When Does a Database Update Become a Patentable Invention?

BT Americas Inc. v. Palo Alto Networks, Inc. 

Federal Circuit • No. 2025-1572 • October 29, 2026 • Affirmed 

The issue in one minute 

The patent describes a network-monitoring system that sorts incoming network activity, sets aside events it cannot confidently classify, sends relevant information for further review, and uses feedback from that review to change the rules used by the monitoring probe. The dispute was whether earlier technology already taught the important parts of that process. 

Palo Alto Networks petitioned for inter parties review (IPR). The PTAB found the challenged claims obvious over earlier references, principally Duvall and Chu. BT Americas, the patent owner before the Board, appealed. The Federal Circuit affirmed the Board’s decision. 

1. What the patented system does 

Picture a company network handling thousands of connections. A monitoring system sees events such as a device connecting to an external server, a user opening a website, or an application sending data. The system’s job is not to send every event to a security analyst. It first tries to sort the events automatically. 

The patent’s architecture can be understood as a sequence of decisions. A sensor collects network information. A probe examines it using filtering rules. Some events can be dealt with by the rules; others remain uncertain and are passed along for deeper analysis. Feedback from that analysis can then be used to change the probe’s rules while it is still running. 

2. How the sorting and filtering actually work 

The patent discusses filtering in stages. The point is to reduce a very large stream of network events to the smaller set that deserves attention. 

A simple example 

Suppose an employee’s computer connects to a server. The probe reads the connection details and checks them against its filtering rules. If a rule says that this destination is trusted, the traffic may be allowed. If a rule identifies it as prohibited, it may be blocked. If the rules do not give a clear answer, the event can be held for further examination instead of being automatically treated as harmless. 

Now suppose an analyst reviews that unresolved event and concludes that the destination should be blocked. The system’s feedback process can lead to a change in the filtering database. When the probe later sees the same destination—or traffic matching the revised rule—it can make a different decision without waiting for the analyst to review every repeated event. 

Important limit: This example illustrates the operation described by the patent and the Board’s reasoning. It is not a claim that the patent specifies this exact user scenario or a particular machine-learning algorithm. The key mechanism discussed in the case is rule-based filtering and changing the rules used by the probe. 

3. The key claim: what must the invention be able to do? 

Patent claims are the legal boundaries of the invention. Claim 1 includes sensors, filtering, further analysis of unresolved information, an analyst system, a feedback receiver and a modification-control system. 

The decisive wording in claim 1: “a modification control system for dynamically modifying an analysis capability of the probe during operation thereof based on the received feedback.” 

What does that phrase mean in everyday technical terms? 

Break it into three parts: 

• “Based on the received feedback” — The system receives a result or instruction from the review process. The probe is not changing its rules for no reason; the feedback is the trigger or basis for the change. 
• “Modifying an analysis capability” — The change must affect how the probe examines or classifies network activity. If the probe uses a database of filtering rules, changing those operative rules can change the decisions it makes. 
• “During operation” — The probe does not have to be shut down and rebuilt before its analysis rules can change. The claimed capability is to make the change while the monitoring system is running. 

In plain terms: the system learns from a review decision in the operational sense that its working rules are updated, and it uses those changed rules when it processes later network activity. The patent language does not, by itself, mean that the system uses modern machine learning or retrains an AI model. 

4. What had already been disclosed before this patent? 

The Board compared the claimed arrangement with earlier publications. It relied principally on Duvall and Chu for the core obviousness analysis. 

Duvall: filtering by rules that can be edited 

Duvall, U.S. Patent No. 5,884,033, describes an internet filtering system. It uses rules to decide whether data should be allowed, blocked or deferred for later action. It also describes an Editing Manager that can add, delete or modify filtering rules. 

Technically, that means the system’s decision process is controlled by a rule set. Change the rule set and the system may classify the next item differently. That is the important overlap with the patent’s idea of changing the probe’s analysis capability. 

Chu: human input when a trust decision is unresolved 

Chu’s 1997 MIT research on trust management discusses mechanisms such as blacklists and whitelists, and user intervention when a trust decision cannot be resolved automatically. The Board relied on this teaching as relevant to the patent’s use of human review and feedback for unresolved information. 

5. Why the Board considered the earlier technology similar 

The Board did not say that Duvall was the same product as the patented network-intrusion system. It asked whether the earlier teachings, considered together, supplied the functions that the claims required. 

The central reasoning is straightforward: Duvall already had a filtering system whose rules could be edited. Chu described human intervention in unresolved trust decisions. The Board concluded that combining these teachings would have provided a skilled person with the claimed filtering, review and rule-update arrangement. 

6. The real technical disagreement: is changing a database the same as changing the probe? 

BT Americas argued that editing a database did not necessarily modify the probe’s analysis capability. Its position drew a distinction between changing information stored in a database and changing the way the probe itself analyses network activity. 

The Board focused on what the database did. If the probe consults that database to decide how to filter network events, the database is part of the probe’s decision mechanism. Changing an operative rule can therefore change the probe’s behaviour. The Board also relied on evidence that database updates could be made while the system was operating. 

The Federal Circuit held that substantial evidence supported the Board’s finding. It did not establish a universal rule that every database update changes an invention’s analytical capability. Its conclusion was tied to the evidence and the way the filtering database functioned in this case. 

7. What the Federal Circuit decided 

The Federal Circuit reviewed the ultimate obviousness conclusion de novo and the Board’s underlying factual findings for substantial evidence. It rejected the principal challenges and affirmed. 

• Dynamic modification: The record supported the finding that changing the operative filtering database while the system was running could change the probe’s filtering or analysis capability. 
• Security Operations Center and claim 6: The court found the Board’s explanation of the analyst-system functionality adequate, including the roles of the SOC-side analysis and the probe-side system. 
• Expired patent and IPR jurisdiction: The court rejected the argument that patent expiration prevented the PTAB from conducting the IPR, applying Apple Inc. v. Gesture Technology Partners, 127 F.4th 364 (Fed. Cir. 2025). 

The opinion is designated nonprecedential. It is best understood as a case-specific affirmance, not a new binding rule about database updates or IPR jurisdiction over expired patents. 

8. What companies should take from this case 

For companies developing cybersecurity, fraud detection, content moderation or other rule-driven software, the case shows why a patent application should explain the technical mechanism—not only the business result. If the asserted advance is that a system improves after feedback, the application should make clear what is changed, where the change is applied, how it alters later processing, and what is technically different from existing rule-update systems. 

For an in-house IP team reviewing a competitor’s patent, the same questions work in reverse: identify the actual decision mechanism, locate earlier systems that used comparable rules or feedback, and test whether the claim adds a technical step that the earlier systems did not teach. 

9. Patent validity screening questions 

1. What exactly does the software examine—packets, URLs, addresses, user actions, transaction records, or another type of data? 
2. How does it classify that data: fixed rules, a database lookup, thresholds, a statistical model, or a combination? 
3. Were those filtering or classification rules already disclosed in an earlier patent, paper, product manual or public system? 
4. Did earlier technology already defer uncertain items for a second review? 
5. Was human review or user feedback already used to resolve uncertain decisions in this field? 
6. Does the patent explain how feedback changes the system’s later operation, or does it merely claim the result of being “dynamic” or “adaptive”? 
7. If a database is updated, does that update actually change the system’s decision process, or does it only change stored records that do not control the claimed analysis? 
8. Would a skilled engineer have had a reason to combine the identified prior-art teachings? 
9. Are the alleged technical improvements actually required by the claims, or are they only described in the specification? 
10. If commercial success or praise is relied on, can it be tied to the specific claimed technical features? 

These questions are an initial screening framework, not a legal conclusion. A proper invalidity analysis requires a claim-by-claim review, verified prior-art references, the correct priority date, claim construction and evidence addressing the applicable legal standard. 

Rightium takeaway 

The patent’s central mechanism can be pictured as a live rule-based monitoring loop: collect network events, test them against filters, isolate unresolved events, review them, and use feedback to update the rules that govern later decisions. 

The Board found that Duvall’s editable filtering rules and Chu’s teachings on trust decisions and human intervention supplied the important pieces of that loop. The Federal Circuit found sufficient evidence to support the Board’s findings and affirmed. The practical patent lesson is to identify and claim the precise technical step that makes a feedback-driven system different from an already-known system with editable rules. 

Sources 

• Federal Circuit opinion, No. 2025-1572 (Oct. 29, 2026): https://www.cafc.uscourts.gov/opinions-orders/25-1572.OPINION.10-29-2026_2778774.pdf 
• PTAB Final Written Decision, IPR2023-00889 (Nov. 7, 2024): https://www.sternekessler.com/app/uploads/2024/11/IPR2023-00889-2024-11-07-32-Final-Written-Decision.pdf 
• U.S. Patent No. 7,895,641 B2: https://patents.google.com/patent/US7895641B2/en 
• Duvall, U.S. Patent No. 5,884,033: https://patents.google.com/patent/US5884033A/en 
• USPTO Patent Trial and Appeal Case Tracking: https://ptacts.uspto.gov/ 

Editorial note: The party roles stated in the background follow the PTAB caption: Palo Alto Networks was the IPR petitioner and BT Americas was the patent owner before the Board. The Federal Circuit opinion is non-precedential.