US 9100428

I'll search for this patent and any related litigation.

Let me verify the claim set and check specifically for litigation.

One more check to pin down the claim set.

US Patent 9,100,428 — Analyst Summary

Scope note: I searched for the literal identifier 9100428 in USPTO-derived databases and Federal Circuit materials. I found no Federal Circuit (CAFC) appeal, docket entry, or 2026 CAFC decision referencing this patent. Statements below are grounded in the patent's own text (Google Patents full text) plus USPTO-derived bibliographic records; anything I could not verify is flagged explicitly.

---

1. Bibliographic data

Sources: https://patents.google.com/patent/US9100428/en ; https://www.freepatentsonline.com/9100428.html ; https://uspto.report/patent/grant/9100428

2. Abstract (verbatim)

"Systems and methods are presented for generating a threat score and a usage score of each of a plurality of IP addresses. The threat score may be determined based on quantity of occurrences and recency of each occurrence of an IP address in network alert datasets, in addition to a weighting factor for each data source indicating the accuracy of the data source."

3. Independent claims — plain-language overview

The patent's summary section recites three claim aspects (a threat-score system, a usage-score system, and a non-transitory computer-readable storage medium). Caveat: the authoritative full text I retrieved does not display numbered claim rows, so I cannot verify the claim numbers or the total claim count from that source. The three aspects below track the claim bodies as reproduced in the patent text.

Claim Aspect A — Threat-score system (computer system with processors + storage storing modules):

1. Determine an IP address for which a threat score is to be computed.
2. Access one or more data sources holding recorded network threat events, including date/time of each event, the originating IP address, and/or an event type.
3. Identify which data sources contain occurrences of that IP address, where each occurrence indicates a threat by that IP.
4. For each such data source, do three things: (a) count the quantity of occurrences of the IP in that source; (b) compute the recency of each occurrence, measured as the elapsed time between the occurrence and the current time; and (c) obtain a weighting factor for the data source indicating the expected accuracy of the occurrences it reports.
5. Compute the threat score based at least on the quantity of occurrences, the recency, and the data-source weighting.

Claim Aspect B — Usage-score system (processors + storage storing modules):

1. Determine an IP address for which a usage score is to be computed.
2. Access one or more data sources holding network usage datasets — recorded network usage events with date/time, originating IP address, and/or event type.
3. Identify which usage datasets contain occurrences of that IP, where each occurrence indicates usage by that IP (i.e., trusted activity rather than threat activity).
4. For each such source: count occurrences; compute recency (elapsed time between the event time and current time); obtain a weighting factor indicating the authority of the data source.
5. Compute the usage score from quantity, recency, and weighting.

Claim Aspect C — Non-transitory computer-readable storage medium (instructions for the threat-score process):
Same substantive steps as Aspect A — determine the IP; access threat-event data sources (date/time, originating IP, event type); find which sources contain occurrences of the IP; per source, compute quantity of occurrences, recency relative to current time, and a data-source weighting factor reflecting expected accuracy; then compute the threat score from those three inputs. (The summary also breaks off mid-recitation at "determine a weighting factor for each of the data sources.")

Key structural points common to all three: claims are drafted using "and/or" for the data fields (i.e., not all fields are necessarily required); the recency term is defined functionally (time between occurrence and "a current time"); and the score is a function of exactly the named factors "at least on" — leaving room for additional factors.

4. Supporting disclosure worth noting (not claim-verified)

• Weighting derivation: accuracy of a data source can be estimated by comparing overlapping reports across sources, or by checking reported threat IPs against later-confirmed threats; weight cᵢ may be an estimated percentage of that source's IPs actually involved in threats (a "signal-to-noise" ratio). Real-time or scheduled (e.g., nightly) recomputation is described.
• Combination example: two sources B1 and B2 each weighted 0.2 → (1−0.2)×(1−0.2)=0.64 chance of non-threat → threat score ≈ 0.36.
• Decay: exponential decay Dᵢ(t):=e^{c(t−t₀)}, plus constant, step, linear, Weibull, Hill, and smooth-compact decay options.
• Usage normalization: arctan-based normalization to bound the usage score between 0 and 1.
• Reporting: side-by-side threat/usage scores (e.g., IP 58.58.23.145 with threat 0.78 and usage 0.90), "bomb" risk ratings, and a two-dimensional heat map plotting threat score vs. usage score to surface high-threat/high-trust (likely false-positive) and high-threat/low-trust IPs.

5. Litigation / CAFC check and identified uncertainties

• No CAFC 2026 docket hit found for 9100428. My searches of Federal Circuit 2026 decision summaries and docket materials returned no case involving this patent number. I therefore cannot confirm or deny any appeal, IPR, or district-court action — absence of a hit in my searches is not proof that none exists.

• Identifier collisions (interpreted literally, not auto-corrected): searches for the bare string "9100428" also returned unrelated records that merely share the digits — e.g., JP 9100428 W (PCT/JP91/00428), PCT/FR 91/00428 (WO1991019174A1), and PCT/CA91/00428 (WO1992009254A1). These are different filings (Japanese/French/Canadian 1991 PCT applications) and have no relationship to US 9,100,428. I flag them so they are not conflated.

• Unverified items: (i) exact claim numbers (1, N, M) and total claim count; (ii) whether any dependent claims add limitations beyond the three recited aspects; (iii) current legal status and any pending reexamination/IPR, since the "Active" label is a database assumption rather than a legal conclusion; (iv) security-interest assignments recorded against the patent (Morgan Stanley Senior Funding, Royal Bank of Canada, Wells Fargo) are financing liens, not ownership transfers — Palantir Technologies Inc. remains the assignee of record.

I'll research litigation involving US 9,100,428 across patent litigation databases.

Let me search more targeted sources for this specific patent number.

Let me check PTAB, docket databases, and Unified Patents litigation records directly.

Litigation Search — US Patent 9,100,428

Bottom line

I found no litigation involving US 9,100,428. Across every source I was able to reach, the patent appears only as a bibliographic/prior-art record (assignee Palantir Technologies Inc.), never as an asserted patent in a district-court, ITC, PTAB, or Federal Circuit proceeding. This is consistent with the earlier-generated summary in this analysis, which likewise found no CAFC/2026 docket hit — I flag that as corroboration, not contradiction.

Note this is a negative finding from my searches, not a certified "no litigation exists" conclusion. See §4 for the verification limits.

---

1. Sources searched and what each returned

---

2. Litigation table

There are therefore no plaintiff/defendant/jurisdiction/case-number/filing-date/outcome entries to report. I will not populate this table with cases that do not name US 9,100,428.

---

3. Palantir matters I did find — and why they are NOT this patent

To be explicit so these are not conflated with 9,100,428:

• Palantir Technologies Inc. v. Abramowitz et al, N.D. Cal. No. 5:16-cv-05857 — patent ownership/inventorship and trade-secret dispute (remanded to state court; motion to remand granted Mar. 9, 2017). The patents at issue in the underlying dispute are not identified as US 9,100,428, and the cause of action was not infringement of this patent.
• Cupat v. Palantir Technologies Inc., D. Colo. No. 1:22-cv-02384 — securities class action, not patent litigation.
• Palantir Technologies, Inc. v. Jain, S.D.N.Y. No. 1:25-cv-08985 — confidential-information / employment dispute (sent to arbitration). Not a patent case.
• Palantir's own SEC filings (FY2024 20-F/ARS and 10-Qs) contain only generic indemnification/IP-risk boilerplate; they do not disclose any infringement action asserting 9,100,428.

None of these involves US 9,100,428 as an asserted patent.

---

4. Identifier collisions — do not conflate (interpreted literally)

Searches for the bare string 9100428 returned many unrelated records that merely share digits. Per the strict no-auto-correct rule, I list them so they are excluded:

• JP 9100428 W (PCT/JP91/00428) — 1991 Japanese PCT (physical-quantity/acceleration sensor).
• PCT/FR 91/00428 (WO1991019174A1) — 1991 French PCT (temperature-monitoring device).
• PCT/EP 91/00428 (WO1991013947A3) — 1991 EPO PCT (liquid-crystalline medium, Merck).
• PCT/GB 91/00428 (WO1991014743A1) — 1991 UK PCT (antifouling paint).
• MU 9100428-4 — Brazilian utility model (surgical trocar seal).
• "9100428" also appears as a fax number in Pakistan SECP filings (PSX documents, 2025) — a pure numeric collision.

None of these relate to US 9,100,428.

---

5. Confidence and limitations (candid assessment)

• What I can state with reasonable confidence: No litigation involving US 9,100,428 appears in the public patent-litigation and patent-record sources I could reach.
• What I cannot verify: I could not directly query PACER/CM-ECF, Docket Navigator, Lex Machina, or the Unified Patents Litigation Case List in a way that returned a definitive "no cases" result — my Unified Patents access returned the patent page but not a litigation list, and my CourtListener/PTAB searches returned only unrelated matters. Absence of a hit is not proof that no case exists, especially for (i) sealed or very recently filed complaints, (ii) ITC Section 337 investigations, (iii) foreign proceedings, or (iv) cases where the patent is asserted but the number is not OCR-searchable.
• Assignee posture: The recorded security-interest assignments (Morgan Stanley Senior Funding, Royal Bank of Canada, Wells Fargo) are financing liens, not ownership transfers; Palantir Technologies Inc. remains assignee of record. This is relevant context but does not itself generate litigation.

Recommended next steps to close the gap

1. Query PACER directly for "9,100,428" across all district courts (and the Federal Circuit CM/ECF).
2. Pull the Unified Patents Litigation Case List and search the patent's litigation history tab on the patent detail page.
3. Run Docket Navigator / Lex Machina "patents asserted" searches, plus PTAB (IPR/PGR/CBM) and ITC EDIS (Section 337).
4. Check the continuation family (US 9,560,066; US 10,230,746; US 10,805,321), since a related continuation — not the '428 itself — is more likely to be the asserted member of a family.

If any of those confirms a case, I can backfill the plaintiff/defendant/jurisdiction/case-number/filing-date/status table in §2.

I'll start by verifying the structured PTAB block against live sources, then check the patent family for related proceedings.

Let me run additional targeted checks — including Unified Patents (a common defensive aggregator) and the related family members.

PTAB / AIA Trial Analysis — US Patent 9,100,428

Bottom line up front: I found zero AIA trial proceedings on this patent. The structured "PTAB proceedings on file" block (USPTO Open Data Portal) is empty, and my independent web searching surfaced nothing that contradicts it. Every apparent "hit" for the string 9100428 or 9,100,428 traced back to an unrelated filing — details in the collision table below.

---

Proceedings overview

Zero AIA trial proceedings on file. Total count: 0 — no IPRs, no PGRs, no CBM reviews, no derivation proceedings, no institution decisions, no Final Written Decisions, and (consistent with the prior section's CAFC check) no appeals. Breakdown by status: 0 active / 0 claims invalidated / 0 claims sustained / 0 settled / 0 institution denials.

Defensive posture this gives a defendant: the patent is untested and unhardened and unweakened — a double-edged posture. There is no FWD to hand you a cancellation order, and no claim of the '428 patent has been canceled at the Board. Equally, there is no § 315(e)(2) estoppel on any party, and there is no Board claim construction, no institution-stage merits ruling, and no PTAB-authored obviousness record to leverage. As of 2026-09-27 the patent is a blank slate for PTAB purposes: whoever files first writes the record, and the § 315(b) one-year clock from service of an infringement complaint is the only structural constraint.

Verification status (read this before relying on it): the ODP-derived block in the prompt is the canonical list and reports no proceedings. My searches were run against Google Patents, FreePatentsOnline, USPTO-derived aggregators (uspto.report, Unified Patents portal), PTAB petition-hosting pages on ptacts.uspto.gov, Docket Alarm PTAB coverage, and general web search. Absence of a hit is not affirmative proof of absence — a very recently filed petition that has not yet been indexed, or one docketed under a party name I did not query, would not appear in my results. Treat the finding as high-confidence but not infallible.

---

Per-proceeding detail

None available. There is no proceeding number, petitioner, judge panel, institution decision, FWD, settlement, or appeal to report. I will not manufacture one. To make the negative finding auditable, here is what was checked and what it returned:

Identifier collisions — do not conflate these with US 9,100,428

Interpreted literally, the bare string 9100428 matches many unrelated records. None is a PTAB proceeding, and none has any relationship to US 9,100,428:

The one search result that looked like a PTAB petition ("Petitioner: VMware… real party-in-interest") concerns U.S. Patent 10,951,459 in Cirba v. VMware — a different patent, different owner, different technology. Ignore it.

---

Strategic summary

Claim-by-claim status: entirely UNTESTED. Because no AIA trial has ever been instituted, no claim of the '428 patent is CANCELED, and no claim is "SUSTAINED" in any PTAB sense. A "sustained" claim in PTAB parlance means a claim that survived a Final Written Decision — that has never happened here. The three claim aspects described in the earlier analysis (threat-score system; usage-score system; non-transitory CRM) remain in force in their original, as-granted form. There is likewise no certificate of correction, no disclaimer under 37 C.F.R. § 1.321, and no reexamination certificate that I located, so I have no basis to say the claim scope has been narrowed in any post-grant forum. Do not represent to a court that any claim has been narrowed or adjudicated.

Estoppel landscape: there is none, and that cuts for the defense. § 315(e)(1) and (e)(2) estoppel attach only to a petitioner that obtained a Final Written Decision under § 318(a). With zero FWDs, no party is estopped from anything, and no prior-art ground is foreclosed. A defendant filing today has the entire universe of § 102/§ 103 art available — including art that would otherwise have been "reasonably could have been raised" by an earlier petitioner. Practically, this means: (i) there is no Vivint-style "roadmap" concern in the other direction, because there is no prior Board decision to copy from, and (ii) conversely, there is no General Plastic second-bite history to worry about either, since no first bite has been taken. The patent's § 315(b) one-year window starts running from the date that particular defendant is served with a complaint alleging infringement.

Pattern signals: none. No petitioner has filed on this patent at all, let alone filed serially. Palantir Technologies, Inc. has not been an active PTAB patent owner on this family as far as my searching could determine (flag: unverified — I could not exhaustively search Palantir's full PTAB portfolio within this session). No defensive aggregator is in the chain — Unified Patents lists the '428 patent in its citation graph but sponsors no challenge against it. Palantir's appellate activity that surfaced was European (EPO Board of Appeal T 2496/17, decision 2020-05-06, Accessing spreadsheet objects / PALANTIR TECHNOLOGIES, remitted to first instance) — that is an EPO appeal, not a Federal Circuit appeal, and it involves a different, spreadsheet-related patent. Do not cite it as a U.S. appeal.

Family note (carry this into any assertion response): per the prior section, the earlier-issued-and-granted family includes US 9,560,066 B2, US 10,230,746 B2 ("System and Method for Evaluating Network Threats and Usage"), and US 10,805,321 B2. A plaintiff pressing this technology area may assert one of those instead of, or alongside, the '428 patent. I was not able to verify whether any of those family members has been subject to an AIA trial (search budget exhausted). This is the single highest-value open question and should be re-run against PTAB E2E before you finalize a defensive budget.

Availability caveat for 2026: the '428 patent has a 2014-01-03 priority date, so it is an AIA patent and is IPR-eligible. The PGR window (9 months from grant, i.e., expiring on or about 2016-05-04) closed years ago. CBM review is unavailable — the transitional CBM program sunset for new petitions on 2020-09-16, and in any event a network-security scoring patent would face a hard "technological invention" fight under § 42.301(b). IPR under § 311 is therefore the only realistic AIA avenue. (This paragraph is my own statutory/practice analysis, not a fact drawn from a cited source.)

---

Recommended next steps

1. No PTAB activity exists — say so plainly, and do not over-read it. The absence is a mild negative signal about the patent's commercial salience (well-asserted patents eventually attract IPRs) but it is not evidence of invalidity, and it is not evidence the patent is strong. It most likely means the patent has never been asserted in a campaign large enough to attract a third-party challenger.

2. Re-verify the null result against the authoritative systems before filing anything. Run the patent number through the PTAB E2E "Patent Trial" search at https://ptab.uspto.gov/ and the AIA trial statistics/Developer Hub API at https://developer.uspto.gov/, and confirm against CourtListener's RECAP docket search at https://www.courtlistener.com/?type=r&q=%229100428%22. This analysis is a search-based finding; it is not a substitute for a live E2E docket pull at filing time.

3. If a demand letter cites the '428 patent, the § 315(b) clock is your critical path. The deadline to petition is one year from the date you are served with a complaint alleging infringement of that patent (35 U.S.C. § 315(b)). Because no prior petitioner exists, you cannot seek joinder — you must carry your own petition, so budget for a full petition, not a joinder motion.

4. Prior-art scouting should focus on where the claims are weakest. Per the earlier claim analysis, the independent claims are drafted with "and/or" between the data fields (threat events, date/time, originating IP, event type) and the score is required to depend "at least on" quantity, recency, and a source weighting factor. The likely attack surface is § 103 over 2011–2013-era IP-reputation and SIEM/Splunk-class log-correlation art — e.g., the type of references already cited on the face of the patent (Ashley, Cooperative intrusion detection ecosystem for IP reputation-based security, US 2014/0059683; Stiansen, US 8,726,379; Splunk's Blacklisting and Whitelisting of Security-related Events, US 2013/0318604). The patent's own cited references are the natural starting set, and none has yet been tested by the Board. Note the priority date is 2014-01-03 (the underlying app. 14/147,402), which sets your § 102(b) art cutoff.

5. Do not cite any FWD, judge panel, or proceeding number in a brief for this patent. There is nothing to cite. If opposing counsel represents otherwise, demand the proceeding number and pull it from PTAB E2E — per the operating rules, identifiers are to be interpreted literally and not auto-corrected, and an asserted "IPR" number that resolves to a different patent is a fabrication signal.

6. Check whether a financing lien creates any standing or joinder wrinkle. The prior section notes security-interest assignments to Morgan Stanley Senior Funding, Royal Bank of Canada, and Wells Fargo. These are liens, not ownership transfers — Palantir Technologies Inc. remains patent owner of record and is the only proper respondent to a petition. Confirm current ownership on the USPTO Assignment recordation database immediately before filing so your mandatory notices under 37 C.F.R. § 42.8 are accurate.

7. Mirror the diligence on the family. Repeat steps 1–2 for US 9,560,066, US 10,230,746, and US 10,805,321. If a plaintiff pivots to a continuation after you file on the '428 patent, an unrun family check is the most likely way this analysis goes stale.

Unverified items (stated explicitly rather than guessed): whether any recently filed (post-indexing) petition exists; whether any family member has PTAB history; whether the patent has ever been subject to ex parte reexamination at the Central Reexamination Unit; and whether any district-court case has named it (the prior section found no CAFC activity, but I did not complete a district-court docket sweep in this session).

Key links for your own verification:

• Patent full text: https://patents.google.com/patent/US9100428/en
• USPTO PTAB E2E (case search): https://ptab.uspto.gov/
• USPTO Open Data Portal / Patent Trial APIs: https://developer.uspto.gov/
• CourtListener RECAP docket search: https://www.courtlistener.com/
• PTAB public petitions portal (captions & papers): https://ptacts.uspto.gov/ptacts/public-informations/

I'll search for the assignment records, including reel/frame data and correspondent information.

Good — I found a reel/frame lead for the Wells Fargo lien. Let me pin down the other recordings.

Assignment-Record Reconstruction — US 9,100,428 B1

Sourcing note (read first). I was not able to load the Assignment Center result page directly — assignmentcenter.uspto.gov / assignment.uspto.gov render as JavaScript applications that my retrieval could not execute, so I could not pull the reel/frame detail rows, execution dates, or correspondent fields for this patent. What follows is built from (a) the authoritative Google Patents legal-events text supplied in this analysis, (b) one cross-referenced reel/frame recovered from a sibling Palantir patent via a Dimensions record, and (c) SEC-filing context. Every field I could not verify is marked not retrieved. I have not invented any reel/frame, date, or attorney name.

---

Inventors

• Visbal is the sole named inventor. His Palantir affiliation is inferable from three converging facts: (i) the patent was assigned to Palantir; (ii) he is a co-inventor on US 8,832,832 "IP reputation" (Visbal et al.), a Palantir patent listed as prior art against this one; and (iii) the application is a continuation of Ser. No. 14/147,402, filed Jan. 3, 2014, i.e. a company-originated continuation, not a solo filing.
• Unusual-pattern check — unclear. I found no evidence of Visbal departing Palantir within 12 months of filing, and equally no evidence of continued employment. I cannot date his tenure from the records reachable here. I expressly decline to call a "fire-sale precursor" pattern on this record — a single inventor on a company continuation with no departure evidence is not a finding.
• No other inventors, no third-party co-owners, no government-interest statements surfaced.

---

Original assignee

Palantir Technologies Inc. — named on the issued patent and still the assignee of record today.

• Primary line of business: enterprise data-integration / analytics software for government and commercial customers (Foundry, Gotham, Apollo platforms). The '428 subject matter — IP reputation scoring, threat/usage scoring, and a threat-vs-usage heat map — sits in Palantir's cyber/network-security analytics line.
• Product embodying the claims: Palantir is unquestionably an operating company with shipped software and, since Sept. 30, 2020, a publicly traded one (NASDAQ: PLTR). I did not, however, verify that Palantir ever shipped a standalone IP-reputation product practicing claim 1 — so I mark "product embodying the claims" as operating company, yes; claim-practicing product, unverified.
• Current status: operating, publicly listed. Corporate address on later national-phase filings is 1200 17th Street, Floor 15, Denver, CO 80202 (relocated from Palo Alto, CA) — a change of address only, not a recorded change of name or ownership.
• No bankruptcy, no dissolution, no acquisition. Palantir has never filed Chapter 7/11 on this record.

---

Assignment timeline

All post-issuance entries below are recorded events from the Google Patents legal-events text; reel/frame is given only where I actually recovered it. Order is by recorded date.

2015-05-11 (executed not retrieved) / recorded 2015-05-11 — Reel not retrieved

• Conveyance: Assignment of assignors' interest ("see document for details")
• Assignor: VISBAL, ALEXANDER
• Assignee: PALANTIR TECHNOLOGIES, INC.
• Correspondent: not retrieved
• Context: The original inventor → company assignment; the only ownership transfer in the entire chain. Recordation ~8 months post-filing is unremarkable for a continuation.

2020-06-04 (executed not retrieved) / recorded 2020-01-27 — Reel not retrieved

• Conveyance: Security Interest (Security Agreement)
• Assignor: Palantir Technologies Inc.
• Assignee: Morgan Stanley Senior Funding, Inc., as Administrative Agent
• Correspondent: not retrieved
• Context: Securitization — collateral grant under Palantir's revolving credit facility. SEC 8-K context: the underlying Pledge and Security Agreement is dated Dec. 20, 2019, which lines up with a late-Jan. 2020 recording. Note the discrepancy: Google Patents shows both a 2020-01-27 and a 2020-06-04 Morgan Stanley security-interest entry; I could not resolve which execution date attaches to which recording.

2020-01-27 (executed not retrieved) / recorded 2020-01-27 — Reel not retrieved

• Conveyance: Security Interest (Security Agreement)
• Assignor: Palantir Technologies Inc.
• Assignee: Royal Bank of Canada, as Administrative Agent
• Correspondent: not retrieved
• Context: Securitization — concurrent collateral grant to a second administrative agent.

2020-06-04 (executed not retrieved) / recorded 2020-06-04 — Reel 052856 / 0382 ✅ (only reel/frame I recovered for this patent's chain)

• Conveyance: Release of Security Interest
• Assignor: ROYAL BANK OF CANADA
• Assignee: Palantir Technologies Inc.
• Correspondent: not retrieved
• Context: Securitization unwind — RBC's lien released, leaving Morgan Stanley as administrative agent. Reel/frame is confirmed indirectly: the corrective entry below cites "REEL 052856 FRAME 0382" as the release it corrects.

2021-08-26 (executed not retrieved) / recorded 2021-08-26 — Reel not retrieved (corrects 052856/0382)

• Conveyance: Corrective Assignment
• Assignor: ROYAL BANK OF CANADA
• Assignee: Palantir Technologies Inc.
• Correspondent: not retrieved
• Context: Administrative correction only — removes erroneously listed application no. 16/832,267 from the release previously recorded at reel 052856/0382. No change in ownership.

2022-07-03 (executed 2022-07-01) / recorded 2022-07-03 — Reel not retrieved

• Conveyance: Security Interest
• Assignor: Palantir Technologies Inc.
• Assignee: Wells Fargo Bank, N.A.
• Correspondent: not retrieved
• Context: Securitization / successor-agent substitution. SEC context corroborates: Amendment No. 13 to the Revolving Credit Agreement, dated July 1, 2022, names Wells Fargo as Administrative Agent "in its capacity as successor-in-interest to Morgan Stanley Senior Funding, Inc."

2022-07-03 (executed 2022-07-01) / recorded 2022-07-03 — Reel not retrieved

• Conveyance: Assignment of Intellectual Property Security Agreements
• Assignor: Morgan Stanley Senior Funding, Inc.
• Assignee: Wells Fargo Bank, N.A.
• Correspondent: not retrieved
• Context: Lien transfer — Morgan Stanley's IP security agreements formally moved to Wells Fargo as successor agent. Still not an ownership transfer.

Cross-reference (flag, not a finding for this patent): A sibling Palantir patent, US 10,152,531 B2, carries the Wells Fargo security interest at REEL/FRAME 060572/0506, effective 2022-07-01, recorded 2022-07-03 — the same effective and recording dates as the '428 Wells Fargo entry. Because these are blanket portfolio security agreements recorded once across many patents, 060572/0506 is very likely the reel/frame for the '428 lien as well — but I did not independently confirm that, so I do not assert it.

Net ownership finding: there is exactly one ownership assignment in the chain (2015, Visbal → Palantir). Everything after 2015 is a security interest, a release, an agent substitution, or a corrective. Palantir Technologies Inc. remains assignee of record.

---

Timeline diagram

timeline
    title Ownership and lien record US 9100428
    2014 : Filed by Palantir Technologies
    2015 : Patent issued Aug 4
         : Inventor assignment recorded May 11
    2020 : Morgan Stanley lien recorded
         : Royal Bank of Canada lien recorded
         : Royal Bank lien released
    2021 : Corrective assignment recorded Aug 26
    2022 : Wells Fargo lien recorded Jul 3
         : Morgan Stanley liens moved to Wells Fargo

---

NPE / troll-pattern signals

---

Verdict

Insufficient data — with the important qualifier that the insufficiency is narrow, and the NPE hypothesis is affirmatively disconfirmed on every testable axis.

• The only ownership transfer of record is the 2015-05-11 inventor→Palantir assignment; every later entry (2020-01-27, 2020-06-04 at reel 052856/0382, 2021-08-26, and 2022-07-03) is a security interest, its release, a corrective, or a successor-agent substitution — all financing liens, not conveyances of title. Palantir Technologies Inc. is still assignee of record, so the classic NPE chain (operating co → licensing LLC → asserter) does not exist here.
• The verdict is "Insufficient data" rather than a clean negative solely because I could not retrieve a single correspondent of record, and correspondents are the precise tell the NPE checklist depends on (Signal 3). Combined with zero identified litigation, I have no evidentiary basis to test recurrence.
• Flagged contradiction with the earlier section: the prior summary states the priority date as January 3, 2014 (per Google Patents), while the Unified Patents portal lists 2014-01-02 for US-9100428-B1. I note this rather than auto-correct it; it does not affect the assignment chain.

Verification links:

• USPTO Assignment Center: https://assignmentcenter.uspto.gov/
• USPTO Patent Assignment Search: https://assignment.uspto.gov/patent/index.html
• Google Patents record (source of the legal-events dates above): https://patents.google.com/patent/US9100428/en
• Sibling-patent reel/frame cross-reference (Wells Fargo 060572/0506): https://app.dimensions.ai/details/patent/US-[10152531](/patent/10152531)-B2

To close the gap: (1) pull the reel/frame detail rows for all seven entries in Assignment Center; (2) capture the correspondent of record on the 2015-05-11 assignment specifically; (3) confirm whether 060572/0506 is the reel/frame for the '428 Wells Fargo lien; (4) check the continuation family (US 9,560,066; US 10,230,746; US 10,805,321), whose chains may diverge from the '428's.

I'll search for the patent's citation records, since the full text I was given does not include the front-page reference lists.

Good — I found the reference list source. Let me pull the full citation lists (US patents, foreign, and non-patent literature) for US 9,100,428.

Let me retrieve the remainder of the reference list, including earlier US references, foreign documents, and other publications.

Prior Art / Cited-Reference Analysis — US 9,100,428 B1

Method and a candid limitation up front. I searched for the front-page reference lists of US 9,100,428 (the "References Cited" block: US patent documents, foreign documents, and other publications). The authoritative full text supplied for this analysis does not reproduce that block, so I pulled it from third-party renderings of the patent (FreePatentsOnline's 9100428.html, Justia, and USPTO-derived mirrors). The FreePatentsOnline listing was truncated in the results I could retrieve, and I hit the tool-call limit before completing the list. What follows is therefore a partial but verified-so-far citation set, not a certified-complete one. I flag extrapolations explicitly. Per the strict rule, all identifiers are reproduced literally and have not been auto-corrected.

Also flagged for consistency with the previously generated sections: those sections found no litigation and no PTAB proceeding on this patent, and noted that the full text exposes three claim aspects (A = threat-score system; B = usage-score system; C = non-transitory CRM). My § 102 mapping below uses those same three aspects, and I am not re-deriving them.

---

1. An important framing point: most cited references are not threat-scoring art

US 9,100,428 is a Palantir patent, and Palantir's boilerplate practice is to cite a large block of its own portfolio and unrelated data-visualization/risk references on the front page. Of the ~29 US references I recovered, only a handful are actually directed to IP reputation, intrusion detection, or malware/network-threat analysis — the rest are cohort-visualization, risk-management, spreadsheet, and process-control references that have no realistic bearing on the claims. I separate them below so the analysis is not diluted.

---

2. References cited on US 9,100,428 — the materially relevant subset

These are the cited references that could plausibly touch the claims. Dates given are the publication/issue date as listed; note the priority-date problem in § 4.

---

3. Cited references that are Palantir "housekeeping" / self-citations (not prior art to these claims)

These were also on the front page but are directed to unrelated technology, and several are Palantir's own patents/applications:

• US 8,832,594 B2 — Thompson et al. — "Space-optimized display of multi-column tables…" — 2014-09-09
• US 8,812,960 B2 — Sun et al. — "Cohort-based presentation of user interaction data" — 2014-08-19
• US 2014/0157172 A1 — Peery et al. — "Geographic layout of petroleum drilling data…" — 2014-06-05
• US 2014/0143009 A1 — Brice et al. — "Risk reward estimation for company-country pairs" — 2014-05-22
• US 8,707,185 B2 — Robinson et al. — "Dynamic information management system…live social networking…" — 2014-04-22
• US 2014/0108985 A1 — Scott et al. — "Configurable user displays in a process control system" — 2014-04-17
• US 2014/0108380 A1 — Gotz et al. — "Iterative refinement of cohorts using visual exploration…" — 2014-04-17
• US 2014/0068487 A1 — Steiger et al. — "…visualizing correlations between blood glucose data and events…" — 2014-03-06
• US 2014/0012796 A1 — Petersen et al. — "Advanced intelligence engine" — 2014-01-09
• US 8,589,273 B2 — Creeden et al. — "Methods and systems for managing risk management information" — 2013-11-19
• US 2013/0290825 A1 — Arndt et al. — "Switch control in report generation" — 2013-10-31
• US 2013/0282696 A1 — John et al. — "Interactive data exploration and visualization tool" — 2013-10-24
• US 2013/0238616 A1 — Rose et al. — "Detecting associates" — 2013-09-12
• US 8,484,115 B2 — Aymeloglu et al. — "Object-oriented time series generator" — 2013-07-09
• US 2013/0151453 A1 — Bhanot et al. — "Real-time predictive intelligence platform" — 2013-06-13
• US 2012/0323888 A1 — Osann, Jr. — "Automatic webpage characterization and search results annotation" — 2012-12-20
• US 2012/0254129 A1 — Wheeler et al. — "System and method for managing sensitive data using intelligent mobile agents on a network" — 2012-10-04
• US 2012/0221553 A1 — (title truncated in retrieval) — ~2012-08/09

None of these is a plausible § 102 reference to the threat-scoring/usage-scoring claims. They are visual-analytics and enterprise-data references.

---

4. The critical § 102 date problem, and why it changes the analysis

US 9,100,428 is an AIA patent. App. 14/479,863 was filed 2014-09-08 as a continuation of app. 14/147,402, filed 2014-01-03 (priority date). Because 14/147,402 was filed after March 16, 2013, AIA § 102 governs, and prior art must be "before the effective filing date," i.e., before 2014-01-03.

This creates a real problem for the on-point references:

• US 2014/0059683 A1 (Ashley) published 2014-02-27 and US 8,726,379 / US 2014/0366132 (Stiansen) issued/published 2014-05-13 / 2014-12-11 — all after the 2014-01-03 effective filing date. As publications/patents per se, they are therefore not § 102(a)(1) art. They can only qualify as § 102(a)(2) art (i.e., "effectively filed" earlier U.S. patents/applications) if their own effective filing dates pre-date 2014-01-03 — which I could not verify from the retrieved records and which must be checked on each reference's continuity data.
• US 8,832,832 (Visbal, "IP reputation") is by the same inventor and same assignee (Palantir). Under AIA § 102(b)(2)(C), a disclosure commonly owned at the time of filing is excepted from § 102(a)(2). It is therefore almost certainly not available as prior art against the '428 claims, despite being on topic.
• US 8,312,546 (Alme, 2012-11-13) and US 2013/0139268 (An, 2013-05-30) comfortably pre-date 2014-01-03 and are genuine § 102(a)(1) art — but as malware-detection and cross-domain-security-sharing references, they do not disclose the claimed combination (see § 5).

Bottom line on dates: the two or three most factually similar references are the hardest to use under § 102 because of the priority date, and the ones that clearly qualify on date are the least similar on subject matter.

---

5. § 102 mapping to the three claim aspects — honest assessment

The independent claims require, essentially: (i) access multiple data sources of recorded network threat events (date/time, originating IP, event type); (ii) identify sources containing the IP; (iii) per source, determine quantity of occurrences, recency measured against a current time, and a weighting factor for the source; and (iv) compute the threat score from at least those three inputs. Aspect B mirrors this with network usage data and a source "authority" weighting to yield a usage score.

I found no cited reference that, on the retrieved text, anticipates any independent claim 1:1 under § 102. The claimed novelty resides in the specific scoring combination — per-source occurrence count + recency relative to a current time + data-source weighting — plus the separate, independent usage score (Aspects A and B coexisting). The cited art at most touches isolated elements.

---

6. Things I could NOT verify (stated rather than guessed)

1. Complete citation list. The FreePatentsOnline "References Cited" block was truncated in retrieval; I show ~29 US references plus likely additional earlier references. A complete list should be pulled directly from the patent's PDF (front page, columns under "(56) References Cited") or the USPTO PatentCenter "References Cited" API.
2. Foreign references and "Other References" (NPL) on the '428 itself. I saw foreign/NPL blocks (e.g., CN 101729531; CN 103281301; EP 1962222; EP 2892197; EP 2897051; WO 2005010685; FireEye materials; Baker et al.; Crosby et al.; Lee et al.) attached to citing patents US 9,537,880 and US 9,407,652, not confirmed as on the '428. I cannot assert the '428's own foreign/NPL list.
3. Effective filing dates of Ashley and Stiansen — dispositive for whether they are § 102(a)(2) art. Unverified.
4. Which citations are examiner-cited vs. applicant-cited, and any § 102(b)(2)(C) common-ownership exceptions actually invoked during prosecution of 14/479,863.
5. Whether the "'428 is cited by" (forward citations) list — e.g., US 9,407,652, US 9,537,880, US 10,309,729, US 9,916,465, US 10,084,802, US 10,230,689 — was intended by the requester. Those are forward citations (later patents citing the '428), which are not prior art to the '428 and cannot anticipate it. Listed here only to prevent conflation.

---

7. Recommended next steps to make this analysis filing-grade

1. Pull the complete "(56) References Cited" block from the granted PDF (patentimages/USPTO), not a text mirror — that is the only authoritative source for the citation set.
2. For Ashley (2014/0059683) and Stiansen (8,726,379 / 2014/0366132), retrieve continuity data to fix their effective filing dates; only then can a § 102(a)(2) or § 103 theory be built on them.
3. Confirm common ownership/§ 102(b)(2)(C) treatment of the Visbal "IP reputation" (8,832,832) sibling.
4. Treat the visual-analytics references in § 3 as non-art for these claims; do not let them pad a § 103 combination.
5. Cross-check the family (US 9,560,066; US 10,230,746; US 10,805,321) — per the previous sections, an asserted/challenged member is more likely to be a continuation, and the prior-art posture should be run across the family.

Confidence: High that the citation block is dominated by non-analogous Palantir self-citations; high that no retrieved cited reference anticipates the independent claims; low/moderate on completeness of the list, on the '428's own foreign/NPL references, and on the § 102(a)(2) date positions of Ashley/Stiansen — all of which I have flagged rather than guessed.

I'll gather the prior-art references cited on the face of US 9,100,428 and in its family, since the earlier sections referenced them but did not enumerate them fully.

Let me pull the full references-cited list and the key family references.

Let me try to pin down the exact examiner-cited reference list on the '428 patent and check the closest family member's prosecution.

Obviousness Analysis — US 9,100,428 B1 under 35 U.S.C. § 103

Scope note on inputs. This section builds on the previously generated Patent Summary, Litigation Summary, and PTAB section (no litigation; no AIA trials; three independent claim aspects). I did not repeat their bibliographic/status content. Because the earlier sections did not enumerate a "Prior Art" list, I retrieved the examiner-cited references from the face of the '428 patent (US Patent References block at https://www.freepatentsonline.com/[9100428](/patent/9100428).html and https://patents.justia.com/patent/9100428) and pulled the substance of the three most probative references from their own records.

Two contradictions I must flag before proceeding:

1. Date conflict. This task states "Current Date: April 26, 2026." The operating rules at the top of this session state "Today's date is 2026-09-27," and the prior PTAB section expressly anchored to 2026-09-27. I have not auto-corrected either; I simply note that a statutory-deadline statement (e.g., § 315(b)) would need a settled date.
2. Unverified citation. The earlier PTAB section listed Splunk's US 2013/0318604 as appearing "on the face of the patent." I could not confirm that in the face-of-record list I retrieved. I treat it below as § 102(a)(1) prior art on its own publication date (it is published before the '428 priority date), not as a face-of-record citation. Flagging so the provenance isn't overstated.

---

1. Legal framework and the critical art-status question

The '428 patent has an effective filing date of January 3, 2014 (the earlier of the § 9/8/2014 continuation and the § 1/3/2014 parent, app. 14/147,402). That is after March 16, 2013, so the AIA § 102/§ 103 regime applies — not pre-AIA § 102. This matters enormously here, because several of the examiner-cited references published after the priority date and are only available as art under § 102(a)(2) ("effectively filed" U.S. patent/application publication).

Two art-status traps worth naming:

• Ashley and Stiansen are § 102(a)(2) art, not § 102(a)(1). Ashley published 2014-02-27 — seven weeks after the '428 priority date — so it cannot be a "printed publication" under § 102(a)(1). It is nonetheless available because it was effectively filed 2012-08-21. Same logic for US 8,726,379 (granted 2014-05-13, effectively filed 2011-07-15). Both remain fully usable in a § 103 combination; § 103 reaches § 102(a)(2) art so long as the § 102(b)(2)(C) common-ownership exception does not apply — and here the owners are IBM and Norse, not Palantir, so the exception does not apply.
• US 8,832,832 ("IP reputation," Visbal) is a Palantir-family reference. As § 102(a)(2) art it would be excepted under § 102(b)(2)(C) if the subject matter and the '428's claimed invention were commonly owned by Palantir as of the '428 effective filing date. I flag this as unverified — I did not confirm the ownership record as of 2014-01-03 — but it is the one cited reference most likely to be removed from the art set rather than added to it. Do not build a combination on it without confirming the assignment chain.

Governing standard. KSR Int'l Co. v. Teleflex Inc., 550 U.S. 398 (2007), controls: the inquiry is whether the claimed subject matter as a whole would have been obvious to a PHOSITA at the effective filing date, and a combination need not be taught by the references themselves where there was a known problem, a finite number of identified, predictable solutions, and a reasonable expectation of success. The MPEP 2143 rationales apply, principally: (A) combining prior art elements according to known methods; (B) simple substitution of a known element; (C) use of a known technique to improve a similar device in the same way; and (F) an express teaching, suggestion, or motivation in the art.

Posited PHOSITA. A person with a bachelor's degree in computer science or electrical engineering (or equivalent) and two to three years of experience in network security operations, SIEM/log-correlation platforms, or IP-reputation production systems — or equivalent practical experience. This is the level at which IP-reputation scoring, exponential decay of event relevance, and source-reliability weighting were all routine 2011–2013 techniques.

---

2. Claim construction points that shape the § 103 analysis

From the claim bodies reproduced in the earlier section and at https://uspto.report/patent/grant/9100428:

1. "and/or" between the data fields. Every independent aspect recites the data-source fields conjunctively-and-disjunctively: "a plurality of recorded network threat events, date and time of each..., an originating IP address for each..., and/or an event type of each...". Under the broadest reasonable reading, not every field must be present — a single source supplying just an IP and a timestamp suffices for that element.
2. "based at least on." The score is required to depend on at least quantity, recency, and weighting. This is open-ended: the patentee cannot escape prior art by showing the prior art score also used other inputs (severity, ISP, geography, port, ASN). Any additional-input argument is foreclosed by the claim's own "at least on" language.
3. "recency ... determined based on an amount of time between respective occurrences and a current time." Purely functional and fully met by any age-based decay or time-window computation. The specification itself concedes a menu of them (exponential, constant, step, linear, Weibull, Hill, smooth-compact) — i.e., the patentee treats decay-function choice as a design selection within a known genus, which is itself a § 103 concession.
4. "weighting factor ... indicating expected accuracy of respective occurrences ... of the data source" (Aspect A/C) vs. "indicating authority of each of the data sources" (Aspect B). Two labels for the same concept: a per-source reliability/trust multiplier. Different wording, same function.
5. Apparent drafting defect. The Aspect A/C limitation reads "indicating expected accuracy of respective occurrences indicated in the data source of the data source" in the text I retrieved. I have not auto-corrected this. If that duplication is in the granted claim, it is a § 112(b) issue, not a § 103 issue — but it is worth confirming against the USPTO-issued claim set, because it changes nothing about the art mapping.

---

3. What each core reference actually discloses (verified content only)

3.1 Stiansen, US 8,726,379 (Norse) — the threat-reputation core

Verified content (https://www.freepatentsonline.com/[8726379](/patent/8726379).html; https://patents.google.com/patent/US8726379; abstract summary at https://wiki.golden.com/wiki/US_Patent_8726379_Systems_and_methods_for_dynamic_protection_from_electronic_attacks-R94Y9D6):

• "Systems and methods for gathering, classifying, and evaluating real time security intelligence data concerning security threats presented by an IP address, and reporting in real time the degree and character of such security threats." → IP-address-specific scoring ("degree") plus event typing ("character"), computed in real time.
• Expressly frames the problem of blacklists and false positives: "it's not enough to blacklist a given IP Address; countermeasures must also be able to remove IP Addresses from the blacklist as they are recycled and assigned to new users presenting no threat or risk." → time-based aging of an IP's threat status.
• Expressly frames multi-tenant/shared-IP ambiguity: "a single IP Address assigned to a cable subscriber may actually represent transactions from multiple computers accessing the Internet through a shared gateway, some of which may be malicious, and others of which may not."
• Expressly frames context-dependence: "an IP Address that presents a risk for one type of transaction may present no risk at all for another type of transaction."
• Criticizes payload-signature approaches as reactive and urges proactive IP-level risk assessment over three billion simultaneously-assigned addresses.

Stiansen is, functionally, the threat-score half of the '428 claim set, plus the motivation for the usage-score half.

3.2 Ashley, US 2014/0059683 (IBM) — multi-source event aggregation

Verified content (https://patents.google.com/patent/US20140059683A1/en; https://portal.unifiedpatents.com/patents/patent/US-20140059683-A1):

• "An intrusion detection system (IDS) is enhanced to operate in a cluster of such systems, and IDSs organized into a cluster cooperate to exchange IP reputation influencing events information between or among the cooperating systems in real-time."
• "An IDS includes an IP reputation analytics engine to analyze new and existing events, correlate information, and to raise potential alerts," optionally via "a pattern matching algorithm, a continuous data mining algorithm, or the like."
• FIG. 13: "representative IP reputation influencing information that may be processed by an analytics engine"; FIG. 5 depicts a "known IP reputation service" that the disclosure builds upon.
• Stated benefit: "enhanced and early detection of threats that is much more reliable and scalable as compared to prior art techniques."

Ashley supplies: (a) multiple heterogeneous data sources carrying IP-identified threat events; (b) event weighting/relative influence on the resulting reputation ("influencing"); (c) an express motivation to improve reliability (i.e., reduce false positives) by aggregating across sources — and it expressly acknowledges the "known IP reputation service" as the starting point.

3.3 Coates/Splunk, US 2013/0318604 ("Blacklisting and whitelisting of security-related events") — quantity, time-stamping, and the trust/threat duality

Verified content (https://patents.google.com/patent/US20130318604A1/en; https://www.freepatentsonline.com/y2013/0318604.html; granted as US 9,276,946, the specification of which is reproduced at https://patentimages.storage.googleapis.com/f8/f9/78/7509e3921787bb/US9276946.pdf):

• Indexing machine data into "time stamped searchable events" that "include information relating to computer or network security."
• Field extraction of values (e.g., an IP field) "from a field in the indexed data using a schema," then correlation searches "of the time stamped searchable events using the one or more extracted values."
• Grouping events by "one or more fields in each of the events satisfying a criteria for a group of security-related events" — groups "indicative of a potential security threat."
• A summary "may include details including a count of the number of events in the group of security events" and "a metric representing a summary or calculation based on the count and/or one or more fields."
• The blacklist/whitelist duality: a "remove element … for removing ('whitelisting') a summary … to indicate that the summary and/or related groups of events are acceptable (e.g., do not pose a security threat)," and a "modify element … for modifying ('blacklisting') … to indicate that the summary and/or related groups of events pose a potential security threat."
• Time-period-based retrieval: "Events corresponding to a particular time period may be retrieved based on events having a time-stamp within the particular time period."

Coates/Splunk supplies: quantity ("count of the number of events"), event time-stamps enabling recency windows, IP field extraction across a corpus, and — critically — the art's own explicit two-sided characterization of the same IP's events as either threatening (blacklist) or acceptable (whitelist). That last item is the closest thing in the art to the '428's threat/usage duality.

---

4. Element-by-element mapping

4.1 Aspect A / Aspect C (threat score — the independent system and CRM claims)

Bottom line on Aspect A/C: strong § 103 case. Every element is individually disclosed, and the score-combining step is disclosed at exactly the level of generality the claim recites ("based at least on").

4.2 Aspect B (usage score)

Bottom line on Aspect B: moderate-to-strong. The specific dataset types (VPN logs, white lists, proxy logs) are admitted prior art in the '428's own specification, which is usable as an applicant admission. The remaining novelty is the label "usage score" and the arithmetic (a decayed weighted sum). The specification's normalization formula — Ŝ = (2/π)·arctan(kS_usage) — is a mathematical operation on historical event data, which is itself a § 103-vulnerability marker (a known statistical normalization applied to a known count).

---

5. Motivation to combine — why a PHOSITA would have done this

This is the crux, and the record supplies at least seven independent § 103 rationales, several of which come from the patentee's own mouth:

(a) Same field, same problem, same components (MPEP 2143(A)). Stiansen, Ashley, and Coates are all network-security event-correlation or IP-reputation references. Ashley itself builds on "a known IP reputation service" (FIG. 5) and seeks to make IP reputation "much more reliable." Coates is a SIEM platform indexing the same class of security events. Combining a reputation service (Stiansen/Ashley) with a log-indexing/counting engine (Coates) is the paradigm case of "arranging old elements according to known methods."

(b) The patentee's own Background supplies the motivation and concedes the problem. The '428 specification states: "Traditional IP address blacklists and whitelists have to be updated periodically and contain many false positives. Traditional methods of classifying an IP address as a threat can mistakenly classify IP addresses of employees and authorized users as threats." That is an admission that (i) blacklists and whitelists both existed, (ii) they were known to be updated over time, and (iii) they produced false positives specifically for employee/authorized-user IPs. A statement of the problem in the applicant's own specification is evidence of what a PHOSITA would have been motivated to solve. It also pre-supplies the two-sided threat/trust architecture: the reason you would compute a trust metric is that you already knew the threat metric mislabeled your own employees.

(c) Stiansen expressly identifies the false-positive mechanism the '428 claims to solve. Stiansen teaches that a shared/recycled IP "may actually represent transactions from multiple computers … some of which may be malicious, and others of which may not," and that an IP risky for one transaction "may present no risk at all for another." That is the motivation—stated in a § 102(a)(2) reference—to maintain a second, independent score representing legitimate/authorized usage, so that a high threat score does not automatically produce a block. Stiansen also expressly requires the ability to remove IPs from a blacklist as they are recycled, i.e., to age threat status over time — the recency element.

(d) Coates supplies the dual-label data model ready-made. Coates's blacklist/whitelist dichotomy is a binary version of the '428's threat-score/usage-score pair. Substituting a continuous, decay-weighted count for a binary whitelist flag is a simple substitution of a known element (MPEP 2143(B)) — and the '428's own claim language ("at least on") does not require more than the substitution.

(e) The named inputs are admitted to be conventional. The '428 specification lists its own data sources as an intrusion detection system, a firewall, a proxy server, and a VPN — the four canonical enterprise security log sources of 2013 — and lists VPN logs, white lists, and post-login weblogs as the usage-data sources. A PHOSITA would not regard "use a firewall log and a VPN log" as an inventive contribution.

(f) The scoring mathematics was a known, finite, predictable genus. Decay functions (exponential, step, linear, Weibull, Hill, smooth-compact) and reliability weighting were standard in reputation and trust systems by 2013; the '428 specification enumerates them as alternatives, which is a concession that the choice among them is a design selection. KSR holds that "if a technique has been used to improve one device, and a person of ordinary skill in the art would recognize that it would improve similar devices in the same way, using the technique is obvious."

(g) The combination yields predictable, expected results with no unexpected mechanism. Combining two independent weighted, decayed counts produces two independent scores — exactly the stated benefit (surfacing "high threat score and high usage score" IPs such as the specification's 58.58.23.145 / 127.165.4.2 examples). There is no teaching away, no criticality of any specific parameter, and no asserted unexpected result.

---

6. Named combinations that would render the claims obvious

Combination 1 (primary): Stiansen US 8,726,379 + Ashley US 2014/0059683 + Coates US 2013/0318604

• Stiansen → IP-level threat reputation, real-time evaluation, "degree and character" of threat, time-based aging of blacklist status, express false-positive/shared-IP motivation.
• Ashley → multi-data-source aggregation of IP reputation events, source-influence weighting, correlation engine, reliability motivation.
• Coates → time-stamped indexed security events, IP field extraction, per-group counts and count-derived metrics, and the blacklist/whitelist threat-vs-trusted duality.
• Result: every element of Aspect A and Aspect C, and (with the '428's admitted VPN/proxy/white-list sources supplying the usage datasets) every element of Aspect B. This is the strongest combination and the one I would lead with.

Combination 2: Stiansen '379 + Ashley '683 + Bhanot US 2013/0151453

Substitutes a "real-time predictive intelligence platform" for Coates to supply the scoring/weighting layer. Weaker on the quantity element (Bhanot's count-based metrics are less explicit than Coates's "count of the number of events in the group") — use as a secondary/backup combination.

Combination 3: Stiansen '379 + Coates '604 + the '428's own admitted art (VPN logs, proxy logs, white lists)

Focuses on the usage-score aspect (Aspect B) where the applicant admission is strongest.

Combination 4 (mapping/detection layer only): Stiansen '379 or Ashley '683 + Bishop US 2014/0123279 + Williamson US 8,646,080

Useful if the response argues the threat events are too generic. Bishop and Williamson are examiner-cited and dated before the priority date, but I did not verify their substantive content in this session — treat their precise teaching as an open verification item.

Do not build on US 8,832,832 ("IP reputation," Visbal). It is Palantir-family art and, as § 102(a)(2) art, is likely excepted under § 102(b)(2)(C). Confirm ownership as of 2014-01-03 before relying on it in either direction.

---

7. The strongest nonobviousness arguments — and how they fare

I state these candidly, because a § 103 conclusion that ignores them is not useful.

1. "No single reference, and no combination, teaches two independent scores."
   Response: Neither Aspect A nor Aspect B requires two scores — each is independently claimed. Aspect A is satisfied by Stiansen/Ashley/Coates alone. Aspect B, if separately asserted, requires only the threat/usage label distinction, which Coates's blacklist/whitelist and the '428's admitted VPN/white-list sources together supply. Separately claimed inventions must be separately invalidated, and each is separately vulnerable.

2. "The claim requires a data-source weighting based on expected accuracy, which is a specific derivation."
   Response: The limitation is result-oriented ("indicating expected accuracy"). Ashley's "influencing" weighting and Bhanot's predictive scoring address it. Note the specification itself computes cᵢ as a "signal-to-noise ratio" and kᵢ "based on how reliable a certain data source is" — a bare statistical ratio, which is the kind of routine calculation § 103 treats as within the skill level.

3. "The prior art doesn't teach decay of each occurrence individually."
   Response: Stiansen teaches real-time aging/removal of IPs from blacklists; Coates teaches re-querying events by time period. Applying a per-occurrence decay weight is the predictable application of a known technique, and the specification concedes the decay-function genus.

4. "Long-felt need / the blacklist false-positive problem persisted."
   Response: This cuts both ways. The '428's Background frames the problem as known and unsolved, which can support a long-felt-need narrative. But there is no evidence in the record I found of licensing, commercial success, industry praise, copying, or a nexus between any such evidence and the claimed features — and the prior sections establish zero litigation and zero AIA trials, which is weak evidence of commercial salience. Asserting long-felt need without nexus evidence will not carry the day.

5. § 112 / § 101 side issues (not § 103, but relevant to overall exposure). The Aspect A/C text's apparent duplicated phrase ("...in the data source of the data source") raises § 112(b); and the claims recite a computerized scoring algorithm over historical network data, which invites an Alice step-two attack. Neither helps the patent owner in a § 103 posture, and the § 101 issue should be tracked separately.

---

8. Residual uncertainty — state plainly, do not paper over

• I could not retrieve a complete, authoritative "References Cited" block for the '428 from a single canonical source (Google Patents' full-text rendering in this session does not expose the numbered claim rows or the (56) block; FreePatentsOnline and Justia each render partial lists that agree on the entries I cross-checked). The list in § 1 is assembled from those two sources and is likely, but not certainly, complete — in particular, the non-patent-literature portion of the '428's face is unverified. Note that the NPL items I surfaced ("Rapid: Reputation based approach for improving intrusion detection effectiveness"; FireEye/VirusTotal materials) came from other patents' (56) blocks (e.g., US 8,925,082; US 9,916,465; US 10,084,802) — do not attribute them to the '428 without checking.
• I did not independently verify the substantive disclosures of Bishop US 2014/0123279, Bhanot US 2013/0151453, Petersen US 2014/0012796, Williamson US 8,646,080, or the CN references. Treat their use in a combination as requiring a full-text pull and pinpoint citations.
• The Splunk reference's presence on the '428 face is unconfirmed (see the flag at the top). It remains § 102(a)(1) prior art regardless.
• The § 102(b)(2)(C) status of US 8,832,832 is unverified and is the single most likely reference to be removed from the art set.
• Claim-number and dependent-claim verification remains open (carried forward from the prior Patent Summary): I still cannot confirm the total claim count, the independent-claim numbering, or whether any dependent claim narrows the three aspects. A § 103 opinion that does not cover the dependent claims is incomplete — several dependent claims, if any, may recite the specific decay functions, the arctan normalization, or the heat-map reporting, each of which has its own (and different) art mapping.

Recommended verification steps before this analysis is used in any filing or opinion:

1. Pull the USPTO Patent Application Information Retrieval file wrapper (Public PAIR / Patent Center) for app. 14/479,863 to get the complete (56) list, the examiner's reasons for allowance, and any IDS — the reasons-for-allowance statement is the fastest route to knowing which limitation the examiner believed was not taught.
2. Confirm the assignment chain for US 8,832,832 as of 2014-01-03 (USPTO Assignment Search) to settle § 102(b)(2)(C).
3. Full-text pull Stiansen '379, Ashley '683, and Coates '604 with pinpoint column/figure citations, since my mapping above relies on abstracts, backgrounds, and specification excerpts rather than a verified column-by-column read.
4. Re-run the same § 103 analysis against the family members (US 9,560,066; US 10,230,746; US 10,805,321) — the prior PTAB section flagged family coverage as the highest-value open question, and different family members may carry different (and narrower) claims.