System and method for investigating large amounts of data

Information

  • Patent Grant
  • 11392550
  • Patent Number
    11,392,550
  • Date Filed
    Thursday, August 22, 2019
    5 years ago
  • Date Issued
    Tuesday, July 19, 2022
    2 years ago
Abstract
A data analysis system is proposed for providing fine-grained low latency access to high volume input data from possibly multiple heterogeneous input data sources. The input data is parsed, optionally transformed, indexed, and stored in a horizontally-scalable key-value data repository where it may be accessed using low latency searches. The input data may be compressed into blocks before being stored to minimize storage requirements. The results of searches present input data in its original form. The input data may include access logs, call data records (CDRs), e-mail messages, etc. The system allows a data analyst to efficiently identify information of interest in a very large dynamic data set up to multiple petabytes in size. Once information of interest has been identified, that subset of the large data set can be imported into a dedicated or specialized data analysis system for an additional in-depth investigation and contextual analysis.
Description
BACKGROUND OF THE DISCLOSURE

The present invention relates generally to computer-based data analysis. In particular, the present invention relates to computer systems and methods for investigating and analyzing large amounts of data such as, for example, transaction logs of bank, call data records (CDRs), computer network access logs, e-mail messages of a corporation, or other potentially high-volume data that may contain up to billions to trillions of records.


Today, corporations, businesses, governmental agencies, and other organizations collect huge amounts of data, covering everything from e-mail messages, fined-grained web traffic logs to blogs, forums, and wikis. At the same time, organizations have discovered the risks associated with the constantly-evolving cyber security threat. These risks take many forms, including exfiltration, cyber fraud, money laundering, and damage to reputations. In an attempt to reduce these risks, organizations have invested in custom information technology projects costing hundreds of millions of dollars to manage and analyze collected data. These projects typically involve the creation of a data warehouse system for aggregating and analyzing the data.


Data warehousing systems have existed for a number of years, but current data warehousing systems are ill-suited for today's investigation challenges for a number of reasons. These include:


1. Scale: inability to accommodate up to petabyte-scale data sets that include up to billions or trillions of data records.


2. High-latency searches: search results to investigative queries should be returned in a matter of seconds, not hours or days.


3. Data Silo-ing: lack of consolidation of an organization's relevant data; instead, data collected by the organization is distributed throughout multiple disparate database systems that are incapable of reciprocal operation with one another; investigative searches for information require submitting a sub-search to each of the separate systems and aggregating the search results, possibly in different data formats, requiring development of time-consuming and expensive custom information technology components.


4. Loss of original data: data cannot be accessed in its original form, instead transformed versions of the data are presented during analysis potentially causing loss of valuable context.


The present invention attempts to address these problems and others, facilitating low latency searches of very large and possibly dynamic data sets in which search results present matching data in an original form.


BRIEF SUMMARY OF THE DISCLOSURE

The appended claims may serve as a summary of the disclosure.





BRIEF DESCRIPTION OF THE DRAWINGS

The present invention is illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings and in which like reference numerals refer to similar elements and in which:



FIG. 1 illustrates an embodiment of the invention comprising a set of interconnected functional modules;



FIG. 2 illustrates an example operation of the parser of FIG. 1;



FIG. 3 illustrates an example operation of the transformer of FIG. 1;



FIG. 4 illustrates an example operation of the importer of FIG. 1;



FIG. 5 illustrates an example data model of the data repository of FIG. 1;



FIG. 6 illustrates yet another example data mode of the data repository of FIG. 1;



FIG. 7 illustrates yet another example data model of the data repository of FIG. 1



FIG. 8 is a flowchart illustrating logic for performing an example search using the system of FIG. 1;



FIG. 9 is a flowchart illustrating logic for performing another example search using the system of FIG. 1;



FIG. 10 is a block diagram of a computer system in which an embodiment of the invention may be implemented.





DETAILED DESCRIPTION OF PREFERRED EMBODIMENT(S)

In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid unnecessarily obscuring the present invention.


Several embodiments are described hereafter that can each be used independently of one another or with any combination of the other embodiments. However, any individual embodiment might not address any of the problems discussed above or might only address one of the problems discussed above. Some of the problems discussed above might not be fully addressed by any of the embodiments described herein. Although headings are provided, information related to a particular heading, but not found in the section having that heading, may also be found elsewhere in the specification.


Example embodiments will be described according to the following outline:


1.0 Functional Overview


2.0 Structural Overview

    • 2.1 Data Sources
    • 2.2 Distributed Key-Value Data Repository
    • 2.3 Exemplary Data Repository Data Model
    • 2.4 Adaptors
      • 2.4.1 Parser
      • 2.4.2 Transformer
      • 2.4.3 Importer
    • 3.0 Example Search Operation
      • 3.1 Example Single-Level Search
      • 3.2 Example Two-Level Search
    • 4.0 Example Implementing Mechanism


1.0 Functional Overview


According to some embodiments, the present invention aims to provide new and useful system implementing methods for investigating large amounts of data. The system is massively scalable, may operate on commodity hardware, and solves the problem of silo-ing of large-scale databases though the system's capability of ingesting data from disparate heterogeneous data sources in a single data repository that provides indexing and efficient searching of ingested data. The system is flexible in that it is agnostic with respect to data formats. The system is adaptive in that it facilitates data analyst-driven queries on an extremely large volume of data that is constantly being updated.


In general terms, the system uses a horizontally-scalable distributed key-value data repository to index data obtained from potentially multiple disparate data sources. Examples of data include, but are not limited to, network traffic and access logs, bank transaction records, call data records, e-mail messages, netflows, electronic blogs, forums, wikis, etc. More generally, data includes, but is not limited to, any character data that reflects an activity of an individual person or organization. The activity may be an online activity such as, for example, accessing a website, sending or receiving an e-mail, or making an online payment with a credit card or an offline activity such as, for example, using a key card to gain access to a building. Typically, but not always, data includes timestamps indicating when the activities took place.


The indexing process includes parsing the data to derive index keys from parse tokens, either using parse tokens as index keys or transforming parse tokens to use as index keys, or a combination of the two. At the same time, the process divides the data into relatively small data blocks, which may be compressed, and stored in the data repository keyed by an assigned identifier.


In some embodiments, the system supports at least two types of searches: single-level and two-level. Each of the two types has a corresponding indexing scheme. For both single-level searches and two-level searches, the data repository holds a “key-value family” mapping data block identifiers to blocks of data. As used herein, the term “key-value family” refers generally to an identifiable set of related key-value pairs in which keys are mapped to values. Within a key-value family, keys may be unique. A key may be mapped to more than one value and different keys may be mapped to different numbers of values. Both the keys and the values may an arbitrary byte sequences representing a string, a number, or binary data, for example.


In some embodiments, in a single-level search, a first key-value family maps keys derived from parse tokens to data block identifiers and a second key-value family maps data block identifiers to data blocks. To conduct a single-level search specifying search criterion, the system determines a set of one or more data block identifiers from the first key-value family that are keyed by a key that matches the search criterion. The determined set of data block identifiers are then used to determine a set of one or more data blocks from the second key-value family using the determined set of data block identifiers as keys to the second key-value family.


In some embodiments, a data block identifier in the first key-value family is supplemented with snippet identifying information identifying a byte sequential portion of the identified data block. The snippet identifying information may be a byte offset and a byte length, for example. Alternatively, the snippet identifying information may be, for example, line number information identifying line(s) of the identified data block. The system may return search results by (i) uncompressing the determined set of data blocks, if compressed; (ii) using the supplemental information to identify snippets in the uncompressed data blocks, and (iii) returning the identified snippets as search results. An example of a single level search is “all e-mail messages sent from or received by [X]” where [X] is the search-specified first criterion and may be an e-mail address or a person's name, for example.


In some embodiments, for a two-level search, an additional key-value family is used. A first key-value family maps keys to keys of a second key-value family. In other words, values of the first key-value family are keys of the second key-value family. The second key-value family in turn maps values of the first key-value family to data block identifiers; a third key-value family maps data block identifiers to data blocks.


In some embodiments, to conduct a two-level search specifying a first criterion and one or more second criteria, the system determines a set of one or more values from the first key-value family that are keyed by a key that matches the first criterion and that satisfy the second criteria. In other words, only values of that key that satisfy the second criteria are included in the set. The system then determines a set of data block identifiers from the second key-value family that are keyed by keys that match the set of values determined from the first key-value family. The determined set of data block identifiers are then used to determine a set of data blocks from the third key-value family. In some embodiments, a data block identifier in the second key-value family is supplemented with snippet identifying information. An example of a two-level search is “all e-mail messages sent by [X] in the past [Y] days” where [X] is the first criterion and [Y] is the second criteria.


In some embodiments, the keys are byte sequences derived from selected parse tokens of the input data. The parse tokens that are selected may vary depending on the type of data and the type of queries expected to be performed. For example, keys for e-mail messages may include sender and/or recipient e-mail addresses. As another example, keys for web accesses logs may include internet protocol (IP) address, uniform resource locators (URLs), etc.


In some embodiments, snippets of uncompressed data blocks are returned as results to searches thereby providing the data in its original form in the search results. For example, the results to the above example searches may return the contents of the actual e-mail messages.


In some embodiments, the system of the present invention enables organizations to leverage their existing investments in traditional computer-based data analysis systems which may be designed for specific investigative tasks or suited for specific types of data. More particularly, once information of interest has been uncovered by a search using the system of the present invention, that subset of the data can be incorporated into another data analysis system for additional in-depth investigation and contextual analysis. In effect, the system of the present invention can be used to filter a very large set of data to identify only that subset of the cyber set that requires further investigation and analysis without over-burdening or over-populating traditional, dedicated, or other data analysis systems with large amounts of data “noise”.


With regard to scalability, the system of the present invention may scale horizontally across commodity hardware to handle up to hundreds of terabytes to petabytes of data. The system may store the data in a compressed form for storage space efficiency and without needing to keep indexes in volatile memory. The system may be fault tolerant through replication across nodes and data centers and can be scaled without downtime.


In some embodiments, the system utilizes a distributed, “NoSQL” data repository to hold both the data and selective indexes. The data may be compressed into data blocks before being written to disk. High throughput import of data may be accomplished with in-memory write buffering and bulk serialization to disk. The system can provide low latency searches by its ability to scale horizontally across a number of computing nodes. In some embodiments, any node may be used to process searches.


Further, the indexing and searching solution of the present invention can operate where the data repository supports a limited set of query operations. In particular, the solution can operate where only equality and range query operations on keys and values are supported. Notably, the solution can effectively operate where wildcard operators, “like” operators, or regular-expression-based pattern matching query operators are not supported by the data repository.


In some embodiments, the system is agnostic to data format and can ingest virtually any type of structured data: from call data records (CDRs) to netflows to virtually any other data or file format.


Typical applications of the current invention include the investigation and analysis of extremely large amounts (e.g., hundreds of terabytes) of data of multiple heterogeneous data sources such as log files, e-mail message spools, transaction logs, call data records, etc. that might be found in a business, organization, governmental agency, school, university, hospital, etc. With the system of the present invention, a data analyst can investigate top-down trends, behaviors, and activities or bottom-up target centric analysis across a larger dataset.


The invention which includes both method and apparatus aspects (i.e., apparatus comprising respective means to perform the steps of the methods), may be embodied within various kinds of hardware including one or more general purpose computers such as the general purpose computer 1000 of FIG. 10.


2.0 Structural Overview


2.1 Data Sources



FIG. 1 shows the overall structure of an embodiment of the invention. Referring to FIG. 1, an organization may manage one or more data sources 101 that generate data, perhaps continuously or on an ongoing or periodic basis. Any sizeable organization typically will manage multiple data sources 101 that generate vast amounts of data. Example data sources 101 include databases, log files, transaction logs, call data records, access logs, netflows, authentication logs, authorization logs, e-mail message spools, and any other data container for data.


Data generated by data sources 101 includes, but is not limited to, any character data that reflects an activity of an individual person or organization. The activity may be an online activity such as, for example, accessing a website, sending or receiving an e-mail, or making an online payment with a credit card or an offline activity such as, for example, using a key card to gain access to a building. Typically, but not always, data includes timestamps indicating when the activities took place.


Typically, but not always, data generated by data sources 101 adheres to some sort of data structure or data format. For example, data stored in a database may adhere to a relational database structure or related schema. As another example, data in a log file may be formatted in eXtensible Markup Language (XML) or similar markup language. As yet another example, data may be formatted in plain-text (e.g., ASCII) with whitespace characters (e.g., tab, space, and newline characters) providing structure. Other data formats are possible and any machine-parse-able character-based data format is contemplated as being within the scope of the invention.


Data sources 101 of an organization may generate and collect extremely large amounts of data. Organizations would appreciate a way to efficiently sift through this data to quickly identify information of interest or information pertinent to a line of inquiry. The information of interest may be as fine-grained or finer-grained as, for example, a single e-mail message amongst hundreds of thousands or even millions of e-mail messages stored across multiple e-mail servers. The information of interest may not be known a priori. In other words, organizations may wish to pursue an investigative line of inquiry in which the data is iteratively searched until information of interest is revealed or discovered. In this case, searches of data that take hours or days to complete or that require submission of search queries to multiple data analysis systems would be inefficient. In one respect, organizations would appreciate a single tool that allows them to quickly find or discover the proverbial “needle in the haystack” in which a 100 byte snippet of a single web access log file, for example, is analogous to the needle and petabytes of data collected by hundreds of different heterogeneous data sources, for example, is analogous to the haystack.


To address the need to efficiently investigate and analyze large amounts of data, the system of FIG. 1 is proposed. The system includes a distributed key-value data repository 111, one or more adaptors 103, and a search mechanism 113 with a search interface 114. The data repository 111, the adaptor(s) 103, the search mechanism 113, and the search interface 114 may be interconnected to one another using any suitable data communication mechanism such as, for example, one or more data networks. The one or more data networks may include one or more local area networks (LANs), one or more wide area networks (WANs), or the Internet. The components of the system may be distributed across one or more computer systems such as the computer system 1000 of FIG. 10. Alternatively, some or all components may be embodied within a single computer system. When distributed across multiple computer systems, components may additionally be distributed geographically, for example, across one or more data centers.


2.2 Distributed Key-Value Data Repository


The distributed key-value data repository 111 may operate on a cluster of computing nodes 112. The nodes 112 of the cluster may be interconnected via a communication bus such as one or more local area data networks, one or more wide area data networks, the Internet, or other suitable data network or communication mechanism. In one embodiment, a node 112 is a server computer system comprised of commodity or readily-available hardware components running a server operating system such as a Microsoft Windows®-based, Unix-based, or Linux-based operating system for example. A node 112 may also be implemented by a virtual machine system or other software-based implementation of a computing device.


Very generally, data is stored in the data repository 111 as key-value pairs. The number of key-value pairs can amount to a very large data set up to hundreds of terabytes to even petabytes of data. To handle such size, the data repository 111 allows key-value pairs to be distributed across the nodes 112 of the cluster.


The data repository 111 may be decentralized. In some embodiments, every node 112 in the cluster performs the same function or functions. Key-value pairs may be distributed across nodes 112 of the cluster according to a key distribution scheme. Each key may have one or more master nodes 112 to which the key is assigned according to the key distribution scheme. Each node 112 may have partitioner logic that executes on the node 112 for carrying out the key distribution scheme. The partitioner logic of each node 112 of the cluster may distribute keys randomly across the nodes 112 using a consistent hashing technique, for example. Other key distribution schemes may be used by the nodes 112 and the present invention is not limited to any particular key distribution scheme.


In some embodiments, any node 112 in the cluster can receive and service a read or write request for any key, even if the requested key is mastered by other node(s) 112 in the cluster. To do so, the partitioner logic at the receiving node 112 determines, based on the requested key, which node(s) 112 in the cluster are the master node(s) 112 for the requested key and sends the request to one or more of the master node(s) 112. In the case where the node 112 receiving a request for a given key is not a master node 112 for that key, the node 112 receiving the request effectively acts a “proxy” node 112 for the key.


The data repository 111 may be elastic. A new node 112 can be added to the cluster without causing downtime to the existing nodes 112 in the cluster. As new nodes 112 are added, data repository access (reads and writes) throughput may be increased. New keys may be distributed across the new nodes 112.


The data repository 111 may be fault-tolerant. Key-value pairs can be replicated across multiple nodes 112 in the cluster so that for a given key, multiple nodes 112 are master nodes 112 for that key. Thus, the data repository 111 can prevent single points of failure. The data repository 111 or nodes 112 thereof may be replicated across multiple data centers or different geographical locations.


The data repository 111 may be eventually consistent (as opposed to strictly consistent) so that access (reads and writes) latency is kept to a minimum and so that the data repository 111 has a high availability in the event of node 112 failures. Thus, the data repository 111 need not be an (Atomic, Consistent, Isolated and Durable) ACID-compliant data store.


The data repository 111 may support a limited set of query operations on keys and values. In particular, the data repository 111 may support only equality (e.g., “=”) and range operations (e.g., “>=”, “>”, “<”, and “<=”) on keys and values. In some embodiments, searches are conducted on the data repository 111 using equality operators on keys and using equality and/or range operators on values.


The data repository 111 may provide high throughput import of data with in-memory write buffering and bulk serialization to non-volatile storage. As mentioned, a write of a key-value pair to the data repository 111 may be made at any node 112 in the cluster. For fault tolerance, the node 112 receiving the write may record the key-value pair to a local append-only commit log stored in a non-volatile memory of the receiving node 112. As an append-only log, this recordation is a fast operation requiring no disk seeking. The partitioner logic of the receiving node 112 then uses the key to determine the master node(s) 112 for the key. If the receiving node 112 is not a master node 112 for the key or not the only master node 112 for the key, then the receiving node 112 sends the write to the other master node(s) 112 for the key. Each node 112 in the cluster maintains a volatile memory table for collecting batches of key-value pair writes for which the node 112 is a master. Each node 112 periodically flushes its volatile-memory table to a non-volatile memory of the node 112 where the key-value pairs are permanently stored. The volatile memory table may be flushed to a non-volatile memory when the table is full, there are threshold number of key-value pairs in the table, on a set time interval, for example.


In some embodiments, the data repository 111 is implemented using the Apache Cassandra distributed database management system. Apache Cassandra is open source software maintained by the Apache Software Foundation and currently available online at the Internet domain cassandra.apache.org. In other embodiments, the data repository 111 is implemented using the Apache HBase distributed database management system. Apache HBase is open source software maintained by the Apache Software Foundation and current available online at the Internet domain hbase.apache.org. However, other distributed key-value data store systems may be used for the data repository 111 and the present invention is not limited to only the Apache Cassandra system or the Apache HBase system.


2.3 Exemplary Data Repository Data Model


Turning now to FIG. 5, therein is shown a block diagram of an exemplary data model 500 for the data repository 111 of FIG. 1. Very generally, the data model 500 contains one or more keyspaces 501 which in turn each contain one or more key-value families 502. A keyspace 501 is a named collection of related key-value families 502. The data repository 501 may contain multiple keyspaces 501. Each keyspace 501 may contain one or more key-value families 502.


A key-value family 502 is named set of related key-vale pairs. Key and values are variable length byte sequences. In many cases, the byte sequence of a key represents a character string such as, for example, an e-mail address. The string may be encoded according to a character encoding scheme (e.g., UTF-8). In many cases, the byte sequence of a value also represents a character string. In other cases, the byte sequence of a value represents raw binary data. The byte sequence of a key or value can also represent other data types such a numbers, date/times, etc.


Keys of a key-value family 502 may be unique. A key may map to more than one value and different keys may map to different numbers of values. For example, in the key-value family 502 of FIG. 5, “key1” maps to two values while “key2” maps to only one. The values of a key may be stored or arranged by the data repository 111 in a sorted order based on the values of the key.


Depending on the key distribution scheme employed by the data repository 111, keys of a key-value family 502 may be distributed across a number of nodes 112 of the data repository 111 cluster. Some keys of a key-value family 502 may be mastered on one node 112 while other keys of the key-value family 502 may be mastered on another node 112. More nodes 112 may be added to the cluster as the size (e.g., the number of keys) in a key-value family 502 grows. New keys added to the key-value family 502 may be mastered by the new nodes 112. A single key-value family 502 may contain up to billions of key-value pairs amounting to terabytes or even petabytes of data. In one embodiment, all values for a given key are mastered on the same node 112 that the given key is mastered. Thus, for a given key, one node 112 may master all of the values to which the key maps.


2.4 Adaptors


The adaptor(s) 103 are the mechanism by which input data 102 is ingested into the system and stored in the data repository 111. There may be an adaptor 103 for each type of data source 101. For example, the may be an adaptor 103 for ingesting input data 102 produced by a database system data source 101 and another adaptor 103 for a web access log data source 101. There may be separate adaptors 103 for separate instances of the same type of data source 103. For example, there may be one adaptor 103 for an instance of an e-mail server data source 101 in the Los Angeles office and another adaptor 103 for and another instance of an e-mail server data source 101 in the New York office. A single adaptor 103 may ingest input data 102 produced by multiple types or multiple instances of data sources 101. For example, a single adaptor 103 may ingest input data 102 produced by multiple database server data sources 101 or a database server data source 101 and a network access log data source 101. Thus, a one-to-one correspondence between adaptors 103 and data sources 101 is not required and one-to-many, many-to-one, or many-to-many configurations are possible across different types and different instances of data sources 101.


In this document the term “input data” is used to mean data that is presented as input to the system. That is, data that is obtained by an adaptor 103 from a data source 101 for processing and possible ingest into the data repository 111.


An adaptor 103 may obtain input data 102 through any number of means including receiving input data 102 from a data source 101 or retrieving input data 102 from a data source 101. If receiving, the adaptor 103 may, for example, receive the input data 102 in one or more network messages or event notifications. In this case, the adaptor 102 may have a network listener to which the data source 101 can connect and provide the network message or event notification. If retrieving, the adaptor 103 may, for example, periodically access or connect to a data source 101 to obtain input data 102 as a network client of the data source 101. Other techniques for obtaining input data 102 may be used according to the requirements of the implementation at hand. The present invention is not limited to any particular technique by which an adaptor 103 obtains input data 102.


However obtained, an adaptor 103 processes a stream of input data 102 as part of a data processing pipeline of the adaptor 103. The input to the data processing pipeline includes the stream of input data 102 obtained from one or more data sources 101. The output includes a stream of compressed or uncompressed blocks 105 of data 102 and a stream of key-value pairs 110 to be stored in the data repository 111.


In some embodiments, the data processing pipeline includes a parser 104, a transformer 107, and an importer 109. The parser produces the stream of data blocks 105 and a stream of parse tokens 106. The transformer 107 produces a stream of transformed parse tokens 108 from the stream of parse tokens 106 produced by the parser 104. The importer 109 produces the stream of key-value pairs 110 from the stream of transformed parse tokens 108 produced by the transformer 107.


The stream of input data 102 processed by an adaptor 103 may be obtained continuously or essentially continuously by the adaptor 103 as data sources 101 generate new data. For example, an adaptor 103 for a web access log file may obtain input data 102 as a web server process is writing to the log file. In this case where the stream of input data 102 is continuous or essentially continuous, the data repository 111 is also continuously or essentially continuously updated with new data blocks 105 and new key-value pairs 110. Old or stale data can be purged from the data repository 111 to effectively provide a rolling window of an organization's data. Alternatively, an adaptor 103 may be configured to obtain a fixed amount of data to create a snapshot of the organization's data in the repository 111. A combination of continuous/essentially continuous and fixed amount may be used as well. For example, some adaptors 103 may be configured to obtain input data 102 from data sources 101 continuously or essentially continuously while other adaptors 103 may be configured to obtain a set amount of input cyber 102 from other data sources 101.


As mentioned, in one embodiment, the data processing pipeline of an adaptor 103 includes a parser 104, a transformer 107, and an importer 109. It will be understood that these and other associated building blocks and components of an adaptor 103, may be configured as stand-alone logic elements, or may be combined together in one or more assemblies, as needed or appropriate for the particular implementation at hand. A logic element may be implemented in software, hardware, or combination of hardware and software.


2.4.1 Parser


One responsibility of the parser 104 is to divide the stream of input data 102 into discrete data blocks 105. The data blocks 105 are stored in the data repository 111 and indexed by the key-value pairs 110 stored in the data repository by the importer 109. How the parser 104 determines to divide the stream of input data 102 into data blocks 105 may vary depending on the type of the input data 102. A number of different strategies may be employed by the parser 104 to divide the input data 102 stream into data blocks 105. These strategies include, but are not limited to:


“logical data entity”. In this strategy, the parser 104 divides the input data 102 stream along identifiable logical data entity boundaries in the stream. A data block 105 is produced for each logical data entity in the stream. This strategy can be effective when the logical data entities are of a sufficient byte size. What is a sufficient byte size may vary depending on the optimal byte size range for storage of values in the key-value repository 111. For example, if the input data 102 stream is a stream of e-mail messages, then the parser 104 may produce a data block 105 for each e-mail message.


“byte count”. In this strategy, the parser 104 divides the input data 102 stream into uniform or essentially uniformly sized data blocks 105. This strategy may be effective when the logical data entities in the stream are relatively small. In this case, multiple logical data entities can be captured by the parser 104 in a single data block 105. For example, if the input data 102 stream is from a web access log file data source 101, each logical data entity of the log file (i.e., each web access log entry) may consist only of a few lines of text data. In this case, it may be more efficient for the parser 104 to bundle many logical data entities from the input data 102 stream in a single data block 105.


“combination”. The strategy involves a combination of the “logical data entity” strategy and the “byte count” strategy. In particular, the parser 104 determines the size of each logical data entity in the input data 102 stream. If the size exceeds a size threshold, then a data block 105 is produced for the logical data entity. If the size is less than the threshold, then the parser 104 collects a number of successive logical data entities from the stream until the threshold is exceeded at which point the parser 104 produces the collected logical data entities as a single data block 105.


Another responsibility of the parser 104 is to parse logical data entities in the input data 102 stream to produce parse tokens 106. Similar to how the parser 104 determines to divide the input data 102 stream into data blocks 105, what parse tokens 106 are produced by the parser 104 from a logical data entity may vary depending on the type of the input data 102. Further, the parse tokens 106 produced may vary depending on the expected lines of inquiry to be pursued with the system. For example, one line of inquiry might be to identify e-mail messages sent by person X in the past Z days. Another example line of inquiry might be to identify all systems that were accessed from a given internet protocol (IP) address. In the first example, each logical data entity may correspond to an e-mail message and the parser 104 may parse each e-mail message for the e-mail address of the sender and the e-mail address(es) of the recipient(s). The sender's and recipients' e-mail addresses may be produced by the parser 104 as parse tokens 106. In the second example, each logical data entity may correspond to an entry in a system access log and the parser 104 may parse the entry for the IP address of the accessing network peer logged in the entry.


Responsibilities and functions of the parser 104 of FIG. 1 will now be explained in greater detail with reference to FIG. 2. As shown, the parser obtains a stream of input data 102. The stream includes a series of logical data entities 201 with perhaps some breaks or gaps 202 in the stream between successive logical data entities 201. Depending on the data format of the input data 102, the parser 104 parses the input data 102 to identify the boundaries of logical data entities 201 in the stream. Generally, this involves identifying defined or known byte sequences in the input data 102 that indicate the boundaries. The byte sequences may be identified through a syntactical analysis of the stream. For example, if the input data 102 is from an access log file, then the byte sequences may correspond to a newline character or a newline character and carriage return character sequence. The parser 104 may use third-party Application Program Interfaces (APIs) or third-party software libraries to parse input data 102 and identify the logical data entities 201 therein. Break or gap data 202 may be discarded by the parser 104.


As the parser 104 identifies logical data entities 201 in the input data 102, the parser 104 groups them into data block items 203. The parser 104 sends a stream of data block items 203 to the data repository 111 for storage, for example, by issuing and sending database commands to the data repository 111. Each data block item 203 may include a key-value family identifier 204, a data block identifier 205, and a data block 105. The format and type of the logical data entities 201 of a data block 105 may vary depending on the type of the input data 102. For example, a logical data entity 201 may be an e-mail message, a log file entry, a call data record, a netflow record, or any other logical data entity of data.


The key-value family identifier 204 identifies the key-value family 502 in the data repository 111 in which the data block identifier 205 and the data block 105 of the data block item 203 is to be stored as a key-value pair. The data block identifier 205 is the key and the data block 105 is the value of the key-value pair. Although not shown, the data block item 203 may also include a keyspace identifier to identify the keyspace 501 that contains the key-value family 502 identified by the key-value family identifier 204. Alternatively, the parser 104 may have specified a keyspace 501 to the data repository 111 in a previous communication with the data repository 111 such as, for example, when establishing a networking session with the data repository 111.


The data block identifier 205 is used to identify the associated data block 105 in the data repository 111. The data block identifier 205 may be any byte sequence suitable for uniquely identifying the associated data block 105 within the data repository 111, or within a keyspace 501 as the case may be. For example, the data block identifier 205 may be a universally unique identifier (UUID) or generated by applying a MD5, SHA, or similar cryptographic hash algorithm to the associated data block 105. Other types of identifiers may be used and the present invention is not limited to any particular type of data block identifier.


The data block 105 of a data block item 203 may be compressed by the parser 104. Any suitable lossless data compression algorithm may be used for this purpose (e.g., GNU Zip). Alternatively, the parser 104 may send data blocks 105 to the data repository 111 uncompressed where they are compressed by the data repository 111, effectively delegating compression of the data blocks 105 to the data repository 111. In either case, data blocks 105 are preferably stored in the data repository 111 in a compressed form for efficient use of data repository 111 non-volatile memory storage space. However, data blocks 105 may be stored in the data repository 111 in an uncompressed form if desired.


The parser 104 also produces a stream of parse items 206 from the input data 102. The parser 104 provides the stream of parse items 206 to the transformer 107. The parser 104 may produce a parse item 206 for one or more logical data entities 201 in the input data 102 stream. Thus, a parse item 206 may be associated with one or more corresponding logical data entities 201 from the input data 102 stream.


As shown, a parse item 206 may include, among other information, a data block identifier 205 and one or more parse tokens 106. The parser 104 may have extracted the one or more parse tokens 106 from the one or more logical data entities 201 corresponding to the parse item 206. The data block identifier 205 may identify the data block 105 containing the one or more corresponding logical data entities 201. The parser 104 may generate one or more parse items 206 for the same data block 105.


In some embodiments, a parse item 206 additionally specifies snippet identifying information 207. For example, the snippet identifying information 207 may be a byte offset into an uncompressed data block 105 and a byte length. The byte offset and the byte length may identify a snippet (byte sequential portion) of the uncompressed data block 105. For example, the byte offset may be a numerical value identifying a number of bytes from a beginning of the uncompressed data block 105. The next byte length number of bytes of the uncompressed data block 105 constitutes the snippet. As another example, the snippet identifying information 207 may identify a line number or line number(s) of the uncompressed data block 105 that constitute the snippet. The snippet may be all of, some of, or a portion of the one or more logical data entities 201 corresponding to the parse item 206. Other information in a parse token item 206 may include a keyspace 501 identifier.


Parse tokens 106 identified in the input data 102 are selected byte sequences of the input data 102 identified by the parser 104. Which byte sequences are selected may vary depending on the type of logical data entities 201 of the input data 102 and/or the expected searches to be conducted on the input data 102 using the system. For example, for a Simple Mail Transport Protocol (SMTP)-based e-mail message, the parse tokens 106 may include the header values from the SMTP header of the e-mail message (e.g., the “Received:”, “Date:”, “To:”, “From:”, “Sender:”, and “Subject:” headers). If, for example, the system will be used to search on e-mail subject, then the value of the “Subject:” header may be further tokenized by the parser 104 to separate each word of the subject into individual parse tokens 106. Alternatively, the entire subject of the e-mail message may be treated as a single parse token 106. Other parse tokens 206 may be selected for e-mail messages or for different types of input data 102.


2.4.2 Transformer


An adaptor 103 may include a transformer 107 for optionally transforming parse tokens 106 produced by the parser 104. Such transforming may include, but is not limited to:


“Canonicalization”. Parse tokens 106 representing values that have multiple possible representations may be transformed into a standardized or normalized format. For example, string values may be converted to all lowercase characters. As another example, time and date values may be converted into a string representing a numerical value representing a number of time units (e.g., milliseconds) since an epoch.


“Concatenation”. One parse token 106 may be appended to another parse token 106 to produce yet another concatenated parse token. When appending parse tokens 106 together to form a concatenated parse token, delimiters (e.g., whitespace characters or other special byte sequences) may be introduced so that the individual constituent parse tokens 106 are identifiable in the concatenated parse token.


“Truncation”. The beginning or end portion of parse token 106 may be removed.


“Lookup”. A parse token 106 may be replaced with or concatenated with another byte sequence retrieved from a data dictionary, an external database, etc. using the original parse token 106 as a key to the data dictionary, external database, etc. The original parse token 106 is provided by the transformer 107 to the data dictionary, external database, etc. and in return receives a byte sequence to use in place of the original parse token 106 or to concatenate with the original parse token 106.


“Conversion”. A parse token 106 may be converted from one data format to another. For example, a non-ASCII string may be converted to UTF-8.


The above are just examples of some of the types of the transformations the transformer 107 may perform on parse tokens 106. Other types of transformation are possible and the transformer 107 is not limited to only those transformations discussed above.



FIG. 3 illustrates an example operation of the transformer 107 of FIG. 1. As shown, the transformer 107 obtains a stream of parse items 206 from the parser 104. From the input stream of parse items 206 the transformer 107 produces an output stream of parse items 206 which includes zero or more transformed parse tokens 108. In particular, each output parse item 206 corresponds to an input parse item 106 in which none, some, or all of the parse tokens 106 of the input parse data item 206 have been transformed by the transformer 107. Thus, an output parse item 206 may contain the same, fewer, or more parse tokens than its corresponding input parse item 206 may include one or more parse tokens 106 received from the parser 104 that the transformer 107 did not transform. In the example shown in FIG. 3, one output parse item 206 contains at least one transformed parse token 108.


2.4.3 Importer


One responsibility of the importer 109 is to store the parse tokens 106 and/or transformed parse tokens 108 in the data repository 111 in a manner that indexes the data blocks 105. As will be explained in greater detail below, a data analyst may then conduct a search on the indexes to find snippets of data blocks 105 of interest. How the importer 109 organizes the indexes typically will be dictated by the expected searches to be conducted using the indexes. As mentioned previously, in some embodiments, at least two types of searches are supported by the system of the present invention: single-level searches and two-level searches. Each type of search may have a corresponding data model in the data repository 111 that supports it. Before describing an example operation of the importer 109, exemplary data models supporting single-level searches and two-level searches will be described.


Single-Level Search:


Referring now to FIG. 6, according to some embodiments, in the data model 600 supporting a single-level search, a first key-value family 602A maps keys derived from parse tokens 106/108 to data block identifiers 205 and a second key-value family 602B maps the data block identifiers 205 to data blocks 105.


In some embodiments, to conduct a single-level search specifying search criterion using this data model 600, the search mechanism 113 determines a set of one or more data block identifiers 205 from the first key-value family 602A that are keyed by a key that matches the search criterion. The determined set of data block identifiers 205 are then used to determine a set of one or more data blocks 105 from the second key-value family 602B using the determined set of data block identifiers 205 as keys to the second key-value family 502.


In some embodiments, a data block identifier 205 in the first key-value family 602A may be supplemented with snippet identifying information 207 identifying a snippet of the identified data block 105. The search mechanism 113 may then return search results by (i) uncompressing the determined set of data blocks 105, if compressed; (ii) using the supplemental snippet identifying information 207 to identify snippets in the uncompressed data blocks 105, and (iii) returning the identified snippets as search results.


In some embodiments, a first key-value family 602A contains key-value pairs 110 produced by one or more adaptor(s) 103. Recall that a key of a key-value family can have more than one value. In the data model 600, each value of a key of the first key-value family 602A may “point” 601 to a data block 105 from which the key was derived by an adaptor 103. As an example, if the keys of the first key-value family 602A are sender e-mail addresses obtained from a set of e-mail messages, then a key in the first key-value family 602A may map to multiple values, one value, for example, for each e-mail message of the set of e-mail messages sent from a particular e-mail address. Each value in the first key-value family 602A in this case for example may point 601 to a data block 105 containing the corresponding e-mail message.


In some embodiments, the value of a key-value pair 110 in the first key-value family 602A is a composite value comprising a data block identifier 205 and snippet identifying information 207 identifying a snippet of the uncompressed data block 105 identified by the data block identifier 205. In some embodiments, this snippet is returned as a search result. For example, the snippet may be an e-mail message, a log entry, a call data record (CDR), or other logical data entity of data.


In some embodiments, the second key-value family 602B contains data blocks 105 produced one or more adaptor(s) 103. Keys of the second key-value family 602B may be data block identifiers 205. Values of the second key-value family 602B may be data blocks 105, either compressed or uncompressed. In some embodiments, each key in the second key-value family 602B maps to only one data block 105.


Two-Level Search:


Referring now to FIG. 7, according to some embodiments, in the data model 700 supporting a two-level search, an additional key-value family is used. A first key-value family 702A maps keys to keys of a second key-value family 702B. In other words, values of the first key-value family 702A are keys of the second key-value family 702B. The second key-value family 70B in turn maps values of the first key-value family 702A to data block identifiers 205. A third key-value family 702C maps data block identifiers 205 to data blocks 105.


According to some embodiments, to conduct a two-level search specifying a first criterion and one or more second criteria using this data model 700, the search mechanism 113 determines a set of one or more values from the first key-value family 702A that are keyed by a key that matches the first criterion and that satisfy the second criteria. In other words, only values of that key that satisfy the second criteria are included in the set. The search mechanism 113 then determines a set of one or more data block identifiers 205 from the second key-value family 702B that are keyed by keys that match the set of values determined from the first key-value family 702A. The determined set of data block identifiers 205 are then used to determine a set of data blocks 105 from the third key-value family 702C. In some embodiments, a data block identifier 205 in the second key-value family 702B is supplemented with snippet identifying information 207 identifying a snippet of the identified data block 105. An example of a two-level search is “all e-mail messages sent by [X] in the past [Y] days” where [X] is the first criterion and [Y] is the second criteria.


In some embodiments, the first key-value family 702A contains key-value pairs 110 produced by one or more adaptor(s) 103. A key in the first key-value family 702A may map to one or more values. Each value of a key in the first key-value family 702A may “point” 701 to a key of a second key-family 702B. That is, a value of a key in the first key-value family 702A may match a key in the second key-value family 702B.


In some embodiments, the second key-value family 702B contains key-value pairs 110 produced by one or more adaptor(s) 103. Keys of the second key-value family 702B may match values of the first key-value family 702A. Keys in the second key-value family 702B may map to one or more values. A value of a key in the second key-value family 702B may “point” 601 to a data block 105. In some embodiments, a value of a key in the second key-value family 702B is a composite value comprising a data block identifier 205 and snippet identifying information 207 identifying a snippet of the uncompressed data block 105 identified by the data block identifier 205.


Importer—Example Detailed Operation:


Turning now to FIG. 4, therein is shown an example operation of the importer 109 of FIG. 1 according to one or more embodiments of the invention. As shown, the importer 109 may receive as input a stream of parse items 206 from the transformer 107. Each received parse item 206 may contain a data block identifier 205, snippet identifying information 207, and/or one or more parse tokens 106 and/or one or more transformed parse tokens 108 (not shown). As output, the importer 109 may produce a stream of key-value pair items 401 from the input stream of parse items 206. Each key-value pair item 401 may include a key-value family identifier 402 and a key-value pair 110 consisting of a key 403 and a value 404. The importer 109 may send the stream of key-value pair items 401 to the data repository 111 to be stored therein, for example, as part of a series of database commands.


How the importer 109 forms and generates key-value pairs 110 from the input stream of parse items 206 will depend on the expected searches to be performed.


In some embodiments, for single-level searches specifying a search criterion, one key-value pair item 401 is produced by the importer 109 for each input parse item 206. Referring to the exemplary single-level search data model 600 of FIG. 6, the key-value pair item 401 contains the key-value family identifier 402 of the key-value family 602A to which the key-value pair 110 of the key-value item 401 is to be added. The key 403 of the key-value item 401 is generated from parse tokens 106 and/or 108 of the input parse item 206 based on how the keys of the key-value family 602A will be searched using the search criterion of the single-level search. For example, if the search criterion will be a text string such as, for example, a person's name, an e-mail address, and IP address, etc., then the key 403 of each key-value item 401 may be a byte sequence representing a string formed by the importer 109 from parse tokens 106 and/or transformed parse tokens 108. The value 404 of the key-value item 401 may be generated from the data block identifier 205 and the snippet identifying information 207 of the input parse item 206 to form a composite data block identifier value such as the one shown in FIG. 6.


In some embodiments, for single-level searches, multiple key-value pair items 401 may be produced by the importer 109 for an input parse item 206. In this case, the key-value family identifier 402 and the value 404 of the key-value pair 110 may be the same for each of the multiple key-value pair items 401. However, the key 403 of the key-value pair 110 may be different for each of the multiple key-value pair items 401 produced for the input parse item 206. Producing multiple key-value pair items 401 for an input parse item 206 may be useful for indexing in the data repository 111 by multiple keys 403, the same snippet of the data block 105 identified by the data block identifier 205 of the input parse item 206. For example, for an input parse item 206 with a parse token 106 “john.smith@example.com”, the importer 109 could, for example, produce three key-value pair items 401 one with a key 403 of “john.smith”, another with a key 403 of “john smith”, and yet another with a key 403 of “john.smith@example.com”. Thus, a search criterion of any of “john.smith”, “john smith”, or “john.smith@example.com” may produce the same data block 105 snippet as a search result.


In some embodiments, for two level searches specifying a first search criterion and one or more second search criteria, two key-value pair items 401 are produced by the importer 109 for an input parse item 206. Referring to the exemplary single-level search data model 700 of FIG. 7, for two-level searches, the importer 109 produces a first key-value pair item 401 containing the key-value family identifier 402 of the first key-value family 702A and produces a second key-value pair item 401 containing the key-value family identifier 402 of the second key-value family 702B. The key 403 of the first key-value item 401 may be generated from parse tokens 106 and/or 108 of the input parse item 206 based on how the keys of the first key-value family 702A will be searched using the first search criterion of the two-level search. The value 404 may be generated based on the key 403 and parse tokens 106 and/or 108 of the input parse item 206 based on how the values of the first key-value family 702A will be searched using the second search criteria.


For example, assume the system will be used to search for “all e-mail addresses sent by [x] within the past [y] days” where [x] is the first search criterion and [y] is the second search criteria. Given an e-mail message with SMTP headers that specify that the message was sent from “John Smith <john.smith@example.com>” on “Thu, 23 Aug. 2010 18:58:04+0000”, the importer 109 may produce a first key-value pair item 401 with a key 403 of “john.smith@example.com” and a value 404 of “john.smith@example.com_1282589884” where the portion of the value “1282589884” is a fixed-width string representing the number of seconds since an epoch of Jan. 1, 1970 GMT that the e-mail message was sent. Formatting the date/time in this way facilitates range searches based on the second search criteria. For example, all e-mail messages sent by “john.smith@example.com” sent in the past five days can be found by searching for key-value pairs 110 in the first key-value family 702A where the key equals “john.smith@example.com” and the value is greater than or equal to “john.smith@example.com_<SECONDS>” where <SECONDS> is a fixed-width string representing the number of seconds since the epoch five days ago from a time the search was requested or performed. Note that the underscore character ‘_’ used in the example value 404 “john.smith@example.com_1282589884” is an arbitrary delimiter separating the e-mail address from the time value and other delimiters or no delimiters could be used. For example, the value could just as easily be “john.smith@example.com#1282589884” or “john.smith@example.com1282589884”.


The key 403 of the second key-value item 401 may be the value 404 of the first key-value item 401 such that the key-value pair 110 of the first key-value item 401 to be stored in the first key-value family 702A points 701 to the key-value pair of the second key-value item 401 to be stored in the second key-value family 702B. Returning to the example in the previous paragraph, the key 403 of the second key-value item 401 for the e-mail message may be “john.smith@example.com_1282589884”. The value 404 of the second key-value item 401 may be generated from the data block identifier 205 and the snippet identifying information 207 of the input parse item 206 to form a composite data block identifier value such as the one shown in FIG. 7. For example, the value 404 of the second key-value item 401 may point 601 to the data block 105 stored in the third key-value family 702C containing the e-mail message sent by John Smith on Thu, 23 Aug. 2010 18:58:04 GMT.


In some embodiments, as with single-level searches, in two-level searches, multiple first key-value pair items 401 may be produced by the importer 109 for an input parse item 206. In this case, the key-value pairs 110 of each of the multiple first key-value pair items 401 may be different from one another. For example, returning again to the e-mail message example above, three first key-value pair items 401 with three different key-value pairs 110 may be generated by the importer 109 as follows:


key=“john.smith@example.com”; value=“john.smith@example.com_1282589884”


key=“john.smith”; value=“john.smith_1282589884”


key=“john smith”; value=“john smith_1282589884”


These three key-value pairs 110 may then be stored by the importer 109 in the first key-value family 702A. Three corresponding key-value pairs 110 may be stored by the importer 109 in the second key-value family 702B in which each key matches a value of one of the three key-value pairs 110 above stored in the first key-value family 702A. Note that if John Smith has sent many e-mail messages, then each of the keys for John Smith in the first key-value family 702A (e.g., “john.smith@example.com”, “john.smith”, and “john smith”) might each have multiple values, one for each message he sent.


3.0 Example Search Operation


With the above description in mind, and with reference to FIGS. 1-7, example search operations of the system of FIG. 1 in accordance with some embodiments will now be described. In the following description, it will be assumed for the sake of illustration that the search functionality is provided by a combination of the search mechanism 113 and the data repository 111. However, this is just one possible implementation. Other implementations where the search functionality is provided entirely by the data repository 111 or a combination of the data repository 111, the search mechanism 113, and one or more other system component(s) are also possible. All such implementations are within the scope of the invention.


The search mechanism 113 may be implemented in software, hardware, or a combination of software and hardware. The GUI 114 may be a stand-alone component communicatively coupled to the search mechanism 113, for example via a data network or other communication bus. Alternatively, the GUI 114 may be a component of the search mechanism 113, for example as part of a desktop computer application. In either case, the search mechanism 113 may be communicatively coupled to one or more nodes 112 of the data repository 111, for example via a data network.


The search mechanism 113 receives as input a set of search parameters and provides as output a set of search results. The set of search parameters may be provided to the search mechanism 113 by a data analyst through the GUI 114, for example. The set of search results of are obtained from the data repository 111 by the search mechanism 113 based on the input set of search parameters. In some embodiments, the set of search parameters may be for one of two types of searches: (1) a single-level search, or (2) a two-level search. Because search functionality may be carried out differently depending on whether the set of search parameters are for a single-level search or a two-level search, the search functionality will be described separately for each type of search. For the sake of simplicity, the following description presents a single-level search operation and a two-level search operation including example search parameters. However, it should be understood that single-level searches and two-level searches specifying other search parameters are supported.


3.1 Example Single-Level Search Operation


Turning now to FIG. 8, therein is shown a flow diagram of a process 800 for carrying out a single-level search in accordance with one or more embodiments of the invention. Initially, the search mechanism 113 obtains (block 801) a search criterion. Generally, the search criterion is a byte sequence that will be used by the search mechanism 113 as a key to the first key-value family 602A of the data repository 111. The search criterion may be derived by the search mechanism 113 from search parameter(s). Such derivation may include transformation, canonicalization, formatting, conversion, or encoding of the search parameter(s). The search parameter(s) may be submitted to the search mechanism 113 by a data analyst through the GUI 114. Alternatively, the search parameter(s) may be submitted to the search mechanism 113 by a computerized agent or network client. The search criterion may, for example, be a UTF-8 encoded character string derived from a search parameter submitted to the search mechanism 113 by a data analyst through a search interface of the GUI 114.


Next, the search mechanism 113 uses (block 802) the search criterion to obtain one or more values from the first key-value family 602A. In particular, the search mechanism 113 submits a search request to a node 112 of the data repository 111. The search request is for some or all of the values of the key, if there is one, of the first key-value family 602A that matches (equals) the search criterion. Recall that all keys of a key-value family may be unique at least within that key-value family. Further, recall that a key of a first key-value family may have more than one value. Assuming a key matching the search criterion exists in the first key-value family 602A, then the search request is expected to obtain one or more values to which that key is mapped in the first key-value family 602A. In some embodiments, at least one of the one or more values comprises a data block identifier 205. In some embodiments, at least one of the one or more values comprises snippet identifying information 207 identifying a snippet of an uncompressed data block 105.


In some embodiments, the search request specifies a cap on the number of values to obtain. In particular, a key matching the search criterion may map in the first key-value family 602A to thousands, millions, or even billions of values. Thus, it may be impractical or inefficient for the search mechanism 113 to obtain all values for the key in a single search request. Instead, the search request specifies a number of values for the key to obtain. This number may correspond roughly to the number of search results that the GUI 114 will display at any one time, for example.


In some embodiments, values for the key that matches the search criterion are obtained by the search mechanism 113 in one or more batches. This is done to avoid having to retrieve and materialize all or a large number of values for the key (which could number into the millions or even billions of values) in a volatile memory of the search mechanism 113. This batching technique can be used where the values for the key are stored in the data repository 111 in a sorted order such that ranges or slices of ordered values can be iteratively retrieved from the data repository 111. This batching technique operates generally as follows:


1. A first search request is submitted to a node 112 of the data repository 111 requesting the first N number of values of the key of the first-key value family 602A matching the search criterion. This returns a first set of up to N values in a sorted order.


2. If the first set of values contains N values, then there may be more values to obtain. To do so, a second search request is submitted but this time requesting a next number of values of the key that are greater than the last value in the first set of values.


3. Further search requests may be submitted to obtain successive batches of values, each requesting some number of values of the key that are greater than the last value in the immediately previously obtained batch of values.


This batching technique may be used, for example, as the data analyst requests successive pages of search results through the GUI 114.


Next, the search mechanism 113 uses (block 803) the one or more values obtained from the first key-value family 602A to obtain one or more data blocks 105 from the second key-value family 602B. In some embodiments, the search mechanism 113 submits a search request to a node 112 of the data repository 111 for each value of the one or more values obtained from the first key-value family 602A. Each such search request specifies a data block identifier 205 as a key to the second key-value family 602A. The data block identifier 205 is obtained or derived from the corresponding value of the one or more values obtained from the first key-value family 602A for which the search request is being submitted. As a result, the search mechanism 113 obtains one or more data blocks 105 from the second key-value family 602B, one for each of the one or more values obtained from the first key-value family 602A.


A data block 105 obtained from the second key-value family 602B may be compressed or uncompressed. If compressed, the search mechanism 113 uncompresses (block 804) the data block 105 to produce a corresponding uncompressed data block 105. As a result, the search mechanism 113 obtains and/or produces one or more uncompressed data blocks 105 corresponding to the one or more data blocks 105 obtained from the second key-value family 602B.


Next, the search mechanism 113 uses (block 805) the one or more values obtained from the first key-value family 602A to identify one or more portions of the one or more uncompressed data blocks 105. As mentioned, a value from the first key-value family 602A may be encoded with snippet identifying information 207 identifying a snippet (byte sequential portion) of an uncompressed data block 105. The snippet may, for example, correspond to a logical data entity 201 (e.g., an e-mail message, a log entry, a call data record, a netflow, etc.) of the uncompressed data block 105.


Next, the search mechanism 113 returns (block 806) the one or more identified portions of the one or more uncompressed data blocks as search results. For example, the one or more identified portions may be presented by the search mechanism 113 in the GUI 114. The search results containing the one or more identified portions may be returned by the search mechanism 113 in any suitable data format (e.g., XML, HTML, etc.).


3.2 Example Two-Level Search


Turning now to FIG. 9, therein is shown a flow diagram of a process 900 for carrying out a two-level search in accordance with one or more embodiments of the invention. Initially, the search mechanism 113 obtains (block 901) a first search criterion and one or more second search criteria. Generally, the first search criterion is a byte sequence that will be used by the search mechanism 113 as a key to the first key-value family 702A of the data repository 111. Each of the second search criteria may also be a byte sequence and is used by the search mechanism 113 as a predicate on the values of that key in the first key-value family 702A.


The first search criterion may be derived by the search mechanism 113 from search parameter(s). Such derivation may include transformation, canonicalization, formatting, conversion, or encoding of search parameter(s). The search parameter(s) may be submitted to the search mechanism 113 by a data analyst through the GUI 114. Alternatively, the search parameter(s) may be submitted to the search mechanism 113 by a computerized agent or network client. The first search criterion may, for example, be a UTF-8 encoded character string derived from a search parameter submitted to the search mechanism 113 by a data analyst through a search interface of the GUI 114.


The second search criteria may also be derived by the search mechanism 113 from search parameter(s). The derivation may also include transformation, canonicalization, formatting, conversion, or encoding of search parameter(s). In addition, a search criterion of the one or more second search criteria may be derived in part based on the first search criterion and search parameter(s). Specifically, the search mechanism 113 may derive a second search criterion based on how the values of the first key-value family 702A were populated by adaptor(s) 103. For example, assume a two-level search of “all network access from network address [X] in the past [Y] days”. In this case, an adaptor(s) 103 may have populated the keys of the first key-value family 702A with network addresses and populated the first key-family 702B with values of the form “<network address>_<milliseconds since epoch>” where <network address> is the key for this value and <milliseconds since epoch> is a fixed-width string representing the date/time the associated network address made a network access. In this case, the search mechanism 113 may generate a second search criterion by appending a value derived from a search parameter for [Y] to the first search criterion separated by an underscore character ‘_’. The value derived from the search parameter [Y] might, for example, be a fixed-width string representing a date/time in the past specified by the search parameter.


As mentioned, the search mechanism 113 uses (block 902) the second search criteria as a predicate on the values of the key in the first key-value family 702A that matches (equals) the first search criterion to obtain one or more first values of that key. Recall that the values of a key in the first key-value family 702A may be stored in a sorted order in the data repository 111. Returning the example in the previous paragraph, the values of a key might be stored in increasing order of date/time as determined by the fixed-width string portion of the value representing a time in milliseconds since an epoch. The search mechanism 113 may use the second search criteria to select individual value(s), slice(s) of values, or a combination of individual value(s) and slice(s) of values. Individual values may be selected using an equality operation. Slices of values may be selected using a greater than, greater than or equal to, less then, or less than or equal to operation. The number of second search criteria that the search mechanism 113 uses will depend on the particulars of the two-level search. For example, the example two-level search in the previous paragraph, the search mechanism may use only one second search criterion in conjunction with a greater than operation or a greater than or equal to operation to determine the values of a key corresponding network accesses from a given network address in the past [Y] days. As another example, the search mechanism 113 might use two second search criterion to specify a bounded time range in the past for a two-level search like “all network access from network address [X] between date/time: [Y] and date/time: [Z]”.


When using (block 902) the first search criterion and the one or more second search criteria to obtain one or more first values from the first key-value family 702A, the search mechanism 113 may employ the batching strategy described above with respect to the single-level search.


Assuming a key matching the first search criterion exists in the first key-value family 702A, then the search mechanism 113 obtains (block 902), from the first-key value family 702A, one or more first values of that key that satisfy the one or more second criteria. In some embodiments, at least one of the one or more first values comprises a key to the second key-value family 702B.


Next, the search mechanism 113 uses (block 903) the one or more first values obtained from the first key-value family 702A to obtain one or more second values from the second key-value family 702B. In some embodiments, the search mechanism 113 submits a search request to a node 112 of the data repository 111 for each value of the one or more first values obtained from the first key-value family 702A. Each such search request specifies a value of the one or more first values as a key to the second key-value family 702A. As a result, the search mechanism 113 obtains one or more second values from the second key-value family 702B, one for each of the one or more first values obtained from the first key-value family 702A.


Next, the search mechanism 113 uses (block 904) the one or more second values obtained from the second key-value family 702B to obtain one or more data blocks 105 from the third key-value family 70CB. In some embodiments, the search mechanism 113 submits a search request to a node 112 of the data repository 111 for each value of the one or more second values obtained from the second key-value family 702B. Each such search request specifies a data block identifier 205 as a key to the third key-value family 702C. The data block identifier 205 is obtained or derived from the corresponding value of the one or more second values obtained from the second key-value family 702B for which the search request is being submitted. As a result, the search mechanism 113 obtains one or more data blocks 105 from the third key-value family 702C, one for each of the one or more values obtained from the second key-value family 702B.


A data block 105 obtained from the third key-value family 702C may be compressed or uncompressed. If compressed, the search mechanism 113 uncompresses the data block 105 to produce a corresponding uncompressed data block 105. As a result, the search mechanism 113 obtains and/or produces one or more uncompressed data blocks 105 corresponding to the one or more data blocks 105 obtained from the third key-value family 702C.


Next, the search mechanism 113 uses the one or more second values obtained from the second key-value family 702B to identify one or more portions of the one or more uncompressed data blocks 105. As mentioned, a value from the second key-value family 7B02A may be encoded with snippet identifying information 207 identifying a snippet (byte sequential portion) of an uncompressed data block 105.


Next, the search mechanism 113 returns (block 905) the one or more identified portions of the one or more uncompressed data blocks 105 as search results.


While the above description and accompanying flowcharts describe or depict steps being performed in a certain order. It will be apparent that steps may be performed in a different order or concurrently without departing from the spirit and scope of the invention. For example, if the batching technique is used, then one or more of steps 803-806 may be performed on an already obtained batch of values from the first key-value family 602A concurrently while step 802 is performed to obtain the next batch of values. Similarly, one or more of steps 903-905 may be performed concurrently with step 902. As another example, requests to obtain data blocks 105 from the data repository 111 as in steps 803 and 904 may be made concurrently. Requests of step 903 to obtain values from the second key-value family 702B may be made concurrently. Decompressing multiple compressed values as in step 804 may also be performed concurrently.


4.0 Example Implementing Mechanism


According to one embodiment, the techniques described herein are implemented by one or more special-purpose computing devices. The special-purpose computing devices may be hard-wired to perform the techniques, or may include digital electronic devices such as one or more application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are persistently programmed to perform the techniques, or may include one or more general purpose hardware processors programmed to perform the techniques pursuant to program instructions in firmware, memory, other storage, or a combination. Such special-purpose computing devices may also combine custom hard-wired logic, ASICs, or FPGAs with custom programming to accomplish the techniques. The special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices or any other device that incorporates hard-wired and/or program logic to implement the techniques.


For example, FIG. 10 is a block diagram that illustrates a computer system 1000 upon which an embodiment may be implemented. Computer system 1000 includes a bus 1002 or other communication mechanism for communicating information, and a hardware processor 1004 coupled with bus 1002 for processing information. Hardware processor 1004 may be, for example, a general purpose microprocessor.


Computer system 1000 also includes a main memory 1006, such as a random access memory (RAM) or other dynamic storage device, coupled to bus 1002 for storing information and instructions to be executed by processor 1004. Main memory 1006 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 1004. Such instructions, when stored in storage media accessible to processor 1004, render computer system 1000 into a special-purpose machine that is customized to perform the operations specified in the instructions.


Computer system 1000 further includes a read only memory (ROM) 1008 or other static storage device coupled to bus 1002 for storing static information and instructions for processor 1004. A storage device 1010, such as a magnetic disk or optical disk, is provided and coupled to bus 1002 for storing information and instructions.


Computer system 1000 may be coupled via bus 1002 to a display 1012, such as a cathode ray tube (CRT), for displaying information to a computer user. An input device 1014, including alphanumeric and other keys, is coupled to bus 1002 for communicating information and command selections to processor 1004. Another type of user input device is cursor control 1016, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor 1004 and for controlling cursor movement on display 1012. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.


Computer system 1000 may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and/or program logic which in combination with the computer system causes or programs computer system 1000 to be a special-purpose machine. According to one embodiment, the techniques herein are performed by computer system 1000 in response to processor 1004 executing one or more sequences of one or more instructions contained in main memory 1006. Such instructions may be read into main memory 1006 from another storage medium, such as storage device 1010. Execution of the sequences of instructions contained in main memory 1006 causes processor 1004 to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions.


The term “non-transitory media” as used herein refers to any media that store data and/or instructions that cause a machine to operation in a specific fashion. Such non-transitory media may comprise non-volatile media and/or volatile media. Non-volatile media includes, for example, optical or magnetic disks, such as storage device 1010. Volatile media includes dynamic memory, such as main memory 1006. Common forms of non-transitory media include, for example, a floppy disk, a flexible disk, hard disk, solid state drive, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge.


Non-transitory media is distinct from but may be used in conjunction with transmission media. Transmission media participates in transferring information between non-transitory media. For example, transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus 1002. Transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infra-red data communications.


Various forms of media may be involved in carrying one or more sequences of one or more instructions to processor 1004 for execution. For example, the instructions may initially be carried on a magnetic disk or solid state drive of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system 1000 can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal. An infra-red detector can receive the data carried in the infra-red signal and appropriate circuitry can place the data on bus 1002. Bus 1002 carries the data to main memory 1006, from which processor 1004 retrieves and executes the instructions. The instructions received by main memory 1006 may optionally be stored on storage device 1010 either before or after execution by processor 1004.


Computer system 1000 also includes a communication interface 1018 coupled to bus 1002. Communication interface 1018 provides a two-way data communication coupling to a network link 1020 that is connected to a local network 1022. For example, communication interface 1018 may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communication interface 1018 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, communication interface 1018 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.


Network link 1020 typically provides data communication through one or more networks to other data devices. For example, network link 1020 may provide a connection through local network 1022 to a host computer 1024 or to data equipment operated by an Internet Service Provider (ISP) 1026. ISP 1026 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet” 1028. Local network 1022 and Internet 1028 both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on network link 1020 and through communication interface 1018, which carry the digital data to and from computer system 1000, are example forms of transmission media.


Computer system 1000 can send messages and receive data, including program code, through the network(s), network link 1020 and communication interface 1018. In the Internet example, a server 1030 might transmit a requested code for an application program through Internet 1028, ISP 1026, local network 1022 and communication interface 1018.


The received code may be executed by processor 1004 as it is received, and/or stored in storage device 1010, or other non-volatile storage for later execution.


In the foregoing specification, embodiments have been described with reference to numerous specific details that may vary from implementation to implementation. Thus, the sole and exclusive indicator of what is the invention, and is intended by the applicants to be the invention, is the set of claims that issue from this application, in the specific form in which such claims issue, including any subsequent correction. Any definitions expressly set forth herein for terms contained in such claims shall govern the meaning of such terms as used in the claims. Hence, no limitation, element, property, feature, advantage or attribute that is not expressly recited in a claim should limit the scope of such claim in any way. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

Claims
  • 1. A computer-implemented method comprising: receiving a stream of input data;parsing the input data to identify boundaries of logical data entities in the stream of input data;generating a block item comprising a key-value family identifier, a data block identifier, and a data block based on a logical data entity of the logical data entities, comprising: compressing the data block; andstoring the key-value family identifier in association with a key-value pair comprising the data block identifier as a key of the key-value pair and the compressed data block as a value of the key-value pair;creating and storing a parse item comprising the data block identifier and one or more parse tokens for indexing block items.
  • 2. The computer-implemented method of claim 1, further comprising: receiving a search criterion;using the parse item, determining that the one or more parse tokens match the search criterion;using the data block identifier as a key to the key-value pair, identifying the compressed data block;uncompressing the data block;using the search criterion to identify one or more portions of the uncompressed data block; andreturning the one or more portions of the uncompressed data block as search results.
  • 3. The computer-implemented method of claim 1, further comprising storing a plurality of key-value pairs for a plurality of compressed data blocks, wherein each key-value pair of the plurality of key-value pairs is unique at least amongst all key-value pairs of the plurality of key-value pairs.
  • 4. The computer-implemented method of claim 3, wherein the plurality of key-value pairs comprises at least one million unique keys.
  • 5. The computer-implemented method of claim 1, wherein creating the parse item comprises extracting the one or more parse tokens from one or more of the logical data entities.
  • 6. The computer-implemented method of claim 1, wherein the parse item further comprises snippet identifying information.
  • 7. The computer-implemented method of claim 6, wherein the snippet identifying information is a byte offset into an uncompressed block and a byte length.
  • 8. The computer-implemented method of claim 1, wherein the parse tokens identify byte-sequential portions of the data block.
  • 9. A system comprising: one or more processors;a memory storing instructions which, when executed by the one or more processors, causes performing:receiving a stream of input data;parsing the input data to identify boundaries of logical data entities in the stream of input data;generating a block item comprising a key-value family identifier, a data block identifier, and a data block based on a logical data entity of the logical data entities, comprising:compressing the data block; andstoring the key-value family identifier in association with a key-value pair comprising the data block identifier as a key of the key-value pair and the compressed data block as a value of the key-value pair;creating and storing a parse item comprising the data block identifier and one or more parse tokens for indexing block items.
  • 10. The system of claim 9, wherein the instructions, when executed by the one or more processors, further cause performing: receiving a search criterion;using the parse item, determining that the one or more parse tokens match the search criterion;using the data block identifier as a key to the key-value pair, identifying the compressed data block;uncompressing the data block;using the search criterion to identify one or more portions of the uncompressed data block; andreturning the one or more portions of the uncompressed data block as search results.
  • 11. The system of claim 9, wherein the instructions, when executed by the one or more processors, further cause performing storing a plurality of key-value pairs for a plurality of compressed data blocks, wherein each key-value pair of the plurality of key-value pairs is unique at least amongst all key-value pairs of the plurality of key-value pairs.
  • 12. The system of claim 11, wherein the plurality of key-value pairs comprises at least one million unique keys.
  • 13. The system of claim 9, wherein creating the parse item comprises extracting the one or more parse tokens from one or more of the logical data entities.
  • 14. The system of claim 9, wherein the parse item further comprises snippet identifying information.
  • 15. The system of claim 14, wherein the snippet identifying information is a byte offset into an uncompressed block and a byte length.
  • 16. The system of claim 9, wherein the parse tokens identify byte-sequential portions of the data block.
BENEFIT CLAIM

This application claims the benefit under 35 U.S.C. § 120 as a continuation of application Ser. No. 15/824,096, filed Nov. 28, 2017, which is a continuation of application Ser. No. 15/446,917, filed Mar. 1, 2017, now U.S. Pat. No. 9,852,144; which is a continuation of application Ser. No. 14/961,830, filed Dec. 7, 2015, now U.S. Pat. No. 9,639,578; which is a continuation of application Ser. No. 14/451,221, filed Aug. 4, 2014, now U.S. Pat. No. 9,208,159; which is a continuation of application Ser. No. 13/167,680, filed Jun. 23, 2011, now U.S. Pat. No. 8,799,240, the entire contents of which are hereby incorporated by reference for all purposes as if fully set forth herein. Applicants expressly rescind any disclaimer of subject matter that may have occurred during prosecution of the priority application and advise the USPTO that the claims in the present application may be broader than the claims allowed in the priority application.

US Referenced Citations (843)
Number Name Date Kind
4881179 Vincent Nov 1989 A
5109399 Thompson Apr 1992 A
5241625 Epard et al. Aug 1993 A
5329108 Lamoure Jul 1994 A
5623659 Shi et al. Apr 1997 A
5632009 Rao et al. May 1997 A
5670987 Doi et al. Sep 1997 A
5724575 Hoover et al. Mar 1998 A
5781704 Rossmo Jul 1998 A
5798769 Chiu et al. Aug 1998 A
5845300 Comer Dec 1998 A
5872973 Mitchell et al. Feb 1999 A
5897636 Kaeser Apr 1999 A
5999911 Berg et al. Dec 1999 A
6057757 Arrowsmith et al. May 2000 A
6065026 Cornelia et al. May 2000 A
6073129 Levine et al. Jun 2000 A
6091956 Hollenberg Jul 2000 A
6094653 Li et al. Jul 2000 A
6101479 Shaw Aug 2000 A
6161098 Wallman Dec 2000 A
6219053 Tachibana et al. Apr 2001 B1
6232971 Haynes May 2001 B1
6237138 Hameluck et al. May 2001 B1
6243706 Moreau et al. Jun 2001 B1
6243717 Gordon et al. Jun 2001 B1
6247019 Davies Jun 2001 B1
6279018 Kudrolli et al. Aug 2001 B1
6304873 Klein et al. Oct 2001 B1
6341310 Leshem et al. Jan 2002 B1
6366933 Ball et al. Apr 2002 B1
6369835 Lin Apr 2002 B1
6370538 Lamping et al. Apr 2002 B1
6418438 Campbell Jul 2002 B1
6430305 Decker Aug 2002 B1
6456997 Shukla Sep 2002 B1
6510504 Satyanarayana Jan 2003 B2
6523019 Borthwick Feb 2003 B1
6549752 Tsukamoto Apr 2003 B2
6549944 Weinberg et al. Apr 2003 B1
6560620 Ching May 2003 B1
6574635 Stauber et al. Jun 2003 B2
6581068 Bensoussan et al. Jun 2003 B1
6594672 Lampson et al. Jul 2003 B1
6631496 Li et al. Oct 2003 B1
6642945 Sharpe Nov 2003 B1
6665683 Meltzer Dec 2003 B1
6674434 Chojnacki et al. Jan 2004 B1
6714936 Nevin, III Mar 2004 B1
6745382 Zothner Jun 2004 B1
6775675 Nwabueze et al. Aug 2004 B1
6820135 Dingman Nov 2004 B1
6828920 Owen et al. Dec 2004 B2
6839745 Dingari et al. Jan 2005 B1
6850317 Mullins et al. Feb 2005 B2
6877137 Rivette et al. Apr 2005 B1
6889210 Vainstein May 2005 B1
6944777 Belani et al. Sep 2005 B1
6944821 Bates et al. Sep 2005 B1
6967589 Peters Nov 2005 B1
6976210 Silva et al. Dec 2005 B1
6978419 Kantrowitz Dec 2005 B1
6980984 Huffman et al. Dec 2005 B1
6985950 Hanson et al. Jan 2006 B1
7036085 Barros Apr 2006 B2
7043702 Chi et al. May 2006 B2
7055110 Kupka et al. May 2006 B2
7058648 Lightfoot et al. Jun 2006 B1
7086028 Davis et al. Aug 2006 B1
7111231 Huck et al. Sep 2006 B1
7139800 Bellotti et al. Nov 2006 B2
7158878 Rasmussen et al. Jan 2007 B2
7162475 Ackerman Jan 2007 B2
7168039 Bertram Jan 2007 B2
7171427 Witowski et al. Jan 2007 B2
7174377 Bernard et al. Feb 2007 B2
7194680 Roy et al. Mar 2007 B1
7213030 Jenkins May 2007 B1
7269786 Malloy et al. Sep 2007 B1
7278105 Kitts Oct 2007 B1
7290698 Poslinski et al. Nov 2007 B2
7333998 Heckerman et al. Feb 2008 B2
7370047 Gorman May 2008 B2
7379811 Rasmussen et al. May 2008 B2
7379903 Caballero et al. May 2008 B2
7392254 Jenkins Jun 2008 B1
7426654 Adams et al. Sep 2008 B2
7440978 Chan et al. Oct 2008 B2
7441182 Beilinson et al. Oct 2008 B2
7441219 Perry et al. Oct 2008 B2
7454466 Bellotti et al. Nov 2008 B2
7461158 Rider et al. Dec 2008 B2
7467375 Tondreau et al. Dec 2008 B2
7487139 Fraleigh et al. Feb 2009 B2
7502786 Liu et al. Mar 2009 B2
7525422 Bishop et al. Apr 2009 B2
7529727 Arning et al. May 2009 B2
7529734 Dirisala May 2009 B2
7558677 Jones Jul 2009 B2
7574409 Patinkin Aug 2009 B2
7574428 Leiserowitz et al. Aug 2009 B2
7579965 Bucholz Aug 2009 B2
7596285 Brown et al. Sep 2009 B2
7614006 Molander Nov 2009 B2
7617232 Gabbert et al. Nov 2009 B2
7620628 Kapur et al. Nov 2009 B2
7627812 Chamberlain et al. Dec 2009 B2
7634455 Keene et al. Dec 2009 B1
7634717 Chamberlain et al. Dec 2009 B2
7685109 Ransil Mar 2010 B1
7702616 Wenfeng et al. Apr 2010 B1
7703021 Flam Apr 2010 B1
7706817 Bamrah et al. Apr 2010 B2
7712049 Williams et al. May 2010 B2
7716077 Mikurak May 2010 B1
7716140 Nielsen et al. May 2010 B1
7725530 Sah et al. May 2010 B2
7725547 Albertson et al. May 2010 B2
7725728 Ama et al. May 2010 B2
7730082 Sah et al. Jun 2010 B2
7730109 Rohrs et al. Jun 2010 B2
7761407 Stern Jul 2010 B1
7765489 Shah Jul 2010 B1
7770100 Chamberlain et al. Aug 2010 B2
7802305 Leeds Sep 2010 B1
7805457 Viola et al. Sep 2010 B1
7809703 Balabhadrapatruni et al. Oct 2010 B2
7814084 Hallett et al. Oct 2010 B2
7814085 Pfleger et al. Oct 2010 B1
7818658 Chen Oct 2010 B2
7870493 Pall et al. Jan 2011 B2
7877421 Berger et al. Jan 2011 B2
7880921 Dattilo et al. Feb 2011 B2
7894984 Rasmussen et al. Feb 2011 B2
7899611 Downs et al. Mar 2011 B2
7917376 Bellin et al. Mar 2011 B2
7920963 Jouline et al. Apr 2011 B2
7933862 Chamberlain et al. Apr 2011 B2
7941336 Robin-Jan May 2011 B1
7958147 Turner et al. Jun 2011 B1
7962281 Rasmussen et al. Jun 2011 B2
7962495 Jain et al. Jun 2011 B2
7962848 Bertram Jun 2011 B2
7966199 Frasher Jun 2011 B1
7970240 Chao et al. Jun 2011 B1
7971150 Raskutti et al. Jun 2011 B2
7984374 Caro et al. Jul 2011 B2
8001465 Kudrolli et al. Aug 2011 B2
8001482 Bhattiprolu et al. Aug 2011 B2
8010507 Poston et al. Aug 2011 B2
8010545 Stefik et al. Aug 2011 B2
8015487 Roy et al. Sep 2011 B2
8024778 Cash et al. Sep 2011 B2
8036632 Cona et al. Oct 2011 B1
8041714 Aymeloglu et al. Oct 2011 B2
8073857 Sreekanth Dec 2011 B2
8103543 Zwicky Jan 2012 B1
8112425 Baum et al. Feb 2012 B2
8126848 Wagner Feb 2012 B2
8134457 Velipasalar et al. Mar 2012 B2
8145703 Frishert et al. Mar 2012 B2
8185819 Sah et al. May 2012 B2
8191005 Baier et al. May 2012 B2
8214361 Sandler et al. Jul 2012 B1
8214764 Gemmell et al. Jul 2012 B2
8225201 Michael Jul 2012 B2
8229902 Vishniac Jul 2012 B2
8229947 Fujinaga Jul 2012 B2
8230333 Decherd et al. Jul 2012 B2
8271461 Pike et al. Sep 2012 B2
8280880 Aymeloglu et al. Oct 2012 B1
8290838 Thakur et al. Oct 2012 B1
8290926 Ozzie et al. Oct 2012 B2
8290942 Jones et al. Oct 2012 B2
8301464 Cave et al. Oct 2012 B1
8301904 Gryaznov Oct 2012 B1
8302855 Ma et al. Nov 2012 B2
8312367 Foster Nov 2012 B2
8312546 Aime Nov 2012 B2
8352881 Champion et al. Jan 2013 B2
8368695 Howell et al. Feb 2013 B2
8392556 Goulet et al. Mar 2013 B2
8397171 Klassen et al. Mar 2013 B2
8412707 Mianji Apr 2013 B1
8447722 Ahuja et al. May 2013 B1
8452790 Mianji May 2013 B1
8463036 Ramesh et al. Jun 2013 B1
8489331 Kopf et al. Jul 2013 B2
8489641 Seefeld et al. Jul 2013 B1
8498984 Hwang et al. Jul 2013 B1
8504542 Chang et al. Aug 2013 B2
8510743 Hackborn et al. Aug 2013 B2
8514082 Cova et al. Aug 2013 B2
8515207 Chau Aug 2013 B2
8527949 Pleis et al. Sep 2013 B1
8554579 Tribble et al. Oct 2013 B2
8554653 Falkenborg et al. Oct 2013 B2
8554709 Goodson et al. Oct 2013 B2
8555403 Kilday Oct 2013 B1
8560413 Quarterman Oct 2013 B1
8577911 Stepinski et al. Nov 2013 B1
8589273 Creeden et al. Nov 2013 B2
8595234 Siripuapu et al. Nov 2013 B2
8620641 Farnsworth et al. Dec 2013 B2
8639757 Zang et al. Jan 2014 B1
8646080 Williamson et al. Feb 2014 B2
8676857 Adams et al. Mar 2014 B1
8682696 Shanmugam Mar 2014 B1
8688573 Ruknoic et al. Apr 2014 B1
8689108 Duffield et al. Apr 2014 B1
8713467 Goldenberg et al. Apr 2014 B1
8726379 Stiansen et al. May 2014 B1
8732574 Burr et al. May 2014 B2
8739278 Varghese May 2014 B2
8742934 Sarpy et al. Jun 2014 B1
8744890 Bernier Jun 2014 B1
8745516 Mason et al. Jun 2014 B2
8781169 Jackson et al. Jul 2014 B2
8787939 Papakipos et al. Jul 2014 B2
8788407 Singh et al. Jul 2014 B1
8799313 Satlow Aug 2014 B2
8799799 Cervelli et al. Aug 2014 B1
8807948 Luo et al. Aug 2014 B2
8812960 Sun et al. Aug 2014 B1
8830322 Nerayoff et al. Sep 2014 B2
8832594 Thompson et al. Sep 2014 B1
8868537 Colgrove et al. Oct 2014 B1
8917274 Ma et al. Dec 2014 B2
8924872 Bogomolov et al. Dec 2014 B1
8930331 McGrew et al. Jan 2015 B2
8930874 Duff et al. Jan 2015 B2
8937619 Sharma et al. Jan 2015 B2
8938686 Erenrich et al. Jan 2015 B1
8954410 Chang et al. Feb 2015 B2
8984390 Aymeloglu et al. Mar 2015 B2
9009171 Grossman et al. Apr 2015 B1
9009827 Albertson et al. Apr 2015 B1
9021260 Falk et al. Apr 2015 B1
9021384 Beard et al. Apr 2015 B1
9043696 Meiklejohn et al. May 2015 B1
9043894 Dennison et al. May 2015 B1
9058315 Burr et al. Jun 2015 B2
9092482 Harris et al. Jul 2015 B2
9116975 Shankar et al. Aug 2015 B2
9165100 Begur et al. Oct 2015 B2
9208159 Stowe et al. Dec 2015 B2
9230280 Maag et al. Jan 2016 B1
9280532 Cicerone Mar 2016 B2
9286373 Elliot et al. Mar 2016 B2
9348880 Kramer et al. May 2016 B1
9383911 Aymeloglu et al. Jul 2016 B2
9542446 Duffield et al. Jan 2017 B1
9576003 McGrew et al. Feb 2017 B2
9639578 Stowe et al. May 2017 B2
9852144 Stowe et al. Dec 2017 B2
20010021936 Bertram Sep 2001 A1
20010051949 Carey et al. Dec 2001 A1
20010056522 Satyanarayana Dec 2001 A1
20020032677 Morgenthaler et al. Mar 2002 A1
20020033848 Sciammarella et al. Mar 2002 A1
20020065708 Senay et al. May 2002 A1
20020091694 Senay et al. Jul 2002 A1
20020091707 Hrle et al. Jul 2002 A1
20020095360 Keller Jul 2002 A1
20020095416 Joao Jul 2002 A1
20020095658 Schwols Jul 2002 A1
20020103705 Shulman Aug 2002 A1
20020116120 Brady Aug 2002 A1
20020174201 Ruiz et al. Nov 2002 A1
20020184517 Tadayon et al. Dec 2002 A1
20020188638 Ramer et al. Dec 2002 A1
20020194119 Wright et al. Dec 2002 A1
20020196229 Chen et al. Dec 2002 A1
20030028560 Kudrolli et al. Feb 2003 A1
20030036927 Bowen Feb 2003 A1
20030039948 Donahue Feb 2003 A1
20030050976 Block et al. Mar 2003 A1
20030056112 Vinson Mar 2003 A1
20030061132 Mason et al. Mar 2003 A1
20030093755 O'Carroll May 2003 A1
20030105759 Bess et al. Jun 2003 A1
20030115481 Baird et al. Jun 2003 A1
20030120675 Stauber et al. Jun 2003 A1
20030126102 Borthwick Jul 2003 A1
20030130993 Mendelevitch et al. Jul 2003 A1
20030140106 Raguseo Jul 2003 A1
20030144868 MacIntyre et al. Jul 2003 A1
20030154381 Ouye et al. Aug 2003 A1
20030163352 Surpin et al. Aug 2003 A1
20030196108 Kung Oct 2003 A1
20030212718 Tester Nov 2003 A1
20030225755 Iwayama et al. Dec 2003 A1
20030229848 Arend et al. Dec 2003 A1
20040015478 Pauly Jan 2004 A1
20040032432 Baynger Feb 2004 A1
20040034570 Davis Feb 2004 A1
20040044648 Anfindsen et al. Mar 2004 A1
20040049395 Gaya Mar 2004 A1
20040064256 Barinek et al. Apr 2004 A1
20040085318 Hassler et al. May 2004 A1
20040095349 Bito et al. May 2004 A1
20040111410 Burgoon et al. Jun 2004 A1
20040117345 Bamford et al. Jun 2004 A1
20040117387 Civetta et al. Jun 2004 A1
20040126840 Cheng et al. Jul 2004 A1
20040143602 Ruiz et al. Jul 2004 A1
20040143796 Lerner et al. Jul 2004 A1
20040148301 McKay et al. Jul 2004 A1
20040163039 Gorman Aug 2004 A1
20040193600 Kaasten et al. Sep 2004 A1
20040205492 Newsome Oct 2004 A1
20040215649 Whalen et al. Oct 2004 A1
20040221223 Yu et al. Nov 2004 A1
20040236688 Bozeman Nov 2004 A1
20040236711 Nixon et al. Nov 2004 A1
20040254934 Ho et al. Dec 2004 A1
20040260702 Cragun et al. Dec 2004 A1
20040267746 Marcjan et al. Dec 2004 A1
20050007845 Angerer Jan 2005 A1
20050010472 Quatse et al. Jan 2005 A1
20050021980 Kanai Jan 2005 A1
20050027705 Sadri et al. Feb 2005 A1
20050028094 Allyn Feb 2005 A1
20050039116 Slack-Smith Feb 2005 A1
20050039119 Parks et al. Feb 2005 A1
20050065811 Chu et al. Mar 2005 A1
20050065890 Benaloh Mar 2005 A1
20050080769 Gemmell Apr 2005 A1
20050086207 Heuer et al. Apr 2005 A1
20050091186 Elish Apr 2005 A1
20050097441 Herbach et al. May 2005 A1
20050097482 Hanson et al. May 2005 A1
20050108231 Findleton et al. May 2005 A1
20050114763 Nonomura et al. May 2005 A1
20050125715 Di Franco et al. Jun 2005 A1
20050131964 Saxena Jun 2005 A1
20050162523 Darrell et al. Jul 2005 A1
20050166144 Gross Jul 2005 A1
20050180330 Shapiro Aug 2005 A1
20050182793 Keenan et al. Aug 2005 A1
20050183005 Denoue et al. Aug 2005 A1
20050210409 Jou Sep 2005 A1
20050246327 Yeung et al. Nov 2005 A1
20050251786 Citron et al. Nov 2005 A1
20050288939 Peled et al. Dec 2005 A1
20050289524 McGinnes Dec 2005 A1
20060026120 Carolan et al. Feb 2006 A1
20060026170 Kreitler et al. Feb 2006 A1
20060026561 Bauman et al. Feb 2006 A1
20060031779 Theurer et al. Feb 2006 A1
20060045470 Poslinski et al. Mar 2006 A1
20060053097 King et al. Mar 2006 A1
20060053170 Hill et al. Mar 2006 A1
20060059139 Robinson Mar 2006 A1
20060059423 Lehmann et al. Mar 2006 A1
20060062426 Levy et al. Mar 2006 A1
20060074866 Chamberlain et al. Apr 2006 A1
20060074881 Vembu et al. Apr 2006 A1
20060080139 Mainzer Apr 2006 A1
20060080316 Gilmore et al. Apr 2006 A1
20060080619 Carlson et al. Apr 2006 A1
20060093222 Saffer et al. May 2006 A1
20060095521 Patinkin May 2006 A1
20060106847 Eckardt et al. May 2006 A1
20060116991 Calderwood Jun 2006 A1
20060129746 Porter Jun 2006 A1
20060136513 Ngo et al. Jun 2006 A1
20060137023 Benaloh Jun 2006 A1
20060139375 Rasmussen et al. Jun 2006 A1
20060142949 Helt Jun 2006 A1
20060143034 Rothermel Jun 2006 A1
20060143075 Carr et al. Jun 2006 A1
20060149596 Surpin et al. Jul 2006 A1
20060155654 Plessis et al. Jul 2006 A1
20060161558 Tamma et al. Jul 2006 A1
20060173825 Hess Aug 2006 A1
20060178915 Chao Aug 2006 A1
20060203337 White Sep 2006 A1
20060218149 Patrick Sep 2006 A1
20060218206 Bourbonnais et al. Sep 2006 A1
20060218405 Ama et al. Sep 2006 A1
20060218491 Grossman et al. Sep 2006 A1
20060218637 Thomas et al. Sep 2006 A1
20060241974 Chao et al. Oct 2006 A1
20060242040 Rader Oct 2006 A1
20060242630 Koike et al. Oct 2006 A1
20060248083 Sack et al. Nov 2006 A1
20060248084 Sack et al. Nov 2006 A1
20060253502 Raman et al. Nov 2006 A1
20060265397 Bryan et al. Nov 2006 A1
20060265417 Amato et al. Nov 2006 A1
20060265758 Khandelwal et al. Nov 2006 A1
20060271277 Hu et al. Nov 2006 A1
20060277460 Forstall et al. Dec 2006 A1
20060279630 Aggarwal et al. Dec 2006 A1
20060288056 Yamakawa et al. Dec 2006 A1
20070000999 Kubo et al. Jan 2007 A1
20070011150 Frank Jan 2007 A1
20070016363 Huang et al. Jan 2007 A1
20070018986 Hauser Jan 2007 A1
20070038646 Thota Feb 2007 A1
20070038962 Fuchs et al. Feb 2007 A1
20070043686 Teng et al. Feb 2007 A1
20070050429 Goldring et al. Mar 2007 A1
20070056034 Fernstrom Mar 2007 A1
20070057966 Ohno et al. Mar 2007 A1
20070061487 Moore et al. Mar 2007 A1
20070061752 Cory Mar 2007 A1
20070078832 Ott et al. Apr 2007 A1
20070083541 Fraleigh et al. Apr 2007 A1
20070094389 Nussey et al. Apr 2007 A1
20070094594 Matichuk et al. Apr 2007 A1
20070113164 Hansen et al. May 2007 A1
20070136095 Weinstein Jun 2007 A1
20070143253 Kostamaa et al. Jun 2007 A1
20070150369 Zivin Jun 2007 A1
20070168292 Jogand-Coulomb et al. Jul 2007 A1
20070168871 Jenkins Jul 2007 A1
20070174760 Chamberlain et al. Jul 2007 A1
20070185850 Walters et al. Aug 2007 A1
20070192265 Chopin et al. Aug 2007 A1
20070198571 Ferguson et al. Aug 2007 A1
20070208497 Downs et al. Sep 2007 A1
20070208498 Barker et al. Sep 2007 A1
20070208736 Tanigawa et al. Sep 2007 A1
20070233709 Abnous Oct 2007 A1
20070233756 D'Souza et al. Oct 2007 A1
20070240062 Christena et al. Oct 2007 A1
20070245339 Bauman et al. Oct 2007 A1
20070260648 Friesenhahn et al. Nov 2007 A1
20070266336 Nojima et al. Nov 2007 A1
20070271212 Jones et al. Nov 2007 A1
20070271317 Carmel Nov 2007 A1
20070284433 Domenica et al. Dec 2007 A1
20070294643 Kyle Dec 2007 A1
20070299697 Friedlander et al. Dec 2007 A1
20080015970 Brookfield et al. Jan 2008 A1
20080016155 Khalatian Jan 2008 A1
20080040684 Crump Feb 2008 A1
20080051989 Welsh Feb 2008 A1
20080052142 Bailey et al. Feb 2008 A1
20080077597 Butler Mar 2008 A1
20080077642 Carbone et al. Mar 2008 A1
20080082486 Lermant et al. Apr 2008 A1
20080091693 Murthy Apr 2008 A1
20080104019 Nath May 2008 A1
20080104060 Abhyankar et al. May 2008 A1
20080104141 McMahon May 2008 A1
20080104149 Vishniac May 2008 A1
20080109714 Kumar et al. May 2008 A1
20080126951 Sood et al. May 2008 A1
20080133573 Haft Jun 2008 A1
20080148398 Mezack et al. Jun 2008 A1
20080155440 Trevor et al. Jun 2008 A1
20080162616 Gross et al. Jul 2008 A1
20080172607 Baer Jul 2008 A1
20080177782 Poston et al. Jul 2008 A1
20080186904 Koyama et al. Aug 2008 A1
20080195417 Surpin et al. Aug 2008 A1
20080195608 Clover Aug 2008 A1
20080195672 Hamel et al. Aug 2008 A1
20080201339 McGrew Aug 2008 A1
20080215546 Baum et al. Sep 2008 A1
20080222295 Robinson et al. Sep 2008 A1
20080249820 Pathria Oct 2008 A1
20080255973 El Wade et al. Oct 2008 A1
20080256127 Kim Oct 2008 A1
20080263468 Cappione et al. Oct 2008 A1
20080267107 Rosenberg Oct 2008 A1
20080270316 Guidotti et al. Oct 2008 A1
20080276167 Michael Nov 2008 A1
20080278311 Grange et al. Nov 2008 A1
20080288306 MacIntyre et al. Nov 2008 A1
20080301378 Carrie Dec 2008 A1
20080301643 Appleton et al. Dec 2008 A1
20080313132 Hao et al. Dec 2008 A1
20080313243 Poston et al. Dec 2008 A1
20090002492 Velipasalar et al. Jan 2009 A1
20090027418 Maru et al. Jan 2009 A1
20090030915 Winter et al. Jan 2009 A1
20090031247 Walter et al. Jan 2009 A1
20090031401 Cudich et al. Jan 2009 A1
20090037417 Shankar et al. Feb 2009 A1
20090043801 LeClair Feb 2009 A1
20090055251 Shah et al. Feb 2009 A1
20090088964 Schaaf et al. Apr 2009 A1
20090089651 Herberger et al. Apr 2009 A1
20090106178 Chu Apr 2009 A1
20090106308 Killian et al. Apr 2009 A1
20090106442 Liu Apr 2009 A1
20090112678 Luzardo Apr 2009 A1
20090112745 Stefanescu Apr 2009 A1
20090119309 Gibson et al. May 2009 A1
20090125359 Knapic May 2009 A1
20090125369 Kloosstra et al. May 2009 A1
20090125459 Norton et al. May 2009 A1
20090132921 Hwangbo et al. May 2009 A1
20090132953 Reed et al. May 2009 A1
20090143052 Bates et al. Jun 2009 A1
20090144262 White et al. Jun 2009 A1
20090144274 Fraleigh et al. Jun 2009 A1
20090150868 Chakra et al. Jun 2009 A1
20090164387 Armstrong et al. Jun 2009 A1
20090164934 Bhattiprolu et al. Jun 2009 A1
20090171939 Athsani et al. Jul 2009 A1
20090172511 Decherd et al. Jul 2009 A1
20090172669 Bobak et al. Jul 2009 A1
20090172821 Daira et al. Jul 2009 A1
20090177962 Gusmorino et al. Jul 2009 A1
20090179892 Tsuda et al. Jul 2009 A1
20090187464 Bai et al. Jul 2009 A1
20090187546 Whyte et al. Jul 2009 A1
20090199106 Jonsson et al. Aug 2009 A1
20090216562 Faulkner et al. Aug 2009 A1
20090222400 Kupershmidt et al. Sep 2009 A1
20090222759 Drieschner Sep 2009 A1
20090222760 Halverson et al. Sep 2009 A1
20090234720 George et al. Sep 2009 A1
20090240664 Dinker et al. Sep 2009 A1
20090248757 Havewala et al. Oct 2009 A1
20090249178 Ambrosino et al. Oct 2009 A1
20090249244 Robinson et al. Oct 2009 A1
20090254970 Agarwal et al. Oct 2009 A1
20090254971 Herz Oct 2009 A1
20090271343 Vaiciulis et al. Oct 2009 A1
20090271435 Yako et al. Oct 2009 A1
20090281839 Lynn et al. Nov 2009 A1
20090282068 Shockro et al. Nov 2009 A1
20090287470 Farnsworth et al. Nov 2009 A1
20090292626 Oxford Nov 2009 A1
20090307049 Elliott et al. Dec 2009 A1
20090313223 Rantanen Dec 2009 A1
20090313311 Hoffmann et al. Dec 2009 A1
20090313463 Pang et al. Dec 2009 A1
20090319599 Gaunter Dec 2009 A1
20090319891 MacKinlay Dec 2009 A1
20100011282 Dollard et al. Jan 2010 A1
20100036831 Vemuri et al. Feb 2010 A1
20100042922 Bradateanu et al. Feb 2010 A1
20100057622 Faith et al. Mar 2010 A1
20100057716 Stefik et al. Mar 2010 A1
20100070489 Aymeloglu et al. Mar 2010 A1
20100070523 Delgo et al. Mar 2010 A1
20100070842 Aymeloglu et al. Mar 2010 A1
20100070844 Aymeloglu et al. Mar 2010 A1
20100070845 Facemire et al. Mar 2010 A1
20100070897 Aymeloglu et al. Mar 2010 A1
20100076813 Ghosh et al. Mar 2010 A1
20100076939 Iwaki et al. Mar 2010 A1
20100082541 Kottomtharayil Apr 2010 A1
20100098318 Anderson Apr 2010 A1
20100100963 Mahaffey Apr 2010 A1
20100103124 Kruzeniski et al. Apr 2010 A1
20100114817 Broeder et al. May 2010 A1
20100114831 Gilbert et al. May 2010 A1
20100114887 Conway et al. May 2010 A1
20100122152 Chamberlain et al. May 2010 A1
20100131457 Heimendinger May 2010 A1
20100138842 Balko et al. Jun 2010 A1
20100145909 Ngo Jun 2010 A1
20100161565 Lee et al. Jun 2010 A1
20100161688 Kesselman et al. Jun 2010 A1
20100162176 Dunton Jun 2010 A1
20100173619 Hua et al. Jul 2010 A1
20100191563 Schlaifer et al. Jul 2010 A1
20100191884 Holenstein et al. Jul 2010 A1
20100198684 Eraker et al. Aug 2010 A1
20100199225 Coleman et al. Aug 2010 A1
20100211550 Daniello et al. Aug 2010 A1
20100211618 Anderson et al. Aug 2010 A1
20100223260 Wu Sep 2010 A1
20100228812 Uomini Sep 2010 A1
20100235606 Oreland et al. Sep 2010 A1
20100238174 Haub et al. Sep 2010 A1
20100250412 Wagner Sep 2010 A1
20100262901 DiSalvo Oct 2010 A1
20100280851 Merkin Nov 2010 A1
20100280857 Liu et al. Nov 2010 A1
20100283787 Hamedi et al. Nov 2010 A1
20100293174 Bennett et al. Nov 2010 A1
20100306713 Geisner et al. Dec 2010 A1
20100306722 LeHoty et al. Dec 2010 A1
20100313119 Baldwin et al. Dec 2010 A1
20100313239 Chakra et al. Dec 2010 A1
20100318838 Katano et al. Dec 2010 A1
20100318924 Frankel et al. Dec 2010 A1
20100321399 Ellren et al. Dec 2010 A1
20100325526 Ellis et al. Dec 2010 A1
20100325581 Finkelstein et al. Dec 2010 A1
20100330801 Rouh Dec 2010 A1
20110029498 Ferguson et al. Feb 2011 A1
20110029526 Knight et al. Feb 2011 A1
20110047159 Baid et al. Feb 2011 A1
20110047540 Williams et al. Feb 2011 A1
20110060753 Shaked et al. Mar 2011 A1
20110061013 Bilicki et al. Mar 2011 A1
20110066933 Ludwig Mar 2011 A1
20110074788 Regan et al. Mar 2011 A1
20110074811 Hanson et al. Mar 2011 A1
20110078055 Faribault et al. Mar 2011 A1
20110078173 Seligmann et al. Mar 2011 A1
20110093327 Fordyce, III et al. Apr 2011 A1
20110099133 Chang et al. Apr 2011 A1
20110106795 Maim May 2011 A1
20110107196 Foster May 2011 A1
20110117878 Barash et al. May 2011 A1
20110119100 Ruhl et al. May 2011 A1
20110137766 Rasmussen et al. Jun 2011 A1
20110153384 Horne et al. Jun 2011 A1
20110153592 DeMarcken Jun 2011 A1
20110161096 Buehler et al. Jun 2011 A1
20110161132 Goel et al. Jun 2011 A1
20110161409 Nair Jun 2011 A1
20110167105 Ramakrishnan et al. Jul 2011 A1
20110170799 Carrino et al. Jul 2011 A1
20110173032 Payne et al. Jul 2011 A1
20110173093 Psota et al. Jul 2011 A1
20110173619 Fish Jul 2011 A1
20110179048 Satlow Jul 2011 A1
20110184813 Barne et al. Jul 2011 A1
20110185316 Reid et al. Jul 2011 A1
20110208565 Ross et al. Aug 2011 A1
20110208724 Jones et al. Aug 2011 A1
20110213655 Henkin Sep 2011 A1
20110218934 Elser Sep 2011 A1
20110219450 McDougal et al. Sep 2011 A1
20110225198 Edwards et al. Sep 2011 A1
20110225482 Chan et al. Sep 2011 A1
20110238495 Kang Sep 2011 A1
20110238553 Raj et al. Sep 2011 A1
20110251951 Kolkowtiz Oct 2011 A1
20110258158 Resende et al. Oct 2011 A1
20110258242 Eidson et al. Oct 2011 A1
20110270705 Parker Nov 2011 A1
20110270812 Ruby Nov 2011 A1
20110289317 Darapu Nov 2011 A1
20110289397 Eastmond et al. Nov 2011 A1
20110289407 Naik et al. Nov 2011 A1
20110289420 Morioka et al. Nov 2011 A1
20110291851 Whisenant Dec 2011 A1
20110310005 Chen et al. Dec 2011 A1
20110314007 Dassa et al. Dec 2011 A1
20120004894 Butler Jan 2012 A1
20120013684 Robertson et al. Jan 2012 A1
20120019559 Siler et al. Jan 2012 A1
20120022945 Falkenborg et al. Jan 2012 A1
20120036013 Neuhaus et al. Feb 2012 A1
20120036434 Oberstein Feb 2012 A1
20120050293 Carlhian et al. Mar 2012 A1
20120059853 Jagota Mar 2012 A1
20120065987 Farooq et al. Mar 2012 A1
20120066296 Appleton et al. Mar 2012 A1
20120072825 Sherkin et al. Mar 2012 A1
20120079363 Folting et al. Mar 2012 A1
20120084117 Tavares et al. Apr 2012 A1
20120084118 Bai et al. Apr 2012 A1
20120084184 Raleigh Apr 2012 A1
20120106801 Jackson May 2012 A1
20120117082 Koperda et al. May 2012 A1
20120123989 Yu et al. May 2012 A1
20120124179 Cappio et al. May 2012 A1
20120131512 Takeuchi et al. May 2012 A1
20120136804 Lucia May 2012 A1
20120137235 Ts et al. May 2012 A1
20120144335 Abeln et al. Jun 2012 A1
20120150791 Willson Jun 2012 A1
20120159307 Chung et al. Jun 2012 A1
20120159362 Brown et al. Jun 2012 A1
20120159399 Bastide et al. Jun 2012 A1
20120170847 Tsukidate Jul 2012 A1
20120173985 Peppel Jul 2012 A1
20120180002 Campbell et al. Jul 2012 A1
20120188252 Law Jul 2012 A1
20120196557 Reich et al. Aug 2012 A1
20120196558 Reich et al. Aug 2012 A1
20120197651 Robinson et al. Aug 2012 A1
20120197657 Prodanovic Aug 2012 A1
20120197660 Prodanovic Aug 2012 A1
20120203708 Psota et al. Aug 2012 A1
20120208636 Feige Aug 2012 A1
20120215784 King et al. Aug 2012 A1
20120221511 Gibson et al. Aug 2012 A1
20120221553 Wittmer et al. Aug 2012 A1
20120221580 Barney Aug 2012 A1
20120226590 Love et al. Sep 2012 A1
20120245976 Kumar et al. Sep 2012 A1
20120246148 Dror Sep 2012 A1
20120254129 Wheeler et al. Oct 2012 A1
20120284345 Costenaro et al. Nov 2012 A1
20120284670 Kashik et al. Nov 2012 A1
20120290879 Shibuya et al. Nov 2012 A1
20120296907 Long et al. Nov 2012 A1
20120311684 Paulsen et al. Dec 2012 A1
20120323888 Osann, Jr. Dec 2012 A1
20120330801 McDougal et al. Dec 2012 A1
20120330908 Stowe et al. Dec 2012 A1
20120330973 Ghuneim et al. Dec 2012 A1
20130006426 Healey et al. Jan 2013 A1
20130006725 Simanek et al. Jan 2013 A1
20130006916 McBride et al. Jan 2013 A1
20130016106 Yip et al. Jan 2013 A1
20130018796 Kolhatkar et al. Jan 2013 A1
20130024268 Manickavelu Jan 2013 A1
20130036346 Cicerone Feb 2013 A1
20130046635 Grigg et al. Feb 2013 A1
20130046842 Muntz et al. Feb 2013 A1
20130055264 Burr et al. Feb 2013 A1
20130060742 Chang et al. Mar 2013 A1
20130060786 Serrano et al. Mar 2013 A1
20130061169 Pearcy et al. Mar 2013 A1
20130073377 Heath Mar 2013 A1
20130073454 Busch Mar 2013 A1
20130078943 Biage et al. Mar 2013 A1
20130086482 Parsons Apr 2013 A1
20130097130 Bingol et al. Apr 2013 A1
20130097482 Marantz et al. Apr 2013 A1
20130101159 Chao et al. Apr 2013 A1
20130110822 Ikeda et al. May 2013 A1
20130110877 Bonham et al. May 2013 A1
20130111320 Campbell et al. May 2013 A1
20130117651 Waldman et al. May 2013 A1
20130124567 Balinsky et al. May 2013 A1
20130150004 Rosen Jun 2013 A1
20130151148 Parundekar et al. Jun 2013 A1
20130151305 Akinola et al. Jun 2013 A1
20130151388 Falkenborg et al. Jun 2013 A1
20130151453 Bhanot et al. Jun 2013 A1
20130157234 Gulli et al. Jun 2013 A1
20130166348 Scotto Jun 2013 A1
20130166480 Popescu et al. Jun 2013 A1
20130166550 Buchmann et al. Jun 2013 A1
20130176321 Mitchell et al. Jul 2013 A1
20130179420 Park et al. Jul 2013 A1
20130224696 Wolfe et al. Aug 2013 A1
20130225212 Khan Aug 2013 A1
20130226318 Procyk Aug 2013 A1
20130226953 Markovich et al. Aug 2013 A1
20130232045 Tai et al. Sep 2013 A1
20130238616 Rose et al. Sep 2013 A1
20130246170 Gross et al. Sep 2013 A1
20130251233 Yang et al. Sep 2013 A1
20130262527 Hunter et al. Oct 2013 A1
20130263019 Castellanos et al. Oct 2013 A1
20130267207 Hao et al. Oct 2013 A1
20130268520 Fisher et al. Oct 2013 A1
20130279757 Kephart Oct 2013 A1
20130282696 John et al. Oct 2013 A1
20130290011 Lynn et al. Oct 2013 A1
20130290825 Arndt et al. Oct 2013 A1
20130297619 Chandrasekaran et al. Nov 2013 A1
20130304770 Boero et al. Nov 2013 A1
20130311375 Priebatsch Nov 2013 A1
20130318060 Chang et al. Nov 2013 A1
20140019936 Cohanoff Jan 2014 A1
20140032506 Hoey et al. Jan 2014 A1
20140033010 Richardt et al. Jan 2014 A1
20140040371 Gurevich et al. Feb 2014 A1
20140047319 Eberlein Feb 2014 A1
20140047357 Alfaro et al. Feb 2014 A1
20140059038 McPherson et al. Feb 2014 A1
20140067611 Adachi et al. Mar 2014 A1
20140068487 Steiger et al. Mar 2014 A1
20140074855 Zhao et al. Mar 2014 A1
20140089339 Siddiqui et al. Mar 2014 A1
20140095273 Tang et al. Apr 2014 A1
20140095509 Patton Apr 2014 A1
20140108068 Williams Apr 2014 A1
20140108380 Gotz et al. Apr 2014 A1
20140108985 Scott et al. Apr 2014 A1
20140129261 Bothwell et al. May 2014 A1
20140129936 Richards et al. May 2014 A1
20140149272 Hirani et al. May 2014 A1
20140149436 Bahrami et al. May 2014 A1
20140156527 Grigg et al. Jun 2014 A1
20140157172 Peery et al. Jun 2014 A1
20140164502 Khodorenko et al. Jun 2014 A1
20140181833 Bird et al. Jun 2014 A1
20140189536 Lange et al. Jul 2014 A1
20140195515 Baker et al. Jul 2014 A1
20140195887 Ellis et al. Jul 2014 A1
20140208281 Ming et al. Jul 2014 A1
20140214579 Shen et al. Jul 2014 A1
20140222521 Chait Jul 2014 A1
20140222793 Sadkin et al. Aug 2014 A1
20140244284 Smith Aug 2014 A1
20140244388 Manouchehri et al. Aug 2014 A1
20140267294 Ma Sep 2014 A1
20140267295 Sharma Sep 2014 A1
20140279824 Tamayo Sep 2014 A1
20140310266 Greenfield Oct 2014 A1
20140316911 Gross Oct 2014 A1
20140324876 Konik et al. Oct 2014 A1
20140333651 Cervelli et al. Nov 2014 A1
20140337772 Cervelli et al. Nov 2014 A1
20140344230 Krause et al. Nov 2014 A1
20140344231 Stowe et al. Nov 2014 A1
20140358829 Hurwitz Dec 2014 A1
20150019394 Unser et al. Jan 2015 A1
20150026622 Roaldson et al. Jan 2015 A1
20150039886 Kahol et al. Feb 2015 A1
20150046870 Goldenberg et al. Feb 2015 A1
20150073954 Braff Mar 2015 A1
20150089353 Folkening Mar 2015 A1
20150089424 Duffield et al. Mar 2015 A1
20150100897 Sun et al. Apr 2015 A1
20150100907 Erenrich et al. Apr 2015 A1
20150106155 Castellanos Apr 2015 A1
20150106347 McGrew et al. Apr 2015 A1
20150106379 Elliot et al. Apr 2015 A1
20150112956 Chang et al. Apr 2015 A1
20150134666 Gattiker et al. May 2015 A1
20150169709 Kara et al. Jun 2015 A1
20150169726 Kara et al. Jun 2015 A1
20150170077 Kara et al. Jun 2015 A1
20150178825 Huerta Jun 2015 A1
20150178877 Bogomolov et al. Jun 2015 A1
20150186483 Tappan et al. Jul 2015 A1
20150186821 Wang et al. Jul 2015 A1
20150187036 Wang et al. Jul 2015 A1
20150212663 Papale et al. Jul 2015 A1
20150213043 Ishii et al. Jul 2015 A1
20150213134 Nie et al. Jul 2015 A1
20150227295 Meiklejohn et al. Aug 2015 A1
20150242397 Zhuang Aug 2015 A1
20150254220 Burr et al. Sep 2015 A1
20150261817 Harris et al. Sep 2015 A1
20150309719 Ma et al. Oct 2015 A1
20150317342 Grossman et al. Nov 2015 A1
20150324868 Kaftan et al. Nov 2015 A1
20150341467 Lim et al. Nov 2015 A1
20160034545 Shankar et al. Feb 2016 A1
20160062555 Ward et al. Mar 2016 A1
20160098176 Cervelli et al. Apr 2016 A1
20160110369 Cervelli et al. Apr 2016 A1
20160147730 Cicerone May 2016 A1
20160162519 Stowe et al. Jun 2016 A1
20160299652 Aymeloglu et al. Oct 2016 A1
20170169244 McGrew et al. Jun 2017 A1
20170177606 Stowe Jun 2017 A1
20180046821 McGrew et al. Feb 2018 A1
20180081896 Stowe Mar 2018 A1
20180104149 Stowe Mar 2018 A1
20190188407 McGrew et al. Jun 2019 A1
Foreign Referenced Citations (53)
Number Date Country
2013251186 Nov 2015 AU
2014206155 Dec 2015 AU
102054015 May 2014 CN
102014103482 Sep 2014 DE
102014215621 Feb 2015 DE
0652513 May 1995 EP
1672527 Jun 2006 EP
2551799 Jan 2013 EP
2555126 Feb 2013 EP
2560134 Feb 2013 EP
2778977 Sep 2014 EP
2835745 Feb 2015 EP
2835770 Feb 2015 EP
2838039 Feb 2015 EP
2846241 Mar 2015 EP
2851852 Mar 2015 EP
2858014 Apr 2015 EP
2858018 Apr 2015 EP
2863326 Apr 2015 EP
2863346 Apr 2015 EP
2869211 May 2015 EP
2881868 Jun 2015 EP
2884439 Jun 2015 EP
2884440 Jun 2015 EP
2891992 Jul 2015 EP
2911078 Aug 2015 EP
2911100 Aug 2015 EP
2940603 Nov 2015 EP
2940609 Nov 2015 EP
2993595 Mar 2016 EP
3002691 Apr 2016 EP
3009943 Apr 2016 EP
3182305 Jun 2017 EP
2516155 Jan 2015 GB
2518745 Apr 2015 GB
2012778 Nov 2014 NL
2013306 Feb 2015 NL
624557 Dec 2014 NZ
WO 2000009529 Feb 2000 WO
WO 01025906 Apr 2001 WO
WO 2001088750 Nov 2001 WO
WO 2002065353 Aug 2002 WO
WO 2005104736 Nov 2005 WO
WO 2007133206 Nov 2007 WO
WO 2008064207 May 2008 WO
WO 2009061501 May 2009 WO
WO 2010000014 Jan 2010 WO
WO 2010030913 Mar 2010 WO
WO 2010030914 Mar 2010 WO
WO 2012025915 Mar 2012 WO
WO 2012119008 Sep 2012 WO
WO 2013010157 Jan 2013 WO
WO 2013102892 Jul 2013 WO
Non-Patent Literature Citations (362)
Entry
Abbey, Kristen, “Review of Google Docs,” May 1, 2007, pp. 2.
Official Communication for European Patent Application No. 14180321.3 dated Apr. 17, 2015.
Official Communication for European Patent Application No. 15190307.7 dated Feb. 19, 2016.
Official Communication for European Patent Application No. 15188106.7 dated Feb. 3, 2016.
Official Communication for European Patent Application No. 14187996.5 dated Feb. 12, 2015.
Official Communication for New Zealand Patent Application No. 628263 dated Aug. 12, 2014.
Official Communication for European Patent Application No. 15155846.7 dated Jul. 8, 2015.
“GrabUp—What a Timesaver!” <http://atlchris.com/191/grabup/>, Aug. 11, 2008, pp. 3.
Microsoft, “Registering an Application to a URI Scheme,” <http://msdn.microsoft.com/en-us/library/aa767914.aspx>, printed Apr. 4, 2009 in 4 pages.
Palmas et al., “An Edge-Bunding Layout for Interactive Parallel Coordinates” 2014 IEEE Pacific Visualization Symposium, pp. 57-64.
Kwout, <http://web.archive.Org/web/20080905132448/http://www.kwout.com/> Sep. 5, 2008, pp. 2.
Official Communication for New Zealand Patent Application No. 622473 dated Jun. 19, 2014.
Manske, “File Saving Dialogs,” <http://www.mozilla.org/editor/ui_specs/FileSaveDialogs.html>, Jan. 20, 1999, pp. 7.
Online Tech Tips, “Clip2Net—Share files, folders and screenshots easily,” <http://www.online-tech-tips.com/free-software-downloads/share-files-folders-screenshots/>, Apr. 2, 2008, pp. 5.
Official Communication for Australian Patent Application No. 2014210604 dated Jun. 5, 2015.
The Apache Cassandra Project.
Keylines.Com, “An Introduction to KeyLines and Network Visualization,” Mar. 2014, <http://keylines.com/wp-content/uploads/2014/03/KeyLines-White-Paper.pdf> downloaded May 12, 2014 in 8 pages.
Yang et al., “HTML Page Analysis Based on Visual Cues”, A129, pp. 859-864, 2001.
European Claims in application No. 08730336.8-1951, dated Oct. 2016, 8 pages.
Bernstein et al., “Hyder—A Transactional Record Manager for Shared Flash”, 5th Biennial Conference on Innovative Data Systems Research (CIDR '11), vol. 12, Asilomar, California, Jan. 9-12, 2011.
Li et al., “Interactive Multimodal Visual Search on Mobile Device,” IEEE Transactions on Multimedia, vol. 15, No. 3, Apr. 1, 2013, pp. 594-607.
Gesher, Ari, “Palantir Screenshots in the Wild: Swing Sightings,” The Palantir Blog, Sep. 11, 2007, pp. 1-12, retrieved from the internet https://www.palantir.com/2007/09/palantir-screenshots/ retrieved on Aug. 18, 2015.
“Hbase-Hbase Home,” downloaded from the internet on Sep. 14, 2011, http://hbase.appache.org, 1 page.
Olanoff, Drew, “Deep Dive with the New Google Maps for Desktop with Google Earth Integration, It's More than Just a Utility,” May 15, 2013, pp. 1-6, retrieved from the internet: http://web.archive.org/web/20130515230641/http://techcrunch.com/2013/05/15/deep-dive-with-the-new-google-maps-for-desktop-with-google-earth-integration-its-more-than-just-a-utility/.
Official Communication for European Patent Application No. 14187739.9 dated Jul. 6, 2015.
Map of San Jose, CA. Retrieved Oct. 2, 2013 from http://maps.bing.com.
Niepert et al., “A Dynamic Ontology for a Dynamic Reference Work”, Joint Conference on Digital Libraries, Jun. 17_22, 2007, Vancouver, British Columbia, Canada, pp. 1-10.
Microsoft, “How Word Creates and Recovers the AutoRecover files,” <http://support.microsoft.com/kb/107686>, Article ID: 107686, printed Feb. 11, 2010 in 3 pages.
Griffith, Daniel A., “A Generalized Huff Model,” Geographical Analysis, Apr. 1982, vol. 14, No. 2, pp. 135-144.
Official Communication for Australian Patent Application No. 2014213553 dated May 7, 2015.
Official Communication for European Patent Application No. 09813695.5 dated Apr. 9, 2014.
Official Communication in New Zealand Application No. 628840 dated Aug. 28, 2014.
Celik, Tantek, “CSS Basic User Interface Module Level 3 (CSS3 UI),” Section 8 Resizing and Overflow, Jan. 17, 2012, retrieved from internet http://www.w3.org/TR/2012/WD-css3-ui-20120117/#resizing-amp-overflow retrieved on May 18, 2015.
Official Communication for European Patent Application No. 09813693.0 dated Apr. 8, 2014.
Official Communication for European Patent Application No. 08730336.8 dated Jun. 28, 2017.
Official Communication for Canadian Patent Application No. 2,677,464 dated Jan. 16, 2013.
Ananiev et al., “The New Modality API,” http://web.archive.org/web/20061211011958/http://java.sun.com/developer/technicalArticles/J2SE/Desktop/javase6/modality/ Jan. 21, 2006, pp. 8.
Huang et al., “Systematic and Integrative Analysis of Large Gene Lists Using DAVID Bioinformatics Resources,” Nature Protocols, 4.1, 2008, 44-57.
“Potential Money Laundering Warning Signs,” snapshot taken 2003, https://web.archive.org/web/20030816090055/http:/finsolinc.com/ANTI-MONEY%20LAUNDERING%20TRAINING%20GUIDES.pdf.
GIS-NET 3 Public _ Department of Regional Planning. Planning & Zoning Information for Unincorporated La County. Retrieved Oct. 2, 2013 from http://gis.planning.lacounty.gov/GIS-NET3_Public/Viewer.html.
Official Communication for Australian Patent Application No. 2014202442 dated Mar. 19, 2015.
Official Communication for European Patent Application No. 14189802.3 dated May 11, 2015.
Ask Drexel University Knowledge Base, “How to: Auto Save a Document Before Printing in Word 2007,” published Nov. 13, 2007.
Baker et al., “Megastore: Providing Scalable, Highly Available Storage for Interactive Services”, 5th Biennial Conference on Innovative Data Systems Research (CIDR '11), Asilomar, California, Jan. 9-12, 2011.
Official Communication for Australian Patent Application No. 2012203606 dated Jan. 22, 2014.
Definition “Overlay”, downloaded Jan. 22, 2015, 1 page.
Schroder, Stan, “15 Ways To Create Website Screenshots,” <http://mashable.com/2007/08/24/web-screenshots/>, Aug. 24, 2007, pp. 2.
Shi et al., “A Scalable Implementation of Malware Detection Based on Network Connection Behaviors,” 2013 International Conference on Cyber-Enabled Distributed Computing Knowledge Discovery, IEEE, Oct. 10, 2013, pp. 59-66.
Manno et al., “Introducing Collaboration in Single-user Applications through the Centralized Control Architecture,” 2010, pp. 10.
Kokossi et al., “D7-Dynamic Ontology Management System (Design)”, Information Societies Technology Programme, pp. 1-27.
Official Communication for European Patent Application No. 14197895.7 dated Apr. 28, 2015.
Wang et al., “Research on a Clustering Data De-Duplication Mechanism Based on Bloom Filter,” IEEE 2010, 5 pages.
Nitro, “Trick: How to Capture a Screenshot as PDF, Annotate, Then Share It,” <http://blog.nitropdf.com/2008/03/04/trick-how-to-capture-a-screenshot-as-pdf-annotate-it-then-share/>, Mar. 4, 2008, p. 2.
Claims for Australian Patent Application No. 2012203606 dated Jan. 2014.
Liu, Tianshun, “Combining GIS and the Huff Model to Analyze Suitable Locations for a New Asian Supermarket in the Minneapolis and St. Paul, Minnesota USA,” Papers in Resource Analysis, 2012, vol. 14, p. 8.
Galliford, Miles, “Snaglt Versus Free Screen Capture Software: Critical Tools for Website Owners,” <http://www.subhub.com/articles/free-screen-capture-software>, Mar. 27, 2008, p. 11.
Official Communication for New Zealand Patent Application No. 622517 dated Apr. 3, 2014.
Antoshenkov, Gennady, “Dictionary-Based Order-Preserving String Compression”, The VLDB Journal, pp. 26-39, 1997.
Keylines.com, “Visualizing Threats: Improved Cyber Security Through Network Visualization,” Apr. 2014, <http://keylines.com/wp-content/uploads/2014/04/Visualizing-Threats1.pdf> downloaded May 12, 2014 in 10 pages.
Ferreira et al., “A Scheme for Analyzing Electronic Payment Systems,” Basil 1997.
Keylines.com, “KeyLines Datasheet,” Mar. 2014, <http://keylines.com/wp-content/uploads/2014/03/KeyLines-datasheet.pdf> downloaded May 12, 2014 in 2 pages.
Official Communication for Canadian Patent Application No. 2831660 dated Jun. 9, 2015.
Official Communication for New Zealand Patent Application No. 628495 dated Aug. 19, 2014.
Umagandhi et al., “Search Query Recommendations Using Hybrid User Profile with Query Logs,” International Journal of Computer Applications, vol. 80, No. 10, Oct. 1, 2013, pp. 7-18.
Official Communication for New Zealand Patent Application No. 622513 dated Apr. 3, 2014.
Official Communication for Great Britain Patent Application No. 1404499.4 dated Aug. 20, 2014.
“Using Whois Based Geolocation and Google Maps API for Support Cybercrime Investigations,” http://wseas.us/e-library/conferences/2013/Dubrovnik/TELECIRC/TELECIRC-32.pdf.
Canese et al., “Chapter 2: PubMed: The Bibliographic Database,” The NCBI Handbook, Oct. 2002, pp. 1-10.
Thompson, Mick, “Getting Started with GEO,” Getting Started with GEO, Jul. 26, 2011.
“Remove a Published Document or Blog Post,” Sharing and Collaborating on Blog Post.
Official Communication for European Patent Application No. 14180432.8 dated Jun. 23, 2015.
Microsoft, “Introduction to Versioning,” <http://office.microsoft.com/en-us/sharepointtechnolgy/HA010021576.aspx?mode=print>, 2007 in 3 pages.
Official Communication for Great Britain Patent Application No. 1408025.3 dated Nov. 6, 2014.
Hibbert et al., “Prediction of Shopping Behavior Using a Huff Model Within a GIS Framework,” Healthy Eating in Context, Mar. 18, 2011, pp. 16.
Microsoft Office—Visio, “Add and glue connectors with the Connector tool,” <http://office.microsoft.com/en-us/visio-help/add-and-glue-connectors-with-the-connector-tool-HA010048532.aspx?CTT=l> printed Aug. 4, 2011 in 1 page.
Symantec Corporation, “E-Security Begins with Sound Security Policies,” Announcement Symantec, Jun. 14, 2001.
Warren, Christina, “TUAW Faceoff: Screenshot apps on the firing line,” <http://www.tuaw.com/2008/05/05/tuaw-faceoff-screenshot-apps-on-the-firing-line/>, May 5, 2008, p. 11.
Official Communication for New Zealand Patent Application No. 622473 dated Mar. 27, 2014.
Official Communication for Australian Patent Application No. 2013251186 dated Mar. 12, 2015.
“A First Look: Predicting Market Demand for Food Retail using a Huff Analysis,” TRF Policy Solutions, Jul. 2012, p. 30.
Notice of Acceptance for Australian Patent Application No. 2013251186 dated Nov. 6, 2015.
Microsoft, “Using the Clipboard,” <http://msdn.microsoft.com/en-us/library/ms649016.aspx>, printed Jun. 8, 2009 in 20 pages.
Devanbu et al., “Authentic Third-party Data Publication”, http://www.cs.ucdavis.edu/˜devanbu/authdbpub.pdf, p. 19, 2000.
Azad, Khalid, “A Visual Guide to Version Control,” <http://betterexplained.com/articles/a-visual-guide-to-version-control/>, Sep. 27, 2007 in 11 pages.
Official Communication for Great Britain Patent Application No. 1404457.2 dated Aug. 14, 2014.
Hansen et al., “Analyzing Social Media Networks with NodeXL: Insights from a Connected World”, Chapter 4, pp. 53-67 and Chapter 10, pp. 143-164, published September.
Official Communication for Netherlands Patent Application No. 2012438 dated Sep. 21, 2015.
Amnet, “5 Great Tools for Visualizing Your Twitter Followers,” posted Aug. 4, 2010, http://www.amnetblog.com/component/content/article/115-5-grate-tools-for-visualizing-your-twitter-followers.html.
SnagIt, “SnagIt Online Help Guide,” <http://download.techsmith.com/snagit/docs/onlinehelp/enu/snagit_help.pdf>, TechSmith Corp., Version 8.1, printed Feb. 7, 2007, p. 284.
Hogue et al., “Thresher: Automating the Unwrapping of Semantic Content from the World Wide Web”, 14th International Conference on World Wide Web, WWW 2005: Chiba, Japan, May 10-14, 2005.
Official Communication for Netherlands Patent Application No. 2012436 dated Nov. 6, 2015.
Adams et al., “Worklets: A Service-Oriented Implementation of Dynamic Flexibility in Workflows,” R. Meersman, Z. Tari et al. (Eds.): OTM 2006, LNCS, 4275, pp. 291-308, 2006.
Definition “Identify”, downloaded Jan. 22, 2015, 1 page.
Bugzilla@Mozilla, “Bug 18726—[feature] Long-click means of invoking contextual menus not supported,” http://bugzilla.mozilla.org/show_bug.cgi?id=18726 printed Jun. 13, 2013 in 11 pages.
Official Communication for European Patent Application No. 14180142.3 dated Feb. 6, 2015.
Microsoft—Developer Network, “Getting Started with VBA in Word 2010,” Apr. 2010, <http://msdn.microsoft.com/en-us/library/ff604039%28v=office.14%29.aspx> as printed Apr. 4, 2014 in 17 pages.
Official Communication for European Patent Application No. 14199182.8 dated Mar. 13, 2015.
About 80 Minutes, “Palantir in a Number of Parts—Part 6—Graph,” Mar. 21, 2013, pp. 1-6, retrieved from the internet http://about80minutes.blogspot.nl/2013/03/palantir-in-No. of-parts-part-6-graph.html retrieved on Aug. 18, 2015.
Chen et al., “Bringing Order to the Web: Automatically Categorizing Search Results,” CHI 2000, Proceedings of the SIGCHI conference on Human Factors in Computing Systems, Apr. 1-6, 2000, The Hague, The Netherlands, pp. 145-152.
Official Communication for European Patent Application No. 14197879.1 dated Apr. 28, 2015.
Claims for European Patent Application No. 12173312.5 dated Jun. 2012.
Anonymous, “BackTult—JD Edwards One World Version Control System”, in 1 page, Jul. 23, 2007.
Official Communication for Canadian Patent Application No. 2,677,464 dated Mar. 19, 2012.
Hua et al., “A Multi-attribute Data Structure with Parallel Bloom Filters for Network Services”, HiPC 2006, LNCS 4297, pp. 277-288, 2006.
Dramowicz, Ela, “Retail Trade Area Analysis Using the Huff Model,” Directions Magazine, Jul. 2, 2005 in 10 pages, http://www.directionsmag.com/articles/retail-trade-area-analysis-using-the-huff-model/123411.
Official Communication for European Patent Application No. 14158861.6 dated Jun. 16, 2014.
Alur et al., “Chapter 2: IBM InfoSphere DataStage Stages,” IBM InfoSphere DataStage Data Flow and Job Design, Jul. 1, 2008, pp. 35-137.
Official Communication for European Patent Application No. 12181585.6 dated Sep. 4, 2015.
Official Communication for Australian Patent Application No. 2014210614 dated Jun. 5, 2015.
Official Communication for Netherlands Patent Application No. 2013306 dated Apr. 24, 2015.
Official Communication for European Patent Application No. 14159464.8 dated Jul. 31, 2014.
Nolan et al., “MCARTA: A Malicious Code Automated Run-Time Analysis Framework,” Homeland Security, 2012 IEEE Conference on Technologies for, Nov. 13, 2012, pages.
Rouse, Margaret, “OLAP Cube,” <http://searchdatamanagement.techtarget.com/definition/OLAP-cube>, Apr. 28, 2012.
Goswami, Gautam, “Quite Writly Said!,” One Brick at a Time, Aug. 21, 2005, pp. 7.
Elmasri et al., “Fundamentals of Database Systems”, Fourth Edition, pp. 455-491, 2004.
Official Communication for European Patent Application No. 14159464.8 dated Aug. 20, 2014.
Palantir Technologies, “Palantir Labs—Timeline,” Oct. 1, 2010, retrieved from the internet https://www.youtube.com/watch?v=JCgDW5bru9M.
Official Communication for European Patent Application No. 15165244.3 dated Aug. 27, 2015.
Perdisci et al., “Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces,” USENIX, Mar. 18, 2010, pp. 1-14.
Official Communication for European Patent Application No. 14159464.8 dated Sep. 22, 2014.
Official Communication for Great Britain Patent Application No. 1404489.5 dated Aug. 27, 2014.
Official Communication for Australian Patent Application No. 2014250678 dated Jun. 17, 2015.
Nierman, “Evaluating Structural Similarity in XML Documents”, 6 pages, 2002.
Official Communication for European Patent Application No. 14191540.5 dated May 27, 2015.
Official Communication for European Patent Application No. 14186225.0 dated Feb. 13, 2015.
Wollrath et al., “A Distributed Object Model for the Java System,” Conference on Object-Oriented Technologies and Systems, Jun. 17-21, 1996, pp. 219-231.
Microsoft, “Managing Versions and Checking Documents In and Out (Windows SharePoint Services 2.0),” <http://technet.microsoft.com/en-us/library/cc287876.aspx>, Aug. 22, 2005 in 2 pages.
Miklau et al., “Securing History: Privacy and Accountability in Database Systems”, 3rd Biennial Conference on Innovative Data Systems Research (CIDR), pp. 387-396, Asilomar, California, Jan. 7-10, 2007.
Official Communication for New Zealand Patent Application No. 627962 dated Aug. 5, 2014.
“A Word About Banks and the Laundering of Drug Money,” Aug. 18, 2012, http://www.golemxiv.co.uk/2012/08/a-word-about-banks-and-the-laundering-of-drug-money/.
Official Communication for Great Britain Patent Application No. 1404486.1 dated Aug. 27, 2014.
Klemmer et al., “Where Do Web Sites Come From? Capturing and Interacting with Design History,” Association for Computing Machinery, CHI 2002, Apr. 20-25, 2002, Minneapolis, MN, pp. 8.
Official Communciation for Great Britain Patent Application No. 1411984.6 dated Dec. 22, 2014.
Microsoft Office—Visio, “About connecting shapes,” <http://office.microsoft.com/en-us/visio-help/about-connecting-shapes-HP085050369.aspx> printed Aug. 4, 2011 in 6 pages.
International Search Report and Written Opinion for Patent Application No. PCT/US2009/056700 dated Apr. 19, 2010.
Mentzas et al. “An Architecture for Intelligent Assistance in the Forecasting Process,” Proceedings of the Twenty-Eighth Hawaii International Conference on System Sciences, Jan. 3-6, 1995, vol. 3, pp. 167-176.
Apache HBase.
Thomson et al., “The Case for Determinism in Database Systems”, The 36th International Conference on Very Large Data Bases, Proceedings of the VLDB Endowment, vol. 3, Issue No. 1, p. 11, Singapore, Sep. 13-17, 2010.
Official Communication for European Patent Application No. 14189344.6 dated Feb. 20, 2015.
European Patent Office, “Search Report” in application No. 08730336.8-1951, dated Oct. 19, 2016, 4 pages.
Official Communication for European Patent Application No. 13170952.9 dated Jan. 21, 2014.
Official Communication for European Patent Application No. 15175106.2 dated Nov. 5, 2015.
Boyce, Jim, “Microsoft Outlook 2010 Inside Out,” Aug. 1, 2010, retrieved from the internet https://capdtron.files.wordpress.com/2013/01/outlook-2010-inside_out.pdf.
Microsoft Windows, “Microsoft Windows Version 2002 Print Out 2,” 2002, pp. 1-6.
Wikipedia, “Federated Database System,” Sep. 7, 2013, retrieved from the internet on Jan. 27, 2015 http://en.wikipedia.org/w/index.php?title=Federated_database_system&oldid=571954221.
Official Communication for Great Britain Patent Application No. 1413935.6 dated Jan. 27, 2015.
Map of San Jose, CA. Retrieved Oct. 2, 2013 from http://maps.yahoo.com.
Conner, Nancy, “Google Apps: The Missing Manual,” May 1, 2008, p. 15.
Official Communication for European Patent Application No. 15175151.8 dated Nov. 25, 2015.
International Search Report and Written Opinion in Application No. PCT/US2009/056703, dated Mar. 15, 2010.
Wright et al., “Palantir Technologies VAST 2010 Challenge Text Records _ Investigations into Arms Dealing,” Oct. 29, 2010, pp. 1-10.
Gu et al., “Record Linkage: Current Practice and Future Directions,” Jan. 15, 2004, pp. 32.
Official Communication for Netherlands Patent Application No. 2011729 dated Aug. 13, 2015.
Official Communication for European Patent Application No. 08730336.8 dated Jun. 6, 2012.
Official Communication for European Patent Application No. 151832721.8 dated Nov. 23, 2015.
“Money Laundering Risks and E-Gaming: A European Overview and Assessment,” 2009, http://www.cf.ac.uk/socsi/resources/Levi_Final_Money_Laundering_Risks_egaming.pdf.
Huff et al., “Calibrating the Huff Model Using ArcGIS Business Analyst,” ESRI, Sep. 2008, pp. 33.
Official Communication for New Zealand Patent Application No. 624557 dated May 14, 2014.
Acklen, Laura, “Absolute Beginner's Guide to Microsoft Word 2003,” Dec. 24, 2003, pp. 15-18, 34-41, 308-316.
Beverley, Bill, “Windows Tips & Tricks,” <http://alamopc.org/pcalamode/columns/beverley/bb0301.shtml>, Mar. 2001 in 5 pages.
Quest, “Toad for ORACLE 11.6—Guide to Using Toad,” Sep. 24, 2012, pp. 1-162.
Chung, Chin-Wan, “Dataplex: An Access to Heterogeneous Distributed Databases,” Communications of the ACM, Association for Computing Machinery, Inc., vol. 33, No. 1, Jan. 1, 1990, pp. 70-80.
Official Communication for European Patent Application No. 15183721.8 dated Nov. 23, 2015.
Official Communication for European Patent Application No. 14189347.9 dated Mar. 4, 2015.
Chaudhuri et al., “An Overview of Business Intelligence Technology,” Communications of the ACM, Aug. 2011, vol. 54, No. 8.
Official Communication for New Zealand Patent Application No. 628161 dated Aug. 25, 2014.
Peng et al., “Large-scale Incremental Processing Using Distributed Transactions and Notifications”, Proceedings of the 9th USENIX Symposium on Operating Systems Design and Implementation, USENIX, p. 14, 2010.
Huff, David L., “Parameter Estimation in the Huff Model,” ESRI, ArcUser, Oct.-Dec. 2003, pp. 34-36.
Official Communication for European Patent Application No. 15155845.9 dated Oct. 6, 2015.
“Refresh CSS Ellipsis When Resizing Container—Stack Overflow,” Jul. 31, 2013, retrieved from internet http://stackoverflow.com/questions/17964681/refresh-css-ellipsis-when-resizing-container, retrieved on May 18, 2015.
Official Communication for European Patent Application No. 14197938.5 dated Apr. 28, 2015.
Delcher et al., “Identifying Bacterial Genes and Endosymbiont DNA with Glimmer,” BioInformatics, vol. 23, No. 6, 2007, pp. 673-679.
Hardesty, “Privacy Challenges: Analysis: It's Surprisingly Easy to Identify Individuals from Credit-Card Metadata,” MIT News on Campus and Around the World, MIT News Office, Jan. 29, 2015, 3 pages.
Official Communication for New Zealand Patent Application No. 628585 dated Aug. 26, 2014.
Bluttman et al., “Excel Formulas and Functions for Dummies,” 2005, Wiley Publishing, Inc., pp. 280, 284-286.
Notice of Acceptance for Australian Patent Application No. 2014250678 dated Oct. 7, 2015.
JetScreenshot.com, “Share Screenshots via Internet in Seconds,” <http://web.archive.org/web/20130807164204/http://www.jetscreenshot.com/>, Aug. 7, 2013, pp. 1.
Official Communication for European Patent Application No. 14180281.9 dated Jan. 26, 2015.
Map of San Jose, CA. Retrieved Oct. 2, 2013 from http://maps.google.com.
Chang et al., “Bigtable: A Distributed Storage System for Structured Data”, Google, Inc., OSDI'06: Seventh Symposium on Operating System Design and Implementation, Seattle, WA, Nov. 2006.
G. Antoshenkov et al., Order Preserving String Compression, dated 1996, IEEE, pp. 655-663.
Official Communication for European Patent Application No. 12173312.5 dated Oct. 25, 2012.
International Search Report for International Patent Application No. PCT/US2008/054511 dated Jul. 31, 2008.
O'Reilly.com, http://oreilly.com/digitalmedia/2006/01/01/mac-os-x-screenshot-secrets.html published Jan. 1, 2006 in 10 pages.
Sigrist, et al., “PROSITE, a Protein Domain Database for Functional Characterization and Annotation,” Nucleic Acids Research, 2010, vol. 38, pp. D161-D166.
Sirotkin et al., “Chapter 13: The Processing of Biological Sequence Data at NCBI,” The NCBI Handbook, Oct. 2002, pp. 1-11.
Mizrachi, Ilene, “Chapter 1: GenBank: The Nuckeotide Sequence Database,” The NCBI Handbook, Oct. 2002, pp. 1-14.
Official Communication for Great Britain Patent Application No. 1404574.4 dated Dec. 18, 2014.
Official Communication for Netherlands Patent Application No. 2012437 dated Sep. 18, 2015.
Kitts, Paul, “Chapter 14: Genome Assembly and Annotation Process,” The NCBI Handbook, Oct. 2002, pp. 1-21.
“A Quick Guide to UniProtKB Swiss-Prot & TrEMBL,” Sep. 2011, pp. 2.
“The FASTA Program Package,” fasta-36.3.4, Mar. 25, 2011, pp. 29.
Madden, Tom, “Chapter 16: The BLAST Sequence Analysis Tool,” The NCBI Handbook, Oct. 2002, pp. 1-15.
Kahan et al., “Annotea: an Open RDF Infrastructure for Shared Web Annotations”, Computer Networks, Elsevier Science Publishers B.V., vol. 39, No. 5, dated Aug. 5, 2002.
Official Communication for European Patent Application No. 16204594.2 dated May 18, 2017.
Official Communication for European Patent Application No. 9813695.5 dated Jan. 25, 2019.
Official Communication for European Patent Application No. 08730336.8 dated Feb. 19, 2018.
Official Communication for European Patent Application No. 19161201.9 dated Apr. 5, 2019.
U.S. Appl. No. 14/134,558, filed Dec. 19, 2013, Office Action, dated Oct. 7, 2015.
U.S. Appl. No. 13/831,791, filed Mar. 15, 2013, Office Action, dated Mar. 4, 2015.
U.S. Appl. No. 13/831,791, filed Mar. 15, 2013, Final Office Action, dated Aug. 6, 2015.
U.S. Appl. No. 14/473,552, filed Aug. 29, 2014, Interview Summary, dated Feb. 24, 2015.
U.S. Appl. No. 14/135,289, filed Dec. 19, 2013, Notice of Allowance, dated Oct. 14, 2014.
U.S. Appl. No. 13/839,026, filed Mar. 15, 2013, Restriction Requirement, dated Apr. 2, 2015.
U.S. Appl. No. 14/225,006, filed Mar. 24, 2014, Final Office Action, dated Sep. 2, 2015.
U.S. Appl. No. 13/827,491, filed Mar. 14, 2013, Office Action, dated Oct. 9, 2015.
U.S. Appl. No. 14/319,765, filed Jun. 30, 2014, Final Office Action, dated Jun. 16, 2015.
U.S. Appl. No. 14/306,147, filed Jun. 16, 2014, Final Office Action, dated Feb. 19, 2015.
U.S. Appl. No. 14/225,006, filed Mar. 25, 2014, First Action Interview, dated Feb. 27, 2015.
U.S. Appl. No. 14/306,154, filed Jun. 16, 2014, Advisory Action, dated May 15, 2015.
U.S. Appl. No. 14/225,160, filed Mar. 24, 2014, Final Office Action, dated Feb. 11, 2015.
U.S. Appl. No. 14/306,138, filed Jun. 16, 2014, Office Action, dated May 26, 2015.
U.S. Appl. No. 14/148,568, filed Jan. 6, 2014, Notice of Allowance, dated Aug. 26, 2015.
U.S. Appl. No. 14/326,738, filed Jul. 9, 2014, Notice of Allowance, dated Nov. 18, 2015.
U.S. Appl. No. 14/473,552, filed Aug. 29, 2014, Notice of Allowance, dated Jul. 24, 2015.
U.S. Appl. No. 13/669,274, filed Nov. 5, 2012, Final Office Action, dated May 6, 2015.
U.S. Appl. No. 14/715,834, filed May 19, 2015, Office Action Interview, dated Apr. 13, 2016.
U.S. Appl. No. 14/504,103, filed Oct. 1, 2014, First Action Interview, dated Feb. 5, 2015.
U.S. Appl. No. 14/306,147, filed Jun. 16, 2014, First Action Interview, dated Sep. 9, 2014.
U.S. Appl. No. 14/225,160, filed Mar. 25, 2014, First Office Action Interview, dated Jul. 29, 2014.
U.S. Appl. No. 14/148,568, filed Jan. 6, 2014, Office Action, dated Mar. 26, 2015.
U.S. Appl. No. 13/196,788, filed Aug. 2, 2011, Interview Summary, dated Nov. 25, 2015.
U.S. Appl. No. 13/167,680, filed Jun. 23, 2011, Notice of Allowance, dated Mar. 7, 2014.
U.S. Appl. No. 14/319,765, filed Jun. 30, 2014, First Office Action Interview, dated Nov. 25, 2014.
U.S. Appl. No. 14/323,935, filed Jul. 3, 2014, Office Action, dated Jun. 22, 2015.
U.S. Appl. No. 14/225,006, filed Mar. 25, 2014, First Office Action Interview, dated Sep. 10, 2014.
U.S. Appl. No. 14/323,935, filed Jul. 3, 2014, First Office Action Interview, dated Nov. 28, 2014.
U.S. Appl. No. 14/616,080, filed Feb. 6, 2015, Notice of Allowance, dated Apr. 2, 2015.
U.S. Appl. No. 14/571,098, filed Dec. 15, 2014, First Office Action Interview, dated Aug. 5, 2015.
U.S. Appl. No. 14/222,364, filed Mar. 21, 2014, Office Action, dated Dec. 9, 2015.
U.S. Appl. No. 14/306,147, filed Jun. 16, 2014, Office Action, dated Aug. 7, 2015.
U.S. Appl. No. 14/289,599, filed May 28, 2014, Advisory Action, dated Sep. 4, 2015.
U.S. Appl. No. 14/639,606, filed Mar. 5, 2015, First Office Action Interview, dated Jul. 24, 2015.
U.S. Appl. No. 14/225,084, filed Mar. 25, 2014, Office Action, dated Sep. 11, 2015.
U.S. Appl. No. 14/225,084, filed Mar. 25, 2014, First Office Action Interview, dated Sep. 2, 2014.
U.S. Appl. No. 14/289,599, filed May 28, 2014, Final Office Action, dated May 29, 2015.
U.S. Appl. No. 14/486,991, filed Sep. 15, 2014, Notice of Allowance, dated May 1, 2015.
U.S. Appl. No. 12/556,318, filed Jun. 16, 2014, Office Action, dated Jul. 2, 2015.
U.S. Appl. No. 14/196,814, filed Mar. 4, 2014, Office Action, dated May 5, 2015.
U.S. Appl. No. 14/961,481, filed Dec. 7, 2015, Office Action Interview, dated Mar. 2, 2016.
U.S. Appl. No. 14/741,256, filed Jun. 16, 2015, Office Action, dated Feb. 9, 2016.
U.S. Appl. No. 12/556,321, filed Sep. 9, 2009, Office Action, dated Jul. 7, 2015.
U.S. Appl. No. 14/306,154, filed Jun. 16, 2014, Final Office Action, dated Mar. 11, 2015.
U.S. Appl. No. 14/268,964, filed May 2, 2014, First Office Action Interview, dated Sep. 3, 2014.
U.S. Appl. No. 14/631,633, filed Feb. 25, 2015, First Office Action Interview, dated Sep. 10, 2015.
U.S. Appl. No. 13/826,228, filed Mar. 14, 2013, Notice of Allowance, dated Mar. 27, 2015.
U.S. Appl. No. 14/746,671, filed Jun. 22, 2015, First Office Action Interview, dated Nov. 12, 2015.
U.S. Appl. No. 14/975,215, filed Dec. 18, 2015, First Office Action Interview, dated May 19, 2016.
U.S. Appl. No. 14/800,447, filed Jul. 15, 2012, Final Office Action, dated Jun. 6, 2016.
U.S. Appl. No. 13/835,688, filed Mar. 15, 2013, First Office Action Interview, dated Jun. 17, 2015.
U.S. Appl. No. 14/726,353, filed May 29, 201, First Office Action Interview, dated Sep. 10, 2015.
U.S. Appl. No. 14/294,098, filed Jun. 2, 2014, Final Office Action, dated Nov. 6, 2014.
U.S. Appl. No. 14/319,765, filed Jun. 30, 2014, First Office Action Interview, dated Feb. 4, 2015.
U.S. Appl. No. 14/326,738, filed Jul. 9, 2014, First Office Action Interview, dated Mar. 31, 2015.
U.S. Appl. No. 14/225,084, filed Mar. 25, 2014, Notice of Allowance, dated May 4, 2015.
U.S. Appl. No. 14/813,749, filed Jul. 30, 2015, Office Action, dated Sep. 28, 2015.
U.S. Appl. No. 14/579,752, filed Dec. 22, 2014, First Office Action Interview, dated May 26, 2015.
U.S. Appl. No. 14/676,621, filed Apr. 1, 2015, Notice of Allowance, dated Feb. 10, 2016.
U.S. Appl. No. 14/883,498, filed Oct. 14, 2015, First Office Action Interview, dated Dec. 24, 2015.
U.S. Appl. No. 14/319,765, filed Jun. 30, 2014, First Action Interview, dated Nov. 25, 2014.
U.S. Appl. No. 14/225,160, filed Mar. 24, 2014, Office Action, dated Aug. 12, 2015.
U.S. Appl. No. 14/490,612, filed Sep. 18, 2014, Final Office Action, dated Aug. 18, 2015.
U.S. Appl. No. 14/225,084, filed Mar. 25, 2014, First Action Interview, dated Feb. 20, 2015.
U.S. Appl. No. 14/326,738, filed Jul. 9, 2014, First Action Interview, dated Dec. 2, 2014.
U.S. Appl. No. 14/473,860, filed Aug. 29, 2014, Notice of Allowance, dated Jan. 5, 2015.
U.S. Appl. No. 13/196,788, filed Aug. 2, 2011, Notice of Allowance, dated Dec. 18, 2015.
U.S. Appl. No. 14/842,734, filed Sep. 1, 2015, First Office Action Interview, dated Nov. 19, 2015.
U.S. Appl. No. 14/479,160, filed Sep. 5, 2014, First Office Action Interview, dated Apr. 20, 2016.
U.S. Appl. No. 14/294,098, filed Jun. 2, 2014, First Office Action Interview, dated Aug. 15, 2014.
U.S. Appl. No. 14/451,221, filed Aug. 4, 2014, Notice of Allowance, dated Aug. 4, 2015.
U.S. Appl. No. 14/225,006, filed Mar. 25, 2014, First Office Action Interview, dated Feb. 27, 2015.
U.S. Appl. No. 14/504,103, filed Oct. 1, 2014, Notice of Allowance, dated May 18, 2015.
U.S. Appl. No. 13/747,170, filed Jan. 22, 2013, Notice of Allowance, dated Apr. 4, 2014.
U.S. Appl. No. 14/579,752, filed Dec. 22, 2014, Final Office Action, dated Aug. 19, 2015.
U.S. Appl. No. 14/225,160, filed Mar. 25, 2014, Final Office Action, dated Feb. 11, 2015.
U.S. Appl. No. 14/306,154, filed Jun. 16, 2014, Final Office Action, dated Nov. 16, 2015.
U.S. Appl. No. 14/326,738, filed Jul. 9, 2014, First Action Interview, Dec. 2, 2014.
U.S. Appl. No. 14/746,671, filed Jun. 22, 2015, Notice of Allowance, dated Jan. 21, 2016.
U.S. Appl. No. 13/247,987, filed Sep. 28, 2011, Office Action, dated Apr. 2, 2015.
U.S. Appl. No. 14/552,336, filed Nov. 24, 2014, Notice of Allowance, dated Nov. 3, 2015.
U.S. Appl. No. 14/225,160, filed Mar. 25, 2014, First Office Action Interview, dated Oct. 22, 2014.
U.S. Appl. No. 14/225,160, filed Mar. 25, 2014, Advisory Action, dated May 20, 2015.
U.S. Appl. No. 14/306,138, filed Jun. 16, 2014, First Office Action Interview, dated Sep. 23, 2015.
U.S. Appl. No. 14/486,991, filed Sep. 15, 2014, Office Action, dated Mar. 10, 2015.
U.S. Appl. No. 13/167,680, filed Jun. 23, 2011, Office Action, dated Sep. 26, 2012.
U.S. Appl. No. 13/839,026, filed Mar. 15, 2013, Office Action, dated Aug. 4, 2015.
U.S. Appl. No. 14/504,103, filed Oct. 01, 2014, First Office Action Interview, dated Mar. 31, 2015.
U.S. Appl. No. 14/639,606, filed Mar. 5, 2015, Final Office Action, dated Oct. 16, 2015.
U.S. Appl. No. 14/726,211, filed May 29, 2015, Office Action, dated Apr. 5, 2016.
U.S. Appl. No. 14/323,935, filed Jul. 3, 2014, First Office Action Interview, dated Mar. 31, 2015.
U.S. Appl. No. 14/715,834, filed May 19, 2015, First Office Action Interview, dated Feb. 19, 2016.
U.S. Appl. No. 14/265,637, filed Apr. 30, 2014, Notice of Allowance, dated Feb. 13, 2015.
U.S. Appl. No. 14/289,596, filed May 28, 2014, Advisory Action, dated Apr. 30, 2015.
U.S. Appl. No. 14/225,084, filed Mar. 25, 2014, First Office Action Interview, dated Feb. 20, 2015.
U.S. Appl. No. 14/451,221, filed Aug. 4, 2014, Ex Parte Quayle Action, dated Apr. 6, 2015.
U.S. Appl. No. 14/289,596, filed May 28, 2014, Final Office Action, dated Jan. 26, 2015.
U.S. Appl. No. 15/438,453, filed Feb. 21, 2017, Notice of Allowance, dated May 10, 2017.
U.S. Appl. No. 14/571,098, filed Dec. 15, 2014, First Office Action Interview, dated Nov. 10, 2015.
U.S. Appl. No. 13/247,987, filed Sep. 28, 2011, Office Action, dated Sep. 22, 2015.
U.S. Appl. No. 12/556,321, filed Sep. 9, 2009, Final Office Action, dated Feb. 25, 2016.
U.S. Appl. No. 14/800,447, filed Jul. 15, 2012, First Office Action Interview, dated Dec. 10, 2010.
U.S. Appl. No. 14/639,606, filed Mar. 5, 2015, First Office Action Interview, dated May 18, 2015.
U.S. Appl. No. 13/167,680, filed Jun. 23, 2011, Final Office Action, dated Mar. 13, 2013.
U.S. Appl. No. 14/578,389, filed Dec. 20, 2014, Notice of Allowance, dated Oct. 7, 2016.
U.S. Appl. No. 14/102,394, filed Dec. 10, 2013, Notice of Allowance, dated Aug. 25, 2014.
U.S. Appl. No. 14/715,834, filed May 19, 2015, First Office Action Interview, dated Mar. 14, 2016.
U.S. Appl. No. 14/294,098, filed Jun. 2, 2014, Notice of Allowance, dated Dec. 29, 2014.
U.S. Appl. No. 14/289,599, filed May 28, 2014, First Office Action Interview, dated Jul. 22, 2014.
U.S. Appl. No. 14/148,568, filed Jan. 6, 2014, Final Office Action, dated Oct. 22, 2014.
U.S. Appl. No. 13/669,274, filed Nov. 5, 2012, Office Action, dated May 2, 2016.
U.S. Appl. No. 14/192,767, filed Feb. 27, 2014, Notice of Allowance, dated Dec. 16, 2014.
U.S. Appl. No. 14/289,596, filed May 28, 2014, First Office Action Interview, dated Jul. 18, 2014.
U.S. Appl. No. 14/306,138, filed Jun. 16, 2014, Final Office Action, dated Sep. 14, 2015.
U.S. Appl. No. 14/306,138, filed Jun. 16, 2014, Interview Summary, dated Dec. 3, 2015.
U.S. Appl. No. 14/306,154, filed Jun. 16, 2014, Office Action, dated Jul. 6, 2015.
U.S. Appl. No. 14/108,187, filed Dec. 16, 2013, Notice of Allowance, dated Aug. 29, 2014.
U.S. Appl. No. 13/669,274, filed Nov. 5, 2012, Advisor Action, dated Aug. 26, 2015.
U.S. Appl. No. 14/268,964, filed May 2, 2014, Notice of Allowance, dated Dec. 3, 2014.
U.S. Appl. No. 14/306,138, filed Jun. 16, 2014, Final Office Action, dated Feb. 18, 2015.
U.S. Appl. No. 12/556,318, filed Sep. 9, 2009, Notice of Allowance, dated Apr. 11, 2016.
U.S. Appl. No. 14/552,336, filed Nov. 24, 2014, First Office Action Interview, dated Jul. 20, 2015.
U.S. Appl. No. 14/578,389, filed Dec. 20, 2014, Office Action, dated Oct. 21, 2015.
U.S. Appl. No. 14/571,098, filed Dec. 15, 2014, First Office Action Interview, dated Aug. 24, 2015.
U.S. Appl. No. 13/196,788, filed Aug. 2, 2011, Office Action, dated Oct. 23, 2015.
U.S. Appl. No. 14/578,389, filed Dec. 20, 2014, Office Action, dated Apr. 22, 2016.
U.S. Appl. No. 13/167,680, filed Jun. 23, 2011, Ex-Parte Quayle Office Action, dated May 23, 2013.
U.S. Appl. No. 12/556,318, filed Sep. 9, 2009, Notice of Allowance, dated Nov. 2, 2015.
U.S. Appl. No. 14/306,154, filed Jun. 16, 2014, First Office Action Interview, dated Sep. 9, 2014.
U.S. Appl. No. 14/451,221, filed Aug. 4, 2014, Office Action, dated Oct. 21, 2014.
U.S. Appl. No. 14/580,218, filed Dec. 23, 2014, Office Action, dated Jun. 26, 2015.
U.S. Appl. No. 14/996,179, filed Jan. 14, 2016, Notice of Allowance, dated Oct. 24, 2016.
U.S. Appl. No. 14/278,963, filed May 15, 2014, Notice of Allowance, dated Sep. 2, 2015.
U.S. Appl. No. 14/734,772, filed Jun. 9, 2015, First Office Action Interview, dated Jul. 24, 2015.
U.S. Appl. No. 14/734,772, filed Jun. 9, 2015, First Office Action Interview, dated Oct. 30, 2015.
U.S. Appl. No. 11/709,462, filed Feb. 21, 2007, Final Office Action, dated Jan. 7, 2011.
U.S. Appl. No. 14/746,671, filed Jun. 22, 2015, First Office Action Interview, dated Sep. 28, 2015.
U.S. Appl. No. 14/961,830, filed Dec. 7, 2015, Office Action, dated May 20, 2016.
U.S. Appl. No. 14/849,454, filed Sep. 9, 2015, Notice of Allowance, dated May 25, 2016.
U.S. Appl. No. 14/278,963, filed May 15, 2014, Final Office Action, dated Jan. 30, 2015.
U.S. Appl. No. 11/709,462, filed Feb. 21, 2007, Final Office Action, dated Mar. 26, 2010.
U.S. Appl. No. 11/709,462, filed Feb. 21, 2007, Office Action, dated May 25, 2012.
U.S. Appl. No. 14/883,498, filed Oct. 14, 2015, Office Action, dated Mar. 17, 2016.
U.S. Appl. No. 14/800,447, filed Jul. 15, 2015, Interview Summary, dated Mar. 3, 2016.
U.S. Appl. No. 11/709,462, filed Feb. 21, 2007, Final Office Action, dated Dec. 2, 2012.
U.S. Appl. No. 11/709,462, filed Feb. 21, 2007, Notice of Allowance, dated Aug. 27, 2014.
U.S. Appl. No. 14/841,338, filed Aug. 31, 2015, Office Action, dated Feb. 18, 2016.
U.S. Appl. No. 14/571,098, filed Dec. 15, 2014, First Office Action Interview, dated Mar. 11, 2015.
U.S. Appl. No. 14/734,772, filed Jun. 9, 2015, Notice of Allowance, dated Apr. 27, 2016.
U.S. Appl. No. 11/709,462, filed Feb. 21, 2007, Office Action, dated Oct. 13, 2009.
U.S. Appl. No. 11/709,462, filed Feb. 21, 2007, Office Action, dated Sep. 1, 2010.
U.S. Appl. No. 14/871,465, filed Sep. 30, 2015, First Office Action Interview, dated Apr. 11, 2016.
U.S. Appl. No. 13/827,491, filed Mar. 14, 2013, Final Office Action, dated Jun. 22, 2015.
U.S. Appl. No. 14/871,465, filed Sep. 30, 2015, First Office Action Interview, dated Feb. 9, 2016.
U.S. Appl. No. 15/446,917, filed Mar. 1, 2017, Notice of Allowance, dated Aug. 24, 2017.
U.S. Appl. No. 15/446,917, filed Mar. 1, 2017, Office Action, dated Apr. 21, 2017.
U.S. Appl. No. 15/824,096, filed Nov. 28, 2017, Notice of Allowance, dated Apr. 30, 2019.
U.S. Appl. No. 15/824,096, filed Nov. 28, 2017, Office Action dated Apr. 30, 2019.
U.S. Appl. No. 15/824,096, filed Nov. 28, 2017, Final Office Action, dated Feb. 7, 2019.
U.S. Appl. No. 15/183,371, filed Jun. 15, 2016, Office Action, dated Apr. 6, 2018.
U.S. Appl. No. 15/690,099, filed Aug. 29, 2017, Office Action, dated Jun. 8, 2018.
U.S. Appl. No. 15/690,099, filed Aug. 29, 2017, Notice of Allowance, dated Nov. 2, 2018.
U.S. Appl. No. 14/996,179, filed Jan. 14, 2016, First Office Action Interview, dated May 20, 2016.
Related Publications (1)
Number Date Country
20190384747 A1 Dec 2019 US
Continuations (5)
Number Date Country
Parent 15824096 Nov 2017 US
Child 16548803 US
Parent 15446917 Mar 2017 US
Child 15824096 US
Parent 14961830 Dec 2015 US
Child 15446917 US
Parent 14451221 Aug 2014 US
Child 14961830 US
Parent 13167680 Jun 2011 US
Child 14451221 US