DETAILED ACTION
This office action is responsive to the request for Continued Examination filed 2/6/2026. The application contains claims 1-5, 7-12, 14-19, all examined and rejected.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-5, 7-12, 14-19 are rejected under 35 U.S.C. § 101 because the instant application is directed to non-patentable subject matter. Specifically, the claims are directed toward at least one judicial exception without reciting additional elements that amount to significantly more than the judicial exception. The rationale for this determination is in accordance with the guidelines of USPTO, applies to all statutory categories, and is explained in detail below.
When considering subject matter eligibility under 35 U.S.C. 101, (1) it must be determined whether the claim is directed to one of the four statutory categories of invention, i.e., process, machine, manufacture, or composition of matter. If the claim does fall within one of the statutory categories, (2a) it must then be determined whether the claim is directed to a judicial exception (i.e., law of nature, natural phenomenon, and abstract idea), and if so (2b), it must additionally be determined whether the claim is a patent-eligible application of the exception. If an abstract idea is present in the claim, any element or combination of elements in the claim must be sufficient to ensure that the claim amounts to significantly more than the abstract idea itself. Examples of abstract ideas include certain methods of organizing human activities; a mental processes; and mathematical concepts, (2019 PEG)
STEP 1.
Per Step 1 of the two-step analysis, the claims are determined to be directed to a statutory eligibility category.
Step 2A: Prong One:
The invention is directed to identify anomalies within data which is akin to Mental Process (see Alice), As such, the claims include an abstract idea. When considering the limitations individually and as a whole the limitations directed to the abstract idea are:
determine, for a first time of a first time series, losses of the plurality of firmware versions computed (Mental process, observation, evaluation, and judgment);
determine that a loss of a first firmware version of the plurality of firmware versions exceeds an outlier threshold (Mental process, observation, evaluation, and judgment);
identify, based on the determination that the loss of first firmware version exceeds the outlier threshold, that the first firmware version of the plurality of firmware versions is anomalous across the first time series (Mental process, observation, evaluation, and judgment),
determine a second plurality of firmware versions of the second type of CPE (Mental process, observation, evaluation, and judgment);
identify, that a second firmware version of the second plurality of firmware versions is anomalous across a second time series (Mental process, observation, evaluation, and judgment);
perform a mitigation action to address the anomalous firmware version, the mitigation including updating the plurality of types of CPE to a different firmware version (Mental process, observation, evaluation, and judgment).
Step 2A: Prong Two:
When considering the additional elements, they do not integrate the judicial exception into a practical application. The additional elements are:
A system comprising: at least one processor; and at least one memory storing computer-executable instructions, that when executed by the at least one processor, cause the at least one processor to (do not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer, “the claim invokes computers or other machinery merely as a tool to perform an existing process”, MPEP 2106.05(f)(2)), collect metrics data for a plurality of types of customer-provided equipment (CPE) over a window of time, wherein the metrics data comprises one or more of: interactive voice response (IVR) session data; calls handled data; and truck schedule data (insignificant extra-solution activity, collecting data MPEP 2106.05g); train a first autoencoder for a first type of CPE of the plurality of type of CPE using at least a portion of the metrics data to detect anomalies within a plurality of firmware versions of the first type of CPE, using the first autoencoder (do not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer, “the claim invokes computers or other machinery merely as a tool to perform an existing process”, MPEP 2106.05(f)(2)); store data indicating that the first firmware version of the plurality of firmware versions is anomalous across the first time series (insignificant extra-solution activity, MPEP 2106.05g); train, for a second type of CPE of the plurality of types of CPE, a second autoencoder using at least the portion of the metrics data, and using the second autoencoder (do not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer, “the claim invokes computers or other machinery merely as a tool to perform an existing process”, MPEP 2106.05(f)(2)), store second data indicating that the second firmware version of the plurality of firmware versions is anomalous across the second time series (insignificant extra-solution activity, MPEP 2106.05g).
This judicial exception is not integrated into a practical application. The elements are recited at a high level of generality, i.e. a generic computing system performing generic functions including generic processing of data. Accordingly, the additional elements do not integrate the abstract into a practical application because it does not impose any meaningful limits on practicing the abstract idea. Therefore, the claims are directed to an abstract idea. (2019 Revised Patent Subject Matter Eligibility Guidance ("2019 PEG"). Thus, under Step 2A of the Mayo framework, the Examiner holds that the claims are directed to concepts identified as abstract.
STEP 2B.
Because the claims include one or more abstract ideas, the examiner now proceeds to Step 2B of the analysis, in which the examiner considers if the claims include individually or as an ordered combination limitations that are "significantly more" than the abstract idea itself. This includes analysis as to whether there is an improvement to either the "computer itself," "another technology," the "technical field," or significantly more than what is "well-understood, routine, or conventional" in the related arts.
The instant application includes in Claim 1 additional steps to those deemed to be abstract idea(s).
When taken the steps individually, these steps are:
A system comprising: at least one processor; and at least one memory storing computer-executable instructions, that when executed by the at least one processor, cause the at least one processor to (do not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer, “the claim invokes computers or other machinery merely as a tool to perform an existing process”, MPEP 2106.05(f)(2)), collect metrics data for a plurality of customer-provided equipment (CPE) models over a window of time, wherein the metrics data comprises one or more of: interactive voice response (IVR) session data; calls handled data; and truck schedule data (insignificant extra-solution activity, collecting data MPEP 2106.05g) and receiving, sending, and user input is a Well-Understood, Routine, Conventional activity MPEP 2106.05(d) (In Bilski, the court added to Flook that pre-solution (such as data gathering) and insignificant step in the middle of a process (such as receiving user input) to be equally ineffective); train a first autoencoder for a first CPE model of the plurality of CPE models using at least a portion of the metrics data to detect anomalies within a plurality of firmware versions of the first CPE model, using the first autoencoder (do not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer, “the claim invokes computers or other machinery merely as a tool to perform an existing process”, MPEP 2106.05(f)(2)); store data indicating that the first firmware version of the plurality of firmware versions is anomalous across the first time series (insignificant extra-solution activity, MPEP 2106.05g) a Well-Understood, Routine, Conventional activity MPEP 2106.05(d)(II)(IV) (Storing and retrieving information in memory);
train, for a second type of CPE of the plurality of types of CPE, a second autoencoder using at least the portion of the metrics data, and using the second autoencoder (do not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer, “the claim invokes computers or other machinery merely as a tool to perform an existing process”, MPEP 2106.05(f)(2)), store second data indicating that the second firmware version of the plurality of firmware versions is anomalous across the second time series (insignificant extra-solution activity, MPEP 2106.05g) a Well-Understood, Routine, Conventional activity MPEP 2106.05(d)(II)(IV) (Storing and retrieving information in memory).
In the instant case, Claim 1 is directed to above mentioned abstract idea. Technical functions such as sending, receiving, displaying and processing data are common and basic functions in computer technology. The individual limitations are recited at a high level and do not provide any specific technology or techniques to perform the functions claimed.
Looking to MPEP 2106.05 (d), based on court decisions well understood, routine and conventional computer functions or mere instruction and/or insignificant activity have been identified to include: Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321,120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TU Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) (using a telephone for image transmission); O/P Techs., /no., v. Amazon.com, Inc., 788 F,3d 1359, 1363, 115 USPQ2d 1090,1093 (Fed. Cir, 2015) (sending messages over a network); buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) (computer receives and sends information over a network); but see DDR Holdings, LLC v. Hotels.com, L.P., 773 F.3d 1245, 1258, 113 USPG2d 1097, 1106 (Fed. Cir. 2014) ("Unlike the claims in Ultramercial, the claims at issue here specify how interactions with the Internet are manipulated to yield a desired result-a result that overrides the routine and conventional sequence of events ordinarily triggered by the click of a hyperlink," (emphasis added)}; Insignificant intermediate or post solution activity -See Bilski v. Kappos, 581 U.S. 593, 611 -12, 95 USPQ2d 1001,1010 (2010) (well-known random analysis techniques to establish the inputs of an equation were token extra-solution activity); In Bilski referring to Flook, where Flook determined that an insignificant post-solution activity does not makes an otherwise patent ineligible claim patent eligible. In Bilski, the court added to Flook that pre-solution (such as data gathering) and insignificant step in the middle of a process (such as receiving user input) to be equally ineffective. The specification and Claim does not provide any specific process with respect to the display output that would transform the function beyond what is well understood. Like as found in Electric Power Group, Bilski, the technical process to implement the input and display functions are conventional and well understood.
In addition, when the claims are taken as a whole, as an ordered combination, the combination of steps does not add "significantly more" by virtue of considering the steps as a whole, as an ordered combination. The instant application, therefore, still appears only to implement the abstract idea to the particular technological environments using what is well-understood, routine, and conventional in the related arts. The steps are still a combination made to the abstract idea. The additional steps only add to those abstract ideas using well-understood and conventional functions, and the claims do not show improved ways of, for example, an unconventional non-routine functions for authorizing the timing of a payment and to activate a display screen based on a trigger or camera functions that could then be pointed to as being "significantly more" than the abstract ideas themselves. Moreover, Examiner was not able to identify any "unconventional" steps, which, when considered in the ordered combination with the other steps, could have transformed the nature of the abstract idea previously identified. The instant application, therefore, still appears to only implement the abstract ideas to the particular technological environments using what is well-understood, routine, and conventional in the related arts.
Further, note that the limitations, in the instant claims, are done by the generically recited computing devices. The limitations are merely instructions to implement the abstract idea on a computing device that is recited in an abstract level and require no more than a generic computing devices to perform generic functions.
CONCLUSION
It is therefore determined that the instant application not only represents an abstract idea identified as such based on criteria defined by the Courts and on USPTO examination guidelines, but also lacks the capability to bring about "Improvements to another technology or technical field" (Alice), bring about "Improvements to the functioning of the computer itself" (Alice), "Apply the judicial exception with, or by use of, a particular machine" (Bilski), "Effect a transformation or reduction of a particular article to a different state or thing" (Diehr), "Add a specific limitation other than what is well-understood, routine and conventional in the field" (Mayo), "Add unconventional steps that confine the claim to a particular useful application" (Mayo), or contain "Other meaningful limitations beyond generally linking the use of the judicial exception to a particular technological environment" (Alice), transformed a traditionally subjective process performed by humans into a mathematically automated process executed on computers (McRO), or limitations directed to improvements in computer related technology, including claims directed to software (Enfish).
The dependent claims, when considered individually and as a whole, likewise do not provide “significantly more” than the abstract idea for similar reasons as the independent claim. For example claim 2 disclose “determine, based on the losses, a probability density function (PDF) for the plurality of firmware versions; determine, based on the PDF, a cumulative distribution function (CDF); determine an outlier threshold based on the CDF and a predetermined probability” (Mental process, Mathematical concept). It does not integrate the abstract idea into a practical application and did not add significantly more to the abstract idea. claim 3 disclose “wherein the loss is a mean absolute error loss” is directed to the description of data, which is directed to generally linking the use of a judicial exception to a particular technological environment or field of use. It does not integrate the abstract idea into a practical application and did not add significantly more to the abstract idea. Claim 4 disclose analyze the metrics data to identify one or more firmware versions of the first type CPE whose metrics data are outliers; and exclude the metrics data of the one or more firmware versions from the at least portion of the metrics data used to train the first autoencoder (Mental process). It does not integrate the abstract idea into a practical application and did not add significantly more to the abstract idea.
Claim 5 disclose determine a first date in the first time series, and determine that a second date within a three-day time window of the first date is also included in the first time series(Mental process). It does not integrate the abstract idea into a practical application and did not add significantly more to the abstract idea. Claim 7 disclose “wherein the first time series comprises two non-contiguous segments“ is description of data, which is directed to generally linking the use of a judicial exception to a particular technological environment or field of use. It does not integrate the abstract idea into a practical application and did not add significantly more to the abstract idea.
Therefore, the dependent claims 2-5, and 7 which impose additional limitations—also fail to claim patent-eligible subject matter because the limitations cannot be considered statutory. In reference to claims 2-7 these dependent claim have also been reviewed with the same analysis as independent claim 1. The dependent claim(s) have been examined individually and in combination with the preceding claims, however they do not cure the deficiencies of claim 1; where all claims are directed to the same abstract idea, "addressing each claim of the asserted patents [is] unnecessary." Content Extraction &. Transmission LLC v, Wells Fargo Bank, Natl Ass'n, 776 F.3d 1343, 1348 (Fed. Cir. 2014). If applicant believes the dependent claims are directed towards patent eligible subject matter, they are invited to point out the specific limitations in the claim that are directed towards patent eligible subject matter. Independent claims 8 and 15 and dependent claims 9-14, 16-20 for the other statutory class are similarly analyzed.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 4-5, 7-9, 11-12, 14-16, and 18-19 are rejected under 35 U.S.C. 103 as being unpatentable over Oñate López et al. [US 2022/0198229 A1, hereinafter D1] in view of Wright et al. [US 2021/0320936 A1, hereinafter D2] further in view of Murata et al. [US 2024/0152133 A1, hereinafter Murata].
With regard to Claim 1,
D1 teach a system comprising: at least one processor; and at least one memory storing computer-executable instructions, that when executed by the at least one processor, cause the at least one processor to:
collect metrics data for a plurality of types of customer-provided equipment (CPE) models over a window of time (¶4, “system for detecting anomalies in metric data provided by one or more customers … causes the system to receive metric data indicative of a plurality of time-series based observations for a particular customer metric”, ¶55, “feature selection process or mechanism for time-series based observations for various metrics. … number (e.g., n) of features selected and/or determined according to the techniques of the present disclosure are based on the current value/observation for a particular metric and historical values/observations for that metric (e.g., observations received within a previous hour or a previous day)“, ¶69, “customer devices 102, for example, may be a communication device, such as a telephone, smart phone, computer, tablet, or laptop”, ¶105, “metric data is indicative of time-series based observations for a particular customer metric, and selection and/or specification of the metric may be based on, and/or tailored to, the unique needs of the particular customer”), wherein the metrics data comprises one or more of:
interactive voice response (IVR) session data (¶65, “most contact centers utilize some level of automated processes in place of live agents, such as, for example, interactive voice response (IVR)”, ¶72, “call controller 108 which, for example, serves as an adapter or interface between the switch and the other routing, monitoring, and communication-handling components of the contact center system 100 … call controller 108 may also extract data about an incoming interaction, such as the customer's telephone number, IP address, or email address, and then communicate these with other contact center components in processing the interaction“, ¶87, ¶91);
calls handled data (Fig. 1, ¶62, “contact center system 100 may be embodied as any system capable of providing contact center services (e.g., call center services, chat center services, SMS center services, etc.) to an end user and otherwise performing the functions described herein”,¶72, “call controller 108 which, for example, serves as an adapter or interface between the switch and the other routing, monitoring, and communication-handling components of the contact center system 100 … call controller 108 may also extract data about an incoming interaction, such as the customer's telephone number, IP address, or email address, and then communicate these with other contact center components in processing the interaction“, ¶87, ¶91); and
truck schedule data;
train a first [model] for a first type of CPE of the plurality of types of CPE using at least a portion of the metrics data to detect anomalies within a plurality of [systems] of the first type of CPE (Fig. 5, ¶140, ¶69, “customer devices 102, for example, may be a communication device, such as a telephone, smart phone, computer, tablet, or laptop”, ¶105, “metric data is indicative of time-series based observations for a particular customer metric, and selection and/or specification of the metric may be based on, and/or tailored to, the unique needs of the particular customer”, ¶140, “model offers automatic parameter tuning across a wide range of various metrics”, ¶4, “system for detecting anomalies in metric data … receive metric data indicative of a plurality of time-series based observations for a particular customer metric”, ¶55, “feature selection process or mechanism for time-series based observations for various metrics. … number (e.g., n) of features selected and/or determined … are based on the current value/observation for a particular metric and historical values/observations for that metric (e.g., observations received within a previous hour or a previous day)“,¶53, “INS model … anomaly detection for time series observations may be considered as analogous to, or otherwise informed by, outlier detection in multivariable systems. To associate anomaly detection for time serious observations with outlier detection in multivariable systems, the present disclosure envisions extraction of useful features from time series data that help describe the continuous behavior of various metrics and are sensitive to outliers”, ¶54, “a machine learning algorithm for detecting anomalies in any time-series metric data that produces a model”, ¶86, “analytics module 138 also may generate, update, train, and modify predictors or models based on collected data, such as, for example, customer data, agent data, and interaction data”, ¶87);
identify that a first [system] of the plurality of [systems] is anomalous across a first time series; and store data indicating that the first [systems] of the plurality of [systems] is anomalous across the first time series (¶53, “INS model … anomaly detection for time series observations may be considered as analogous to, or otherwise informed by, outlier detection in multivariable systems. To associate anomaly detection for time serious observations with outlier detection in multivariable systems, the present disclosure envisions extraction of useful features from time series data that help describe the continuous behavior of various metrics and are sensitive to outliers”, ¶54, “present disclosure provides a machine learning algorithm for detecting anomalies in any time-series metric data that produces a model”, ¶86, “analytics module 138 also may generate, update, train, and modify predictors or models based on collected data, such as, for example, customer data, agent data, and interaction data”, ¶87, ¶158, “provide information about whether the component is operating properly or is malfunctioning , enabling notification of an owner or operator of the component of the anomalous behavior of the component at the time it occurs”);
train for a second type of CPE of the plurality of types of CPE , a second [model] using at least the portion of the metrics data (¶69, “customer devices 102, for example, may be a communication device, such as a telephone, smart phone, computer, tablet, or laptop”, ¶105, “metric data is indicative of time-series based observations for a particular customer metric, and selection and/or specification of the metric may be based on, and/or tailored to, the unique needs of the particular customer”, ¶140, “model offers automatic parameter tuning across a wide range of various metrics. In another aspect, as the model does not rely on a predetermined number of spheres to be generated for a particular customer metric, spheres may be generated according to each iteration of the model, which may provide greater accuracy and/or precision, at least in some cases”, ¶4, “system for detecting anomalies in metric data … receive metric data indicative of a plurality of time-series based observations for a particular customer metric”, ¶55, “feature selection process or mechanism for time-series based observations for various metrics. … number (e.g., n) of features selected and/or determined … are based on the current value/observation for a particular metric and historical values/observations for that metric (e.g., observations received within a previous hour or a previous day)“;.
identify, using the [model], that a second [system] of the plurality of [systems] is anomalous across a first time series (¶53, “INS model … anomaly detection for time series observations may be considered as analogous to, or otherwise informed by, outlier detection in multivariable systems. To associate anomaly detection for time serious observations with outlier detection in multivariable systems, the present disclosure envisions extraction of useful features from time series data that help describe the continuous behavior of various metrics and are sensitive to outliers”, ¶54, “present disclosure provides a machine learning algorithm for detecting anomalies in any time-series metric data that produces a model”, ¶86, “analytics module 138 also may generate, update, train, and modify predictors or models based on collected data, such as, for example, customer data, agent data, and interaction data”, ¶87); and
store data indicating that the second [systems] of the plurality of [systems] is anomalous across the second time series (¶158, “provide information about whether the component is operating properly or is malfunctioning, enabling notification of an owner or operator of the component of the anomalous behavior of the component at the time it occurs”).
D1 does not explicitly teach a first firmware version; plurality of firmware versions; second firmware version and second plurality of firmware versions; and perform a mitigation action to address the anomalous firmware version, the mitigation including updating the plurality of types of CPE to a different firmware version.
D2 teach disclose a system comprising: at least one processor; and at least one memory storing computer-executable instructions, that when executed by the at least one processor, cause the at least one processor to:
collect metrics data for a plurality of types of customer-provided equipment (CPE) over a window of time (Fig. 2, ¶44, “The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition The characteristics of the deep learning model can be different for each of these groupings.”, ¶15, “management controller, thus, has a trusted view of the computing device's device configuration, status, and performance metrics. Monitoring techniques described herein can augment system security with real-time detection of behavior abnormalities”, ¶18, “deep learning models include usage of Recurrent Neural Networks (RNN) for processing system events to determine what events collected in health information are part of the normal workload usage. Prior logs can be used to train the deep learning network to be used in the field”, ¶¶21-22),
train a first [model] for a first type of CPE of the plurality of types of CPE using at least a portion of the metrics data to detect anomalies within a plurality of firmware versions of the first type of CPE (¶26, ¶33, ¶28, “version numbers of firmware are can be differently processed as a separate event information”, ¶44, “The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings.”, grouping based on same model, architecture or heterogeneous composition, ¶18, “deep learning models include usage of Recurrent Neural Networks (RNN) for processing system events to determine what events collected in health information are part of the normal workload usage. Prior logs can be used to train the deep learning network to be used in the field”, ¶24, “health information 214 can include … log information, session counters, user action information, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device”, ¶44, “anomaly can be classified as being related to a firmware or software component”, , ¶64, “Examples of health information can include temperature associated with a chip, such as one or more a central processing unit, memory, etc., log information, session counters, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device, processing workload information, peripheral device configuration information, peripheral device sensor information, etc.”, ¶37, “health information parameter feedback 216 can include a collection of health information 214 collected over a time period”);
determine, for a first time of a time series [that the first firmware version of the plurality of firmware versions is anomalous across a first time series] (¶26, ¶28, “version numbers of firmware are can be differently processed as a separate event information”, ¶¶32-33, ¶44, “The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings.”, ¶15, “Monitoring techniques described herein can augment system security with real-time detection of behavior abnormalities. When an abnormality occurs”, ¶64, “health information can include temperature associated with a chip, such as one or more a central processing unit, memory, etc., log information, session counters, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device, processing workload information, peripheral device configuration information, peripheral device sensor information, etc.”, ¶18, “deep learning models … determine what events collected in health information are part of the normal workload usage. Prior logs can be used to train the deep learning network to be used in the field”, ¶24, “health information 214 can include … log information, session counters, user action information, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device”, ¶70, “alert is sent … alert may indicate that an anomaly is present and particular criteria associated with the anomaly),
identify, that the first firmware version of the plurality of firmware versions is anomalous across a first time series, and store data indicating that the first firmware version of the plurality of firmware versions is anomalous across the first time series (¶26, ¶28, “version numbers of firmware are can be differently processed as a separate event information”, ¶33, ¶44, “The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings.”, ¶15, “Monitoring techniques described herein can augment system security with real-time detection of behavior abnormalities. When an abnormality occurs, an action can be taken, for example, alerting supervisors, approved corrective actions, updating a model to include the anomaly as permissible, etc.”, ¶18, “(RNN) for processing system events to determine what events collected in health information are part of the normal workload usage. Prior logs can be used to train the deep learning network to be used in the field”, ¶64, “health information can include temperature associated with a chip, such as one or more a central processing unit, memory, etc., log information, session counters, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device, processing workload information, peripheral device configuration information, peripheral device sensor information, etc.”, ¶24, “health information 214 can include … log information, session counters, user action information, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device”, ¶44, “anomaly can be classified as being related to a firmware or software component”, ¶70, “alert is sent … alert may indicate that an anomaly is present and particular criteria associated with the anomaly”); and
store data indicating that the first firmware version of the plurality of firmware versions is anomalous across the first time series (¶15, “Monitoring techniques described herein can augment system security with real-time detection of behavior abnormalities. When an abnormality occurs, an action can be taken, for example, alerting supervisors, approved corrective actions, updating a model to include the anomaly as permissible, etc.”);
train, for a second type of CPE of the plurality of types of CPE, a second [model] using at least the portion of the metrics data; determine a second plurality of firmware versions of the second type of CPE (¶26, ¶33, ¶28, “version numbers of firmware are can be differently processed as a separate event information”, ¶44, “The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings.”, training different models for different groupings of devices and the grouping is based on same model, architecture or heterogeneous composition, ¶18, “deep learning models include … processing system events to determine what events collected in health information are part of the normal workload usage. Prior logs can be used to train the deep learning network to be used in the field”, ¶24, “health information 214 can include … log information, session counters, user action information, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device”, ¶64, “health information can include temperature associated with a chip, such as one or more a central processing unit, memory, etc., log information, session counters, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device, processing workload information, peripheral device configuration information, peripheral device sensor information, etc.”, ¶37, “health information parameter feedback 216 can include a collection of health information 214 collected over a time period”);
determine a second plurality of firmware versions of the second type of CPE (¶26, ¶28, “version numbers of firmware are can be differently processed as a separate event information”, ¶¶32-33, ¶44, “The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings.”, ¶15);
identify, using the second [model], that a second firmware version of the second plurality of firmware versions is anomalous across a second time series (¶26, ¶¶32-34, ¶28, “version numbers of firmware are can be differently processed as a separate event information”, ¶¶43-44, “The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings.”, grouping based on same model, architecture or heterogeneous composition, ¶18, “deep learning models … processing system events to determine what events collected in health information are part of the normal workload usage. Prior logs can be used to train the deep learning network to be used in the field”, ¶24, “health information 214 can include … log information, session counters, user action information, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device”, ¶44, “anomaly can be classified as being related to a firmware or software component”, , ¶64, “health information can include temperature associated with a chip, such as one or more a central processing unit, memory, etc., log information, session counters, network packet counters, power consumption, error information, a record of firmware or software installed on the computing device, processing workload information, peripheral device configuration information, peripheral device sensor information, etc.”, ¶37, “health information parameter feedback 216 can include a collection of health information 214 collected over a time period”); store second data indicating that the second firmware version of the second plurality of firmware versions is anomalous across the second time series (¶15, “Monitoring techniques described herein can augment system security with real-time detection of behavior abnormalities. When an abnormality occurs, an action can be taken, for example, alerting supervisors, approved corrective actions, updating a model to include the anomaly as permissible, etc.”); and
perform a mitigation action to address the anomalous firmware version, the mitigation including updating the plurality of types of CPE to a different firmware version (Claim 6, claim 9, “wherein the action includes updating a firmware component to a version that is used by other computing devices of the plurality of computing devices”, ¶44, “anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group. In one example, the component can be set for update. The update may occur as part of a next scheduled maintenance time or dynamically”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings”).
D1 and D2 are analogous art to the claimed invention because they are from a similar field of endeavor of using models to detect anomalous in data. Thus, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify D1 resulting in resolutions as disclosed by D2 with a reasonable expectation of success.
One of ordinary skill in the art would be motivated to modify D1 as described above to assure compatibility of the system firmware with the provided service and to prevent possible attacks or malware infections by assuring the installation of the latest system updates and providing monitoring techniques that can augment system security with real-time detection of behavior abnormalities. When an abnormality occurs, an action can be taken, for example, alerting supervisors, approved corrective actions, updating a model to include the anomaly as permissible (D2, ¶15).
D1-D2 does not explicitly disclose autoencoder model, determine, for a first time of a first time series, losses of the plurality of [data] computed using the first autoencoder, determine that a loss of a [data] of the plurality of [data] exceeds an outlier threshold, identify, using the first autoencoder, based on the determination that the loss of exceeds the outlier threshold, a second autoencoder.
Murata teach train a first autoencoder (¶40, “autoencoder is used for learning the threshold, and a reconstruction error generated therefrom is used as the anomaly score”),
determine, for a first time of a first time series, losses of the plurality of [data] computed using the first autoencoder (¶37, “threshold acquisition apparatus of the present embodiment receives a data set of anomaly scores corresponding to an acoustic data set as input. The acoustic data set, which is a target data in the anomaly detection system, is a set of batch data including a plurality of frames (time lengths), and final anomaly determination is made on a batch basis, not on a frame basis”, ¶40, “an autoencoder is used for learning the threshold, and a reconstruction error generated therefrom is used as the anomaly score”, ¶47);
determine that a loss of a [data] of the plurality of [data] exceeds an outlier threshold (¶¶7-8, ¶24, “anomaly detection system calculates an anomaly score yt=f (xt) for an input xt, performs determination of anomaly/normality based on the magnitude relation between the anomaly score yt=f (xt) and a threshold θ for anomaly determination, and outputs the determination result (binary data) at={0,1}”, ¶¶71-72, “based on the provided allowable number of times ka, the anomaly determination is performed on each threshold candidate θp and each batch Zs. When the number of detection times exceeds the provided allowable number of times ka, the anomaly determination unit 122 determines that the corresponding determination target is anomalous”, ¶40, “same data set or the same type of data set of anomaly scores as that used in the anomaly detection system may be used as the data set of anomaly scores included in the input to the threshold acquisition apparatus. For example, an autoencoder is used for learning the threshold, and a reconstruction error generated therefrom is used as the anomaly score”, ¶41);
identify, based on the determination that the loss of the [data] exceeds the outlier threshold, that the [data] of the plurality of [data] is anomalous across a first time series (¶¶7-8, ¶24, “anomaly detection system calculates an anomaly score yt=f (xt) for an input xt, performs determination of anomaly/normality based on the magnitude relation between the anomaly score yt=f (xt) and a threshold θ for anomaly determination, and outputs the determination result (binary data) at={0,1}”, ¶40, “autoencoder is used for learning the threshold, and a reconstruction error generated therefrom is used as the anomaly score”, ¶9, “anomaly scores determined to be anomalous included in a set of anomaly scores per predetermined section length, which is a part of time-series data that do not include anomalous data”);
a second autoencoder, identify, using the second autoencoder, that a second [data] of the second plurality of [data] is anomalous across the second time series (¶¶7-8, ¶24, “anomaly detection system calculates an anomaly score yt=f (xt) for an input xt, performs determination of anomaly/normality based on the magnitude relation between the anomaly score yt=f (xt) and a threshold θ for anomaly determination, and outputs the determination result (binary data) at={0,1}”, ¶40, “autoencoder is used for learning the threshold, and a reconstruction error generated therefrom is used as the anomaly score”, ¶9, “anomaly scores determined to be anomalous included in a set of anomaly scores per predetermined section length, which is a part of time-series data that do not include anomalous data”).
D1-D2 and Murata are analogous art to the claimed invention because they are from a similar field of endeavor of using models to detect anomalous in data. Thus, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify D1 resulting in resolutions as disclosed by Murata with a reasonable expectation of success.
One of ordinary skill in the art would be motivated to modify D1-D2 as described above to benefit from autoencoder model abilities for detecting anomaly as autoencoder is able to learn non-linear activation functions and multiple layers, could be applied to various types of data, and it can apply transfer learning to prime the encoder and decoder which would speed up the model training by using a pre-trained model. This is simply substituting of one known element for another to obtain predictable results and usage of known technique to improve similar devices (methods, or products) in the same way (MPEP 2143).
With regard to Claim 2,
D1-D2-Murata teach the system of claim 1, wherein the instructions to identify, using the first autoencoder, that the first firmware version of the plurality of firmware versions is anomalous across the first time series comprises instructions that, when executed by the at least one processor, cause the at least one processor to:
determine, based on the losses, a probability density function (PDF) for the plurality of firmware versions (Murata ¶27, ” Poisson distribution is a probability distribution indicating that a certain event has occurred k times in a predetermined unit of time, and its probability mass function is expressed as follows (see FIG. 2 )”, ¶28, “FIG. 2 illustrates the probability density function of the Poisson distribution”);
determine, based on the PDF, a cumulative distribution function (CDF) (Murata, Fig. 3, ¶14, ¶54, “cumulative distribution calculation unit 112 receives the mean detection rate λ(θ′) as input, models the number of times k that an anomaly is detected in a predetermined section length T by the Poisson distribution based on the mean detection rate λ(θ′), calculates a probability p (k>ka; Tλ(θ′)) that the number of times k is greater than the allowable number of times ka (S112), and outputs the calculation result”, ¶¶55-56); and
determine an outlier threshold based on the CDF and a predetermined probability (Murata, ¶55, ¶57, “cumulative distribution calculation unit 112 calculates a plurality of probabilities p (k>ka; Tλ(θ′)) while changing the allowable number of times ka within an appropriate range … cumulative distribution calculation unit 112 includes the allowable number acquisition unit 113”¶59, “allowable number acquisition unit 113 receives a plurality of probabilities p (k>ka; Tλ(θ′)), … and outputs the acquired minimum allowable number of times Ka”, ¶¶61-62, “threshold estimation unit 120 receives the anomaly score data set Z=[Z1, . . . , ZS], the allowable number of times ka, information indicating a performance index, and a desired performance index (target value) q as input, estimates a threshold candidate θ′ such that the number of sections determined to be anomalous per predetermined section length T, which is a part of the data set Z, satisfies a predetermined criterion by using the allowable number of times ka”).
The same motivation to combine for claim 1 equally applies for current claim.
With regard to Claim 4,
D1-D2-Murata teach the system of claim 1, wherein the instructions include further instructions that when executed by the at least one processor, cause the at least one processor to further:
analyze the metrics data to identify one or more firmware versions of the first type CPE whose metrics data are outliers (D2, Fig. 2, ¶15, “management controller, thus, has a trusted view of the computing device's device configuration, status, and performance metrics. Monitoring techniques described herein can augment system security with real-time detection of behavior abnormalities. When an abnormality occurs, an action can be taken, for example, alerting supervisors, approved corrective actions, updating a model to include the anomaly as permissible”, ¶18, ¶44, “anomaly can be classified as being related to a firmware or software component”); and
exclude the metrics data of the one or more firmware versions from the at least portion of the metrics data used to train the first autoencoder (D1, ¶12, “to define the plurality of parameters based on the metric data may include to filter out outliers from the metric data and to define the coverage limit based at least partially on the filtered metric data”, Murata , ¶40, “autoencoder is used for learning the threshold, and a reconstruction error generated therefrom is used as the anomaly score”).
The same motivation to combine for claim 1 equally applies for current claim.
With regard to Claim 5,
D1-D2-Murata teach the system of claim 1, wherein the instructions include further instructions that when executed by the at least one processor, cause the at least one processor to further:
determine a first date in the first time series, and determine that a second date within a three-day time window of the first date is also included in the first time series (D1, ¶141, “collection 600 of data points includes approximately 288 points collected over one day. Of course, it should be appreciated that in other examples, the collection 600 may include another suitable number of data points collected over another suitable time period”).
The same motivation to combine for claim 1 equally applies for current claim.
With regard to Claim 7,
D1-D2-Murata teach the system of claim 1, wherein the first time series comprises two non-contiguous segments (D2, ¶37, “health information parameter feedback 216 can be generated by the management controller 116. In some examples, the health information parameter feedback 216 can be gathered, stored, and then sent in batches. In one example, the health information parameter feedback 216 can include a collection of health information 214 collected over a time period”, different batches include non-contiguous segments (e.g. batch 1 and batch 3 will be non-contiguous segments).
The same motivation to combine for claim 1 equally applies for current claim.
With regards to claims 8 and 15;
Claims 8 and 15 are similar in scope to claim 1; therefore, they are rejected under similar rationale.
With regards to claims 9 and 16;
Claims 8 and 15 are similar in scope to claim 2; therefore, they are rejected under similar rationale.
With regards to claims 11 and 18;
Claims 11 and 18 are similar in scope to claim 4; therefore, they are rejected under similar rationale.
With regards to claims 12 and 19;
Claims 12 and 19 are similar in scope to claim 5; therefore, they are rejected under similar rationale.
With regards to claim 14;
Claim 14 is similar in scope to claim 7; therefore, they are rejected under similar rationale.
Claims 3, 10, and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Oñate López et al. [US 2022/0198229 A1, hereinafter D1] in view of Wright et al. [US 2021/0320936 A1, hereinafter D2] further in view of Murata et al. [US 2024/0152133 A1, hereinafter Murata] further in view of Neofytouet al. [US 2022/0284551 A1, hereinafter Neofytou].
With regard to Claim 3,
D1-D2-Murata teach the system of claim 2, wherein the loss is a [reconstruction error] (Murata , ¶40, “autoencoder is used for learning the threshold, and a reconstruction error generated therefrom is used as the anomaly score”).
The same motivation to combine for claim 1 equally applies for current claim.
D1-D2-Murata Does not explicitly disclose the usage of mean absolute error loss.
Neofytou the loss is a mean absolute error loss (¶43, “reconstruction loss is a mean absolute error loss”, ¶69, “a loss function for the training of the first and second autoencoders includes i) mean absolute error loss between the source images and reconstructed images, ii) mean absolute error loss between the reconstructed illumination embeddings”).
D1-D2-Murata and Neofytou are analogous art to the claimed invention because they are from a similar field of endeavor of using and training autoencoder models. Thus, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify D1-D2-Murata resulting in resolutions as disclosed by Neofytou with a reasonable expectation of success.
D1-D2-Murata disclose the ability to use reconstruction error function to identify anomaly score (Murata, ¶40) and Neofytou disclose that the reconstruction error function is mean absolute error loss (¶43). Therefore, it would have been obvious to one of ordinary skill in the art at the time of the invention to have substituted the reconstruction error function taught by Neofytou of D1-D2-Murata because both elements were known equivalents for calculating reconstruction error.
With regards to claims 10 and 17;
Claims 10 and 17 are similar in scope to claim 3; therefore, they are rejected under similar rationale.
Response to Arguments
Applicant argue that training autoencoders and computing reconstruction losses using trained neural network models cannot practically be performed in the human mind as autoencoders are specific machine learning architecture.
Examiner respectfully disagrees,
The rejection did not classify the training of the autoencoders as part of the mental process as the training step do not amount to more than a recitation of the words "apply it" (or an equivalent), such as mere instructions to implement an abstract idea on a computer, “the claim invokes computers or other machinery merely as a tool to perform an existing process”, MPEP 2106.05(f)(2).
Applicant argue that the current claims integrate the any recited exception into a practical application by updating firmware versions for customer-provided equipment (CPE) which is similar to example 47 (Remarks p.9).
Examiner respectfully disagrees,
First, the claimed system comprise a processor and memory. The action claimed of updating firmware is done on the CPE that is not a part of the claimed system.
Second, the action as it is not processed and executed by the claimed system, under broadest reasonable interpretation, it is a signal sent by the system and the action is executed or not by the user that own the CPE.
Third, assuming arguendo that the execution is done automatically, then the execution will be executed by the CPE system and not the claimed system.
Fourth, the argued limitation that is considered the source for improvement is actually part of the abstract idea and cannot be on its own the source of improvement.
Fifth, as clarified previously the claimed system comprise a processor and memory. The action claimed of updating firmware is done on the CPE that is not a part of the claimed system which is not similar to example 47 that disclose the ability of the claimed system to take dynamic and in real time steps to detecting anomalies using a trained neural network and taking remedial network actions (dropping malicious packets, blocking traffic from the source address).
Therefore, the applicant arguments are not persuasive.
Applicant argue that the present claims detect anomalies using trained autoencoders and take remedial action by updating CPE to a different firmware version to improve network reliability. The specification confirms this technical improvement, explaining that the invention enables faster identification of problematic firmware revisions to "more quickly deploy mitigations" and "provide for greater end-user network reliability." and the Federal Circuit has recognized that claims directed to improvements in computer related technology are patent eligible. In Enfish, LLC V. Microsoft Corp., 822 F.3d 1327 (Fed. Cir.
2016), the court held that claims directed to improvements in computer functionality are not abstract. Similarly, in DDR Holdings, LLC v. Hotels.com, L.P., 773 F.3d 1245 (Fed. Cir. 2014), the court found claims patent eligible where they addressed a problem specifically arising in the realm of computer networks.
Examiner respectfully disagrees,
First, the claimed system as clarified the claimed system comprise a processor and memory. The action claimed of updating firmware is done on the CPE that is not a part of the claimed system.
Second, the argued limitation that is considered the source for improvement is actually part of the abstract idea and cannot be on its own the source of improvement.
Third, DDR Holdings, LLC v. Hotels.com included had additional elements that amounted to significantly more than the abstract idea, because they modified conventional Internet hyperlink protocol to dynamically produce a dual-source hybrid webpage, which differed from the conventional operation of Internet hyperlink protocol that transported the user away from the host’s webpage to the third party’s webpage when the hyperlink was activated. 773 F.3d at 1258-59, 113 USPQ2d at 1106-07. Thus, the claims in DDR Holdings were eligible. The provided claims does not disclose any additional elements that amount to significantly more than the abstract idea.
Fourth, in Enfish, LLC V. Microsoft Corp., the court held that the claims were not directed to an abstract idea but to a specific improvement in computer functionality the selfreferential table. This improvement allowed faster data lookups, more efficient storage, and flexible database configuration, making the claims patent-eligible. However, the current claim does not disclose similar advantage as a user can compute losses for firmware versions, and performing firmware updates to address identified anomalies using computer and machine learning models as tools.
Therefore, the applicant arguments are not persuasive.
Applicant argue that D1 actually teaches away from using multiple different models for different device types. As noted in paragraph [0140] of D1, "because the model may be trained irrespective of the particular customer metric, the model offers automatic parameter tuning across a wide range of various metrics." This passage indicates that D1
contemplates a single model that can be applied across various metrics, rather than training separate models for different types of equipment which suggests a design philosophy contrary to the claimed approach of training type-specific autoencoders (Remarks, P. 11).
Examiner respectfully disagrees,
First, D1 does not teach away from using multiple different models. As applicant disclose in the argument that D1 disclose that “the model may be trained irrespective of the particular customer metric”. This language clearly show the possibility to train a generic model which show flexibility by having the possibility to do that. This does not limit D1 in anyway and showing flexibility or ability to have different approaches or different possible scenarios cannot be considered as teaching away from using multiple models as may be means that it could be done this way or not (flexibility).
Second, D1 disclose the ability to handle different types of CPE as a telephone, smart phone, computer, tablet, or laptop See ¶69, the model will use metric that are tailored to, the unique needs of the particular customer See ¶105, and that the system have the ability to tune the model to the different metrics See ¶140, “model offers automatic parameter tuning across a wide range of various metrics”. Therefore, as different users have different types of equipment providing different data that the system tune the model to; then D1 teach the ability to use different models for different equipment types.
Third, D2 also teach the argued limitation by teach that devices could be grouped based on same model (i.e. type), architecture or heterogeneous composition of the devices and that the is different for each group See at least ¶44, “The anomaly can be classified as being related to a firmware or software component. The anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group”, “each of the computing devices 102 a-102 n can be of a same model as the computing device 102 a. In other examples, a different model, but same architecture can be used. In other examples, the group of computing devices 102 can have a heterogeneous composition. The characteristics of the deep learning model can be different for each of these groupings”. In addition, as the model is different for every grouping this show that the different groups of CPE will have different models. Therefore, D2 also disclose the argued limitation.
Therefore, the applicant arguments are not persuasive.
Applicant argue that D2 discusses grouping computing devices and mentions that "the
characteristics of the deep learning model can be different for each of these groupings" at paragraph [0044], D2 does not teach or suggest using autoencoders. D2 discusses deep learning models generally and recurrent neural networks (RNNs) specifically, as noted in paragraph [0018], but autoencoders are a distinct type of neural network architecture with different characteristics and training methodologies. The Examiner cannot simply substitute one type of neural network for another without proper motivation, as different neural network architectures serve different purposes and have different capabilities.
Examiner respectfully disagrees,
It is well known in the art the existence of different type of neural network and that each of the different type of neural network provide different benefits and that they could be substituted to gain specific benefit associated with a type of neural network, actually the applicant disclose the exact reason that may motivate the substitution between types of neural network (“different neural network architectures serve different purposes and have different capabilities”). Therefore, the applicant arguments are not persuasive.
Applicant argue that D2 does not teach identifying that a particular firmware version is anomalous across a time series as required by the claims. D2 merely detects that a device has a different firmware version compared to other devices in a group. As D2 states, "[t]he anomaly can be that the computing device 102 has a different firmware or software version compared to the other computing devices in the group." D2, paragraph [0044]. This is fundamentally different from the claimed limitation of identifying "that a first firmware version of the plurality of firmware versions is anomalous across the first time series." The claims require determining that a specific firmware version itself behaves anomalously over time, not merely that a device has a different version than other devices. D2's approach of flagging version differences does not teach or suggest analyzing the behavior of firmware versions across time series data to identify anomalous firmware versions as recited in the claims (Remarks P. 11).
Examiner respectfully disagrees, The provided argument isolate ¶44 from the reminder of D2’s citation provided in the rejection. D2 does not merely compare firmware version statically across devices. Rather, D2 disclose that firmware version information is processed as separate event information (¶28) within a deep learning anomaly detection framework operating on health information and time series workload behavior (¶18, ¶24, ¶26, ¶64). D2 further disclose classification of anomalies related to firmware or software components (¶33, ¶44), real time detection of behavioral abnormalities (¶15), and anomaly alert associated with specific anomaly criteria (¶70). Thus, D2 teach identifying firmware related anomalies across time series behavioral data rather than merely detecting that one device has different version than other device.
Therefore, the applicant arguments are not persuasive.
Applicant argue that Murata teaches the use of autoencoders for anomaly detection,
Murata does not teach training multiple autoencoders for different types of equipment or for detecting anomalies in firmware versions. Murata's disclosure relates to acoustic anomaly detection, which is a fundamentally different technical field from firmware anomaly detection in customer-provided equipment. The Examiner has alleged that because autoencoders learn based on input data, using different input data would result in a "second autoencoder." However, Applicant submits that this interpretation conflates the concept of training a single autoencoder with different data versus training separate, distinct autoencoders for different types of equipment as recited in the claims (Remarks P. 12).
Examiner respectfully disagrees,
First Murata mention autoencoder once and not multiple autoencoders. Autoencoder learns to reconstruct its input data by minimizing a reconstruction loss function. As the input data change the Autoencoder learning process that involves adjusting the weights and biases change based on the input data. The specific patterns, features, and underlying structure present in the input data are what the autoencoder learns to encode and decode. Therefore, if the input data changes, the autoencoder will learn different internal representations and parameter values to accurately reconstruct that new data. Which is considered a second autoencoder.
Second, the claims do not require the first and second autoencoder to have different architectures. They require different models. A different trained autoencoder, with different learned weights/parameters based on different input data, is a different model even if the same autoencoder architecture is used. In other words, the presented argument improperly equates “different autoencoders” with “different autoencoders architecture”. The claim only require a first and second model.
Third, Murata is not relied on for detecting anomalies in firmware versions. In response to applicant's arguments against the references individually, one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986).
Therefore, the applicant arguments are not persuasive.
Applicant argue that The Examiner has alleged that one of ordinary skill in the art would be motivated to combine D1, D2, and Murata to "benefit from autoencoder model abilities for detecting anomaly." However, this generic statement does not provide a specific, articulated reason why one of ordinary skill in the art would modify the systems of D1 and D2 to use separate autoencoders for different types of CPE to detect firmware anomalies.
Examiner respectfully disagrees, the examiner refer the applicant to the rejection for the details of the motivation for combining the references as the argued motivation to combine D1, D2, and Murata is not the provided motivation in the rejection.
As to the remaining dependent claims, applicant argue that they are allowable due to their respective direct and indirect dependencies upon one of the aforementioned Independent claims. The examiner respectfully disagrees, Independent claims were not allowable as stated in the paragraph above in this “Response to Arguments” section in this office action.
Conclusion
The prior art made of record and not relied upon is considered pertinent to the applicant’s disclosure.
US Patent Application Publication No. 2022/20237930 filed by Rando et al. that teach the ability to use mean absolute error as a loss Function See at least ¶146
Examiner has pointed out particular references contained in the prior arts of record in the body of this action for the convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and Figures may apply as well. It is respectfully requested from the applicant, in preparing the response, to consider fully the entire references as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior arts or disclosed by the examiner. It is noted that any citation to specific pages, columns, figures, or lines in the prior art references any interpretation of the references should not be considered to be limiting in any way. A reference is relevant for all it contains and may be relied upon for all that it would have reasonably suggested to one having ordinary skill in the art. In re Heck, 699 F.2d 1331-33, 216 USPQ 1038-39 (Fed. Cir. 1983) (quoting In re Lemelson, 397 F.2d 1006, 1009, 158 USPQ 275, 277 (CCPA 1968)).
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MOHAMED ABOU EL SEOUD whose telephone number is (303)297-4285. The examiner can normally be reached Monday-Thursday 9:00am-6:00pm MT.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Michelle Bechtold can be reached at (571) 431-0762. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MOHAMED ABOU EL SEOUD/Primary Examiner, Art Unit 2148
Prosecution Insights