Ex Parte Ahuja et al

Patent Trial and Appeal Board

Nov 18, 2013

10816422 (P.T.A.B. Nov. 18, 2013)

UNITED STATES PATENT AND TRADEMARK OFFICE
__________

BEFORE THE PATENT TRIAL AND APPEAL BOARD
__________

Ex parte RATINDER PAUL AHUJA,
KIM GETGEN, DONALD MASSARO,
SHAUN COLEMAN, and ASHISH KHASGIWALA
__________

Appeal 2011-011331
Application 10/816,422
Technology Center 2100
__________

Before TONI R. SCHEINER, DONALD E. ADAMS, and
JEFFREY N. FREDMAN, Administrative Patent Judges.

FREDMAN, Administrative Patent Judge.

DECISION ON APPEAL
This is an appeal1 under 35 U.S.C. § 134 involving claims to a method
comprising a graphical user interface for a capture system. The Examiner
rejected the claims as obvious. We have jurisdiction under 35 U.S.C. § 6(b).
We affirm.

1 Appellants identify the Real Party in Interest as McAfee, Inc.
(See App. Br. 4).
Appeal 2011-011331
Application 10/816,422

2
Statement of the Case
Background
According to the Specification, “objects captured over a network can
be queried using a graphical user interface. In one embodiment, the
graphical user interface (GUI) includes a search editor to enable a user to
author and edit a search that mines objects captured by a capture system”
(Spec. 4 ¶ 0004).
The Claims
Claims 1-5, 25, and 27-33 are on appeal. Claim 1 is representative
and reads as follows:
1. A method comprising:
presenting a graphical user interface (GUI) for a capture
system, wherein the GUI comprises one or more views including:
a search editor view to enable parameters of a search of tags of
objects captured by the capture system to be defined, the capture
system configured to intercept data from data streams, reconstruct the
data, and store network transmitted objects according to a capture rule
that defines which objects are to be captured by the capture system,
wherein each tag is associated with at least one captured object and
includes relevant information that describes the at least one object,
and wherein the capture rule is part of a default rule set for the capture
system configured to monitor network traffic and capture the at least
one object, and wherein the capture system is configured to store a
document captured by the capture system according to the capture
rule, which identifies a first internet protocol (IP) address from which
the document was sent and a second IP address associated with an
intended destination of the document, and wherein after an initial
search is generated it is scheduled to occur on a periodic basis such
that a report is automatically sent to a network address of an author of
the initial search; and
a capture rule view to enable parameters of the capture rule to
be defined.

Appeal 2011-011331
Application 10/816,422

3
The issues
A. The Examiner rejected claims 1-3, 25, 27-29, 32, and 33 under
35 U.S.C. § 103(a) as obvious over Dugatkin,2 Piersol,3 and Yanagihara4
(Ans. 3-7).
B. The Examiner rejected claims 4 and 30 under 35 U.S.C. § 103(a) as
obvious over Dugatkin, Piersol, Yanagihara, and Kahn5 (Ans. 8).
C. The Examiner rejected claims 5 and 31 under 35 U.S.C. § 103(a) as
obvious over Dugatkin, Piersol, Yanagihara, and Outlook6 (Ans. 8-9).
A. 35 U.S.C. § 103(a) over Dugatkin, Piersol, and Yanagihara
The Examiner finds that Dugatkin teaches “presenting a graphical
user interface GUI for a capture system (para. [0046]), wherein the GUI
compris[es] one or more views” (Ans. 3). The Examiner finds that Dugatkin
teaches that the “capture system [is] configured to intercept data from data
streams, reconstruct the data, and store network transmitted objects
according to a capture rule” (id.).
The Examiner specifically finds that with “successive refinement, a
first capture group 320 may include all of the various types of transport
protocols, also referred to as layer 3 data units, of all IP data units 310)
(para. [0048]) [referring to all IP data units implies that first, second and any
subsequent IP addresses are captured and identified]” (id. at 4).

2 Dugatkin et al., US 2005/0021715 A1, published Jan. 27, 2005.
3 Piersol, K., US 6,978,297 B1, issued Dec. 20, 2005.
4 Yanagihara et al., US 6,161,102, issued Dec. 12, 2000.
5 Kahn, C., US 7,185,192 B1, issued Feb. 27, 2007.
6 Microsoft Outlook 2000 © 1995-2000.
Appeal 2011-011331
Application 10/816,422

4
The Examiner finds that Piersol teaches “tags of objects captured by
the capture system to be defined (the metadata file contains special
information about the document from the capturing device)” (Ans. 5). The
Examiner finds that Yanagihara teaches “a search editor view to enable
parameters of a search” (id.).
The Examiner conludes it would have been obvious to “modify
Dugatkin by improving user’s efficiency in evaluating search results from a
schedule search. One would have been motivated to do so in order to
provide accurate information to users about the availability of information
sources” (id.).
The issue with respect to this rejection is: Does the evidence of record
support the Examiner’s conclusion that the combination of Dugatkin,
Piersol, and Yanagihara render claim 1 obvious?
Findings of Fact
1. Dugatkin teaches that the “manager 250 may provide an
interface to allow a user to create and/or modify filters 212 to be used by the
collectors 210” (Dugatkin 4 ¶ 0046).
2. Dugatkin teaches that the “collectors 210 may review, capture
and otherwise obtain network traffic and network traffic data in capture
groups. A ‘capture group’ is a group of data units or network traffic data
concerning the data units which may be collected according to system
defined and/or user defined constraints” (Dugatkin 3 ¶ 0036).
3. Dugatkin teaches that the “start trigger may be set to be a
particular kind of data unit, may be a particular network address specified as
Appeal 2011-011331
Application 10/816,422

5
a source and/or destination address in a data unit, may be a data rate of the
network traffic, and others” (Dugatkin 3 ¶ 0036).
4. Dugatkin teaches that the “triggers may be a pattern or rule
specifying a portion of a network address or other identifying information
included in a data unit” (Dugatkin 3 ¶ 0036).
5. Dugatkin teaches that
The characterization units 220 may automatically
compile and compute a network traffic characterization
derived from or representing a series of assembled statistics
based on the network traffic data provided by the collectors
210. . . . The characterization units 220 may gather
statistics, provide traffic data analysis, and generate user
readable reports that may be web-accessible in conjunction
with preparing the network traffic characterization.

(Dugatkin 4 ¶ 0051.)
6. Dugatkin teaches that the “collectors 210 may include filters
212 . . . . The filters 212 may be system defined and/or user-defined. The
filters may be defined and modified by characterization units 220 via
feedback 230. The filters 212 may be used for various purposes, such as, for
example, to restrict the collected network traffic based on the source or
destination addresses” (Dugatkin 4 ¶¶ 0044-0045).
7. Dugatkin teaches that “a first capture group 320 may include all
of the various types of transport protocols, also referred to as layer 3 data
units, of all IP data units 310. The transport protocols may be ICMP data
units 322, UDP data units 324, TCP data units 326 and other data units 328”
(Dugatkin 4 ¶ 0048).
Appeal 2011-011331
Application 10/816,422

6
8. Dugatkin teaches that “[p]ertinent information from each
collected data unit is obtained and saved as network traffic data based on the
filters . . . . The pertinent information may be obtained by various plug-ins,
modules or units, each of which may store the pertinent information in
varying formats” (Dugatkin 7 ¶ 0076).
9. Piersol teaches that:
[E]ach document captured within an FMA system is stored
on the FMA as a separate UNIX directory that includes a
metadata file. In one embodiment, the metadata file
contains special information about the document such as, for
example, bibliographic data extracted from the capturing
device. In one embodiment, document metadata consists of
pairs of attribute names and their values.

(Piersol, col. 8, ll. 49-57.)
10. Piersol teaches that the “name of the document is not stored as
part of the directory system of the NOA, but is instead stored within the
metadata file. . . . In addition, a unique identifier, such as a serial number,
may be assigned to each document and stored in the document’s metadata
file” (Piersol, col. 9, l. 66 to col. 10, l. 5).
11. Yanagihara teaches that it
[I]s also desirable to allow a user on a client computer
system in a network to obtain accurate information about the
availability of information sources while also allowing the
operator of a server computer system to maintain the
information sources and also provide accurate information to
users of client systems about the availability of information
sources
(Yanagihara, col. 3, ll. 16-22).
Appeal 2011-011331
Application 10/816,422

7
12. Yanagihara teaches that
[T]he user of client system 33 will type into an input device
such as a keyboard the words defining a future search, and
the processor 37 will communicate this search request along
with the scheduled time to the processor 10 which will store
the search request as well as the scheduled time. Typically,
the scheduled time is a plurality of scheduled times causing
the processor 10 to periodically report the results of searches
for new and modified documents which have been made
available in the various information storage devices

(Yanagihara, col. 9, ll. 10-19).
13. Yanagihara teaches that the “user is presented with a report
showing the results of each scheduled search” (Yanagihara, col. 9, ll. 33-34).
Principles of Law
“The combination of familiar elements according to known methods
is likely to be obvious when it does no more than yield predictable results.”
KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 416 (2007). “If a person of
ordinary skill can implement a predictable variation, § 103 likely bars its
patentability.” Id. at 417. As noted by the Court in KSR, “[a] person of
ordinary skill is also a person of ordinary creativity, not an automaton.” 550
U.S. at 421.
Analysis
We adopt the Examiner’s findings regarding the scope and content of
the prior art (Ans. 3-7; FF 1-11) and agree with the conclusion that the
method of presenting a graphical user interface for a capture system would
have been prima facie obvious in view of Dugatkin, Piersol, and Yanagihara.
Appellants present arguments disputing the prima facie case of obviousness,
which we will separately address.
Appeal 2011-011331
Application 10/816,422

8
Appellants contend that “nothing in Dugatkin discusses any type of
capture rule, which outlines source and destination address information”
(App. Br. 10). Appellants contend that “the Dugatkin reference does not
have the requisite intelligence to track information being sent by/to specific
IP addresses” (id.).
We are not persuaded. We agree with the Examiner that once
Dugatkin teaches the capture of source and destination information (FF 2-4),
the ordinary artisan would have reasonably incorporated such capture
information where desired. In particular, Dugatkin teaches a user interface
for collectors 210 (FF 1) where the collectors 210 “capture and otherwise
obtain network traffic and network traffic data in capture groups. A ‘capture
group’ is a group of data units or network traffic data concerning the data
units which may be collected according to system defined and/or user
defined constraints” (Dugatkin 3 ¶ 0036; FF 2). Dugatkin then teaches that
the “start trigger may be set to be a particular kind of data unit, may be a
particular network address specified as a source and/or destination address in
a data unit, may be a data rate of the network traffic, and others” (Dugatkin 3
¶ 0036; FF 3). Dugatkin further explains that the “triggers may be a pattern
or rule specifying a portion of a network address or other identifying
information included in a data unit” (Dugatkin 3 ¶ 0036; FF 4).
Thus, Dugatkin is reasonably interpreted as teaching a capture rule
where the data may include the “source and/or destination address” where
the user defines the data of interest (FF 3).
Appellants contend that in the “very passage being cited by the
Examiner, the Dugatkin reference is discussing the transport protocols
Appeal 2011-011331
Application 10/816,422

9
being used for filtering” (App. Br. 11). Appellants contend that
“[m]istakenly, the Examiner uses the term ‘IP data units’ to somehow arrive
at a capture rule that identifies a first IP address from which the document
was sent and a second IP address associated with an intended destination of
the document” (id.).
We are not persuaded. Dugatkin teaches that the
[C]ollectors 210 may include filters 212 . . . .
The filters 212 may be system defined and/or user-
defined. The filters may be defined and modified by
characterization units 220 via feedback 230. The filters 212
may be used for various purposes, such as, for example, to
restrict the collected network traffic based on the source or
destination addresses

(Dugatkin 4 ¶¶ 0044-0045; FF 6). The “user-defined” filters are expressly
taught to have the capacity to limit collected data to particular source or
destination addresses (FF 6). This explicitly requires that the filters include
a capability to identify the source and destination addresses from and to
which the data units are transmitted, or else the restriction taught by
Dugatkin would not be possible.
Appellants contend that “the same capture rule that is identifying
which document is to be captured is also dictating whether that same
document should be stored or discarded. None of this is provided in the
Examiner’s references” (App. Br. 12). Appellants contend that “nothing in
the Dugatkin reference discusses discerning which documents should even
be stored” (Reply Br. 4).
We are not persuaded. Dugatkin teaches that “[p]ertinent information
from each collected data unit is obtained and saved as network traffic data
Appeal 2011-011331
Application 10/816,422

10
based on the filters” (Dugatkin 7 ¶ 0076; FF 8). Since Dugatkin also teaches
that the filters are user or system defined components of the collectors (FF 6)
which collectors capture data units in network traffic (FF 2-4), the same
“user-defined” capture rule dictates what information is stored or discarded
(FF 2, 8).
Appellants contend that “no reference discusses any type of search
scheduling to occur after an initial search is generated, or how such
searching would continue on a periodic basis” (App. Br. 12). Appellants
further contend that “no reference discusses how a report would be
automatically sent to a network address of an author of the initial
search” (id.).
We are not persuaded. Yanagihara teaches the concept of search
scheduling, including a search request on a periodic basis, specifically
teaching that a processor “will store the search request as well as the
scheduled time. Typically, the scheduled time is a plurality of scheduled
times causing the processor 10 to periodically report the results of searches
for new and modified documents which have been made available in the
various information storage devices” (Yanagihara, col. 9, ll. 14-19; FF 12).
Regarding the automatic reports, Yanagihara further teaches that the
“user is presented with a report showing the results of each scheduled
search” (Yanagihara, col. 9, ll. 33-34; FF 13). We agree with the Examiner
that the teaching by Yanagihara to automatically present the report to the
user is reasonably interpreted as suggesting that the report is sent to the
correct network address of the user, since the user is receiving the report (see
Ans. 13).
Appeal 2011-011331
Application 10/816,422

11
Appellants contend that “there are three elements being recited in
Independent Claim 1: tags, objects, and a document. In a best-case scenario,
the Examiner has only found two of these elements” (App. Br. 13).
We are not persuaded. The Specification teaches that the “object
assembly module 28 reconstructs the objects being transmitted by the
packets. For example, when a document is transmitted, e.g. as an email
attachment, it is broken down into packets” (Spec. 10-11 ¶ 0033). As we
interpret the Specification, documents are a type of object, and not a separate
category. This is further supported by the Specification’s teaching that the
[O]bject classification module 30 uses the inherent
properties and signatures of various documents to determine
the content type of each object. For example, a Word
document has a signature that is distinct from a PowerPoint
document, or an Email document. The object classification
module 30 can extract out each individual object and sort
them out by such content types

(Spec. 13 ¶ 0039).
To the extent that claim 1 requires capture of both “objects” and
“documents,” that is, the capture of more than one data component,
Dugatkin expressly teaches capture of “data units” plural, which are user-
defined data captured by the system (FF 2-4).
Appellants contend that “the serial numbers are not transmitted over
the network, nor are they stored according to a capture rule that defines
which serial numbers would be captured on the front end of a capture
system” (App. Br. 13). Appellants contend that the “Piersol reference
teaches away from this feature of Independent Claim 1. The Piersol
architecture labels documents with a serial number, whereas Independent
Appeal 2011-011331
Application 10/816,422

12
Claim 1 is outlining a capture system in which network transmitted objects
are being captured based on a capture rule” (id. at 14).
We are not persuaded. As an initial matter, claim 1 does not exclude
transmission of the tags over the network, nor does claim 1 include any
limitations on how the tags are stored. More importantly, the Examiner
relies upon Piersol to teach the use of serial numbers for identification of
captured information, noting that “Piersol teaches a document’s capture date
is used for the name of the document directory and a unique identifier, such
as a serial number, may be assigned to each document” (Ans. 14).
Appellants do not identify, and we do not find, any teaching in either
Dugatkin or Piersol which teach away from the incorporation of a unique
identifier for a captured document as taught by Piersol (FF 10) into the
capture system of Dugatkin (FF 1-8), for the reason given by the Examiner
that such a unique identifier would “give the user convenience of a wide
variety of criteria to perform customized search” (Ans. 5). See In re Fulton,
391 F.3d 1195, 1201 (Fed. Cir. 2004) (“The prior art’s mere disclosure of
more than one alternative does not constitute a teaching away from any of
these alternatives because such disclosure does not criticize, discredit, or
otherwise discourage the solution claimed”). Here, neither Dugatkin nor
Piersol discourage or criticize any particular element of the combination.
Conclusion of Law
The evidence of record supports the Examiner’s conclusion that the
combination of Dugatkin, Piersol, and Yanagihara render claim 1 obvious.

Appeal 2011-011331
Application 10/816,422

13
B. and C. 35 U.S.C. § 103(a)
The Examiner relies upon Dugatkin, Piersol, and Yanagihara as
discussed above, further relying upon Kahn and Outlook to teach various
types of search criteria (Ans. 8-9). The Examiner provides sound fact-based
reasoning for combining Kahn or Outlook with Dugatkin, Piersol, and
Yanagihara. We adopt the fact finding and analysis of the Examiner.
Appellants provide no arguments relating to these rejections, so we affirm
these rejections for the reasons given above.
SUMMARY
In summary, we affirm the rejection of claim 1 under 35 U.S.C. §
103(a) as obvious over Dugatkin, Piersol, and Yanagihara. Pursuant to
37 C.F.R. § 41.37(c)(1), we also affirm the rejection of claims 2, 3, 25, 27-
29, 32, and 33 as these claims were not argued separately.
We affirm the rejection of claims 4 and 30 under 35 U.S.C. § 103(a)
as obvious over Dugatkin, Piersol, Yanagihara, and Kahn.
We affirm the rejection of claims 5 and 31 under 35 U.S.C. § 103(a)
as obvious over Dugatkin, Piersol, Yanagihara, and Outlook.

No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a).

AFFIRMED

cdc