June 19, 2019
(“Ans.”).
Appeal 2019-006433
Application 14/604,141

4
string occurrence. See Non-Final Act. 4–7. Although the Examiner
acknowledges that Warren does not disclose explicitly the recited
application-layer protocol and data item, as well as extracting the data item
from the traffic without decoding or parsing the application-layer protocol,
where the application-layer data item comprises an application-layer user
identifier, the Examiner cites Horovitz for teaching these features. See id.
The Examiner also acknowledges that Warren lacks the recited operator and
basing the predefined expression on the direction of traffic to or from the
user, but cites Gonzalez-Pardo for teaching these features. See id. The
Examiner also cites Ahrens for teaching (1) the application-layer data item
comprises an application-layer user identifier; and (2) correlating that user
identifier and an additional identifier extracted from the traffic’s metadata
for subsequent user tracking. See id. at 6–7. Based on these collective
teachings, the Examiner concludes that the claim would have been obvious.
See id. at 4–7.
Appellant argues that the Examiner’s reliance on Horovitz is
misplaced because, among other things, Horovitz’s general mention of data
of various media types fails to disclose or suggest an application-layer data
item comprises an application-layer identifier of the user as claimed. Appeal
Br. 7–9. Appellant adds that the cited prior art, including Ahrens, does not
correlate an application-layer user identifier and an identifier extracted from
communication traffic metadata, let alone disclose subsequent user tracking
as claimed. Id. at 9–11.

Appeal 2019-006433
Application 14/604,141

5
ISSUE
Under § 103, has the Examiner erred in rejecting claim 1 by finding
that Warren, Horovitz, Gonzalez-Pardo, and Ahrens collectively would have
taught or suggested correlating (1) an application-layer user identifier
extracted from communication traffic without decoding or parsing an
application-layer protocol, and (2) an additional identifier extracted from the
traffic’s metadata for subsequent user tracking?

ANALYSIS
We begin by clarifying the Examiner’s mapping. In the rejection, the
Examiner refers to Horovitz’s teaching of hypertext transfer protocol
(HTTP) and file transfer protocol (FTP) that include application-layer data
in connection with the recited application-layer user identifier. See Non-
Final Act. 7. The Examiner also refers to Ahrens’s teaching of
“user/browser/operating system identifiers and location information” in
connection with the recited application-layer user identifier. See id. at 6.
It is unclear from these particular articulations in the rejection exactly
what element in these references the Examiner maps to the recited
application-layer user identifier. The Examiner, however, states in the
rejection’s response to arguments section that Ahrens tracks the user by
correlating (1) the information identifying the user, where this information
includes the user’s email address, and (2) the internet protocol (IP) address
of the user’s client device in paragraph 34. Non-Final Act. 3; accord Ans. 3
(maintaining the response to arguments articulated in the Non-Final Office
Action). Based on these articulated findings considered in light of the claim
language, we presume the Examiner intends to map (1) the recited
Appeal 2019-006433
Application 14/604,141

6
application-layer user identifier to the user’s email address, and (2) the
recited additional identifier to an IP address.
Turning to the claim, claim 1 recites, in pertinent part, correlating
(1) the recited application-layer user identifier, and (2) an additional
identifier extracted from the communication traffic’s metadata for
subsequent user tracking. On this record, Appellant does not persuasively
rebut the Examiner’s reliance on the cited prior art, including Ahrens, for at
least suggesting the disputed limitations including correlating the recited
identifiers, where this correlation is at least capable of being used for
subsequent user tracking. First, given Warren’s teaching of detecting
“interesting information” in paragraph 6 as the Examiner indicates (Ans. 3),
we see no error in the Examiner’s finding that this “interesting information”
can include email addresses in light of Ahrens’s paragraph 34 (see Ans. 3–
4)—information that identifies a user at least in that sense. Accord
Gonzalez-Pardo 640 (showing exemplary matched email addresses with
user-identifying information, including surnames, in Table II).
Nor do we find error in the Examiner’s reliance on Horovitz for at
least suggesting extracting a detected application-layer data item, namely an
application-layer user identifier, as claimed. As noted in Horovitz’s Figure 2
and paragraph 37, data items are extracted from network traffic based on
identified media types and presented to the user in steps 58 and 62.
Because these media types include textual information as noted in paragraph
36, and given the application-layer protocols, including HTTP, in paragraph
21, Horovitz at least suggests extracting a detected application-layer user
identifier as claimed, or that such an identifier extraction would have been at
least an obvious variation.
Appeal 2019-006433
Application 14/604,141

7
We also see no error in the Examiner’s reliance on Ahrens for at least
suggesting (1) extracting an additional identifier, namely an IP address, from
traffic metadata, and (2) correlating that identifier and the extracted
application-layer user identifier, namely an email address, for subsequent
user tracking as claimed. See Final Act. 3 (finding that Ahrens tracks a user
by correlating the information identifying the user and the IP address of the
user’s client device in paragraph 34). That Ahrens’s post indexing module
208 stores and maintains various user-oriented content in a database
including, among other suitable metadata, (1) information identifying who
submitted a post; (2) the IP address of the user’s client device; and (3) one
or more terms extracted from the post only underscores that correlating a
user’s extracted IP and email addresses to track the user as the Examiner
proposes (see Final Act. 3; Ans. 4) would have been at least an obvious
variation in light of Ahrens, especially when considered with the other prior
art. See Ahrens ¶¶ 41, 45–46 (noting that terms can be extracted from IP
addresses, user identifiers, or other information that the system can relate to
a posting user).
Appellant’s contention, then, that the cited prior art, including Ahrens,
does not correlate an application-layer user identifier and an identifier
extracted from communication traffic metadata, let alone disclose
subsequent user tracking as claimed (Appeal Br. 11) is unavailing and not
commensurate with the scope of the claim that does not preclude Ahrens’s
functionality considered in light of the other prior art under the Examiner’s
proposed combination. Moreover, Appellant’s arguments regarding
Ahrens’s individual shortcomings in this regard (Appeal Br. 9–11) do not
show nonobviousness where, as here, the rejection is based on the cited
Appeal 2019-006433
Application 14/604,141

8
references’ collective teachings. See In re Merck & Co., 800 F.2d 1091,
1097 (Fed. Cir. 1986).
Therefore, we are not persuaded that the Examiner erred in rejecting
claim 1, and claims 3, 4, 6–8, 10, 11, 13–15, and 17–20 not argued
separately with particularity.

CONCLUSION
In summary:
Claims
Rejected
35 U.S.C. § Reference(s)/Basis Affirmed Reversed
1, 3, 4,
6–8, 10,
11, 13–
15, 17–
20
103 Warren, Horovitz,
Gonzalez-Pardo,
Ahrens
1, 3, 4, 6–
8, 10, 11,
13–15, 17–
20

TIME PERIOD FOR RESPONSE
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(1)(iv). See 37
C.F.R. § 41.50(f).

AFFIRMED