please the court the secular presents to claim construction errors in the board's anticipation rulings and the i p r below claim twenty six of the patent at issue is the only independent claim involved in this appeal claim twenty six are sites eight data collection and processing center and of relevance of this appeal at risk requires that the data collection and processing center a do two things first be capable of doing doing two things that is  an anomaly and then to do so in a particular way that is by analyzing data entering into a plurality of hosts servers and computer sites the analyzing the data step the board chair below is too broadly construed that claim to allow the instance where information about the data track and the network traffic to satisfy that limitation and to understand yes can i just says s s so i mean here the common claim construction issue between the two cases can be summarized maybe you even have summarized that are the board has is whether in direct analysis of data by the central unit even when the central unit doesn't i think that will summarize it so in addition why is that not one reasonable understanding of analyzing data in something like the same way that the term medical analysis is used as i understand it you can correct me if i'm wrong to refer to analyzing data by analyzing earlier studies of that data even if the direct data is not presented to the med analyst i'm not sure the see and the board at the core said that's not really quite right you can reasonably say the central unit analyzes data by analyzing and then our says even if it doesn't if it gets only the results of th servers into pure sites so data about that they are metadata are not the data that entered into the host servers and computer sites and the specification is consistent and supports that reading for example column seven and one of the advantages of the invention it's important to keep in mind is that in the prior art approach you would have these distributed network modules they did their own isolated or module host based intrusion detection and they report the fact of an anomaly to some other component of the system the advantage of the zero eight four patent was that you could get a broader scope of protection by looking at data from many of the summaries that they did that are provided by the purple computers in the case of the porch reference which is in the second i b m appeal i don't believe that there are substantial evidence that shows what's in fact in those anomaly reports there's a description of what the anomaly is which includes summaries of the data that's received is that will i think it's wrong and that that has not been shown that the summaries that are provided these anomaly reports in the course reference in fact contain the same data that were delivered to the network modules it's a different case with reference which is the prior art here and there in the winter same data has to be raw data can't be that seems to me that's what your post vission that's right but the only point in the reply brief there is that we're not requiring that every data packet in a pack of a system be delivered to the centralized processor but you have to have some of it at least as drafted in claim twenty s they're receiving the raw data and they s a long summaries of the raw data to the central computer that's right and that's not the same data that they receive that's the question of whether that falls within the plan and it is your hon respect leon that we see it differently and i and the prosecution history shows that what is required is raw data to be delivered to the centralized processor and i think your arch question also got some of the data that enter the network is written in oxman there is a disclosure that some of the reports that go from the notes to the central server do include some of the data and i want to address that head on and that's why the debt to finding an anomaly limitation is important here the patent makes a distinction between anomaly detection and then subsequent steps of classifying the anomaly as a as a real threat real intrusion or a false alarm and if you look to the pat four doesn't use that raw data or analyze that raw data to detect an anomaly so the claims require that the data collection processing center do two things it's got to detect the anomalies and then in the way it does so must involve analyzing the exceptions and do not reflect actual security problems what that suggests is that detecting the initial unusual traffic pattern or signature that is the an omelet detection that's different than determining whether the unusual traffic is in fact potentially harmful and we can see another example that and the description of figure for return to content of the zero eight for patent and it says the intrusion detection portion of the system receives data from the various intrusion detection systems on the network and analyzes this to detect an attempted intrusion to detect an attempt attempted intrusion or intrusion reconnaissance activity and then it says the data is logged and analyzed if an intrusion is detected and alerts lock so it's making a section in the detection of the anomaly and then what would happen if it turns out that anomaly is in fact a true threat and then it triggers things like adjusting the sensitivity of firewalls alerting network modules adjusting anomaly detection sets a charity and alarm threshold so if we look for example at claim twenty seven in addition to detecting anomaly the central processor can determine which of the devices that so in the briefing the argument from intellectual ventures was that the plain meaning of the claim requires the narrow sense of what it means to monitor or the data and analyze that they ha detect intrusions this morning morphed a little bit into more of a cross q sion disclaimer type argument that wasn't raised below but i believe the thrust of their their argument for this court is that the plain meaning of analyzing data entering into a plurality of host servers in computer sites requires that there be this first hand analysis for that data at the raw data and there's no support in playing an ordinary meeting that claim language with these limitations and in fact if we turn to the zero eight for patent and we look to the for patent for guidance is what what does it mean when it when it says that the data collection processing center is monitoring data and analyzing the data to detect  receives information from various network devices attached to a computer network for example all communications can be sent to the central server that a connection processes and or it also says later in column seven that it says that suspicious network traffic events are collected and potentially in context and forwarded to a central database an analysis engine in the central centralized engine uses pattern correlation across multiple customers event intrusions and then another yet another way of performing these functions that write you about it starts at the bottom of collimate now it says that the president mentioned monitors the traffic from your alley of customers and continuing tallinn nine line for the data that set this data from existing customers conventional intrusion detection systems this provided at the central central database and then analyze these data records encompass these multiple alternative ways of getting the data from that remote hosts back to the central central server associated with a known intrusion pattern or technique a particular file name or file type associated with a known intrusion pattern or technique or other similar types of information and it was not so it's clear here that the anomal sent this was a collection of data that was received is sent back and central server is analyzed determine if it constitutes an actual anomaly now i don't lecture ventures argues that what happens at the central server is is that the server want to for can also use possible security problems reported by all the agents one of six one there and to help detect intrusion pat patterns detect intrusion techniques and other security problems that is intrusion section other examples paragraph fifty and this is what the board referred to as the direct it actually i haven't but and there it's talks about after that after logging the anomaly you add that to the collection of security information that you used for this network based approach and once in and then you can go on and do your general intrusion detection actions it's caught intrusion detection actions such as actions going in can include monitoring all of the incoming data other packets you can recognize attack patterns report possible intrusions and soft so how this isn't detecting anomalies is is beyond me but if you look at paragraph seventy seven that the whole in a detailed description of an actual the actual configuration for the for the network server one of four it describes that it has a quote anomaly detection mechanism five twenty this is that at the central no so it's it's the plane and express disclosure of the absolute reference clearly teaches that what's going on is you're receiving information from the no central server is looking at that information with the benefit of a broader source of of network events that it's cracked and and it's determining whether or not there is an anomaly or an intrusion that suppose hypothetically that the central computer get only one thing which was to count the number detected by the peripheral computers and then made a decision as to what action to take based on that would with that being within the scope of closure in one the central server simpl and if we look first to the healthy around line thirty says second upon detection of suspected reconnaissance probing the detection process adjust its matching parameters in alarm thresholds to focus sensitivity on attacks from suspected sources and it begins with specific targets and doesn't it doesn't support this this portion of  terms to describe the situation where we've now seen the central server is now seen that there is the security problem in the future we're going to keep and have a we're going to be on the lookout for the security problem and so certain parameters have to be information arriving at its respective client terminals so they're informed of the nominee and they can check for that anomaly and then in fifty four it's updating the firewall one twelve in the notification of anomaly hope may include updating the collection of corporate security data one twenty two include information about the anomaly modifying security procedures to account for the anomaly or performing other similar tasks so your modify necrosis security procedures to account for the anomaly in if we've now detected in the only we've added that to our collective knowledge of potential problems and were able to account for the anomaly by modifying our security procedures it's justified from one skill now it's perspective that means you've adjusted anomaly detection sensitivity what else that mean in alarm thresholds they overlooked the more unfortunately i overlooked that portion of the testimony there were some other claims that had the same even a claim limitation and so that was addressed in an earlier portion of his petition testimony on whether claim thirty three wouldn't to supported by ox math and i think if you read the opinion it century said that congress didn't make out its burden and it's fair to see clear to see why if we look at the joint appendix six one fo board overlooked what was provided in paragraph one forty five that's not a fair criticism the board's final written decision cited paragraph one seventy eight if we see here one seventy eight refers back to the analysis not standing  features that are provided in thirty three if you put that up against dr cocytus as the board that did i don't remember dr goldstein say here are other measures that the system could this means and your doctor also like saying i don't see that these but basically i don't see these words and absent and they haven't explained why these words are present the more that kind of testimony that i have read out smith and i'm and i tell you doesn't withstand the logical conclusion that one would reach reading or got fifty to fifty four of ops message along with that interpretation of those provisions provided by d