DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This action is in response to the arguments filed on 04/22/2026. Claims 1-20 are pending in the application and have been considered below.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Regarding Claim 1:
For Step 1, the claim is a method, so it does recite a statutory category of invention.
For Step 2A, Prong 1:
The claim recites the limitation of “defining a plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “defining” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “generating a graph of the plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “generating” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “creating a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “creating” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connecting, for each node corresponding to a single metric of the rules, the corresponding node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connecting” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges, wherein the edges are defined based on the pair of metrics being specified together in the second rule” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connecting” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “assigning each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “assigning” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “detecting anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “detecting” step from practically being performed in the human mind. This limitation is a mental process. MPEP 2106.04(a)(2)(III)(C).
The claim recites the limitation of “ranking detected anomalies based on ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph; wherein the defining occurs before the detecting” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “ranking” step from practically being performed in the human mind. This limitation is a mental process.
For Step 2A, Prong 2, the claim recites an additional element: system and receiving, in real time, system metrics from a plurality of networked resources.
The “system” is a generic component to apply an abstract idea under 2106.05(f).
The “receiving, in real time, system metrics from a plurality of networked resources” step is a form of insignificant extra-solution activity. See MPEP 2106.05(g).
Step 2B
The additional element of “system” does not amount to significantly more for the reasons set forth in step 2A above. Additionally, under the 2019 PEG, a conclusion that an additional element is insignificant extra-solution activity in Step 2A should be reevaluated in Step 2B.
Here the “receiving, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“system “to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 2:
Claim 2 which incorporates the rejection of claim 1, recites further an additional limitation:
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies.”
The “alerting” is a generic component to apply an abstract idea under 2106.05(f).
The additional element of “alerting an end user of the detected anomalies based on the ranking of the detected anomalies” does not amount to significantly more for the reasons set forth in step 2A above.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies” to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 3:
Claim 3, which incorporates the rejection of claim 1, recites further limitations such as “at least one metric describing a state of one or more resources; and
at least one condition, wherein each condition is defined for a corresponding metric” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 4:
Claim 4, which incorporates the rejection of claim 1, recites further limitations such as “observing for anomalous metrics and/or anomalous log through statistical analysis” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 5:
Claim 5, which incorporates the rejection of claim 1, recites further limitations such as “edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 6:
Claim 6, which incorporates the rejection of claim 1, recites further limitations such as “value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 7:
Claim 7, which incorporates the rejection of claim 1, recites further limitations such as “computing an importance value for a given node based on all edge weights of edges
connected to the given node; and
upon computing importance values for all nodes, ranking the nodes based on the
importance values” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 8:
For Step 1, the claim is a non-transitory computer-readable medium, so it does recite a statutory category of invention.
For Step 2A, Prong 1:
The claim recites the limitation of “define a plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “define” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “generate a graph of the plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “generate” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “create a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “create” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connect, for each node corresponding to a single metric of the rules, the corresponding node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connect” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges, wherein the edges are defined based on the pair of metrics being specified together in the second rule” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connecting” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “assign each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “assign” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “detect anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “detect” step from practically being performed in the human mind. This limitation is a mental process. MPEP 2106.04(a)(2)(III)(C).
The claim recites the limitation of “rank detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph; wherein the defining occurs before the rank” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “rank” step from practically being performed in the human mind. This limitation is a mental process.
For Step 2A, Prong 2, the claim recites additional elements: system, non-transitory computer-readable medium, processor, and receive, in real time, system metrics from a plurality of networked resources.
The additional elements of “system” “non-transitory computer-readable medium” and processor “are generic computer component that amounts to mere instructions to apply the abstract idea. See MPEP 2106.05(f).
The processor is recited at a high level of generality, i.e., as a generic processor performing a generic computer function of processing data. This generic processor limitation is no more than mere instructions to apply the exception using a generic computer component.
The “receive, in real time, system metrics from a plurality of networked resources” step is a form of insignificant extra-solution activity. See MPEP 2106.05(g).
Step 2B
The additional elements of “system, non-transitory computer-readable medium and processor” do not amount to significantly more for the reasons set forth in step 2A above.
Additionally, under the 2019 PEG, a conclusion that an additional element is insignificant extra-solution activity in Step 2A should be reevaluated in Step 2B.
Here the “receiving, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements of
“system, non-transitory computer-readable medium and processor “to perform the claim steps do not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 9:
Claim 9, which incorporates the rejection of claim 8, recites further an additional limitation: “alerting an end user of the detected anomalies based on the ranking of the detected anomalies.”
The “alerting” is a generic component to apply an abstract idea under 2106.05(f).
The additional element of “alerting an end user of the detected anomalies based on the ranking of the detected anomalies” does not amount to significantly more for the reasons set forth in step 2A above.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies” to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 10:
Claim 10, which incorporates the rejection of claim 8, recites further limitations such as “at least one metric describing a state of one or more resources; and
at least one condition, wherein each condition is defined for a corresponding metric” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 11:
Claim 11, which incorporates the rejection of claim 8, recites further limitations such as “the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 12:
Claim 12, which incorporates the rejection of claim 8, recites further limitations such as “edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 13:
Claim 13, which incorporates the rejection of claim 8, recites further limitations such as “edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 14:
Claim 14, which incorporates the rejection of claim 8, recites further limitations such as “compute an importance value for a given node based on all edge weights of edges
connected to the given node; and
upon compute importance values for all nodes, rank the nodes based on the importance
values” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 15:
For Step 1, the claim is a system, so it does recite a statutory category of invention.
For Step 2A, Prong 1:
The claim recites the limitation of “define a plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “define” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “generate a graph of the plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “generate step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “create a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “create” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connect, for each node corresponding to a single metric of the rules, the corresponding node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connect” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges, wherein the edges are defined based on the pair of metrics being specified together in the second rule” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connecting” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “assign each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “assign” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “detect anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “detect” step from practically being performed in the human mind. This limitation is a mental process. MPEP 2106.04(a)(2)(III)(C).
The claim recites the limitation of “rank detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph; wherein the defining occurs before the rank” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “rank” step from practically being performed in the human mind. This limitation is a mental process.
For Step 2A, Prong 2, the claim recites additional elements: system, non-transitory computer-readable medium and processor, and “receive, in real time, system metrics from a plurality of networked resources.”
The additional elements of “system, non-transitory computer-readable medium and processor “are generic computer components that amount to mere instructions to apply the abstract idea. See MPEP 2106.05(f).
The processor is recited at a high level of generality, i.e., as a generic processor performing a generic computer function of processing data. This generic processor limitation is no more than mere instructions to apply the exception using a generic computer component.
Step 2B
The additional elements of “system, non-transitory computer-readable medium and processor” do not amount to significantly more for the reasons set forth in step 2A above. Additionally, under the 2019 PEG, a conclusion that an additional element is insignificant extra-solution activity in Step 2A should be reevaluated in Step 2B.
Here the “receiving, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements of
“system, non-transitory computer-readable medium and processor “to perform the claim steps do not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 16:
Claim 16 which incorporates the rejection of claim 15, recites further an additional limitation:
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies.”
The “alerting” is a generic component to apply an abstract idea under 2106.05(f).
The additional element of “alerting an end user of the detected anomalies based on the ranking of the detected anomalies” does not amount to significantly more for the reasons set forth in step 2A above.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies” to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 17:
Claim 17, which incorporates the rejection of claim 15, recites further limitations such as “at least one metric describing a state of one or more resources; and
at least one condition, wherein each condition is defined for a corresponding metric” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 18:
Claim 18, which incorporates the rejection of claim 15, recites further limitations such as “the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 19:
Claim 19 which incorporates the rejection of claim 15, recites further limitations such as “edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 20:
Claim 20, which incorporates the rejection of claim 15 recites further limitations such as “value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-4, 7-11, 14-18 are rejected under 35 U.S.C. 103 as being unpatentable over Ge et al. (US 2011/0231704 A1, hereinafter referred to as Ge), in view of Biswas et al. (US 2013/0318233 A1, hereinafter referred to as Biswas), and further in view of AMBICHL et al. (US 2017/0075749 A1, hereinafter referred to as AMBICHL), and Scharf et al. (US 2015/0131458 A1, hereinafter referred to as Scharf).
As to claim 1, Ge teaches a method for ranking detected anomalies, the method comprising:
defining a plurality of rules (paragraph [0019], rules that are defined, defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify
root cause(s) of detected, reported and/or identified network events);
generating a graph of the plurality of rules (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734), comprising:
creating a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly (paragraphs [0013] …generating a set of diagnostic events from the normalized set of data sources which potentially cause the symptom event instance, the diagnostic events being determined based on dependency rules; and analyzing the set of diagnostic events to select a root cause event based on root cause rules; [0016] "An example short-duration event [events are represented by nodes and correspond to detected metrics in the rule chart] is a link flap that automatically clears itself. Example minor events include, but are not limited to, a router processor becoming temporarily overloaded, increasing the risk for protocol malfunction, and/or sporadic packet losses;" [0041]- [0042] Fig. 7; [0043]- [0045] Fig.8, the graph contains system events 415, 420, 425, 430, and 435. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes);
connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045] Fig. 8, system events 415, 420, 425, 430, and 435 are interconnected with weighted edges 905, 910, 915, etc.…),
[wherein the edges are defined based on the pair of metrics being specified together in the second rule];
assigning each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045]; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest.");
detecting anomalies by comparing the system metrics relative to the rules, wherein the system metrics include at least current system state or activity (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest"; [0018], collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115; [0019] Initially, the operator 140 provides, specifies and/or defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events; wherein using the broadest reasonable interpretation, Examiner interprets “an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events” to include “system metrics include at least current system state or activity” ); and
ranking detected anomalies based on ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph (paragraphs [0043]- [0046] Fig.8, the graph contains system events 415, 420, 425, 430, and 435 that are interconnected with weighted edges 905, 910, 915, etc. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes. In some examples, event E 435 is selected as the root cause of symptom event graph 310 because it has the highest priority of 50…Further still, root cause events may be selected based on the sum of the priorities along the path from the root cause event to the symptom event of interest 405…);
wherein the defining occurs before the detecting (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest").
Ge teaches “To collect data, information and/or parameters representative of any number and/or type(s) of network event(s), network fault(s) and/or performance problem(s) for a network 115, the example communication system 100 of FIG. 1 includes any number and/or type(s) of data collectors and/or sources, two of which are designated at reference numerals 120 and 125. The example data sources 120 and 125 of FIG. 1 collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115 (paragraph [0018]).
However, Ge fails to explicitly teach:
[connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
receiving, in real time, system metrics from a plurality of networked resources; and
connecting, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric.
Biswas, in combination with Ge, teaches:
receiving, in real time, system metrics from a plurality of networked resources (paragraphs [0017] The communication devices include network traffic devices 106, such as access points or routers, and client devices 108, such as laptop computers, desktop computers, and portable computing devices, all of which are capable of communicating with each other using a network communications protocol specification; [0094]-[0095] …” The query messages can be sent and responses received in real-time, so that responses in general, and operational statistics (interpreted by Examiner as system metrics) in particular, will be current and will help to provide a network management system with increased accuracy, efficiency, and responsiveness”).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the system of Ge to add real-time monitoring to the system of Ge, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to provide a network management system with increased accuracy, efficiency, and responsiveness”, as suggested by Biswas ([0095]).
However, Ge and Biswas fail to explicitly teach:
[connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric.
Ambichl, in combination with Ge and Biswas, teaches:
connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge (paragraphs [0248]- [0250] Fig. 22a " a virtual self-loop causal connection 410c with very low causal factor 413c [causal factor corresponds to the severity level of the rule] may be introduced for event types that have, according to knowledge of the technical domain, typically no other root cause and are therefore the root cause of themselves. Self-loop 413c is an edge with corresponding causal factor 3 connecting Event Node Record 1 with itself), [wherein the edge to itself is defined based on the first rule including the single metric].
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge and Biswas to add node connection to the combination system of Ge and Biswas, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to indicate a type of event that most probably is its own root cause, a self-loop causal link 413e is added to the event graph before calculation of the root cause probability factors. Adding those events provides more variations for the random surfer to escape from event 5 and its self-loop. This dampens the effect of the self-loop and provides expected root cause probability results that are also justified and supported by the calculated causal factors, as suggested by Ambichl ([0250]- [0253]).
However, Ge, Biswas and Ambichl fail to explicitly teach:
[connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
[connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge], wherein the edge to itself is defined based on the first rule including the single metric.
Scharf, in combination with Ge, Biswas and Ambichl, teaches:
[connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule (paragraphs [0059] The transport layer may include vertices 610 which correspond to routers, and edges 620 that correspond
to connections. The edges 620 may be associated with metrics including routing metrics and recessive metrics. For example, in FIG. 6, metric C may be a routing cost which may be used as the routing metric. Metric D may be a first recessive metric such as capacity associated with the transport layer);
[connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge], wherein the edge to itself is defined based on the first rule including the single metric (paragraph [0049] Each edge 420 may represent a connection for which a metric is available. The network topology 400 may include edges for both direct and indirect connections depending on the available metrics. For example, the network topology 400 may include two metrics: metricA and metricB. MetricA may be a routing metric used to determine the routing path of packets. Accordingly, each direct connection may have a value for metricA. MetricB may be a recessive metric. Accordingly, metricB may be available for each direct connection as well as indirect connections spanning more than one vertex. In the example topology 400, edges 420a-e may be direct connections having both metricA
and metricB. Edge 420/, connecting vertex 410a and vertex 410c may have a value for only metricB. The absence of a value for metricA may indicate that no routing metric is available because there is no direct connection between vertices 410a and 410c. An edge, such as edge 420/ may be considered a shortcut path…; [0057] The topology manager server 150 may be configured with various rules for determining whether to substitute a shortcut value. For example, topology manager server 150 may substitute the metric value for a shortcut edge if the shortcut edge value is less than the substituted edge values. Rules governing shortcut values may be based on the particular recessive metric. Examiner interprets “the metric value for a shortcut edge if the shortcut edge value is less than the substituted edge values” as first rule including the single metric.)
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add metrics to the combination system of Ge, Biswas and Ambichl, as taught by Scharf, above. The modification would have been obvious because one of ordinary skill would be motivated to determine a routing path and calculate its cost, as suggested by Scharf, ([0005]).
As to claim 2, which incorporates the rejection of claim 1, Ge teaches: alerting an end user of the detected anomalies based on the ranking of the detected anomalies (paragraph [0021] "The example root cause analyzer of Fig. 1 reports identified root cause event(s) to the operator via, for example, the user interface").
As to claim 3, which incorporates the rejection of claim 1, Ge teaches wherein the plurality of rules each comprises: at least one metric describing a state of one or more resources (paragraph [0018] The system "includes any number and/or type(s) of data collectors and/or sources", which "collect and/or store network event, network fault,
and/or performance data and/or information obtained and/or collected from any number
and/or type(s) of network devices."); and at least one condition, wherein each condition is defined for a corresponding metric (paragraphs [0040] an example condition [event node] in a rule is. "external border gateway protocol flap," which may cause the symptom event of interest "interface flap."); [0043] the rule defines measured or detected network event(s), which if they occur, may be a root cause for a symptom event of interest).
As to claim 4, which incorporates the rejection of claim 1, Ge teaches wherein the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis (paragraph [0028] the rule generator "statistically correlates the output of the root cause identifier with other time series of events [e.g. system logs] stored in the data store to learn, adapt, and/or incorporate previously unknown and/or learned knowledge of the network.")
As to claim 7, which incorporates the rejection of claim 1, Ge teaches wherein ranking nodes comprises: computing an importance value for a given node based on all edge weights of edges connected to the given node; and upon computing importance values for all nodes, ranking the nodes based on the importance values (paragraph [0045] "the priority of a particular potential root cause event may depend on the number of event instances associated with the potential root cause event node. Specifically, the priority of a potential root cause node may be multiplied by the number of event instances associated with the potential root cause event node [i.e., the number of edges connected to the potential root cause event node].")
As to claim 8, Ge teaches a non-transitory computer-readable medium comprising one or more instructions that when executed on a processor cause the processor to perform operations ([0057]) comprising:
define a plurality of rules (paragraph [0019], rules that are defined…defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify
root cause(s) of detected, reported and/or identified network events);
generate a graph of the plurality of rules (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734), comprising:
create a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly (paragraphs [0013] …generating a set of diagnostic events from the normalized set of data sources which potentially cause the symptom event instance, the diagnostic events being determined based on dependency rules; and analyzing the set of diagnostic events to select a root cause event based on root cause rules; [0016] "An example short-duration event [events are represented by nodes and correspond to detected metrics in the rule chart] is a link flap that automatically clears itself. Example minor events include, but are not limited to, a router processor becoming temporarily overloaded, increasing the risk for protocol malfunction, and/or sporadic packet losses;" [0041]- [0042] Fig. 7; [0043]- [0045] Fig.8, the graph contains system events 415, 420, 425, 430, and 435 …Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes);
connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045] Fig. 8, system events 415, 420, 425, 430, and 435 are interconnected with weighted edges 905, 910, 915, etc.…), [wherein the edges are defined based on the pair of metrics being specified together in the second rule];
assign each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045]; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest");
detect anomalies by comparing the system metrics relative to the rules, wherein the system metrics include at least current system state or activity (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest."); and
rank detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph (paragraphs [0043]- [0046] Fig.8, the graph contains system events 415, 420, 425, 430, and 435 that are interconnected with weighted edges 905, 910, 915, etc. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes. In some examples, event E 435 is selected as the root cause of symptom event graph 310 because it has the highest priority of 50. Further still, root cause events may be selected based on the sum of the priorities along the path from the root cause event to the symptom event of interest 405; [0018], collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115; [0019] Initially, the operator 140 provides, specifies and/or defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events; wherein using the broadest reasonable interpretation, Examiner interprets “an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events” to include “system metrics include at least current system state or activity”);
wherein the define occurs before the detecting (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest").
Ge teaches “To collect data, information and/or parameters representative of any number and/or type(s) of network event(s), network fault(s) and/or performance problem(s) for a network 115, the example communication system 100 of FIG. 1 includes any number and/or type(s) of data collectors and/or sources, two of which are designated at reference numerals 120 and 125. The example data sources 120 and 125 of FIG. 1 collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115 (paragraph [0018]).
However, Ge fails to explicitly teach:
[connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
receive, in real time, system metrics from a plurality of networked resources; and
connecting, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric.
Biswas, in combination with Ge, teaches:
receive, in real time, system metrics from a plurality of networked resources (paragraphs [0017] The communication devices include network traffic devices 106, such as access points or routers, and client devices 108, such as laptop computers, desktop computers, and portable computing devices, all of which are capable of communicating with each other using a network communications protocol specification; [0094]-[0095] …” The query messages can be sent and responses received in real-time, so that responses in general, and operational statistics in particular, will be current and will help to provide a network management system with increased accuracy, efficiency, and responsiveness”).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the system of Ge to add real-time monitoring to the system of Ge, as taught by Biswas, above. The modification would have been obvious because one of ordinary skill would be motivated to provide a network management system with increased accuracy, efficiency, and responsiveness”, as suggested by Biswas ([0095]).
However, Ge and Biswas fail to explicitly teach:
[connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
connect, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric.
Ambichl, in combination with Ge and Biswas, teaches:
connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge (paragraphs [0248]- [0250] Fig. 22a "a virtual self-loop causal connection 41 0c with very low causal factor 413c [causal factor corresponds to the severity level of the rule] may be introduced for event types that have, according to knowledge of the technical domain, typically no other root cause and are therefore the root cause of themselves. Self-loop 413c is an edge with corresponding causal factor 3 connecting Event Node Record 1 with itself), [wherein the edge to itself is defined based on the first rule including the single metric].
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge and Biswas to add node connection to the combination system of Ge and Biswas, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to indicate a type of event that most probably is its own root cause, a self-loop causal link 413e is added to the event graph before calculation of the root cause probability factors. Adding those events provides more variations for the random surfer to escape from event 5 and its self-loop. This dampens the effect of the self-loop and provides expected root cause probability results that are also justified and supported by the calculated causal factors, as suggested by Ambichl ([0251]- [0253]).
However, Ge, Biswas and Ambichl fail to explicitly teach:
[connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
[connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge], wherein the edge to itself is defined based on the first rule including the single metric.
Scharf, in combination with Ge, Biswas and Ambichl, teaches:
[connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule (paragraphs [0059] The transport layer may include vertices 610 which correspond to routers, and edges 620 that correspond
to connections. The edges 620 may be associated with metrics including routing metrics and recessive metrics. For example, in FIG. 6, metric C may be a routing cost which may be used as the routing metric. Metric D may be a first recessive metric such as capacity associated with the transport layer);
[connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge], wherein the edge to itself is defined based on the first rule including the single metric (paragraph [0049] Each edge 420 may represent a connection for which a metric is available. The network topology 400 may include edges for both direct and indirect connections depending on the available metrics).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add metrics to the combination system of Ge, Biswas and Ambichl, as taught by Scharf, above. The modification would have been obvious because one of ordinary skill would be motivated to determine a routing path and calculate it cost, as suggested by Scharf, ([0005]).
As to claim 9, which incorporates the rejection of claim 8, Ge teaches: alerting an end user of the detected anomalies based on the ranking of the detected anomalies (paragraph [0021] "The example root cause analyzer of Fig. 1 reports identified root cause event(s) to the operator via, for example, the user interface.").
As to claim 10, which incorporates the rejection of claim 8, Ge teaches wherein the plurality of rules each comprises: at least one metric describing a state of one or more resources (paragraph [0018] The system "includes any number and/or type(s) of data collectors and/or sources", which "collect and/or store network event, network fault,
and/or performance data and/or information obtained and/or collected from any number
and/or type(s) of network devices."); and at least one condition, wherein each condition is defined for a corresponding metric (paragraphs [0040] an example condition [event node] in a rule is. "external border gateway protocol flap," which may cause the symptom event of interest "interface flap."); [0043] the rule defines measured or detected network event(s), which if they occur, may be a root cause for a symptom event of interest).
As to claim 11, which incorporates the rejection of claim 8, Ge teaches wherein the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis (paragraph [0028] the rule generator "statistically correlates the output of the root cause identifier with other time series of events [ e.g. system logs] stored in the data store to learn, adapt, and/or incorporate previously unknown and/or learned knowledge of the network.")
As to claim 14, which incorporates the rejection of claim 8, Ge teaches wherein ranking nodes comprises: computing an importance value for a given node based on all edge weights of edges connected to the given node; and upon computing importance values for all nodes, ranking the nodes based on the importance values (paragraph [0045] "the priority of a particular potential root cause event may depend on the number of event instances associated with the potential root cause event node. Specifically, the priority of a potential root cause node may be multiplied by the number of event instances associated with the potential root cause event node [i.e., the number of edges connected to the potential root cause event node]").
As to claim 15, Ge teaches a system, comprising:
a non-transitory computer-readable medium ([0057]);
a processor programmed to cooperate with the instructions to perform operations ([0057]) comprising:
define a plurality of rules (paragraph [0019], rules that are defined; defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify
root cause(s) of detected, reported and/or identified network events.);
generate a graph of the plurality of rules (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734), comprising:
create a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly (paragraphs [0013, generating a set of diagnostic events from the normalized set of data sources which potentially cause the symptom event instance, the diagnostic events being determined based on dependency rules; and analyzing the set of diagnostic events to select a root cause event based on root cause rules; [0016] "An example short-duration event [events are represented by nodes and correspond to detected metrics in the rule chart] is a link flap that automatically clears itself. Example minor events include, but are not limited to, a router processor becoming temporarily overloaded, increasing the risk for protocol malfunction, and/or sporadic packet losses;" [0041]- [0042] Fig. 7; [0043]- [0045] Fig.8, the graph contains system events 415, 420, 425, 430, and 435. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes);
connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045] Fig. 8, system events 415, 420, 425, 430, and 435 are interconnected with weighted edges 905, 910, 915, etc.), [wherein the edges are defined based on the pair of metrics being specified together in the second rule];
assign each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045]; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest");
detect anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest"); and
rank detected anomalies based on the ranking of the nodes corresponding to the metrics of the graph (paragraphs [0043]- [0046] Fig.8, the graph contains system events 415, 420, 425, 430, and 435. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes. In some examples, event E 435 is selected as the root cause of symptom event graph 310 because it has the highest priority of 50. Further still, root cause events may be selected based on the sum of the priorities along the path from the root cause event to the symptom event of interest 405); [0018], collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115; [0019] Initially, the operator 140 provides, specifies and/or defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events; wherein using the broadest reasonable interpretation, Examiner interprets “an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events” to include “system metrics include at least current system state or activity”);
wherein the define occurs before the detecting (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest").
Ge teaches “To collect data, information and/or parameters representative of any number and/or type(s) of network event(s), network fault(s) and/or performance problem(s) for a network 115, the example communication system 100 of FIG. 1 includes any number and/or type(s) of data collectors and/or sources, two of which are designated at reference numerals 120 and 125. The example data sources 120 and 125 of FIG. 1 collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115)” (paragraph [0018]).
However, Ge fails to explicitly teach:
[connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
receive, in real time, system metrics from a plurality of networked resources;
connect, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric.
Biswas, in combination with Ge, teaches:
receive, in real time, system metrics from a plurality of networked resources (paragraphs [0017] The communication devices include network traffic devices 106, such as access points or routers, and client devices 108, such as laptop computers, desktop computers, and portable computing devices, all of which are capable of communicating with each other using a network communications protocol specification; [0094]-[0095] …” The query messages can be sent and responses received in real-time, so that responses in general, and operational statistics in particular, will be current and will help to provide a network management system with increased accuracy, efficiency, and responsiveness”).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the system of Ge to add real-time monitoring to the system of Ge, as taught by Biswas, above. The modification would have been obvious because one of ordinary skill would be motivated to provide a network management system with increased accuracy, efficiency, and responsiveness”, as suggested by Biswas ([0095]).
However, Ge and Biswas fail to explicitly teach:
[connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric.
Ambichl, in combination with Ge and Biswas, teaches:
connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge (paragraphs [0248]- [0250] Fig. 22a "a virtual self-loop causal connection 41 0c with very low causal factor 413c [causal factor corresponds to the severity level of the rule] may be introduced for event types that have, according to knowledge of the technical domain, typically no other root cause and are therefore the root cause of themselves. Self-loop 413c is an edge with corresponding causal factor 3 connecting Event Node Record 1 with itself), [wherein the edge to itself is defined based on the first rule including the single metric].
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge and Biswas to add node connection to the combination system of Ge and Biswas, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to indicate a type of event that most probably is its own root cause, a self-loop causal link 413e is added to the event graph before calculation of the root cause probability factors. Adding those events provides more variations for the random surfer to escape from event 5 and its self-loop. This dampens the effect of the self-loop and provides expected root cause probability results that are also justified and supported by the calculated causal factors, as suggested by Ambichl ([0251]- [0253]).
However, Ge, Biswas and Ambichl fail to explicitly teach:
[connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule;
[connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge], wherein the edge to itself is defined based on the first rule including the single metric.
Scharf, in combination with Ge, Biswas and Ambichl, teaches:
[connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges], wherein the edges are defined based on the pair of metrics being specified together in the second rule (paragraphs [0059] The transport layer may include vertices 610 which correspond to routers, and edges 620 that correspond
to connections. The edges 620 may be associated with metrics including routing metrics and recessive metrics. For example, in FIG. 6, metric C may be a routing cost which may be used as the routing metric. Metric D may be a first recessive metric such as capacity associated with the transport layer);
[connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge], wherein the edge to itself is defined based on the first rule including the single metric (paragraph [0049] Each edge 420 may represent a connection for which a metric is available. The network topology 400 may include edges for both direct and indirect connections depending on the available metrics. For example, the network topology 400 may include two metrics: metricA and metricB. MetricA may be a routing metric used to determine the routing path of packets. Accordingly, each direct connection may have a value for metricA. MetricB may be a recessive metric. Accordingly, metricB may be available for each direct connection as well as indirect connections spanning more than one vertex. In the example topology 400, edges 420a-e may be direct connections having both metricA
and metricB. Edge 420/, connecting vertex 410a and vertex 410c may have a value for only metricB. The absence of a value for metricA may indicate that no routing metric is available because there is no direct connection between vertices 410a and 410c. An edge, such as edge 420/ may be considered a shortcut path…; [0057] The topology manager server 150 may be configured with various rules for determining whether to substitute a shortcut value. For example, topology manager server 150 may substitute the metric value for a shortcut edge if the shortcut edge value is less than the substituted edge values. Rules governing shortcut values may be based on the particular recessive metric. Examiner interprets “the metric value for a shortcut edge if the shortcut edge value is less than the substituted edge values” as first rule including the single metric.)
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add metrics to the combination system of Ge, Biswas and Ambichl, as taught by Scharf, above. The modification would have been obvious because one of ordinary skill would be motivated to determine a routing path and calculate it cost, as suggested by Scharf, ([0005]).
As to claim 16, which incorporates the rejection of claim 15, Ge teaches: alerting an end user of the detected anomalies based on the ranking of the detected anomalies (paragraph [0021] "The example root cause analyzer of Fig. 1 reports identified root cause event(s) to the operator via, for example, the user interface").
As to claim 17, which incorporates the rejection of claim 15, Ge teaches wherein the plurality of rules each comprises: at least one metric describing a state of one or more resources (paragraph [0018] The system "includes any number and/or type(s) of data collectors and/or sources", which "collect and/or store network event, network fault,
and/or performance data and/or information obtained and/or collected from any number
and/or type(s) of network devices."); and at least one condition, wherein each condition is defined for a corresponding metric (paragraphs [0040] an example condition [event node] in a rule is. "external border gateway protocol flap," which may cause the symptom event of interest "interface flap."); [0043] the rule defines measured or detected network event(s), which if they occur, may be a root cause for a symptom event of interest).
As to claim 18, which incorporates the rejection of claim 15, Ge teaches wherein the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis (paragraph [0028] the rule generator "statistically correlates the output of the root cause identifier with other time series of events [ e.g. system logs] stored in the data store to learn, adapt, and/or incorporate previously unknown and/or learned knowledge of the network").
Claims 5, 12 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Ge et al. (US 2011/0231704 A1, hereinafter referred to as Ge), in view of Biswas et al. (US 2013/0318233 A1, hereinafter referred to as Biswas), and further in view of AMBICHL et al. (US 2017/0075749 A1, hereinafter referred to as AMBICHL), and Scharf et al. (US 2015/0131458 A1, hereinafter referred to as Scharf), and Chung et al. (US 2009/0177642 A1, hereinafter referred to as Chung).
As to claim 5, which incorporates the rejection of claim 1, Chung, in combination with Ge, Biswas, Ambichl and Scharf, teaches wherein edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation (paragraphs [0042] "Bottleneck rules are defined by means of logical expressions which employ metrics that are combined with arithmetic and logical operators"; [0104] "the module scheduler builds a dependency graph for the identified dependencies. The dependency graph uses a metric as the node and any dependency with another metric as an edge.")
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas, Ambichl and Scharf to add a logical operation to the combination system of Ge, Biswas, Ambichl and Scharf, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use a bottleneck which is anything that inhibits the potential for the target application to execute faster on a given system and is correctable, as suggested by Chung, ([0042]).
As to claim 12, which incorporates the rejection of claim 8, Chung, in combination with Ge, Biswas, Ambichl and Scharf, teaches wherein edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation (paragraphs [0042] "Bottleneck rules are defined by means of logical expressions which employ metrics that are combined with arithmetic and logical operators"; [0104] "the module scheduler builds a dependency graph for the identified dependencies. The dependency graph uses a metric as the node and any dependency with another metric as an edge.")
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas, Ambichl and Scharf to add a logical operation to the combination system of Ge, Biswas, Ambichl and Scharf, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use a bottleneck which is anything that inhibits the potential for the target application to execute faster on a given system and is correctable, as suggested by Chung, ([0042]).
As to claim 19, which incorporates the rejection of claim 15, Chung, in combination with Ge, Biswas, Ambichl and Scharf, teaches wherein edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation (paragraphs [0042] "Bottleneck rules are defined by means of logical expressions which employ metrics that are combined with arithmetic and logical operators"; [0104] "the module scheduler builds a dependency graph for the identified dependencies. The dependency graph uses a metric as the node and any dependency with another metric as an edge.")
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas, Ambichl and Scharf to add a logical operation to the combination system of Ge, Biswas, Ambichl and Scharf, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use a bottleneck which is anything that inhibits the potential for the target application to execute faster on a given system and is correctable, as suggested by Chung, ([0042]).
Claims 6, 13 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Ge et al. (US 2011/0231704 A1, hereinafter referred to as Ge), in view of Biswas et al. (US 2013/0318233 A1, hereinafter referred to as Biswas), and further in view of AMBICHL et al. (US 2017/0075749 A1, hereinafter referred to as AMBICHL), and Scharf et al. (US 2015/0131458 A1, hereinafter referred to as Scharf), and Cohen et al. (US 2014/0372347, hereinafter referred to as Cohen).
As to claim 6, which incorporates the rejection of claim 1, Chung, in combination with Ge, Biswas, Ambichl and Scharf, teaches wherein value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes (paragraph [0052] "A statistical significance [corresponds to an edge value representing a severity level] may be computed using different parameters and respective weights. These parameters may include, for example, [ ...] a number of metrics that show an abnormal behavior" [Note: the edge weight may therefore be adjusted depending on whether multiple metrics are implicated in a logical AND statement in a rule vice a single metric triggering a logical OR statement in a rule.]).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas, Ambichl and Scharf to add logical operation to the combination system of Ge, Biswas, Ambichl and Scharf, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use process flow 700 facilitates establishing different levels for determining an anomaly and, therefore, reduction of false alarms, as suggested by Chung, ([0052]).
As to claim 13, which incorporates the rejection of claim 8, Chung, in combination with Ge, Biswas, Ambichl and Scharf, teaches wherein value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes (paragraph [0052] "A statistical significance [corresponds to an edge value representing a severity level] may be computed using different parameters and respective weights. These parameters may include, for example, a number of metrics that show an abnormal behavior" [Note: the edge weight may therefore be adjusted depending on whether multiple metrics are implicated in a logical AND statement in a rule vice a single metric triggering a logical OR statement in a rule.]).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas, Ambichl and Scharf to add logical operation to the combination system of Ge, Biswas, Ambichl and Scharf. The modification would have been obvious because one of ordinary skill would be motivated to use process flow 700 facilitates establishing different levels for determining an anomaly and, therefore, reduction of false alarms, as suggested by Chung, ([0052]).
As to claim 20, which incorporates the rejection of claim 15, Chung, in combination with Ge, Biswas, Ambichl and Scharf, teaches wherein value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes (paragraph [0052] "A statistical significance [corresponds to an edge value representing a severity level] may be computed using different parameters and respective weights. These parameters may include, for example, a number of metrics that show an abnormal behavior" [Note: the edge weight may therefore be adjusted depending on whether multiple metrics are implicated in a logical AND statement in a rule vice a single metric triggering a logical OR statement in a rule.]).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas, Ambichl and Scharf to add logical operation to the combination system of Ge, Biswas, Ambichl and Scharf, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use process flow 700 facilitates establishing different levels for determining an anomaly and, therefore, reduction of false alarms, as suggested by Chung, ([0052]).
Response to Applicant’s arguments
The Applicant’s arguments filed on 04/22/2026have been fully considered but are not persuasive for the 101 rejections.
Claim Rejections under 35 U.S.C. §101
Argument (pages 8-11)
Applicant appears that the rejection should be withdrawn because claim 1, considered as a whole, is not directed to a mental process. The August 4, 2025 memorandum specifically warns against overexpanding the mental-process grouping and explains that claims should not be treated as reciting a mental process where the recited operations cannot practically be performed in the human mind. It also emphasizes that the Step 2A analysis must be based on the broadest reasonable interpretation and on the claim as a whole, rather than on an oversimplified paraphrase. Here, claim I is not merely "thinking about" rules and rankings.
As amended, claim 1 recites a specific, computer-implemented anomaly-triage technique in which a plurality of rules is transformed into a graph of the rules; a self-edge is defined for a node corresponding to a single metric based on the first rule including the single metric; pairwise edges are defined based on a pair of metrics being specified together in the second rule; edge weights correspond to rule severity; anomalies are detected by comparing system metrics relative to the rules; and detected anomalies are then ranked based on the ranking of the graph nodes corresponding to the metrics. The specification expressly supports that claimed structure and operation, explaining that the graph comprises nodes representing metrics identified in the rules, edges where metrics are identified together in a given rule, and a self-edge when a metric is not connected to other metrics in a given rule, with Figure 3 providing concrete examples of both pairwise edges and the self-loop.
Even if the Office were to characterize some aspect of the claim as involving an abstract idea, claim I integrates any such alleged exception into a practical application at Step 2A, Prong Two. The August 4, 2025 memorandum expressly instructs examiners to
consider whether a claim is directed to an improvement in computer functionality or
another technology or technical field, and to avoid reducing the claim to a bare "apply it"
characterization where the claim instead recites a specific technological implementation.
That is the case here. Claim 1 recites a rule-derived weighted graph having specific
semantics and topology, and uses that graph in a live monitoring context to rank detected anomalies. The specification explains that this graph captures domain knowledge embedded in administrator-defined rules and then uses that structure to prioritize anomalies in monitored systems so that administrators can react more effectively when multiple anomalous metrics arise at the same time. In other words, the claim is directed to a concrete graph-based monitoring and alert-prioritization mechanism, not to the abstract concept of ranking information.
The December 5, 2025 USPTO advance notice of change to the MPEP in light of
Ex Parte Desjardins reinforces the same point. That notice states that the update is not new practice, but is intended to be consistent with existing guidance, and explains that
Desjardins analyzed eligibility in terms of whether the claims were directed to an
improvement in the functioning of a computer or an improvement to another technology
or technical field under Enfish and McRO. The notice further explains, quoting Enfish, that software improvements may be defined by logical structures and processes, and that eligibility turns on whether the claims are directed to an improvement to computer
functionality versus an abstract idea.
The Examiner's treatment of the real-time metric comparison as insignificant extra- solution activity is likewise improper. The current USPTO guidance requires evaluating
whether the recited elements, in combination, meaningfully apply any alleged exception in a technological environment. Claim 1 does not merely gather data and then mentally
analyze it. Rather, the claim recites a specific interaction between rule definition, graph
generation, graph-weighting, comparison of system metrics relative to the rules, and graph-based anomaly ranking. The specification describes this as part of a technical monitoring system that receives live metrics from monitored resources and uses the rule-derived graph to prioritize anomalies and alerts. Thus, the data intake and anomaly detection are part of the claimed technological pipeline itself, not ancillary pre- or post-solution activity.
Claim 1 also recites significantly more than any alleged abstract idea under Step
2B. The August 4, 2025 memorandum states that examiners must determine when a§ 101 rejection is appropriate and should not rely on oversimplified reasoning untethered from the actual claim language. Here, the ordered combination is materially more than a generic processor applying a result. The claim requires transforming rules into a weighted graph of rule-defined metric relationships; defining a self-loop based on a single-metric rule; defining pairwise edges based on metrics specified together in a second rule; detecting anomalies by comparing system metrics relative to the rules; and ranking detected anomalies based on the graph-derived node ranking. The specification explains that this combination leverages the structure of the rules to improve anomaly triage and reduce the practical burden of handling multiple simultaneous anomalies in monitored systems. The rejection does not show that this ordered combination is merely routine or conventional; instead, it abstracts away the claim's specific graph structure and technical use. That is insufficient under current USPTO guidance.
Accordingly, under the USPTO's current guidance, the August 4, 2025 memorandum, and the December 5, 2025 Desjardins advance notice, claim 1 is not directed to an abstract idea, and at a minimum recites significantly more than any alleged judicial exception. Applicant respectfully submits that the rejection under 35 U.S.C. § 101
should therefore be withdrawn.
Examiner’s response:
Examiner respectfully disagrees. Applicant appears to assert that he Examiner's treatment of the real-time metric comparison as insignificant extra- solution activity is likewise improper.
MPEP 2106.04(a) “Mental processes – concepts performed in the human mind (including an observation, evaluation, judgment, opinion).” See additionally see MPEP 2106.04(a)(2).
MPEP 2106.04(a)(2)(III)(C) “A Claim That Requires a Computer May Still Recite a Mental Process.”
Examiner is interpreting the limitations as abstract ideas implemented on a generic computer. (Step 2A Prong 1)
The “defining” step is an observation or evaluation based on a plurality of rules. This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person defines rules. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C).
The “generating” step is an observation or evaluation based on a graph of the plurality of rules. This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person defines rules. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C).
The “creating” step is an observation or evaluation based on a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly. This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person creates or draws a graph with nodes. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C).
The “connecting” step is an observation or evaluation based on for each node corresponding to a single metric of the rules, the corresponding node to itself with an edge, wherein the edge to itself is defined based on the first rule including the single metric. This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person connects nodes of a graph. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C).
The “connecting” step is an observation or evaluation based on for each pair of metrics of the second rules, the corresponding pair of nodes with edges, wherein the edges are defined based on the pair of metrics being specified together in the second rule. This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person connects nodes of a graph using metrics. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C).
The “detecting” step is an observation or evaluation based on anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity. This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person detects anomalies using event logs data of computer system or network analyzer. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C).
The "ranking" step is an observation or evaluation based on detected anomalies based
on the ranking of the nodes corresponding to the metrics of the graph; wherein the
defining occurs before the detecting. This type of observation or evaluation is an act that can be practically performed in the hum an mind, similar to the mental thought processes that occur when a person ranks anomalies detected in a graph based on rules. Such mental observations or evaluations fall within the "mental processes" grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52.
Accordingly, Examiner respectfully submits that the limitations of claim 1 are directed to the abstract idea of a mental process under Step 2A, Prong One.
In the instant claims, the newly added claim features do not improve the functionality of a computer or any technology.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Accordingly, Claim 1 does not integrate the abstract ideas into a practical application and is not patent-eligible under Step 2A, Prong Two.
Unlike Desjardins, the independent claim 1 of the instant application does not recite the details regarding how a computer aids the method, the extent to which the computer aids the method, or the significance of a computer to the performance of the computer-implemented method.
Our analysis is based on the Recentive Analytics wherein the Machine Learning is used at a high level. That is, the claims do not delineate steps through which the machine learning technology achieves an improvement.
Claims 2-7, 9-14 and 16-20 are dependent from one of the not patent eligible independent claims (i.e., claims 1, 8 and 15) discussed above, and are therefore believed to be not patent eligible for at least the same reasons.
Therefore, claims 2-7, 9-14 and 16-20 are not patent eligible due to their nature of dependence upon their respective independent claims and the rejection under 35 U.S.C. §101 is respectfully maintained.
Rejections Under 35 U.S.C. § 103
Applicant’s arguments are moot in view of new ground(s) of rejection (Scharf et al. (US 2015/0131458 A1).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ABABACAR SECK whose telephone number is (571)270-7146. The examiner can normally be reached Monday-Friday 8:00 A.M.-6:00 P.M..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Viker Lamardo can be reached on 571-270-5871. The fax phone number for the organization where this appli1cation or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ABABACAR SECK/Examiner, Art Unit 2147
/VIKER A LAMARDO/Supervisory Patent Examiner, Art Unit 2147
Prosecution Insights