US 11792220

I'll search for authoritative information on this patent, including any 2026 litigation activity.

Let me get the actual claim text and any litigation involving this specific patent number.

I'll research litigation involving US patent 11792220.

Let me dig into the specific litigation records and the Unified Patents portal page for this patent.

Bottom line

I could not identify any litigation — district court, ITC, or Federal Circuit — in which U.S. Patent No. 11,792,220 ("Rule-based network-threat detection," Centripetal Networks, LLC; issued Oct. 17, 2023 from App. No. 18/200,801, filed May 23, 2023, priority Apr. 17, 2015) is named as an asserted patent. Treat this as "no litigation found," not as an affirmative "never litigated" finding — see the verification caveats at the end.

I want to be precise about the distinction, because this patent sits inside one of the most heavily litigated portfolios in network security, and it is easy to conflate family members.

What the record actually shows for the '220 patent itself

• The Google Patents page for US11792220B2 carries the banner "Family has litigation" with a link to Darts‑IP family 55863202. That is a family-level flag. It indicates that at least one member of the patent family has been litigated; it does not establish that the '220 patent itself was asserted. (Source: https://patents.google.com/patent/[US11792220](/patent/US11792220)/en)
• The '220 patent's prosecution chain is entirely continuations: 17/232,291 ← 17/001,164 ← 16/813,220 ← 16/706,388 (now U.S. 10,609,062) ← 16/217,720 (now U.S. 10,567,413) ← 15/827,477 (now U.S. 10,193,917) ← 14/690,302 (now U.S. 9,866,576). Because the '220 patent did not issue until October 17, 2023, it could not have appeared in the Centripetal complaints filed in 2018, 2021, or April 2022 that appear throughout the search record.
• I found no complaint, docket entry, infringement contention, ITC exhibit list, or PTAB proceeding caption naming 11,792,220.

Important negative check: case lists that surfaced alongside the '220 patent on aggregator pages (e.g., a "Related Cases" widget showing PGR2021‑00108, Federal Circuit Nos. 25‑1167/25‑1168, and E.D. Va. No. 2:21‑cv‑00137) are not proceedings against the '220 patent. A post-grant review filed August 3, 2021 cannot challenge a patent that issued in October 2023, and a March 11, 2021 district court complaint cannot assert it either. Those cases attach to a different patent in the same portfolio. I am flagging this specifically to avoid the exact "similar number" conflation your instructions warn against.

Family and portfolio litigation — context only, NOT assertions of the '220

These matters involve patents in the same family or portfolio (notably U.S. 10,193,917, the direct parent of the '220), so they are the disputes most likely to later involve the '220, but none of them names it:

Note that the '917 patent — asserted in the April 2022 E.D. Va./ITC complaints and on appeal in Nos. 24‑1406/24‑2372 — is the immediate parent of the '220 patent. That is a family relationship, not a case involving the '220.

Verification steps and confidence

• Confidence: moderate-to-high that no U.S. litigation asserting the '220 patent has been publicly reported as of the date of my search. My searches covered patent-litigation aggregators (Unified Patents portal, Justia, CourtListener/Federal Circuit opinions) and general web sources.
• I was unable to complete a live, per-patent query of the Unified Patents litigation caselist and the Darts‑IP family 55863202 record for the '220 patent specifically before exhausting my search budget — so absence of results is not proof of absence.
• To close this out with certainty, pull the patent-specific litigation tabs at: https://portal.unifiedpatents.com/patents/patent/11792220, Darts‑IP family 55863202, and a Docket Navigator / PACER party search on "Centripetal Networks" limited to complaints filed after October 17, 2023 (the '220 issue date). Any assertion of the '220 would necessarily post-date that issuance.

If it would help, I can run a targeted follow-up on the Unified Patents patent page and on Centripetal's post-October-2023 complaints to confirm definitively.

I'll first verify the canonical list and then search for any PTAB activity the ODP may not have indexed.

The canonical ODP list is empty, but I found signals worth chasing — including a CAFC decision referencing a Centripetal patent titled "Rule-Based Network-Threat Detection." I need to confirm which patents those proceedings actually target (the '722 shorthand in the case law is ambiguous).

Let me check specifically whether any petition was filed against US 11,792,220 itself (it issued 2023-10-17), including later-filed IPRs/PGRs.

Proceedings overview

Total AIA trial proceedings naming US 11,792,220: 0. The canonical structured source (USPTO ODP "PTAB proceedings on file") returns no AIA trials, and my independent web checks surfaced no IPR, PGR, or CBM petition ever filed against this patent — no institution decision, no FWD, no termination, no appeal. Breakdown by status is therefore uniform: none active, none invalidated, none settled, none denied. (Verification gap flagged below: this is an absence-of-evidence finding on a patent granted 2023-10-17, and ODP ingest lag plus my own search limits mean a very recently filed petition cannot be excluded with 100% certainty.)

Bottom-line defensive posture: this is not a "hardened by surviving IPRs" story and not a "claims are dead" story — it is an untested patent. Every claim of US 11,792,220 still carries its full, original presumption of validity, and there is no FWD you can cite and no claim you can point to as canceled. A defendant's ability to invalidate it is untested, but the family record is unusually informative: this patent is a continuation in the exact same specification chain as US 10,193,917, and the PTAB plus the Federal Circuit have now held the corresponding "rule-based network-threat detection" claims unpatentable over Sourcefire (alone and in combination with Macaulay). That gives a new petitioner a validated template — while § 315(e)(2) estoppel from the sibling IPRs does not block a fresh challenge to the '220.

(No proceeding entries to rank)

Because there are zero proceedings on this patent, the per-proceeding template ("Type / Filed / Status / Panel / Grounds / Institution / FWD / Settlement / Appeal / Defensive value") has no rows to populate. I am not going to synthesize entries from sibling-patent cases — the numbers and dispositions below belong to different patents and must not be cited in a brief as "proceedings on the '220."

Adjacent family proceedings (NOT on US 11,792,220 — context only, do not cite as '220 proceedings)

These are the PTAB/CAFC matters on Centripetal patents in the same specification family or asserted alongside the '220. Treat them as the art roadmap, not as dispositions of the '220.

IPR2022-01097 — Keysight Technologies, Inc. v. Centripetal Networks, Inc. (U.S. Pat. No. 10,193,917)

• Directly relevant: US 10,193,917 is an ancestor patent in the '220's own continuation chain (14/690,302 → 15/827,477 ('917) → 16/217,720 ('413) → 16/706,388 ('062) → … → 17/232,291 → 18/200,801 ('220)). Same specification, same "packet-filtering rule / network-threat indicator / log entry" disclosure.
• Filed 2022-06-02 by Keysight; instituted 2022-12-19.
• FWD 2023-12-15: "We issue this Final Written Decision under 35 U.S.C. § 318(a) … determine that Petitioner has shown by a preponderance of the evidence that claims 1-3, 5-13, and 15-20 are unpatentable. We further determine that Petitioner has not shown that claims 4 and 14 are unpatentable." Grounds: claims 1-3, 5, 11-13, 15, 20 obvious over Sourcefire alone; claims 6-10 and 16-19 obvious over Sourcefire + Macaulay.
• Appeal: Nos. 2024-1406 & 2024-1473, decided 2026-04-23 — affirmed in part, reversed in part; the CAFC reversed the non-obviousness findings as to claims 4 and 14, effectively holding all challenged claims obvious (https://ipwatchdog.com/2026/04/23/federal-circuit-reverses-ptab-ruling-some-centripetal-network-threat-detection-patent-claims-non-obvious/).
• Panel on appeal: noted as nonprecedential; the PTAB panel sat before APJs whose names I could not verify from the sources retrieved.

IPR2021-01147 (U.S. Pat. No. 10,542,028) and IPR2021-01148 (U.S. Pat. No. 10,757,126) — Palo Alto Networks, Inc. v. Centripetal Networks, Inc.

• Both titled "Rule-Based Network-Threat Detection." Filed 2021-07; instituted February 2022; FWD 2023-02-09 holding all challenged claims unpatentable under § 103 over Sourcefire (alone or with a second reference).
• CAFC Nos. 23-1654 / 23-1655, decided 2024-10-31, AFFIRMED (Lourie, Taranto, Stark; Taranto authored). Key holding: "responsive to" is a cause-and-effect limitation but not exclusive — action may be triggered by network-threat indicators plus other criteria. https://www.courtlistener.com/opinion/[10171832](/patent/10171832)/centripetal-networks-llc-v-palo-alto-networks-inc/

IPR2021-01149 — Palo Alto Networks, Inc. v. Centripetal Networks, Inc. (U.S. Pat. No. 10,567,413)

• FWD 2023-02-17 (Paper 46) determining all challenged claims unpatentable. Affirmed on appeal, No. 23-1785, decided 2024-10-31 (Board's "boundary" construction upheld; Sourcefire + Macaulay).

IPR2022-00182 — Palo Alto Networks, Inc. v. Centripetal Networks, Inc. (U.S. Pat. No. 9,917,856) (Cisco and Keysight filed substantively identical petitions and sought joinder, IPR2022-01151 / IPR2022-01199)

• FWD 2023-05-23: claims 1, 24, 25 unpatentable as obvious. Significant procedural history: Centripetal's recusal motion based on APJ McNamara's Cisco stock (disclosed, under the 5 C.F.R. § 2640.202 threshold).
• CAFC No. 23-2027, decided 2025-10-22: recusal argument rejected, but the FWD was VACATED AND REMANDED for failure to adequately consider Centripetal's evidence of copying. https://www.cafc.uscourts.gov/opinions-orders/23-2027.OPINION.10-22-2025_2591433.pdf

IPR2022-01525 — Keysight v. Centripetal (U.S. Pat. No. 10,284,526) — FWD 2024-04-15, all claims 1-20 unpatentable; CAFC No. 2024-2246, decided 2026-04-02, AFFIRMED (IPUG anticipates claim 1). https://www.cafc.uscourts.gov/opinions-orders/24-2246.OPINION.4-2-2026_2670414.pdf

Keysight IPR on U.S. Pat. No. 11,012,474 — FWD canceled all challenged claims except claims 6, 14, 22, 30, and 33, which survived only because Keysight's petition failed to substantively argue them (header-and-chart treatment only). Affirmed, Appeal No. 2025-1053 (Fed. Cir. 2026-07-21, nonprecedential). I could not confirm the underlying IPR number from the sources retrieved. https://www.ptabwatch.com/2026/07/does-a-ghost-in-the-room-present-a-case-for-director-ordered-reexamination/

Other family/parallel matters (numbers captured, details not fully verified): IPR2022-01535 (petition re U.S. Pat. No. 10,609,062); IPR2021-01156; IPR2021-01520 / IPR2021-01521 (Palo Alto Networks v. Centripetal, U.S. Pat. No. 9,560,176 and related). Centripetal itself told the Federal Circuit in an October 2022 amicus brief that it had faced 37 IPRs and 1 PGR across its portfolio. ITC Inv. No. 337-TA-1314 (Centripetal v. Keysight, filed 2022-04-19) asserted the '370, '917, and '526 patents — not the '220, which did not issue until 2023-10-17; the ALJ's Initial Determination found no § 337 violation and the asserted patents invalid or ineligible.

Strategic summary

Claim status of US 11,792,220: everything is UNTESTED. Independent claims, dependents, all of it. No claim has been canceled, confirmed, or even construed by the PTAB. Do not let anyone hand you a demand letter or an opinion asserting that "the '220 has been invalidated" — that is false. Conversely, do not assume the patent is weak merely because its relatives died: the '220 has its own claim set, and while it shares the '917's specification, a challenger must still map the '220's specific claims to art. What the family record does establish is that the class of art used against the '917 — the Sourcefire 3D System User Guide (as a § 102(b)/§ 311(b) printed publication), alone and in combination with Macaulay (US 2015/0207809) — has survived repeated Federal Circuit scrutiny, including two 2024-10-31 affirmances (Nos. 23-1654/1655, 23-1785) and a partial reversal in the petitioner's favor on 2026-04-23 (Nos. 2024-1406/1473). That combination is the obvious starting point for any '220 petition.

Estoppel landscape. § 315(e)(2) estoppel is patent-specific: it bars a petitioner (and its privies) from raising, in a civil action or ITC proceeding, any ground it raised or reasonably could have raised in an IPR that reached a final written decision — but only as to the patent claims in that proceeding. Because the prior FWDs are on US 10,542,028, 10,757,126, 10,567,413, 9,917,856, 10,193,917, 10,284,526, and 11,012,474, no one is estopped as to US 11,792,220. Two consequences for a defendant: (1) a fresh IPR on the '220 is available even to the very parties (Keysight, Palo Alto, Cisco) that already litigated the siblings — though General Plastic / Fintiv discretionary-denial risk rises sharply for serial challengers and co-pending litigation; and (2) if you choose to defend in court on prior art, you have not burned any '220-specific grounds yet — preserve that option by evaluating Sourcefire/Macaulay against the '220 claims early rather than after a § 315(b) one-year bar runs from service of a complaint. Note the one-year clock is also your deadline for the IPR you'd actually want.

Pattern signals. The same petitioners (Keysight, Palo Alto Networks, Cisco) repeatedly attacked this family, and Cisco's and Keysight's joinder maneuvers in IPR2022-00182 / IPR2022-01151 / IPR2022-01199 drew sustained § 314(a)/Fintiv and "harassment" fights — read the PTAB's treatment of those arguments before you file a me-too petition. Centripetal is an aggressive patent owner that litigates PTAB outcomes hard (it appealed nearly every loss, mounted a recusal/ethics campaign that produced Federal Circuit precedent, and submitted amicus briefs attacking PTAB practice), so expect a vigorous Patent Owner Preliminary Response with objective-indicia arguments (long-felt need, industry praise, copying) — copying evidence is precisely what vacated the '856 FWD, so build or rebut that record deliberately. I found no defensive aggregator (e.g., Unified Patents) as petitioner in this chain; challenges appear competitor-driven, which matters for privity/RPI analysis and for who can be bound by estoppel.

Recommended next steps

1. Do not build a defense on a nonexistent FWD. There is no PTAB decision to quote for US 11,792,220. Any argument that the '220's claims are canceled is unsupportable; the only citable dispositions are the sibling-patent decisions listed above, and they must be labeled as such.
2. Re-verify the null before you rely on it. I checked the ODP "PTAB proceedings on file" block (empty) and multiple web sources; I could not confirm any '220 petition. If you need certitude for an opinion of counsel or a case-management statement, pull the patent's complete PTAB record directly at PTAB E2E / the USPTO Patent Center for US 11,792,220 and confirm no IPR2023-/IPR2024-/IPR2025-/IPR2026- petition names it. Flag: the '220 issued only 2023-10-17, so a petition could exist that ODP has not yet ingested.
3. Calendar the triggers if the '220 is being asserted. (a) § 315(b): one year from service of a complaint alleging infringement of the '220 to file an IPR. (b) PGR is unavailable — the 9-month post-grant window (35 U.S.C. § 321(c)) closed on 2024-07-17. (c) If you do file, the statutory trial timeline is one year from institution (35 U.S.C. § 316(a)(11)), extendable up to six months for good cause — budget institution decision (~6 months), PO response (+3), petitioner reply (+3), oral hearing (~month 11-12), FWD by month 12.
4. Mine the family FWDs for your petition skeleton. Get the IPR2022-01097 FWD (2023-12-15, re the '917) plus the 2024-10-31 and 2026-04-23 CAFC opinions. They confirm (i) Sourcefire qualifies as a printed publication for this specification family, (ii) "responsive to" does not require threat-indicator-only triggering, and (iii) dependent claims 4/14-type limitations ("existing flow log entry," "responsive to"/continuous-update arguments) are now vulnerable — the CAFC held the Board's contrary findings unsupported by substantial evidence.
5. Watch for a § 315(e)(2)-proof follow-on. Given Keysight's '917 petition covered all claims 1-20 and the '220 shares that disclosure, a Keysight (or other) petition against the '220's claims would be the natural next move and would be unencumbered by estoppel. If you are the defendant, that filing is either your shield or your deadline-setting event.

Sourcing note: the proceeding numbers, dates, holdings, and appeal numbers above come from the structured ODP block (empty for the '220), PTAB/ITC documents surfaced via PTAB CTS/petition downloads, the Federal Circuit opinions at the URLs cited, and law-firm/press summaries (Oliff, Patterson Sheridan, IPWatchdog, PTAB Watch, Legal Era). Items I could not independently confirm to document level — the IPR number underlying Appeal 2025-1053 (the '474 patent), panel compositions for the '028/'126/'413/'917 IPRs, and whether IPR2022-01535 was instituted — are flagged as such rather than asserted.

I'll research the assignment record for US 11792220 before writing the analysis.

Assignment Record Reconstruction — US Patent 11,792,220 B2 ("Rule-based network-threat detection")

Data-completeness caveat up front (please read before relying on the timeline): the USPTO Assignment Center is an interactive search interface; in this session I was able to confirm that assignments are recorded against this patent and what they convey, but I was not able to retrieve the reel/frame numbers or the correspondent-of-record fields. Those fields are marked "not retrieved" below rather than guessed. Everything else is anchored to the authoritative patent record and to court/PTAB/ITC documents linked inline.

---

Inventors

• The application data sheet for the sibling family member (US 16/554,293) records every inventor's mailing address as c/o Centripetal Networks, Inc., 99 Bow Street, Suite 300W, Portsmouth, NH 03801 — i.e., the entire inventive team was inside the assignee's office. (Docket Alarm copy of the ADS)
• Unusual-pattern check — negative. No evidence any inventor left Centripetal within 12 months of filing. The opposite is documented: Jonathan R. Rogers, a named inventor, signed the ITC complaint verification in April 2022 as VP of Operations & Chief Operating Officer and executed the Delaware conversion certificate in October 2022 as Treasurer and COO. (ITC complaint, 337-TA-1314; Delaware Certificate of Conversion)
• Prosecution correspondence of record for the Centripetal portfolio is Banner & Witcoff, Ltd. (Customer No. 22907), e.g. Kirk A. Sigmon, Reg. No. 76,326. Note: prosecution correspondence is not the same as the assignment-recording correspondent.

---

Original assignee

Centripetal Networks, Inc. — a Delaware corporation, formed 2009-02-25, originally Portsmouth, NH, later 1875 Explorer Street, Suite 900, Reston, VA.

• Products: yes — it ships product that it contends embodies the claims. In its ITC complaint the company states that "The Domestic Industry Products that practice the Asserted Patents are the only products made or sold by Centripetal" and identifies the CleanINTERNET® Threat Intelligence Gateway and RuleGATE® rack-mounted systems, with ~80 employees in Reston, VA and Portsmouth, NH. (ITC Complaint ¶¶ 93–104)
• Primary line of business: network security / network-threat detection appliances and threat-intelligence services (the claimed subject matter is core, not adjacent, to the product).
• Current status: operating as Centripetal Networks, LLC. Converted from a Delaware corporation to a Delaware LLC by statutory conversion effective 2022-12-30; "remains the same entity by operation of law." Not acquired, not dissolved, no bankruptcy found. Per Fed. Cir. Rule 26.1 disclosure (Oct. 2023), the LLC "has no parent corporation and no publicly held corporation owns 10% or more of its stock." (Notice of Name Change, E.D. Va. 2:22-cv-00002 Dkt. 55; Fed. Cir. brief)
• Google Patents collapses the history and shows "Original Assignee: Centripetal Networks LLC / Current Assignee: Centripetal Networks LLC," which masks the Inc.→LLC conversion.

---

Assignment timeline

Records do exist for this patent. Per the legal-events data attached to the patent record, there are two recorded transfers, both keyed to 2023-05-23. Reel/frame and correspondent were not retrievable from the Assignment Center in this session.

---

• Executed on/near 2015-04-17 (parent application 14/690,302 filed) / recorded 2023-05-23 — Reel not retrieved / not retrieved

  • Conveyance: Assignment (assignment of assignors' interest)
  • Assignor: Mallett, Pierre, III; George, Keith A.; Perry, Robert T.; Moore, Sean; Geremia, Peter P.; Ahn, David K.; Rogers, Jonathan R. (all seven named inventors)
  • Assignee: Centripetal Networks, Inc.
  • Correspondent: not retrieved — data gap; cannot assess recurrence.
  • Context: Original inventor assignment; recorded in 2023 rather than 2015, consistent with a chain-of-title re-recordation covering the newly filed 2023 continuation (18/200,801) rather than a fresh transfer of rights. (This is my inference from the coincident dates; the underlying document was not inspected.)

• Executed 2022-10-17 / effective 2022-12-30 / recorded 2023-05-23 — Reel not retrieved / not retrieved

  • Conveyance: Change of Name (see document for details) — Delaware statutory conversion, not a sale
  • Assignor: Centripetal Networks, Inc.
  • Assignee: Centripetal Networks, LLC
  • Correspondent: not retrieved — data gap; cannot assess recurrence.
  • Context: Internal reorg / change of name only. Certificate of Conversion executed 2022-10-17 by Jonathan Rogers (Treasurer & COO), filed with the Delaware Secretary of State 2022-12-30; the LLC is the same entity with the same address and officers.

Related-but-not-on-this-patent (context, excluded from the chain): a Patent and Trademark Security Agreement executed 2017-04-17 encumbering 14 properties in favor of Douglas A. Smith, an individual, 12770 Merit Drive, Suite 800, Dallas, TX 75251 (correspondence fax 617-951-8736). The property list — US 8,037,517; 8,042,167; 8,495,725; 9,094,445; 9,124,552; 9,137,205; 9,160,713; 9,203,806; 9,264,370; 9,413,722; 9,560,077; 9,560,176; 9,565,213; and application 14/625,486 — does not include US 9,866,576 or application 14/690,302, the ancestors of the patent at issue. On the face of the exhibit, this family was not pledged in that financing. (EPAS submission reproduced at E.D. Va. 2:17-cv-00383 Dkt. 28-4)

If you need the reel/frame and correspondent fields, run the patent number at USPTO Assignment Center (mirror: assignment.uspto.gov) — these are exposed per-record as "Reel/Frame" and "Correspondent." I did not have interactive access here and will not invent them.

---

Timeline diagram

timeline
    title Ownership of US 11792220
    2009 : Centripetal Networks Inc formed in Delaware
    2015 : Application 14-690-302 filed
         : Inventors assign to Centripetal Networks Inc
    2018 : Ancestor patent US 9866576 issues
    2022 : Delaware conversion executed and filed
         : Inc becomes Centripetal Networks LLC
    2023 : Continuation 18-200-801 filed
         : Two assignments recorded on May 23
         : US 11792220 issues on Oct 17

---

NPE / troll-pattern signals

1. Shell-entity transfer — not present.
The only 2022–2023 "transfer" is a Delaware statutory conversion, not a sale to a patent-holding vehicle: Certificates of Conversion and Formation filed 2022-12-30, same entity by operation of law, address unchanged (1875 Explorer Street, Suite 900, Reston, VA), officers unchanged (Rogers as Treasurer/COO), and the resulting LLC employs ~80 people and sells CleanINTERNET/RuleGATE. None of the shell tells (single-purpose new LLC, licensing-only business, registered-agent service address as the operating address) is present on the record. Its registered office for Delaware purposes is The Corporation Trust Center — but that is standard corporate housekeeping for a Delaware entity and is the only registered-agent datum in the chain.

2. Known asserter in the chain — not present.
No assignee in the chain matches the named lists (Acacia, Marathon, Intellectual Ventures, IPNav, Wi-LAN, Mosaid/Conversant, Vringo, Pendrell, Innovatio, MPHJ, Lumen View, Round Rock, Document Generation Corp, Spangenberg entities). Centripetal is the original assignee and the current owner. Unclear/unverified: I did not confirm whether Unified Patents or RPX currently list Centripetal on a high-frequency-plaintiff directory; note only that Centripetal is a serial plaintiff against sector competitors (Cisco, Palo Alto Networks, Keysight/Ixia, LookingGlass) while simultaneously being a practicing manufacturer.

3. Repeat correspondent across the chain — unclear (data gap).
The correspondent-of-record field was not retrievable for either 2023-05-23 recordation. I therefore cannot make the recurrence call, and per your own precision rule I decline to substitute prosecution or litigation counsel for it. For completeness only: prosecution correspondence is Banner & Witcoff, Ltd. (Customer No. 22907); litigation counsel for the family is Kramer Levin Naftalis & Frankel LLP. Neither is the assignment correspondent.

4. Cascading transfers — not present.
Two recordations in eight-plus years, both dated 2023-05-23, both between the same corporate family (inventors → Inc.; Inc. → LLC by conversion). No chained LLCs, no serial assignees, no sub-24-month cascade.

5. Pre-litigation transfer — not present (inverted).
The family was in litigation long before any 2023 recordation: Centripetal Networks, Inc. v. Keysight Technologies/IXIA, No. 2:17-cv-00383 (E.D. Va., 2017) asserted the '722 ancestor, and Centripetal Networks, Inc. v. Cisco Systems, Inc., No. 2:18-cv-00094 (E.D. Va.) was filed 2018 — five years before the recorded change of name. No assignment was executed within six months before a first suit naming this patent. This patent itself (issued 2023-10-17) does not appear among the family members asserted in the Cisco, Keysight I/II, PAN, or ITC 337-TA-1314 actions.

6. Bankruptcy fire-sale — not present.
No Chapter 7/11 proceeding for Centripetal Networks, Inc./LLC was located. The 2017 security interest in favor of an individual lender did not cover this family (property list checked, above) and no foreclosure or collateral-assignment recordation appears in this chain.

7. Privateering — not present.
Privateering requires an operating company transferring to a separate NPE that asserts on its behalf. Here the operating company is the asserter: Centripetal ships the accused-competitor-facing product itself and its ITC economic-prong declarations are filed in its own name. No third-party NPE has ever held this patent.

8. Defensive aggregator — not present.
Chain terminates at Centripetal Networks, LLC; no RPX/AST/LOT/Unified/OIN link. The patent is not neutralized.

---

Verdict

Operating-company assertion.

The chain is two recordations long and terminates where it started: seven inventors assigned to Centripetal Networks, Inc., and the same entity continued by Delaware statutory conversion into Centripetal Networks, LLC (both recorded 2023-05-23; conversion executed 2022-10-17, effective 2022-12-30). Centripetal is not a paper owner — it declares under oath in ITC Investigation 337-TA-1314 that CleanINTERNET and RuleGATE practice the asserted family claims and are "the only products made or sold by Centripetal," and a Federal Circuit Rule 26.1 filing confirms no parent or 10% public holder. It does assert aggressively against direct competitors (Cisco, Palo Alto Networks, Keysight/Ixia), but that is a practicing manufacturer suing rivals, not an NPE, and none of the eight NPE signals is affirmatively present — signal 3 (repeat correspondent) is explicitly unclear due to a data gap, not negative-evidence-supported, so treat the correspondent question as open.

Verify: USPTO Assignment Center (search 11792220) · Google Patents legal events

---

Residual open items (for a second pass with Assignment Center access)

1. Reel/frame for both 2023-05-23 recordations, and whether they are a single combined recordation or two.
2. Correspondent name/firm/address on each — needed to score signal 3 and to check that firm against NPE-assertion directories.
3. Execution date on the inventor→Inc. assignment document (2015 vs. 2023), to confirm the re-recordation inference.
4. Confirm no later security-interest or collateral recordation against this specific patent number.

I'll research this patent's citation record and prior art. Let me start with several searches.

Let me get the actual cited references list for this patent.

Let me search for the specific prior-art references at issue in the IPRs and the current litigation status.

Prior-Art Analysis — US 11,792,220 B2 ("Rule-based network-threat detection")

Research limitation, stated up front: I could not retrieve, in this session, the USPTO PatentCenter/Global Dossier "References Cited" pane for application 18/200,801 specifically (US 11,792,220 B2). What I was able to retrieve and cross-check are (a) the family-level citation list published by Google Patents for the 55863202 family (shown on the sibling US 9,413,722 page as "Patent Citations (152)"), and (b) the complete prosecution citation list of the family's root patent, US 9,866,576 (Appl. No. 14/690,302), via uspto.report. Because 11,792,220 is a straight continuation with an identical specification, its examiner citation list is effectively identical to the parent's (continuations of this chain added no new prior art of record). Anything below I could not independently verify is flagged. I have not fabricated titles, dates, or claim mappings I could not confirm.

Also note the important legal caveat: none of the citations below were applied as § 102 anticipation of US 11,792,220 during prosecution. The examiner's citations in this family are § 103 obviousness references (frequently in combination), and the only true single-reference challenge — Sourcefire — was adjudicated as § 103, not § 102. I address "potential § 102" candidly rather than manufacturing anticipation mappings.

---

1. Bibliographic verification (as requested, literal IDs)

The direct chain to 11,792,220 is: 14/690,302 (US 9,866,576) → 15/827,477 (US 10,193,917) → 16/217,720 (US 10,567,413) → 16/706,388 (US 10,609,062) → 16/813,220 (US 10,757,126) → 17/001,164 (US 11,012,459) → 17/232,291 (US 11,700,273) → 18/200,801 (US 11,792,220). Note the immediate parent of the application at issue is 17/232,291, not 17/232,291's own parent.

---

2. The most relevant prior art — the references that actually drove the invalidity fight

This is where the real § 102/§ 103 material sits, because these references were litigated across the 55863202 family (of which 11,792,220 is a member) and adjudicated by the PTAB and Federal Circuit.

2.1 "Sourcefire" — Sourcefire 3D System User Guide, Version 4.10 (printed publication, dated 2011-03-16)

• Full citation: Sourcefire, Inc., Sourcefire 3D System User Guide, v. 4.10 (2011) (Exhibit 1004 / "Sourcefire" in IPR2018-01760, IPR2022-01097, IPR2021-01147/148/149).
• Date: © 2011, dated Mar. 16, 2011; § 102(a)(1) prior art; publicly accessible (upheld by the Board and by the Federal Circuit, Centripetal Networks, Inc. v. Cisco Systems, Inc., No. 20-2057 (Fed. Cir. Mar. 10, 2021) and the companion 20-1635 decision).
• Description: User manual for a commercial Intrusion Prevention System built on "3D Sensor" appliances that monitor a network segment, apply an "intrusion policy" through a rules/detection engine, and take an action per intrusion rule — "alert," "pass," or "drop." It generates "intrusion events," consolidates event data into event views/workflows with refresh intervals, and exposes "first packet"/"last packet" timestamps. The Board construed "network-threat indicator" as "an indicator that represents the identity of a resource associated with a network threat," and found Sourcefire's rules (e.g., keyed to source IP) meet that limitation.
• Claims potentially affected: In IPR2018-01760 the Board held claims 1–7, 10–12, 14–21, 24, and 25 of the sibling '722 patent unpatentable over Sourcefire alone. In IPR2022-01097 the Board held claims 1–3, 5, 11–13, 15, and 20 of the sibling '917 patent unpatentable over Sourcefire alone. Because 11,792,220 shares the specification and overlapping claim scope with these siblings, Sourcefire is the single most relevant reference for the method, packet-log/packet-flow-log, and interface-display limitations recited in claims 1, 7–10, 12–15, and 20 of the family.
• § 102 characterization: Sourcefire is the only reference here that came close to a single-reference showing. It was nonetheless adjudicated under § 103, and on April 2026 the Federal Circuit affirmed in part and reversed in part, holding claims 4 and 14 of '917 additionally unpatentable over Sourcefire. In other words, for 11,792,220's closest relatives, Sourcefire alone was held to disclose every element — the practical equivalent of an anticipatory disclosure, though pleaded as obviousness. Do not expect Sourcefire to be pleaded as § 102 against 11,792,220 itself; the estoppel/record is built on § 103.

2.2 Macaulay — US 2015/0207809 A1

• Full citation: U.S. Patent Pub. 2015/0207809 A1 (Macaulay).
• Date: Published 2015-07-23 — this is after the 2015-04-17 priority date, so it is not prior art standing alone against 11,792,220; it was used in IPR2022-01097 as a secondary reference (as of the '917 patent's later effective filing) to supply "scores" / reputation scoring.
• Description: System for refining cyber threat intelligence that computes dynamic reputation scores for traffic attributes based on event counts, traffic volume, and threat-intelligence source.
• Claims potentially affected: The scoring/ordering dependent claims (e.g., "applying an operator determined based on one or more scores" and the ordering-by-provider-count limitations, claims 30–40 area of the family).
• § 102: None — combination-only (§ 103).

2.3 "FireWall-1 User Interface from 3.0" (PhoneBoy's Security Theater, archived 2014-01-02)

• Full citation: "FireWall-1 User Interface from 3.0," PhoneBoy's Security Theater, archived at the Internet Archive Wayback Machine Jan. 2, 2014 — Ex. 1013 in IPR2022-01151/IPR2022-01199 (US 9,917,856).
• Date: archived Jan. 2, 2014 (content from Check Point FireWall-1 v3.0 era); § 102(b) art relative to the 2015 priority.
• Description: Screens showing a stateful packet-filtering firewall rule base and rule-management UI.
• § 102: Cited as a § 102(b)/§ 103 reference in sibling IPRs; combination use.

2.4 "NetRanger™ User's Guide" (~1990s, exact date unknown)

• Cited in IPR2021-01147/148/149 (US 10,542,028) and IPR2018-01513 (US 9,560,077) as Ex. 1017.
• Description: Cisco/NetRanger intrusion-detection documentation.
• § 102: Combination reference; publication date was not established in the record ("date of publication unknown but prior to Jul. 26, 2021").

2.5 Heberlein et al., "A Network Security Monitor" (Nov. 1989)

• Ex. 1016 in IPR2021-01147/148/149.
• Description: Foundational paper on the Network Security Monitor (NSM), an early network-based IDS; § 102(b) prior art.
• § 102: Combination reference.

2.6 "SonicWALL ViewPoint 60 Administrator Guide" (2010) and FireWall-1/Check Point materials

• Ex. 1014–1015 in IPR2021-01147/148/149. § 102(b) art; combination references.

2.7 Patent-document references used in inter partes reviews / district court

• US 7,185,386 — cited in an invalidity chart against sibling US 9,917,856 (Ex. 2002 in IPR2022-01151). Combination reference.
• US 6,671,811 (Top et al.), US 2006/0053186 A1 (Ashir), US 2003/0105976 A1 (Copeland) — cited as "Y" references in a PCT search report for a related Network Security Monitor application (see below). These are general-purpose packet-filtering/intrusion-detection references.
• US 9,124,552; US 9,160,713; US 9,560,077; US 9,917,856 — these are Centripetal's own patents, the target patents in the Cisco/Palo Alto/Keysight IPRs; they appear in the family's citation record as related art, not as third-party prior art.

---

3. Patent-document citations of record (familial list, ~150 references)

The prosecution record of the family root (US 9,866,576, same specification) lists the following U.S. patent documents, all of which were of record during prosecution of the chain that produced 11,792,220. Dates below are issue dates (as published by uspto.report). I am providing them as a verified citation list; I have not independently verified a descriptive summary for each, so I give the technical category rather than inventing descriptions.

Granted U.S. patents (issue date — assignee/inventor):
6,098,172 (Aug 2000, Coss) · 6,147,976 (Nov 2000, Shand) · 6,226,372 (May 2001, Beebe) · 6,317,837 (Nov 2001, Kenworthy) · 6,484,261 (Nov 2002, Wiegel) · 6,611,875 (Aug 2003, Chopra) · 6,662,235 (Dec 2003, Callis) · 7,089,581 (Aug 2006, Nagai) · 7,107,613 (Sep 2006, Chen) · 7,143,438 (Nov 2006, Coss) · 7,215,637 (May 2007, Ferguson) · 7,227,842 (Jun 2007, Ji) · 7,237,267 (Jun 2007, Rayes) · 7,263,099 (Aug 2007, Woo) · 7,296,288 (Nov 2007, Hill) · 7,299,353 (Nov 2007, Le Pennec) · 7,331,061 (Feb 2008, Ramsey) · 7,478,429 (Jan 2009, Lyon) · 7,539,186 (May 2009, Aerrabotu) · 7,610,621 (Oct 2009, Turley) · 7,684,400 (Mar 2010, Govindarajan) · 7,710,885 (May 2010, Ilnicki) · 7,721,084 (May 2010, Salminen) · 7,818,794 (Oct 2010, Wittman) · 7,913,303 (Mar 2011, Rouland) · 7,954,143 (May 2011, Aaron) · 8,004,994 (Aug 2011, Darisi) · 8,037,517 (Oct 2011, Fulp) · 8,042,167 (Oct 2011, Fulp) · 8,117,655 (Feb 2012, Spielman) · 8,176,561 (May 2012, Hurst) · 8,306,994 (Nov 2012, Kenworthy) · 8,495,725 (Jul 2013, Ahn) · 8,726,379 (May 2014, Stiansen) · 8,806,638 (Aug 2014, Mani) · 8,832,832 (Sep 2014, Visbal) · 8,856,926 (Oct 2014, Narayanaswamy) · 8,935,785 (Jan 2015, Pandrangi) · 9,094,445 (Jul 2015, Moore) · 9,124,552 (Sep 2015, Moore) · 9,137,205 (Sep 2015, Rogers) · 9,154,446 (Oct 2015, Gemelli) · 9,160,713 (Oct 2015, Moore).

U.S. pre-grant publications of record (representative): 2001/0039579; 2001/0039624; 2002/0016858; 2002/0038339; 2002/0049899; 2002/0112188; 2002/0164962; 2002/0165949; 2002/0186683; 2002/0198981; 2003/0018591; 2003/0035370; 2003/0051026; 2003/0097590; 2003/0105976 (Copeland); 2003/0120622; 2003/0123456; 2003/0142681; 2003/0145225; 2003/0154297; 2003/0154399; 2003/0188192; 2003/0212900; 2003/0220940; 2004/0010712; 2004/0073655; 2004/0088542; 2004/0093513; 2004/0098511; 2004/0151155; 2004/0172529; 2004/0172557; 2004/0177139; 2004/0193943; 2004/0199629; 2004/0205360; 2004/0250124; 2005/0010765; 2005/0024189; 2005/0071650; 2005/0108557; 2005/0114704; 2005/0117576; 2005/0125697; 2005/0138204; 2005/0138353; 2005/0141537; 2005/0183140; 2005/0229246; 2005/0251570; 2005/0286522; 2006/0048142; 2006/0053491; 2006/0070122; 2006/0080733; 2006/0085849; 2006/0104202; 2006/0114899; 2006/0133377; 2006/0136987; 2006/0137009; 2006/0146879; 2006/0195896; 2006/0212572; 2006/0248580; 2006/0262798; 2007/0083924; 2007/0211644; 2007/0240208; 2008/0005795; 2008/0043739; 2008/0072307; 2008/0077705; 2008/0163333; 2008/0229415; 2008/0235755; 2008/0279196; 2008/0301765; 2009/0138938; 2009/0172800; 2009/0222877; 2009/0240698; 2009/0328219; 2010/0011433; 2010/0011434; 2010/0082811; 2010/0095367; 2010/0107240; 2010/0132027; 2010/0199346; 2010/0211678; 2010/0232445; 2010/0242098; 2010/0268799; 2010/0296441; 2010/0303240; 2011/0055916 (Ahn); 2011/0055923; 2011/0088092; 2011/0141900; 2011/0185055; 2011/0270956; 2011/0277034; 2012/0023576; 2012/0106354; 2012/0113987; 2012/0240135; 2012/0264443; 2012/0314617; 2012/0331543; 2013/0047020; 2013/0059527; 2013/0061294; 2013/0104236; 2013/0117852; 2013/0254766; 2013/0305311; 2014/0075510; 2014/0115654; 2014/0201123; 2014/0215574; 2014/0259170; 2014/0281030; 2014/0283004; 2014/0283030; 2014/0317397; 2014/0366132; 2015/0033336; 2015/0106930; 2015/0237012; 2015/0244734; 2015/0304354; 2015/0334125 (Bartos); 2015/0341389; 2015/0350229 (Mitchell); 2015/0372977; 2015/0373043 (Wang); 2016/0119365 (Barel); 2016/0294870 (Banerjee).

Foreign patent documents of record: AU 2005328336 B2 (Sep 2011); AU 2006230171 B2 (Jun 2012); CA 2600236 (Oct 2006); EP 1006701 (Jun 2000); EP 1313290 (May 2003); EP 1484884 (Dec 2004); EP 1677484 (Jul 2006); EP 2385676 (Nov 2011); EP 2498442 (Sep 2012); EP 1864226 (May 2013); KR 20010079361 (Aug 2001); WO 2005046145; WO 2006093557; WO 2006105093; WO 2007109541; WO 2011038420; WO 2012146265.

Non-patent literature of record (representative): Bellovin & Cheswick, "Network Firewalls," IEEE Comm. Mag. (1994); Srinivasan et al., "Fast and Scalable Layer Four Switching," ACM SIGCOMM (1998); Feldmann & Muthukrishnan, "Tradeoffs for Packet Classification," IEEE INFOCOM (2000); Fulp, "Trie-Based Policy Representations for Network Firewalls" (2005); Al-Shaer & Al-Saleh firewall-policy work (2003–2004); Greenwald et al., "Designing an Academic Firewall … SURF" (1996); Kindervag et al., Build Security Into Your Network's DNA: The Zero Trust Network Architecture, Forrester (Nov. 5, 2010); Moore, "SBIR Case Study: Centripetal Networks" (Oct. 10, 2012); plus the U.S./EP/AU/CA/WO office actions and ISR/WO items.

Note on the citation quantity: Google Patents renders the family citation count as "Patent Citations (152)." My verified enumeration above runs to roughly 150 patent documents; the small delta is consistent with how Google counts family members versus uspto.report's list. I flag this rather than assert an exact match.

---

4. § 102 vs § 103 — honest framing, per reference

The question asked which claims each reference "potentially anticipates" under § 102. A citation in a patent's "References Cited" section does not establish § 102 anticipation. Applying the actual law:

• Anticipation (§ 102) requires a single reference disclosing every limitation arranged as in the claim, with no need to combine. On this record, no cited reference was applied as a § 102 anticipation of 11,792,220 or any family member during prosecution.
• The closest thing to anticipation is Sourcefire (§ 2.1), which a single reference was held to render — but under § 103, not § 102 — the independent claims of the sibling '722 and '917 patents (which share 11,792,220's specification). For 11,792,220's claim set, Sourcefire is the reference most likely to potentially read on the independent method/device/CRM claims (the "receive rules → determine packet corresponds to criteria → apply operator → generate packet-log entry → generate/communicate/display data" sequence).
• Everything else (Macaulay, FireWall-1, NetRanger, Heberlein, SonicWALL, Copeland, Ashir, Top, and the ~150 prosecution citations) functions as § 103 combination art or as background/§ 102(b) art for individual limitations — chiefly the packet-classification, firewall-rule-ordering, flow-aggregation, and UI-display aspects. They do not individually anticipate the family's ordered combination.

Practical conclusion: For 11,792,220, the operative invalidity theory is obviousness (§ 103), and the lead reference is Sourcefire, optionally combined with Macaulay for the scoring/ordering claims. Anyone asserting § 102 anticipation against 11,792,220 on these citations would be conflating the examiner's § 103 record with § 102.

---

5. 2026 litigation / PTAB activity (material to this patent)

• Centripetal Networks, LLC v. Keysight Technologies, Inc., Fed. Cir. (nonprecedential), decision April 2026 (docket disposition reported Apr. 23, 2026; slip opinion filename …FedCir20260423042426.pdf). The court affirmed the PTAB's holding that claims 1–3, 5–13, and 15–20 of US 10,193,917 (a sibling of 11,792,220 in family 55863202) are unpatentable over Sourcefire alone and Sourcefire + Macaulay, and reversed as to claims 4 and 14, holding them unpatentable as well. The court also rejected Centripetal's APA/notice and claim-construction challenges (construing "packet flow entry").
• This is the latest link in a long chain: IPR2018-01760 (US 9,413,722, Sourcefire, FWD 2020-05-18, affirmed by Centripetal v. Cisco, No. 20-2057, Fed. Cir. Mar. 10, 2021); IPR2022-01097 (US 10,193,917, FWD 2023-12-15, appealed 2024-01-29, decided Apr. 2026).
• Relevance to 11,792,220: Because 11,792,220 is a continuation sharing the '917/'722 specification, the April 2026 affirmance of Sourcefire-based unpatentability for the sibling claims is directly probative of 11,792,220's own exposure, and I found no indication that 11,792,220 itself has been separately challenged in an IPR to date. If you want the specific IPR/civil docket numbers of any 2026 dispute naming 11,792,220 by number, that needs a fresh PACER/PTAB lookup — I could not confirm any such case in this session and will not assert one.

---

6. Flags / caveats

1. Claim-set caveat. The full claim text provided to me for 11,792,220 was truncated (it cut off mid-description), so I did not independently verify 11,792,220's exact claim numbering. The representative claim set I discussed (including the "ordering of a plurality of network threats … based on … a greater number of … network-threat-intelligence providers") is the US 9,866,576 claim set retrieved from uspto.report; confirm 11,792,220's claims against the grant before relying on claim-level mappings.
2. No contradiction with the previously generated "Patent summary" section was found; this analysis extends it by tying the citation record to the specific litigation-driven references.
3. All alphanumeric identifiers above are reproduced literally as retrieved; none were auto-corrected.

Sources: Google Patents (patents.google.com/patent/US11792220/en and family pages); uspto.report/patent/grant/9866576 (prosecution citation list); ai-lab.exparte.com IPR2022-01097 summary; PTAB documents via ptacts.uspto.gov and docketalarm.com; CCH slip opinion CentripetalNetworksKeysightTechnologiesFedCir20260423042426.pdf; caFC 20-2057 opinion (cases.justia.com); IPWatchdog (Apr. 23, 2026).

I'll start by gathering the claim text and the prior-art references cited on this patent's face, then build the § 103 analysis on top of the summary already generated.

Excellent — the search reveals this patent is in the same family as the heavily-litigated '722 patent. Let me pull the actual claim set of US 11,792,220 and the specific PTAB/prior-art record.

Let me pin down the exact granted claim set of US 11,792,220 and check whether this specific patent has been challenged at the PTAB.

Obviousness Analysis — U.S. Patent No. 11,792,220 (Rule-Based Network-Threat Detection)

0. Evidence-base caveats (read first)

Three things must be flagged before the analysis, per the operating rules:

1. The "Prior Art section of this page" is not in the supplied content. The patent text you provided is the Google Patents rendering of US11792220B2 truncated at the end of the Detailed Description. It contains the abstract, definitions, classification tree, and family/legal-status data — but no "Patent Citations" table and no prior-art listing. The Patent Citations (152) tables appear on the related family pages (e.g. US10193917B2, US10609062), not on the page as supplied. I therefore reconstructed the prior-art record from the family's prosecution/IPR/litigation docket and say so explicitly rather than pretending to cite a list I don't have.

2. Date inconsistency. This task states the current date is April 26, 2026; my session context states 2026-09-29. I treat the later date as operative for "known as of" statements, but the discrepancy is noted rather than silently reconciled.

3. Claim-text provenance. The granted claim set of the '220 was not in the supplied page text. The claims relied on below are those published for the same application (Ser. No. 18/200,801) as US20230300162A1 and its immediate continuations (justia 20230300162, justia 20220232027). Granted-claim numbering should be verified against the issued patent before relying on any single-claim conclusion; the substance of the claim family is stable across the record.

Critically, and unlike most obviousness tasks: this patent has already been adjudicated. The '220 is a continuation of the same 2015-04-17 priority family as U.S. 9,413,722, 10,193,917, 10,557,413, 10,609,062, 10,757,126 and others (per the EP3284238B1 family listing and the '220 page's "Other versions" field). Substantively identical claims of the '722 patent were held unpatentable as obvious over Sourcefire, and the Federal Circuit affirmed (Centripetal Networks v. Cisco, No. 20-2057, slip op. (Fed. Cir. Mar. 10, 2021)). That is the single most probative fact in this analysis.

---

1. Level of ordinary skill (adopted from the prior record)

Because the '220 shares the '722's priority date and specification, the skill level adopted in the prior IPR is directly transferable. The Board adopted, unrebutted by the patent owner:

"a bachelor's degree in computer science, computer engineering or an equivalent, as well as four years of industry experience," with "a working knowledge of packet-switched networking, firewalls, security policies, communication protocols and layers, user interfaces, and the use of customized rules to address cyber-attacks."
(Supreme Court petition appendix reproducing the Board's FWD)

A POSITA here is a practical network-security engineer who configures IPS/firewall rule engines and their management GUIs. That skill level is important: it makes GUI-driven rule reconfiguration, log consolidation, and alert ranking ordinary design choices rather than inventive leaps.

Claim construction likewise carries over. The Board construed "network-threat indicator" as an "indicator that represents the identity of a resource associated with a network threat," and expressly grounded it in the '722/'220 specification's own examples ("network addresses, ports, fully qualified domain names (FQDNs), uniform resource locators (URLs), uniform resource identifiers (URIs), or the like") — the identical passage appears in the '220 text you supplied. The Federal Circuit affirmed the Board's application of that construction. This forecloses the principal non-infringement/non-obviousness argument Centripetal ran below (that an IP address in a rule header is only a "whitelist" address and not a threat indicator): the Board and the Court held a POSITA would understand rule criteria keyed to a specific source IP address to identify a resource associated with a network threat, especially where the claim itself recites "network address."

---

2. The presumptive prior art

Caveat on the last row: I could not, in this session, retrieve and verify the specific disclosures of the Ahn/Moore/Rogers family references cited on the family's IDS. I therefore do not rely on them for any limitation-specific assertion; Grounds 1–3 below rest only on Sourcefire, Check Point R77, and the AAPA, each of which I can cite.

Note also that Sourcefire's §102(a)(1) status has already survived a full appeal, and collateral estoppel now bars Centripetal from relitigating printed-publication status against the same petitioner. The Sourcefire reference is thus unusually "clean" prior art for a '220 challenge — no priority-date fight is available, because the '220's own stated priority date (2015-04-17) is the same date Sourcefire predates.

---

3. Ground 1 (primary): Sourcefire alone — §103

This is the ground already adjudicated and affirmed against the '722 (claims 1–7, 10–12, 14–21, 24, 25). Because the '220 claims are in the same family and materially overlap, the mapping below is the strongest and least contestable.

3.1 Sourcefire's teachings

From the Board's FWD as reproduced in the Federal Circuit petition appendix (link):

• Packet-filtering device at a network boundary: Sourcefire's 3D Sensors are inline packet-filtering appliances "provid[ing] real-time network intelligence for real-time network defense." → the claimed packet-filtering device at a boundary.
• Rules with criteria: intrusion rules have a rule header whose arguments include the 5-tuple (protocol, source/destination IP, source/destination port); the manual teaches configuring rules to a specific source IP address. → the claimed packet-matching criteria corresponding to network-threat indicators under the Board's construction.
• Operator: rule headers include rule actions — drop ("block packets from continuing to their destinations"), pass ("permit the packets to continue without interruption"), and alert ("generate reports of intrusion events while typically allowing packets to continue"). → the claimed operator configured to prevent or allow.
• Log entry with rule-derived threat identity: matching a rule generates an intrusion event / event log carrying the rule's msg: string and SID (e.g. msg: Backdoor Doom.juice.a backdoor download/execute attempt, SID 2375), which "identified the one or more network-threat indicators and whether the packet was allowed to continue or was dropped." See the petition exhibit at ptacts.uspto.gov …/1549775 and the 1550307 petition. → the claimed log entry comprising information from the rule that is distinct from the criteria and identifies the network-threat indicator, and indicating allow/block.
• Centralized GUI management: the Defense Center lets users "select, customize, and manage intrusion rules across all the system's sensors," including writing "custom intrusion rules tuned to your environment" (manual at 34). → the claimed interface and the block option / instruction to reconfigure the operator.
• Aggregation/consolidation: Sourcefire's event database aggregates events and the rule/event views consolidate repeated hits; the Board found the "packet-flow log … each packet-flow-log entry corresponds to a different network threat" limitation taught ("Updating the count of a packet-flow log entry indicated that the packet 1) satisfied the one or more criteria and 2) was allowed to continue or was dropped").

3.2 Claim mapping for the '220-style claims

The claims of application 18/200,801 (as published) recite, in substance:

3.3 Motivation to combine

For a single-reference §103 ground, the "motivation" is intrinsic to the reference: Sourcefire itself teaches configuring rule actions, managing rules centrally, and reviewing event logs to decide enforcement, which is exactly the ordering/aggregation/reconfiguration behavior claimed. The Board found the claims obvious over Sourcefire and the Federal Circuit affirmed on substantial evidence. For the '220, the strongest framing is therefore: the claimed subject matter as a whole was already before the Board and the Federal Circuit and was held obvious; the '220 adds no new technical element that changes the analysis.

---

4. Ground 2: Sourcefire + Check Point R77 — §103

Used to shore up the interface / user-invoked reconfiguration / display-of-blocked-packet limitations, and the multi-device management limitation, if the patent owner argues Sourcefire's Defense Center is insufficiently "interactive."

• Check Point R77 SmartDashboard provides a GUI rule editor in which a user changes a rule's action (e.g., block) and pushes the change to security gateways; the expert report in IPR2022-01199 demonstrates, with annotated screenshots, that this "satisfies all requirements" of the corresponding claim elements, including the interface, the user-invoked element, receipt of the instruction by the packet-filtering device, and reconfiguration of the rule operator (Ex. 2003, IPR2022-01199).
• Check Point R77 SmartLog "displays information about the details of the packet-filtering rule … including information indicating that the second packet was prevented from moving toward its intended destination" — i.e. the claimed display of the prevent/allow outcome. Same exhibit.
• Check Point R77 was also shown to satisfy the multi-device limitation (one management server pushing rules to multiple security gateways), covering claims of the type reciting "one or more computing devices that provide packet-filtering rules to a plurality of different packet-filtering devices."

Motivation: both references are in the same field (rule-based perimeter packet filtering with centralized GUI management); a POSITA designing an operator-driven, dashboard-configurable threat-enforcement product would predictably look to the interaction model of an established commercial firewall manager. KSR supplies the rationales directly: (a) combination of prior-art elements according to known methods to yield predictable results; (b) use of a known technique (GUI rule editing) to improve a similar device in the same way; (c) design incentive flowing from the market demand for administrator-tunable enforcement. There is no teaching away: nothing in Sourcefire or R77 disparages interactive rule-action changes or log-detail displays.

Caveat: Centripetal successfully argued in the '856 litigation that Check Point R77 decrypts before inspecting, and therefore does not teach applying packet-filtering rules to encrypted packets (IPR2022-01199 POPR excerpt). That defense is irrelevant to the '220, which (as shown by the specification you supplied) claims plaintext/host-based filtering and DNS-cache resolution — not encrypted-traffic filtering. So R77 remains usable here even though it was attacked elsewhere.

---

5. Ground 3: Sourcefire + Applicant-Admitted Prior Art (threat-intel feed → rule generation) — §103

The '220's own Background is an admission:

"Many organizations subscribe to network-threat services that periodically provide information associated with network threats, for example, reports that include listings of network-threat indicators (e.g., network addresses, uniform resource identifiers (URIs), and the like)."

and

"a packet-filtering device may receive packet-filtering rules configured to cause the packet-filtering device to identify packets corresponding to network-threat indicators…"

That Background passage is a near-verbatim recitation of the '220's own independent claim 1 preamble/steps. Where the specification's Background describes the claimed subject matter as conventional, it is treated as admitted prior art. Combined with Sourcefire (which supplies the rule engine, operator, logging, interaction, and aggregation mechanics), the only remaining alleged novelty — automating the translation of a commercial threat-intel feed into packet-filtering rules, and ranking resulting threats — is a predictable design choice:

• AAPA supplies the content (indicators: network addresses, URIs).
• Sourcefire supplies the machinery (rules with IP criteria and drop/pass/alert operators; event logs carrying rule identity; centralized console).
• The linkage (generate a rule whose criteria correspond to an indicator) requires no more than ordinary skill: the Board already found Sourcefire taught rules keyed to a specific source IP address representing a resource associated with a network threat, and that a POSITA would know of independent intel providers distributing indicator listings (1549775 petition).

Score/ordering claims (e.g., score based on provider identity, provider count, hit counts, recency, threat type, geographic info, anonymous-actor info; "modify the ordering"). These are the weakest link in the chain if the '220's score-specific claims survive. But they are highly vulnerable as obvious design choices under KSR/In re Ethicon: ranking a list by (i) number of hits, (ii) recency, (iii) source reliability/corroboration count, and (iv) severity category is the canonical triage heuristic of every security-operations console. The '220 specification itself concedes the weighting scheme is arbitrary policy (e.g., provider 130's reports "may be regarded as more reliable" than provider 134's — a pure administrator preference, not a technical advance). Additionally, the score claims are the subject of a separate Sourcefire-based §103 challenge to sibling claims (1549775 petition), though I have not confirmed the merits outcome of that proceeding and therefore do not assert it as adjudicated.

---

6. Consolidated motivation-to-combine (KSR/MPEP)

No teaching away exists in either reference. There is no criticality or unexpected result attributed to any individual limitation in the '220 specification; the asserted advantages (latency minimization via "work-conserving scheduling," consolidation) are performance goals of a kind routinely pursued by a POSITA, and the consolidation feature was adjudicated obvious ('722 claim 12).

---

7. Objective indicia and the patent owner's best counter-arguments

Centripetal will press secondary considerations; the record tells us how that has fared:

• Commercial success / praise (ESG paper, Gartner) for RuleGATE/Threat Intelligence Gateway was presented on the '722 and found not entitled to substantial weight because Centripetal "presented no evidence to show that its RuleGATE product was coextensive with the '722 patent's claims" and failed to tie the praise to the limitations (Fox Factory nexus requirement) (Fed. Cir. 20-2057). The same nexus failure will recur unless Centripetal shows coextensiveness of a specific product with the '220 claims.
• Long-felt need ("how to operationalize threat intelligence to proactively identify network threats") was argued and rejected as a §103 counterweight in the '722 appeal.
• However — a real caution: in the parallel '856 case, the Federal Circuit vacated the Board's final written decision on October 22, 2025 "for failure to adequately consider evidence of copying," and remanded (CAFC 23-2027 opinion). Copying by Cisco/defendants is exactly the kind of objective indicium that can defeat a §103 case notwithstanding a strong prima facie showing. If the '220 is ever challenged, expect Centripetal to import the copying evidence developed in the '856 litigation. A §103 analysis of the '220 must therefore engage the copying evidence rather than rest solely on the Sourcefire mapping.
• Claim differentiation / prosecution history: the Notice of Allowance of the sibling '062 patent shows the Examiner expressly recognized that Sourcefire "indeed anticipate[s] the limitations of determining that packets satisfy filtering rule, and subsequently preventing packets from continuing based on the modification of at least one rule using a series of graphical user interfaces," and allowed only on a narrow "explicit progression"/ordering theory (1550307 petition, quoting EX-1002). That allowance rationale is fragile: it is a step-ordering distinction, and step ordering is generally not entitled to patentable weight unless the claim establishes a specific manner of operation producing a different result — and here the Board/Fed. Cir. found the ordered sequence to appear in Sourcefire.

---

8. Procedural overlay: estoppel, ODP, and practical likelihood

• Collateral estoppel: Centripetal fully litigated and lost on (i) Sourcefire's status as a printed publication and (ii) Sourcefire's teaching of "network-threat indicators" as applied to these specifications, through final written decision and Federal Circuit affirmance. A later challenge to the '220 raising the same issues against the same party is well-positioned for estoppel-based resolution.
• Obviousness-type double patenting / terminal disclaimer: the '062 prosecution shows the Examiner used a terminal disclaimer to obviate double patenting over the '722 patent, and the claim-mapping tables in the record (e.g., '917 claim 5 ↔ '722 claim 12; '917 claim 6 ↔ '722 N/A) show how little distance separates family members. Where '220 claims are patentably indistinct from '722 claims already cancelled, the outcome is largely preordained.
• No '220-specific PTAB challenge located. My searches surfaced IPRs against the '722 (IPR2018-01760/-01761, Cisco; IPR2019-01194 family), the '062, the '917 (IPR2022-01097, Keysight), the '856 (IPR2022-00182/-01151/-01199, Palo Alto/Cisco/Keysight), and the '126-lineage claims — but not an IPR expressly docketed on U.S. 11,792,220. That means the '220's specific claim set has not itself been adjudicated; the above conclusions are inferential from the family record, not a reported judgment.

---

9. Bottom line

1. Strongest §103 ground: Sourcefire alone. Its teachings (inline 3D Sensors; rule headers with IP criteria; drop/pass/alert rule actions; event logs carrying SID/msg and allow/block disposition; Defense Center GUI rule management; event aggregation) map onto the '220's independent claims under the Board's affirmed construction of "network-threat indicator." Substantively the same mapping already carried the day against the '722 at the Board and the Federal Circuit.
2. Secondary/backup ground: Sourcefire + Check Point R77 for the interface-driven operator reconfiguration ("block option") and the display of blocked-packet data — R77's SmartDashboard/SmartLog supply these as shown by the annotated demonstration in IPR2022-01199.
3. Third ground: Sourcefire + Applicant-Admitted Prior Art (subscription threat-intel reports listing network-threat indicators) renders the feed→rule automation obvious; the scoring/ordering dependent claims are obvious design choices (KSR; MPEP 2144.04) absent evidence of unexpected results, and were separately challenged on Sourcefire in a sibling proceeding.
4. Motivation is easy in every ground: same field, same problem, predictable combinations of known elements, explicit design incentive in the patent's own Background, and no teaching away.
5. The genuine risk to a §103 holding is objective indicia — specifically copying — as illustrated by the Federal Circuit's October 2025 vacatur and remand in the related '856 appeal. Any rigorous §103 conclusion on the '220 must confront that evidence, not just the reference mapping.
6. Two integrity caveats: (a) the "Prior Art section" of the page was not present in the supplied content, so the reference list above was reconstructed from the public family record; and (b) the exact granted claim numbering of US 11,792,220 was not available in-session and should be verified against the issued patent before any per-claim conclusion is relied upon.