DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on June 2nd, 2026 has been entered.
Response to Arguments
Applicant’s arguments regarding claims 1-20 have been considered. Applicant argues that the combination of Roundy and Muddu does not teach the newly added limitations concerning a router policy change that disables communication between applications associated with different computing domains. The present rejection additionally relies on [REFERENCE], which teaches these limitations, as set forth above. Accordingly, Applicant’s arguments directed to the alleged deficiencies of Roundy and Muddu do not overcome the rejection as presently formulated.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 10-14, and 18-19 are rejected under 35 U.S.C. 103 as being unpatentable over US Patent 9,256,739 (Roundy et al; Roundy) in view of US Patent 10,116, 670 (Muddu et al; Muddu), further in view of US Pre-Grant Patent 2020/0106744 (Miriyala et al; Miriyala).
Regarding claim 1 and analogous claims 14 and 19:
Roundy teaches:
1. A computer-implemented method for cross-environment event correlation, the computer-implemented method comprising: determining, [using one or more machine learning techniques,] one or more correlated events about an issue related to a technical problem or an incident occurring to computing network elements across a plurality of computing domains of a cloud native environment, to facilitate a corrective action to the technical problem or incident;
(Roundy, col. 5: 49-56)
“As illustrated in FIG. 1, exemplary system 100 may also include one or more databases, such as database 120. In one example, database 120 may store information about one or more suspicious events (e.g., suspicious events 122) [i.e. A computer-implemented method for cross-environment event correlation, the method comprising:], information about suspiciousness scores associated with actors and/or suspicious events (e.g., suspiciousness scores 124), and/or information about one or more correlation graphs (e.g., event-correlation graphs 126) [i.e. determining one or more correlated events about an issue related to a technical problem or an incident occurring to computing network elements across a plurality of computing domains].”
(Roundy, col. 20: 20-22)
“In some examples, all or a portion of exemplary system 100 in FIG. 1 may represent portions of a cloud-computing or network-based environment [i.e. of a cloud native environment,].”
2. wherein the determining of the one or more correlated events controls to facilitate a corrective action to the technical problem or the incident;
(Roundy, col. 13: 4-7)
“In some examples, upon generating a procedure for remediating an effect of an attack on a computing system, remediating module 108 may automatically apply the procedure to remediate the effect of the attack [i.e. wherein the determining of the one or more correlated events controls to facilitate a corrective action to the technical problem or the incident;].”
3. extracting a set of knowledge data of the technical problem or the incident of the computing network elements, determined from the one or more correlated events;
(Roundy, col. 5: 49-56)
“As illustrated in FIG. 1, exemplary system 100 may also include one or more databases, such as database 120. In one example, database 120 may store information about one or more suspicious events (e.g., suspicious events 122), information about suspiciousness scores associated with actors and/or suspicious events (e.g., suspiciousness scores 124) [i.e. extracting a set of knowledge data of the technical problem or an incident issue of the computing network elements, determined from the one or more correlated events;], and/or information about one or more correlation graphs (e.g., event-correlation graphs 126).”
3. grouping the one or more correlated events into one or more event groups to represent a relationship with the technical problem or the incident issue of the computing network elements;
(Roundy, col. 8: 48-55)
“For example, constructing module 106 may, as part of server 206 in FIG. 2, construct, in response to the detection of suspicious event 222 involving the first actor, event-correlation graph 230 that includes node 232 that represents the first actor, node 234 that represents a second actor, and edge 236 that interconnects node 232 and node 234 and represents suspicious event 224 involving the first actor and the second actor [i.e. grouping the correlated events into one or more event groups to represent a relationship with the technical problem].”
4. and improving computing operation in the plurality of computing domains by providing the one or more event groups of the one or more correlated events with an explanation about a cause of the technical problem or an incident issue of the computing network elements for the one or more correlated events, wherein the providing of the one or more event groups with the explanation is based on the logical reasoning description.
(Roundy, col. 10:14-25)
“Upon constructing event-correlation graph 500 in FIG. 5, constructing module 106 may construct event-correlation graph 600 in FIG. 6 from event-correlation graph 500 by (1) identifying additional suspicious events that involve the actors represented in event-correlation graph 500 (e.g., “viux.exe” and “wscntfy.exe”) [i.e. for the one or more correlated events based on the logical reasoning description.] and (2) adding, for each identified suspicious event, a representation of the suspicious event to event-correlation graph 600. For example, constructing module 106 may identify, for “viux.exe” represented by node 402 in event-correlation graph 500, a set of suspicious events that involve “viux.exe” and one of executables “iexplorer.exe,” “bot.exe,” and “explorer.exe. [i.e. and improving computing operation in the plurality of computing domains by providing the one or more event groups of correlated events with an explanation about a cause of the technical problem].”
Examiner notes that the claim language states that the explanation is about “a cause” of the technical problem, which can be interpreted as including merely the potential executables under BRI.
Roundy does not explicitly teach:
1. [A computer-implemented method for cross-environment event correlation, the computer-implemented method comprising: determining,] using one or more machine learning techniques, [one or more correlated events about an issue related to a technical problem or an incident occurring to computing network elements across a plurality of computing domains to facilitate a corrective action to the technical problem or incident;]
2. generating a correlation graph comprising a knowledge graph of the extracted set of knowledge data to trace the technical problem or an incident issue of the computing network elements;
3. constructing a logical reasoning description based on the generated correlation graph for a domain-space exploration, wherein: the domain-space exploration includes a combining of entities which includes linking information regarding similar nodes that connect across the technical problem or the incident, the extracting of the set of knowledge data, and the generating of the knowledge graph, and the logical reasoning description comprises
4. the logical reasoning description comprises how the technical problem or the incident in the first computing domain of the plurality of computing domains affects the second computing domain of the plurality of computing domains
Muddu teaches:
1. [A computer-implemented method for cross-environment event correlation, the computer-implemented method comprising: determining,] using one or more machine learning techniques, [one or more correlated events about an issue related to a technical problem or an incident occurring to computing network elements across a plurality of computing domains to facilitate a corrective action to the technical problem or incident;]
2. generating a correlation graph comprising a knowledge graph of the extracted set of knowledge data to trace the technical problem or an incident issue of the computing network elements;
(Muddu, col. 24: 27-37)
“FIGS. 9A and 9B show an example event relationship discovery and recordation technique, which can be implemented in the data intake and preparation stage. To facilitate description, FIGS. 9A and 9B are explained below with reference to FIG. 8. The relationship discovery and recordation technique can be performed by, for example, the relationship graph generator 810. Specifically, after the entities are identified in the tokens, the relationship graph generator 810 is operable to identify a number of relationships between the entities, and to explicitly record these relationships between the entities [i.e. generating a correlation graph comprising a knowledge graph of the extracted set of knowledge data]
(Muddu, col. 24: 57-64)
“Such a table of identifiable relationship may be customizable and provides the flexibility to the administrator to tailor the system to his data sources (described above). Possible relationships can include, for example, “connects to,” “uses,” “runs on,” “visits,” “uploads,” “downloads,” “successfully logs onto,” “restarts,” “shuts down,” “unsuccessfully attempts to log onto,” “attacks,” and “infects [i.e. to trace the technical problem or an incident issue of the computing network elements;].””
3. constructing a logical reasoning description based on the generated correlation graph for a domain-space exploration related to how the technical problem or an incident issue in one domain affects another domain of the plurality of domains;
(Muddu, col. 24: 52-54)
“In some implementations, the graph generator 810 can identify a relationship between entities involved in an event based on the actions that are performed by one entity with respect to another entity [i.e. constructing a logical reasoning description based on the generated correlation graph]. For example, the graph generator 810 can identify a relationship based on comparing the action with a table of identifiable relationships [i.e. for a domain-space exploration related to how the technical problem or an incident issue in one domain affects another domain of the plurality of domains;].”
4. the logical reasoning description comprises how the technical problem or the incident in the first computing domain of the plurality of computing domains affects the second computing domain of the plurality of computing domains
(Muddu, col. 24:57-65-col. 25:1-2; col. 25:7-10)
“Such a table of identifiable relationship may be customizable and provides the flexibility to the administrator to tailor the system to his data sources (described above). Possible relationships can include, for example, “connects to,” “uses,” “runs on,” “visits,” “uploads,” “downloads,” “successfully logs onto,” “restarts,” “shuts down,” “unsuccessfully attempts to log onto,” “attacks,” and “infects [i.e. the logical reasoning description comprises how the technical problem].” Also, the identified relationship between the entities can be indicative of the action, meaning that the identifiable relationship can include the action and also any suitable inference that can be made from the action…[i.e. in the first computing domain of the plurality of computing domains]. Also, identifiable relationships can include a relationship between entities of the same type (e.g., two users) or entities of different types (e.g., user and device) [i.e. affects the second computing domain of the plurality of computing domains].”
Neither Roundy nor Muddu teaches:
1. the technical problem or the incident comprises a policy change of a router between a first application running on a virtual machine of a first physical server, and a second application running on a second physical server,
2. the policy change of the router disables communication between the first application and the second application,
3. the router corresponds to a first computing domain of the plurality of computing domains,
4. the first application corresponds to a second computing domain of the plurality of computing domains,
Miriyala teaches:
1. the technical problem or the incident comprises a policy change of a router between a first application running on a virtual machine of a first physical server, and a second application running on a second physical server,
(Miriyala, ¶0024)
“In the example of FIG. 1, data center 10A includes a set of storage systems and application servers, including server 12A through server 12X (collectively “servers 12”) interconnected via high-speed switch fabric 20 provided by one or more tiers of physical network switches and routers”
(Miriyala, ¶0027)
“Data center 10A includes an overlay network that extends switch fabric 20 from physical switches 18, 16 to software or “virtual” switches. For example, virtual routers 30A-30X located in servers 12A-12X, respectively, may extend the switch fabric 20 by communicatively coupling with one or more of the physical switches located within the switch fabric 20 [i.e. of a router between a first application running on a virtual machine of a first physical server, and a second application running on a second physical server,].”
(Miriyala, ¶0125)
“To update policies for a particular object or group of objects, an administrator may instruct policy controller 23 to distribute new policies to policy agents 139 of respective VN agents 35 of a plurality of data centers 10 [i.e. the technical problem or the incident comprises a policy change].”
2. the policy change of the router disables communication between the first application and the second application,
(Miriyala, ¶0056)
“Each of the plurality of application firewall policies comprises one or more application firewall policy rules, and each of the one or more application firewall policy rules defines whether one of VR agents 35 should allow or deny a traffic flow for a respective workload 37 [i.e. the policy change of the router disables communication between the first application and the second application,].”
3. the router corresponds to a first computing domain of the plurality of computing domains,
(Miriyala, ¶0021)
“FIG. 1 illustrates one example implementation of computer network system 8 and a data center 10A that hosts one or more cloud-based computing networks, computing domains or projects, generally referred to herein as cloud computing cluster [i.e. the router corresponds to a first computing domain of the plurality of computing domains,].”
4. the first application corresponds to a second computing domain of the plurality of computing domains,
(Miriyala, ¶0091)
“Further, the administrator may desire to prevent network traffic between web process 304A (e.g., operating within development environment 310A of data center 10A) and API process 306B (e.g., operating within production environment 314A of data center 10A) or between web process 304A (e.g., operating within development environment 310A of data center 10A) and API process 306C (e.g., operating within development environment 310B of data center 10B) [i.e. the first application corresponds to a second computing domain of the plurality of computing domains,].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu and Miriyala. The motivation to combine Roundy with Muddu is to substitute Roundy’s generic correlation-graph input with an internally generated knowledge-graph representation, which would have predictably improved Roundy’s analysis by incorporating the graph within the system as a whole because “[t]hese databases allow rapid reconstruction of the anomalies and all of their supporting data” (Muddu, col. 18:8-11).
One of ordinary skill in the art would further have been motivated to modify the combination of Roundy and Muddu with Miriyala to incorporate policy-controlled virtual-router communications, thereby providing known network-policy events for correlation and analysis and improving management of communication policies across computing domains, because Miriyala teaches that its techniques “greatly reduce the complexity and simplify management of such policies” (Miriyala, ¶ [0125]).
Regarding claim 2:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Muddu teaches:
1. wherein the determining of the correlated events across the plurality of domains is based on a set of historical data or a set of synthetic data, and the extracting of the set of knowledge data includes extracting one or more of a set of semantic knowledge data or a set of meta-knowledge data.
(Muddu, col. 37:56-63)
“The ML-based CEP engine continuously receives new incoming event feature sets and reacts to each new incoming event feature set by processing it through at least one machine learning model. Because of real-time processing, the ML-based CEP engine can begin to process a time slice of the unbounded stream prior to when a subsequent time slice from the unbounded stream becomes available [i.e. wherein the determining of the correlated events across the plurality of domains is based on a set of historical data].”
(Muddu, col. 38: 10-16)
“The event feature set can include at least a subset of the raw event data; metadata associated with the raw event data; transformed, summarized, and/or normalized representation of portions of the raw event data; derived attributes from portions of the raw event data; labels for portions of the raw event data; or any combination thereof [i.e. and the extracting of the set of knowledge data includes extracting one or more of a set of semantic knowledge data].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu. The motivation is the same as claim 1.
Regarding claim 10:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Muddu teaches:
1. further comprising constructing one or more semantic relationships between the plurality of computing domains.
(Muddu, col. 24: 57-64)
“Such a table of identifiable relationship may be customizable and provides the flexibility to the administrator to tailor the system to his data sources (described above). Possible relationships can include, for example, “connects to,” “uses,” “runs on,” “visits,” “uploads,” “downloads,” “successfully logs onto,” “restarts,” “shuts down,” “unsuccessfully attempts to log onto,” “attacks,” and “infects [i.e. further comprising constructing one or more semantic relationships between the plurality of domains].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu. The motivation is the same as claim 1.
Regarding claim 11:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Muddu teaches:
1. wherein the determining of one or more correlated events about an issue comprises: collecting one or more events, one or more logs, or one or more change records from at least some of the plurality of one or more computing domains;
(Muddu, col. 43: 3-6)
“The ML-based CEP engine 1500 can provide (e.g., stream via a data pipeline) the selected and formatted event feature sets to a model-related process thread of the model type 1602 [i.e. wherein the determining of one or more correlated events about an issue comprises: collecting one or more of an event,... the plurality of one or more computing domains;]”
2. and producing normalized formats of the one or more collected events, one or more logs, or one or more change records.
(Muddu, col. 43: 14-17)
“In some embodiments, the ML-based CEP engine 1500 groups and divides the input data for the model-specific process threads into mutually exclusive partitions [i.e. and producing normalized formats of the one or more collected events,].”
Examiner notes that the term “normalized” is not defined in the specification.
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu and Miriyala.. The motivation is the same as claim 3.
Regarding claim 12:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Muddu teaches:
1. wherein the collecting of the one or more events, the one or more logs, or the one or more change records is performed offline using a simulation.
(Muddu, col. 44: 13-15)
“The model training process logic 1616 defines how the model training process thread 1606 is to transform input data (e.g., one or more event feature sets) into a model state or an update to the model state [i.e. wherein the collecting of the one or more events, the one or more logs, or the one or more change records is performed offline using a simulation.].”
Examiner interprets the “update to a model state” as training data validation, which is a simulation.
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu and Miriyala.. The motivation is the same as claim 1.
Regarding claim 13:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Muddu teaches:
1. wherein the collecting of the one or more events, the one or more logs, or the one or more change record is performed offline using a set of history data.
(Muddu, col. 39: 18-21)
“These run-time states (different from a “model state” as used in this disclosure) represent the history of the entity without having to track every historical event involving the entity [i.e. wherein the collecting of the one or more events, the one or more logs, or the one or more change record is performed offline using a set of history data].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu and Miriyala.. The motivation is the same as claim 1.
Regarding claim 17:
Roundy, Muddu, and Miriyala teach the machine of claim 14.
Muddu teaches:
1. the method further comprising constructing one or more semantic relationships between the plurality of computing domains, and wherein the determining one or more correlated events about an issue comprises:
(Muddu, col. 24: 57-64)
“Such a table of identifiable relationship may be customizable and provides the flexibility to the administrator to tailor the system to his data sources (described above). Possible relationships can include, for example, “connects to,” “uses,” “runs on,” “visits,” “uploads,” “downloads,” “successfully logs onto,” “restarts,” “shuts down,” “unsuccessfully attempts to log onto,” “attacks,” and “infects [i.e. i.e. further comprising constructing one or more semantic relationships between the plurality of domains, and wherein the determining one or more correlated events about an issue comprises:]”
2. collecting one or more of events, one or more logs, one or more metrics, or one or more change records from at least some of the plurality of domains;
(Muddu, col. 43: 3-6)
“The ML-based CEP engine 1500 can provide (e.g., stream via a data pipeline) the selected and formatted event feature sets to a model-related process thread of the model type 1602 [i.e. wherein the determining of one or more correlated events about an issue comprises: collecting one or more of an event,... from at least some of the plurality of domains;]”
3. determining one or more correlated events about the issue by using machine learning techniques;
(Muddu, col. 43: 23-26)
“In one specific example, if the model type topology 1714 specifies users as the entity type, the ML-based CEP engine 1500 groups the selected event feature sets by user groups [i.e. determining one or more correlated events about the issue by using one or more machine learning techniques;].”
4. and producing normalized formats of the one or more collected events, logs, or change records.
(Muddu, col. 43: 14-17)
“In some embodiments, the ML-based CEP engine 1500 groups and divides the input data for the model-specific process threads into mutually exclusive partitions [i.e. and producing normalized formats of the one or more collected events,].”
Examiner notes that the term “normalized” is not defined in the specification.
(Muddu, col. 43: 3-6)
“The ML-based CEP engine 1500 can provide (e.g., stream via a data pipeline) the selected and formatted event feature sets to a model-related process thread of the model type 1602 [i.e. by using machine learning techniques;]
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu and Miriyala. The motivation is the same as claim 1.
Regarding claim 18:
Roundy, Muddu, and Miriyala teach the machine of claim 14.
1. wherein the collecting of one or more events, one or more logs, one or more metrics, or one or more change records is performed offline using a simulation or a set of historical data.
(Muddu, col. 39: 18-21)
“These run-time states (different from a “model state” as used in this disclosure) represent the history of the entity without having to track every historical event involving the entity [i.e. wherein at least the collecting of the event, the log, the metric, or the change record is performed offline using… a set of historical data].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu and Miriyala. The motivation is the same as claim 1.
Regarding claim 20:
Roundy, Muddu, and Miriyala teach the machine of claim 19.
1. the extracting of the set of knowledge data includes extracting one or more of a set of semantic knowledge data or a set of meta-knowledge data,
(Muddu, col. 37:56-63)
“The ML-based CEP engine continuously receives new incoming event feature sets and reacts to each new incoming event feature set by processing it through at least one machine learning model. Because of real-time processing, the ML-based CEP engine can begin to process a time slice of the unbounded stream prior to when a subsequent time slice from the unbounded stream becomes available [i.e. the extracting of the set of knowledge data includes extracting one or more of a set of semantic knowledge data].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy with Muddu and Miriyala.. The motivation is the same as claim 1.
Claims 3-9, and 15-16 are rejected under 35 U.S.C. 103 as being unpatentable over US Patent 9,256,739 (Roundy et al; Roundy) in view of US Patent 10,116,670 (Muddu et al; Muddu) further in view of US Pre-Grant Patent 2020/0106744 (Miriyala et al; Miriyala), further in view of US Pre-Grant Patent 2015/0317337 (Edgar).
Regarding claim 3:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Edgar teaches:
1. wherein the using of one or more machine learning technique includes training by an unsupervised learning technique using an association rule learning algorithm or a clustering algorithm.
(Edgar, ¶0029)
“Alternatively or in addition, one or more data mining and/or machine learning algorithms such as support vector machines, artificial neural networks, hierarchical clustering, linear discriminant analysis, contrast set mining, separating hyperplanes, decision trees, Bayesian analysis, linear classifiers, association rules [i.e. wherein the using of one or more machine learning technique includes training by an unsupervised learning technique using an association rule learning algorithm], self-organizing maps, random forests, etc., can be used to identify pattern(s) in the data.”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy, Muddu, and Miriyala with Edgar. The motivation is to incorporate well-known machine learning techniques into the evaluation of correlations as “…machine learning algorithm…can be used to identify a set of rules that describe what makes a group different (e.g., what is different about things that are defective) (Edgar, ¶0087).”
Regarding claim 4:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Edgar teaches:
1. wherein the using of the one or more machine learning techniques includes training by a supervised learning technique using a set of labeled data associated with a data correlation.
(Edgar, ¶0029)
“Alternatively or in addition, one or more data mining and/or machine learning algorithms such as support vector machines [i.e. wherein using the machine learning includes training by a supervised learning technique using a set of labeled data associated with a data correlation.], artificial neural networks, hierarchical clustering, linear discriminant analysis, contrast set mining, separating hyperplanes, decision trees, Bayesian analysis, linear classifiers, association rules, self-organizing maps, random forests, etc., can be used to identify pattern(s) in the data.”
Examiner notes “A support vector machine (SVM) is a supervised machine learning algorithm that classifies data by finding an optimal line or hyperplane that maximizes the distance between each class in an N-dimensional space.” See attached NPL: What are SVMs?
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy, Muddu, and Miriyala with Edgar. The motivation is the same as claim 3.
Regarding claim 5:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Edgar teaches:
1. further comprising configuring the one or more machine learning techniques by a supervised learning technique selected from a group consisting of a support vector machine (SVM), a convolutional neural network (CNN), or a long-short term memory (LSTM) based on a size of the set of correlation data.
(Edgar, ¶0029)
“Alternatively or in addition, one or more data mining and/or machine learning algorithms such as support vector machines [i.e. further comprising configuring the machine learning by a supervised learning technique using a support vector machine (SVM)… based on a size of the set of correlation data], artificial neural networks, hierarchical clustering, linear discriminant analysis, contrast set mining, separating hyperplanes, decision trees, Bayesian analysis, linear classifiers, association rules, self-organizing maps, random forests, etc., can be used to identify pattern(s) in the data.”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy, Muddu, and Miriyala with Edgar. The motivation is the same as claim 3.
Regarding claim 6:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Edgar teaches:
1. recommending a most probable event among the one or more event groups to users with an explanation about the cause of the technical problem or the incident.
(Edgar, ¶0115)
“Using knowledge-driven analytics, denial cost and return on investment can be characterized, pattern(s) can automatically be discovered in denials, and root cause(s) can be identified. A user can be notified when a difference can be made, and the system can 1) recommend action to be taken to fix a current situation and/or 2) recommend change to avoid future problem [i.e. recommending a most probable event group of correlated events of the one or more event groups to user]. Additionally, emerging trend(s) can be identified, and the system can facilitate response to those trend(s) [i.e. with an explanation about the cause of the incident].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy, Muddu, and Miriyala with Edgar. The motivation is the same as claim 3.
Regarding claim 7 and analogous claim 16:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Edgar teaches:
1. wherein the recommending of the most probable event group, with the explanation of the cause of the technical problem or the incident, is based on performing in a runtime a creating, reading, updating, and deleting (CRUD) of data.
(Edgar, ¶0029)
“Further, one or more database structured query language (SQL) methods such as aggregation, online analytical processing (OLAP) cubes, etc. can be used to identify pattern(s) in the data [i.e. wherein the recommending of the most probable event group, with the explanation of the cause of the technical problem or the incident, is based on performing in a runtime a creating, reading, updating, and deleting (CRUD) of data].”
Examiner notes “The reader may remember these four basic types of action with the memorable acronym C.R.U.D.: Create, Read, Update, Delete. High-level data-base languages have operators which permit these four types of actions.” As the teaching of C.R.U.D. is at a basic level, database languages in general teach this acronym. See attached NPL: Managing the data-base environment, Martin, Ch. 21, pg. 381.
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy, Muddu, and Miriyala with Edgar. The motivation is the same as claim 3.
Regarding claim 8:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Edgar teaches:
1. wherein the using of the one or more machine learning techniques further includes a training of one or more machine learning algorithms based on receiving feedback to train for the determining of the one or more correlated events.
(Edgar, ¶0029)
“Alternatively or in addition, one or more data mining and/or machine learning algorithms such as support vector machines, artificial neural networks, hierarchical clustering, linear discriminant analysis, contrast set mining, separating hyperplanes, decision trees, Bayesian analysis, linear classifiers, association rules, self-organizing maps, random forests, etc., can be used to identify pattern(s) in the data [i.e. wherein the using of the one or more machine learning techniques further includes a training of one or more machine learning algorithms based on receiving feedback to train for the determining of the one or more correlated events].”
Examiner notes that the majority of these listed methods include training operations based on receiving some form of feedback.
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy, Muddu, and Miriyala with Edgar. The motivation is the same as claim 3.
Regarding claim 9:
Roundy, Muddu, and Miriyala teach the method of claim 1.
Muddu teaches:
1. further comprising receiving feedback for the determining of the one or more correlated events by an active learning methodology, wherein the active learning methodology which interactively queries a user or an information source to label new data points with desired outputs.
(Muddu, col. 42: 55-59)
“The model input type configuration 1712 specifies what event views (e.g., described in this disclosure) that the model type 1602 subscribes to [i.e. further comprising receiving feedback for the determining of the one or more correlated events by an active learning methodology]. The event feature sets from the unbounded stream 1502 can be labeled with event view labels corresponding to the event views [i.e. wherein the active learning methodology which interactively queries a user or an information source to label new data points with desired outputs].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy, Muddu, and Miriyala with Edgar. The motivation is the same as claim 3.
Regarding claim 15:
Roundy, Muddu, and Miriyala teach the machine of claim 14.
Muddu teaches:
1. the extracting of the set of knowledge data includes extracting one or more of a set of semantic knowledge data or a set of meta-knowledge data,
(Muddu, col. 37:56-63)
“The ML-based CEP engine continuously receives new incoming event feature sets and reacts to each new incoming event feature set by processing it through at least one machine learning model. Because of real-time processing, the ML-based CEP engine can begin to process a time slice of the unbounded stream prior to when a subsequent time slice from the unbounded stream becomes available [i.e. the extracting of the set of knowledge data includes extracting one or more of a set of semantic knowledge data].”
Edgar teaches:
1. and the method further comprises recommending a most probable event group of correlated events of the one or more event groups to users with an explanation about the technical problem or the incident.
(Edgar, ¶0115)
“Using knowledge-driven analytics, denial cost and return on investment can be characterized, pattern(s) can automatically be discovered in denials, and root cause(s) can be identified. A user can be notified when a difference can be made, and the system can 1) recommend action to be taken to fix a current situation and/or 2) recommend change to avoid future problem [i.e. and the method further comprises recommending a most probable event group of correlated events of the one or more event groups to user]. Additionally, emerging trend(s) can be identified, and the system can facilitate response to those trend(s) [i.e. with an explanation about the cause of the incident].”
One of ordinary skill in the art, at the time the invention was filed, would have been motivated to modify Roundy, Muddu, and Miriyala with Edgar. The motivation is the same as claim 3.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PAUL JUSTIN BREENE whose telephone number is (571)272-6320. Examiner
interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-
based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO
Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Michael J Huntley can be reached on 303-297-4307. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786 9199 (IN USA OR CANADA) or 571-272-1000.
/P.J.B./ Examiner, Art Unit 2129
/MICHAEL J HUNTLEY/Supervisory Patent Examiner, Art Unit 2129
Prosecution Insights