DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 12/16/2025 has been entered.
This action is in response to the arguments filed on 12/16/2025. Claims 1-20 are pending in the application and have been considered below.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Regarding Claim 1:
For Step 1, the claim is a method, so it does recite a statutory category of invention.
For Step 2A, Prong 1:
The claim recites the limitation of “defining a plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “defining” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “generating a graph of the plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “generating” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “creating a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “creating” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connecting” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connecting” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “assigning each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “assigning” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “detecting anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “detecting” step from practically being performed in the human mind. This limitation is a mental process. MPEP 2106.04(a)(2)(III)(C).
The claim recites the limitation of “ranking detected anomalies based on ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph; wherein the defining occurs before the detecting” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “ranking” step from practically being performed in the human mind. This limitation is a mental process.
For Step 2A, Prong 2, the claim recites an additional element: system and receiving, in real time, system metrics from a plurality of networked resources.
The “system” is a generic component to apply an abstract idea under 2106.05(f).
The “receiving, in real time, system metrics from a plurality of networked resources” step is a form of insignificant extra-solution activity. See MPEP 2106.05(g).
Step 2B
The additional element of “system” does not amount to significantly more for the reasons set forth in step 2A above. Additionally, under the 2019 PEG, a conclusion that an additional element is insignificant extra-solution activity in Step 2A should be reevaluated in Step 2B.
Here the “receiving, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“system “to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 2:
Claim 2 which incorporates the rejection of claim 1, recites further an additional limitation:
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies.”
The “alerting” is a generic component to apply an abstract idea under 2106.05(f).
The additional element of “alerting an end user of the detected anomalies based on the ranking of the detected anomalies” does not amount to significantly more for the reasons set forth in step 2A above.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies” to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 3:
Claim 3, which incorporates the rejection of claim 1, recites further limitations such as “at least one metric describing a state of one or more resources; and
at least one condition, wherein each condition is defined for a corresponding metric” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 4:
Claim 4, which incorporates the rejection of claim 1, recites further limitations such as “observing for anomalous metrics and/or anomalous log through statistical analysis” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 5:
Claim 5, which incorporates the rejection of claim 1, recites further limitations such as “edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 6:
Claim 6, which incorporates the rejection of claim 1, recites further limitations such as “value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 7:
Claim 7, which incorporates the rejection of claim 1, recites further limitations such as “computing an importance value for a given node based on all edge weights of edges
connected to the given node; and
upon computing importance values for all nodes, ranking the nodes based on the
importance values” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 8:
For Step 1, the claim is a non-transitory computer-readable medium, so it does recite a statutory category of invention.
For Step 2A, Prong 1:
The claim recites the limitation of “define a plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “define” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “generate a graph of the plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “generate” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “create a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “create” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connect” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connecting” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “assign each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “assign” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “detect anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “detect” step from practically being performed in the human mind. This limitation is a mental process. MPEP 2106.04(a)(2)(III)(C).
The claim recites the limitation of “rank detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph; wherein the defining occurs before the rank” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “rank” step from practically being performed in the human mind. This limitation is a mental process.
For Step 2A, Prong 2, the claim recites additional elements: system, non-transitory computer-readable medium, processor, and receive, in real time, system metrics from a plurality of networked resources.
The additional elements of “system” “non-transitory computer-readable medium” and processor “are generic computer component that amounts to mere instructions to apply the abstract idea. See MPEP 2106.05(f).
The processor is recited at a high level of generality, i.e., as a generic processor performing a generic computer function of processing data. This generic processor limitation is no more than mere instructions to apply the exception using a generic computer component.
The “receive, in real time, system metrics from a plurality of networked resources” step is a form of insignificant extra-solution activity. See MPEP 2106.05(g).
Step 2B
The additional elements of “system, non-transitory computer-readable medium and processor” do not amount to significantly more for the reasons set forth in step 2A above.
Additionally, under the 2019 PEG, a conclusion that an additional element is insignificant extra-solution activity in Step 2A should be reevaluated in Step 2B.
Here the “receiving, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements of
“system, non-transitory computer-readable medium and processor “to perform the claim steps do not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 9:
Claim 9, which incorporates the rejection of claim 8, recites further an additional limitation: “alerting an end user of the detected anomalies based on the ranking of the detected anomalies.”
The “alerting” is a generic component to apply an abstract idea under 2106.05(f).
The additional element of “alerting an end user of the detected anomalies based on the ranking of the detected anomalies” does not amount to significantly more for the reasons set forth in step 2A above.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies” to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 10:
Claim 10, which incorporates the rejection of claim 8, recites further limitations such as “at least one metric describing a state of one or more resources; and
at least one condition, wherein each condition is defined for a corresponding metric” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 11:
Claim 11, which incorporates the rejection of claim 8, recites further limitations such as “the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 12:
Claim 12, which incorporates the rejection of claim 8, recites further limitations such as “edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 13:
Claim 13, which incorporates the rejection of claim 8, recites further limitations such as “edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 14:
Claim 14, which incorporates the rejection of claim 8, recites further limitations such as “compute an importance value for a given node based on all edge weights of edges
connected to the given node; and
upon compute importance values for all nodes, rank the nodes based on the importance
values” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 15:
For Step 1, the claim is a system, so it does recite a statutory category of invention.
For Step 2A, Prong 1:
The claim recites the limitation of “define a plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “define” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “generate a graph of the plurality of rules” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “generate step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “create a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “create” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connect” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “connecting” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “assign each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “assign” step from practically being performed in the human mind. This limitation is a mental process.
The claim recites the limitation of “detect anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “detect” step from practically being performed in the human mind. This limitation is a mental process. MPEP 2106.04(a)(2)(III)(C).
The claim recites the limitation of “rank detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph; wherein the defining occurs before the rank” limitation, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. That is nothing in the claim precludes the “rank” step from practically being performed in the human mind. This limitation is a mental process.
For Step 2A, Prong 2, the claim recites additional elements: system, non-transitory computer-readable medium and processor, and “receive, in real time, system metrics from a plurality of networked resources.”
The additional elements of “system, non-transitory computer-readable medium and processor “are generic computer components that amount to mere instructions to apply the abstract idea. See MPEP 2106.05(f).
The processor is recited at a high level of generality, i.e., as a generic processor performing a generic computer function of processing data. This generic processor limitation is no more than mere instructions to apply the exception using a generic computer component.
Step 2B
The additional elements of “system, non-transitory computer-readable medium and processor” do not amount to significantly more for the reasons set forth in step 2A above. Additionally, under the 2019 PEG, a conclusion that an additional element is insignificant extra-solution activity in Step 2A should be reevaluated in Step 2B.
Here the “receiving, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements of
“system, non-transitory computer-readable medium and processor “to perform the claim steps do not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 16:
Claim 16 which incorporates the rejection of claim 15, recites further an additional limitation:
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies.”
The “alerting” is a generic component to apply an abstract idea under 2106.05(f).
The additional element of “alerting an end user of the detected anomalies based on the ranking of the detected anomalies” does not amount to significantly more for the reasons set forth in step 2A above.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“alerting an end user of the detected anomalies based on the ranking of the detected
anomalies” to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 17:
Claim 17, which incorporates the rejection of claim 15, recites further limitations such as “at least one metric describing a state of one or more resources; and
at least one condition, wherein each condition is defined for a corresponding metric” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 18:
Claim 18, which incorporates the rejection of claim 15, recites further limitations such as “the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 19:
Claim 19 which incorporates the rejection of claim 15, recites further limitations such as “edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Regarding Claim 20:
Claim 20, which incorporates the rejection of claim 15 recites further limitations such as “value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes” that are part of the abstract idea.
There are no additional elements recited in this claim that amount to an integration of the judicial exception into a practical application or significantly more than the judicial exception. Therefore, the claim is not eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-4, 7-11, 14-18 are rejected under 35 U.S.C. 103 as being unpatentable over Ge et al. (US 2011/0231704 A1, hereinafter referred to as Ge), in view of Biswas et al. (US 2013/0318233 A1, hereinafter referred to as Biswas), and further in view of AMBICHL et al. (US 2017/0075749 A1, hereinafter referred to as AMBICHL).
As to claim 1, Ge teaches a method for ranking detected anomalies, the method comprising:
defining a plurality of rules (paragraph [0019], rules that are defined, defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify
root cause(s) of detected, reported and/or identified network events);
generating a graph of the plurality of rules (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734), comprising:
creating a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly (paragraphs [0013] …generating a set of diagnostic events from the normalized set of data sources which potentially cause the symptom event instance, the diagnostic events being determined based on dependency rules; and analyzing the set of diagnostic events to select a root cause event based on root cause rules; [0016] "An example short-duration event [events are represented by nodes and correspond to detected metrics in the rule chart] is a link flap that automatically clears itself. Example minor events include, but are not limited to, a router processor becoming temporarily overloaded, increasing the risk for protocol malfunction, and/or sporadic packet losses;" [0041]- [0042] Fig. 7; [0043]- [0045] Fig.8, the graph contains system events 415, 420, 425, 430, and 435. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes);
connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045] Fig. 8, system events 415, 420, 425, 430, and 435 are interconnected with weighted edges 905, 910, 915, etc.…);
assigning each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045]; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest.");
detecting anomalies by comparing the system metrics relative to the rules, wherein the system metrics include at least current system state or activity (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest"; [0018], collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115; [0019] Initially, the operator 140 provides, specifies and/or defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events; wherein using the broadest reasonable interpretation, Examiner interprets “an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events” to include “system metrics include at least current system state or activity” ); and
ranking detected anomalies based on ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph (paragraphs [0043]- [0046] Fig.8, the graph contains system events 415, 420, 425, 430, and 435 that are interconnected with weighted edges 905, 910, 915, etc. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes. In some examples, event E 435 is selected as the root cause of symptom event graph 310 because it has the highest priority of 50…Further still, root cause events may be selected based on the sum of the priorities along the path from the root cause event to the symptom event of interest 405…);
wherein the defining occurs before the detecting (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest.").
Ge teaches “To collect data, information and/or parameters representative of any number and/or type(s) of network event(s), network fault(s) and/or performance problem(s) for a network 115, the example communication system 100 of FIG. 1 includes any number and/or type(s) of data collectors and/or sources, two of which are designated at reference numerals 120 and 125. The example data sources 120 and 125 of FIG. 1 collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115 (paragraph [0018]).
However, Ge fails to explicitly teach:
receiving, in real time, system metrics from a plurality of networked resources; and
connecting, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge.
Biswas, in combination with Ge, teaches:
receiving, in real time, system metrics from a plurality of networked resources (paragraphs [0017] The communication devices include network traffic devices 106, such as access points or routers, and client devices 108, such as laptop computers, desktop computers, and portable computing devices, all of which are capable of communicating with each other using a network communications protocol specification; [0094]-[0095] …” The query messages can be sent and responses received in real-time, so that responses in general, and operational statistics (interpreted by Examiner as system metrics) in particular, will be current and will help to provide a network management system with increased accuracy, efficiency, and responsiveness”).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the system of Ge to add real-time monitoring to the system of Ge, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to provide a network management system with increased accuracy, efficiency, and responsiveness”, as suggested by Biswas ([0095]).
However, Ge and Biswas fail to explicitly teach:
connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge.
Ambichl, in combination with Ge and Biswas, teaches:
connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge (paragraphs [0248]- [0250] Fig. 22a " a virtual self-loop causal connection 410c with very low causal factor 413c [causal factor corresponds to the severity level of the rule] may be introduced for event types that have, according to knowledge of the technical domain, typically no other root cause and are therefore the root cause of themselves. Self-loop 413c is an edge with corresponding causal factor 3 connecting Event Node Record 1 with itself).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge and Biswas to add node connection to the combination system of Ge and Biswas, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to indicate a type of event that most probably is its own root cause, a self-loop causal link 413e is added to the event graph before calculation of the root cause probability factors. Adding those events provides
more variations for the random surfer to escape from event 5 and its self-loop. This dampens the effect of the self-loop and provides expected root cause probability results that are also justified and supported by the calculated causal factors, as suggested by Ambichl ([0250]- [0253]).
As to claim 2, which incorporates the rejection of claim 1, Ge teaches: alerting an end user of the detected anomalies based on the ranking of the detected anomalies (paragraph [0021] "The example root cause analyzer of Fig. 1 reports identified root cause event(s) to the operator via, for example, the user interface").
As to claim 3, which incorporates the rejection of claim 1, Ge teaches wherein the plurality of rules each comprises: at least one metric describing a state of one or more resources (paragraph [0018] The system "includes any number and/or type(s) of data collectors and/or sources", which "collect and/or store network event, network fault,
and/or performance data and/or information obtained and/or collected from any number
and/or type(s) of network devices."); and at least one condition, wherein each condition is defined for a corresponding metric (paragraphs [0040] an example condition [event node] in a rule is. "external border gateway protocol flap," which may cause the symptom event of interest "interface flap."); [0043] the rule defines measured or detected network event(s), which if they occur, may be a root cause for a symptom event of interest).
As to claim 4, which incorporates the rejection of claim 1, Ge teaches wherein the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis (paragraph [0028] the rule generator "statistically correlates the output of the root cause identifier with other time series of events [e.g. system logs] stored in the data store to learn, adapt, and/or incorporate previously unknown and/or learned knowledge of the network.")
As to claim 7, which incorporates the rejection of claim 1, Ge teaches wherein ranking nodes comprises: computing an importance value for a given node based on all edge weights of edges connected to the given node; and upon computing importance values for all nodes, ranking the nodes based on the importance values (paragraph [0045] "the priority of a particular potential root cause event may depend on the number of event instances associated with the potential root cause event node. Specifically, the priority of a potential root cause node may be multiplied by the number of event instances associated with the potential root cause event node [i.e., the number of edges connected to the potential root cause event node].")
As to claim 8, Ge teaches a non-transitory computer-readable medium comprising one or more instructions that when executed on a processor cause the processor to perform operations ([0057]) comprising:
define a plurality of rules (paragraph [0019], rules that are defined…defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify
root cause(s) of detected, reported and/or identified network events);
generate a graph of the plurality of rules (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734), comprising:
create a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly (paragraphs [0013] …generating a set of diagnostic events from the normalized set of data sources which potentially cause the symptom event instance, the diagnostic events being determined based on dependency rules; and analyzing the set of diagnostic events to select a root cause event based on root cause rules; [0016] "An example short-duration event [events are represented by nodes and correspond to detected metrics in the rule chart] is a link flap that automatically clears itself. Example minor events include, but are not limited to, a router processor becoming temporarily overloaded, increasing the risk for protocol malfunction, and/or sporadic packet losses;" [0041]- [0042] Fig. 7; [0043]- [0045] Fig.8, the graph contains system events 415, 420, 425, 430, and 435 …Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes);
connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045] Fig. 8, system events 415, 420, 425, 430, and 435 are interconnected with weighted edges 905, 910, 915, etc.…);
assign each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045]; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest");
detect anomalies by comparing the system metrics relative to the rules, wherein the system metrics include at least current system state or activity (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest."); and
rank detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph (paragraphs [0043]- [0046] Fig.8, the graph contains system events 415, 420, 425, 430, and 435 that are interconnected with weighted edges 905, 910, 915, etc. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes. In some examples, event E 435 is selected as the root cause of symptom event graph 310 because it has the highest priority of 50. Further still, root cause events may be selected based on the sum of the priorities along the path from the root cause event to the symptom event of interest 405; [0018], collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115; [0019] Initially, the operator 140 provides, specifies and/or defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events; wherein using the broadest reasonable interpretation, Examiner interprets “an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events” to include “system metrics include at least current system state or activity”);
wherein the define occurs before the detecting (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest").
Ge teaches “To collect data, information and/or parameters representative of any number and/or type(s) of network event(s), network fault(s) and/or performance problem(s) for a network 115, the example communication system 100 of FIG. 1 includes any number and/or type(s) of data collectors and/or sources, two of which are designated at reference numerals 120 and 125. The example data sources 120 and 125 of FIG. 1 collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115 (paragraph [0018]).
However, Ge fails to explicitly teach:
receive, in real time, system metrics from a plurality of networked resources; and
connecting, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge.
Biswas, in combination with Ge, teaches:
receive, in real time, system metrics from a plurality of networked resources (paragraphs [0017] The communication devices include network traffic devices 106, such as access points or routers, and client devices 108, such as laptop computers, desktop computers, and portable computing devices, all of which are capable of communicating with each other using a network communications protocol specification; [0094]-[0095] …” The query messages can be sent and responses received in real-time, so that responses in general, and operational statistics in particular, will be current and will help to provide a network management system with increased accuracy, efficiency, and responsiveness”).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the system of Ge to add real-time monitoring to the system of Ge, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to provide a network management system with increased accuracy, efficiency, and responsiveness”, as suggested by Biswas ([0095]).
However, Ge and Biswas fail to explicitly teach:
connect, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge.
Ambichl, in combination with Ge and Biswas, teaches:
connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge (paragraphs [0248]- [0250] Fig. 22a "a virtual self-loop causal connection 41 0c with very low causal factor 413c [causal factor corresponds to the severity level of the rule] may be introduced for event types that have, according to knowledge of the technical domain, typically no other root cause and are therefore the root cause of themselves. Self-loop 413c is an edge with corresponding causal factor 3 connecting Event Node Record 1 with itself).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge and Biswas to add node connection to the combination system of Ge and Biswas, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to indicate a type of event that most probably is its own root cause, a self-loop causal link 413e is added to the event graph before calculation of the root cause probability factors. Adding those events provides more variations for the random surfer to escape from event 5 and its self-loop. This dampens the effect of the self-loop and provides expected root cause probability results that are also justified and supported by the calculated causal factors, as suggested by Ambichl ([0251]- [0253]).
As to claim 9, which incorporates the rejection of claim 8, Ge teaches: alerting an end user of the detected anomalies based on the ranking of the detected anomalies (paragraph [0021] "The example root cause analyzer of Fig. 1 reports identified root cause event(s) to the operator via, for example, the user interface.").
As to claim 10, which incorporates the rejection of claim 8, Ge teaches wherein the plurality of rules each comprises: at least one metric describing a state of one or more resources (paragraph [0018] The system "includes any number and/or type(s) of data collectors and/or sources", which "collect and/or store network event, network fault,
and/or performance data and/or information obtained and/or collected from any number
and/or type(s) of network devices."); and at least one condition, wherein each condition is defined for a corresponding metric (paragraphs [0040] an example condition [event node] in a rule is. "external border gateway protocol flap," which may cause the symptom event of interest "interface flap."); [0043] the rule defines measured or detected network event(s), which if they occur, may be a root cause for a symptom event of interest).
As to claim 11, which incorporates the rejection of claim 8, Ge teaches wherein the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis (paragraph [0028] the rule generator "statistically correlates the output of the root cause identifier with other time series of events [ e.g. system logs] stored in the data store to learn, adapt, and/or incorporate previously unknown and/or learned knowledge of the network.")
As to claim 14, which incorporates the rejection of claim 8, Ge teaches wherein ranking nodes comprises: computing an importance value for a given node based on all edge weights of edges connected to the given node; and upon computing importance values for all nodes, ranking the nodes based on the importance values (paragraph [0045] "the priority of a particular potential root cause event may depend on the number of event instances associated with the potential root cause event node. Specifically, the priority of a potential root cause node may be multiplied by the number of event instances associated with the potential root cause event node [i.e., the number of edges connected to the potential root cause event node]").
As to claim 15, Ge teaches a system, comprising:
a non-transitory computer-readable medium ([0057]);
a processor programmed to cooperate with the instructions to perform operations ([0057]) comprising:
define a plurality of rules (paragraph [0019], rules that are defined; defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify
root cause(s) of detected, reported and/or identified network events.);
generate a graph of the plurality of rules (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734), comprising:
create a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules, the rules including a first rule in which a single metric is a potential source of an anomaly and a second rule in which a pair of metrics is a potential source of anomaly (paragraphs [0013, generating a set of diagnostic events from the normalized set of data sources which potentially cause the symptom event instance, the diagnostic events being determined based on dependency rules; and analyzing the set of diagnostic events to select a root cause event based on root cause rules; [0016] "An example short-duration event [events are represented by nodes and correspond to detected metrics in the rule chart] is a link flap that automatically clears itself. Example minor events include, but are not limited to, a router processor becoming temporarily overloaded, increasing the risk for protocol malfunction, and/or sporadic packet losses;" [0041]- [0042] Fig. 7; [0043]- [0045] Fig.8, the graph contains system events 415, 420, 425, 430, and 435. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes);
connect, for each pair of metrics of the second rules, the corresponding pair of nodes with edges (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045] Fig. 8, system events 415, 420, 425, 430, and 435 are interconnected with weighted edges 905, 910, 915, etc.);
assign each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge (paragraphs [0041]- [0042] Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; [0043]- [0045]; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest");
detect anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest"); and
rank detected anomalies based on the ranking of the nodes corresponding to the metrics of the graph (paragraphs [0043]- [0046] Fig.8, the graph contains system events 415, 420, 425, 430, and 435. Additionally, the reasoning rule 715 contains priority values for each edge of the reasoning rule 715. For example, the event A to symptom event edge has a priority 905 of 30, and the event B to symptom event edge has a priority 910 of 20. The example operator 140 defines and/or specifics the priority values for each edge of the rule 715. The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest 405. When evaluating individual root symptoms, the rule-based reasoning module 710 compares the root cause events in the symptom event graph. The root cause event with the maximum priority configured is identified as the root cause event. In the case or a tie, both root cause events are selected as root causes. In some examples, event E 435 is selected as the root cause of symptom event graph 310 because it has the highest priority of 50. Further still, root cause events may be selected based on the sum of the priorities along the path from the root cause event to the symptom event of interest 405); [0018], collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115; [0019] Initially, the operator 140 provides, specifies and/or defines an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events; wherein using the broadest reasonable interpretation, Examiner interprets “an initial set of rules that the root cause analyzer 110 applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events” to include “system metrics include at least current system state or activity”);
wherein the define occurs before the detecting (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest").
Ge teaches “To collect data, information and/or parameters representative of any number and/or type(s) of network event(s), network fault(s) and/or performance problem(s) for a network 115, the example communication system 100 of FIG. 1 includes any number and/or type(s) of data collectors and/or sources, two of which are designated at reference numerals 120 and 125. The example data sources 120 and 125 of FIG. 1 collect and/or store network event, network fault and/or performance data and/or information obtained and/or collected from any number and/or type(s) of network devices (four of which are designated at reference numerals 130-133) of the example network 115)” (paragraph [0018]).
However, Ge fails to explicitly teach:
receive, in real time, system metrics from a plurality of networked resources;
connect, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge.
Biswas, in combination with Ge, teaches:
receive, in real time, system metrics from a plurality of networked resources (paragraphs [0017] The communication devices include network traffic devices 106, such as access points or routers, and client devices 108, such as laptop computers, desktop computers, and portable computing devices, all of which are capable of communicating with each other using a network communications protocol specification; [0094]-[0095] …” The query messages can be sent and responses received in real-time, so that responses in general, and operational statistics in particular, will be current and will help to provide a network management system with increased accuracy, efficiency, and responsiveness”).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the system of Ge to add real-time monitoring to the system of Ge, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to provide a network management system with increased accuracy, efficiency, and responsiveness”, as suggested by Biswas ([0095]).
However, Ge and Biswas fail to explicitly teach:
connect, for each node corresponding to a single metric of the rules, the
corresponding each node to itself with an edge.
Ambichl, in combination with Ge and Biswas, teaches:
connect, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge (paragraphs [0248]- [0250] Fig. 22a "a virtual self-loop causal connection 41 0c with very low causal factor 413c [causal factor corresponds to the severity level of the rule] may be introduced for event types that have, according to knowledge of the technical domain, typically no other root cause and are therefore the root cause of themselves. Self-loop 413c is an edge with corresponding causal factor 3 connecting Event Node Record 1 with itself).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge and Biswas to add node connection to the combination system of Ge and Biswas, as taught by Ambichl, above. The modification would have been obvious because one of ordinary skill would be motivated to indicate a type of event that most probably is its own root cause, a self-loop causal link 413e is added to the event graph before calculation of the root cause probability factors. Adding those events provides more variations for the random surfer to escape from event 5 and its self-loop. This dampens the effect of the self-loop and provides expected root cause probability results that are also justified and supported by the calculated causal factors, as suggested by Ambichl ([0251]- [0253]).
As to claim 16, which incorporates the rejection of claim 15, Ge teaches: alerting an end user of the detected anomalies based on the ranking of the detected anomalies (paragraph [0021] "The example root cause analyzer of Fig. 1 reports identified root cause event(s) to the operator via, for example, the user interface").
As to claim 17, which incorporates the rejection of claim 15, Ge teaches wherein the plurality of rules each comprises: at least one metric describing a state of one or more resources (paragraph [0018] The system "includes any number and/or type(s) of data collectors and/or sources", which "collect and/or store network event, network fault,
and/or performance data and/or information obtained and/or collected from any number
and/or type(s) of network devices."); and at least one condition, wherein each condition is defined for a corresponding metric (paragraphs [0040] an example condition [event node] in a rule is. "external border gateway protocol flap," which may cause the symptom event of interest "interface flap."); [0043] the rule defines measured or detected network event(s), which if they occur, may be a root cause for a symptom event of interest).
As to claim 18, which incorporates the rejection of claim 15, Ge teaches wherein the detected anomalies are detected by observing for anomalous metrics and/or anomalous log through statistical analysis (paragraph [0028] the rule generator "statistically correlates the output of the root cause identifier with other time series of events [ e.g. system logs] stored in the data store to learn, adapt, and/or incorporate previously unknown and/or learned knowledge of the network").
Claims 5, 12 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Ge et al. (US 2011/0231704 A1, hereinafter referred to as Ge), in view of Biswas et al. (US 2013/0318233 A1, hereinafter referred to as Biswas), and further in view of AMBICHL et al. (US 2017/0075749 A1, hereinafter referred to as AMBICHL), and Chung et al. (US 2009/0177642 A1, hereinafter referred to as Chung).
As to claim 5, which incorporates the rejection of claim 1, Chung, in combination with Ge and Ambichl, teaches wherein edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation (paragraphs [0042] "Bottleneck rules are defined by means of logical expressions which employ metrics that are combined with arithmetic and logical operators"; [0104] "the module scheduler builds a dependency graph for the identified dependencies. The dependency graph uses a metric as the node and any dependency with another metric as an edge.")
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add a logical operation to the combination system of Ge, Biswas and Ambichl, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use a bottleneck which is anything that inhibits the potential for the target application to execute faster on a given system and is correctable, as suggested by Chung, ([0042]).
As to claim 12, which incorporates the rejection of claim 8, Chung, in combination with Ge, Biswas and Ambichl, teaches wherein edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation (paragraphs [0042] "Bottleneck rules are defined by means of logical expressions which employ metrics that are combined with arithmetic and logical operators"; [0104] "the module scheduler builds a dependency graph for the identified dependencies. The dependency graph uses a metric as the node and any dependency with another metric as an edge.")
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add a logical operation to the combination system of Ge, Biswas and Ambichl, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use a bottleneck which is anything that inhibits the potential for the target application to execute faster on a given system and is correctable, as suggested by Chung, ([0042]).
As to claim 19, which incorporates the rejection of claim 15, Chung, in combination with Ge, Biswas and Ambichl, teaches wherein edges are defined in the graph when two or more metrics and their corresponding conditions are connected in a given rule via a logical operation (paragraphs [0042] "Bottleneck rules are defined by means of logical expressions which employ metrics that are combined with arithmetic and logical operators"; [0104] "the module scheduler builds a dependency graph for the identified dependencies. The dependency graph uses a metric as the node and any dependency with another metric as an edge.")
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add a logical operation to the combination system of Ge, Biswas and Ambichl, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use a bottleneck which is anything that inhibits the potential for the target application to execute faster on a given system and is correctable, as suggested by Chung, ([0042]).
Claims 6, 13 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Ge et al. (US 2011/0231704 A1, hereinafter referred to as Ge), in view of Biswas et al. (US 2013/0318233 A1, hereinafter referred to as Biswas), and further in view of AMBICHL et al. (US 2017/0075749 A1, hereinafter referred to as AMBICHL), and Cohen et al. (US 2014/0372347, hereinafter referred to as Cohen).
As to claim 6, which incorporates the rejection of claim 1, Chung, in combination with Ge and Ambichl, teaches wherein value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes (paragraph [0052] "A statistical significance [corresponds to an edge value representing a severity level] may be computed using different parameters and respective weights. These parameters may include, for example, [ ...] a number of metrics that show an abnormal behavior" [Note: the edge weight may therefore be adjusted depending on whether multiple metrics are implicated in a logical AND statement in a rule vice a single metric triggering a logical OR statement in a rule.]).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add logical operation to the combination system of Ge, Biswas and Ambichl, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use process flow 700 facilitates establishing different levels for determining an anomaly and, therefore, reduction of false alarms, as suggested by Chung, ([0052]).
As to claim 13, which incorporates the rejection of claim 8, Chung, in combination with Ge, Biswas and Ambichl, teaches wherein value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes (paragraph [0052] "A statistical significance [corresponds to an edge value representing a severity level] may be computed using different parameters and respective weights. These parameters may include, for example, a number of metrics that show an abnormal behavior" [Note: the edge weight may therefore be adjusted depending on whether multiple metrics are implicated in a logical AND statement in a rule vice a single metric triggering a logical OR statement in a rule.]).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add logical operation to the combination system of Ge, Biswas and Ambichl, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use process flow 700 facilitates establishing different levels for determining an anomaly and, therefore, reduction of false alarms, as suggested by Chung, ([0052]).
As to claim 20, which incorporates the rejection of claim 15, Chung, in combination with Ge, Biswas and Ambichl, teaches wherein value for a given edge weight of a given edge connecting two nodes varies depending on a type of logical operation which connects metrics corresponding to the two nodes (paragraph [0052] "A statistical significance [corresponds to an edge value representing a severity level] may be computed using different parameters and respective weights. These parameters may include, for example, a number of metrics that show an abnormal behavior" [Note: the edge weight may therefore be adjusted depending on whether multiple metrics are implicated in a logical AND statement in a rule vice a single metric triggering a logical OR statement in a rule.]).
It would have been obvious to one of ordinary skill in the art before the effective filing of
the claimed invention to modify the combination system of Ge, Biswas and Ambichl to add logical operation to the combination system of Ge, Biswas and Ambichl, as taught by Chung, above. The modification would have been obvious because one of ordinary skill would be motivated to use process flow 700 facilitates establishing different levels for determining an anomaly and, therefore, reduction of false alarms, as suggested by Chung, ([0052]).
Response to Applicant’s arguments
The Applicant’s arguments filed on 12/26/2025 have been fully considered but are not persuasive for the 101 rejections.
Claim Rejections under 35 U.S.C. §101
Step 2A, Prong 1 - The Claim Does Not Recite a Mental Process
Argument (page 8)
Applicant appears to assert that this limitation involves real-time ingestion of telemetry from multiple distributed resources. Humans cannot simultaneously collect and process high volume, high-velocity data streams from numerous machines in real time. This is not a theoretical mental step; it is a concrete machine operation requiring network interfaces and computational resources.
Examiner’s response:
Examiner respectfully disagrees because the “receiving, in real time, system metrics from a plurality of networked resources” step is a form of insignificant extra-solution activity. See MPEP 2106.05(g).
Under the 2019 PEG, a conclusion that an additional element is insignificant extra-solution activity in Step 2A should be reevaluated in Step 2B.
Here the “receiving, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
Argument (pages 8-9)
Claim 1 recites:
"detecting anomalies by comparing the system metrics relative to the rules, wherein the system metrics include at least current system state or activity." This limitation requires comparison of live telemetry against multiple conditions. Detecting anomalies in real time involves statistical or rule-based evaluation across dynamic data streams. Humans cannot perform such comparisons at machine speed or scale.
Examiner’s response:
Examiner respectfully disagrees. Applicant appears to assert that this limitation requires comparison of live telemetry against multiple conditions. Detecting anomalies in real time involves statistical or rule-based evaluation across dynamic data streams. Humans cannot perform such comparisons at machine speed or scale.
MPEP 2106.04(a) “Mental processes – concepts performed in the human mind (including an observation, evaluation, judgment, opinion).” See additionally see MPEP 2106.04(a)(2).
MPEP 2106.04(a)(2)(III)(C) “A Claim That Requires a Computer May Still Recite a Mental Process.”
Examiner is interpreting the limitations as abstract ideas implemented on a generic computer. (Step 2A Prong 1)
The “detecting” step is an observation or evaluation based on anomalies by comparing system metrics relative to the rules, wherein the system metrics include at least current system state or activity. The claim does not recite “live telemetry against multiple conditions.” This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person detects anomalies in a graph based on rules. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C).
Argument (page 9)
Claim 1 recites:
"ranking detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph"
This limitation requires computing node rankings from edge weights and
applying those rankings to anomalies. Ranking based on graph-derived importance values involves aggregation and sorting algorithms. These steps cannot practically be performed mentally because:
• They depend on weighted relationships across a graph.
• They require iterative computation and sorting of multiple anomalies.
Examiner’s response:
Examiner respectfully disagrees. Applicant appears to assert that these steps cannot practically be performed mentally because:
• They depend on weighted relationships across a graph.
• They require iterative computation and sorting of multiple anomalies.
MPEP 2106.04(a) “Mental processes – concepts performed in the human mind (including an observation, evaluation, judgment, opinion).” See additionally see MPEP 2106.04(a)(2).
MPEP 2106.04(a)(2)(III)(C) “A Claim That Requires a Computer May Still Recite a Mental Process.”
Examiner is interpreting the limitations as abstract ideas implemented on a generic computer. (Step 2A Prong 1)
The “ranking” step is an observation or evaluation based on detected anomalies based on the ranking of the nodes corresponding to the metrics of the graph; wherein the defining occurs before the detecting. The claim does not recite “aggregation and sorting algorithms.” This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person ranks anomalies detected in a graph based on rules. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52.
Step 2A, Prong 2 - The Claim Is Integrated Into a Practical Application
Argument (page 9)
1. Real-Time System Monitoring
• "receiving, in real time, system metrics and logs from a plurality of
networked resources."
• This ties the invention to live operational environments, not abstract analysis. Real-time ingestion from multiple networked resources improves system responsiveness and reliability-core aspects of computer functionality.
Examiner’s response:
Examiner respectfully disagrees.
Step 2A, Prong 2
The “receiving, in real time, system metrics from a plurality of networked resources” step is a form of insignificant extra-solution activity. See MPEP 2106.05(g).
Under the 2019 PEG, a conclusion that an additional element is insignificant extra-solution activity in Step 2A should be reevaluated in Step 2B.
Step 2B
The “receive, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
Argument (pages 9-10)
2. Graph-Based Prioritization
• "generating a graph of the plurality of rules ... assigning each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge. "
• This is not a generic rule check. It uses a specialized data structure (weighted graph) to encode relationships among metrics and severity levels. The memo explicitly recognizes that "specialized data structures that achieve a technological benefit" are evidence of integration into a practical application.
Examiner’s response:
Examiner respectfully disagrees. The “generating” step is an observation or evaluation based on a graph of the plurality of rules. This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person generates (i.e. draws) a graph. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C) “A Claim That Requires a Computer May Still Recite a Mental Process.”
The edge weights of the graph (specialized data structure) as recited in the claim do not improve any technological field.
Argument (page 10)
3. Operational Improvement Through Ranking
• "ranking detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph."
• This step transforms raw anomaly detection into actionable intelligence. By ranking anomalies based on graph-derived importance, the system enables efficient triage, reducing false positives and alert noise. This is a concrete improvement to the functioning of network monitoring systems.
Examiner’s response:
Examiner respectfully disagrees. The “ranking” step is an observation or evaluation based on detected anomalies based on the ranking of the nodes corresponding to the metrics of the graph; wherein the defining occurs before the detecting. The claim does not recite “aggregation and sorting algorithms.” This type of observation or evaluation is an act that can be practically performed in the human mind, similar to the mental thought processes that occur when a person ranks anomalies detected in a graph based on rules. Such mental observations or evaluations fall within the “mental processes” grouping of abstract idea set forth in the 2019 PEG. 2019 PEG Section I, 84 Fed. Reg. at 52. See MPEP 2106.04(a)(2)(III)(C) “A Claim That Requires a Computer May Still Recite a Mental Process.”
Argument (pages 10-11)
Step 2B - The Claim Recites Significantly More Than Any Abstract Idea
Even assuming arguendo that an abstract idea were implicated, the additional elements amount to significantly more under the SMED memo:
"Additional elements that amount to significantly more include improvements to the functioning of a computer or another technology, use of a particular machine, or
specialized data structures that achieve a technological benefit."
1. Specialized Data Structure Achieving a Technological Benefit
• "generating a graph of the plurality of rules ... creating a plurality of nodes... connecting... assigning each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge."
• Why it matters: This is not a generic data representation. It is a weighted graph that encodes rule semantics and severity levels to prioritize anomalies. The memo explicitly identifies specialized data structures that achieve a technological benefit as evidence of "significantly more." Here, the technological benefit is improved alert prioritization in distributed systems.
Examiner’s response:
Examiner respectfully disagrees.
MPEP 2106.04(a)(2)(III)(C) “A Claim That Requires a Computer May Still Recite a Mental Process.”
Examiner is interpreting the limitations as abstract ideas implemented on a generic computer. (Step 2A Prong 1)
The "generating a graph of the plurality of rules ... creating a plurality of nodes... connecting... assigning each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge" are interpreted as “mental process.” MPEP 2106.04(a)(2)(III)(C).
Argument (page 11)
2. Real-Time, Distributed Execution
• "receiving, in real time, system metrics and logs from a plurality of networked resources."
• Real-time ingestion from multiple networked resources cannot be performed mentally and requires machine-scale execution. This improves system responsiveness and operational reliability-an improvement to computer functionality.
Examiner’s response:
Examiner respectfully disagrees. The “receive, in real time, system metrics from a plurality of networked resources” step was considered to be extra-solution activity in Step 2A, and thus it is reevaluated in Step 2B to determine if it is more than what is well-understood, routine, conventional activity in the field. The addition of insignificant extra-solution activity does not amount to an inventive concept, particularly when the activity is well-understood or conventional (MPEP 2106.05(d)). This appears to be well-understood, routine, conventional as evidenced by MPEP 2106.05(d)(II)(i).
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data”.
Argument (page 11)
3. Operational Improvement Beyond Generic Processing
• "ranking detected anomalies based on the ranking of the nodes determined from the edge weights and corresponding to the metrics of the graph."
• This step transforms raw anomaly detection into actionable intelligence by ranking anomalies according to graph-derived importance values. This reduces false positives and alert noise, enabling faster remediation. The memo emphasizes that improvements to the functioning of a computer or another technology constitute "significantly more."
As such, Applicant respectfully submits that the rejection of the claims under 35 U.S.C. §101 is improper and should be withdrawn.
Examiner’s response:
Examiner respectfully disagrees. The claim does not recite “transforms raw anomaly detection into actionable intelligence.”
The newly added claim features do not improve the functionality of a computer or any technology.
The claim does not include an additional element that are sufficient to amounts to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of
“system “to perform the claim steps does not amount to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. The claim is not patent eligible.
Therefore, Examiner respectfully maintains the 35 USC 101 rejection upon claim 1 as well as independent claims 8 and 15, as they recite substantially same limitations as amended claim 1.
For the dependent claims, no further arguments were presented, Examiner respectfully maintains the 35 USC 101 rejections upon them, due to their nature of dependence upon their respective independent claims.
Rejections Under 35 U.S.C. § 103
Argument (page 13)
Claim 1
Claim 1 recites: "generating a graph of the plurality of rules, comprising:
creating a plurality of nodes, each of the nodes corresponding to a metric of the plurality of rules ... connecting, for each node corresponding to a single metric of the rules, the corresponding each node to itself with an edge; connecting, for each pair of metrics of the second rules, the corresponding pair of nodes with edges"
• Ge: Edges in Ge encode dependencies among events (symptom/diagnostic)
defined by dependency + spatial/temporal joins; Ge does not form edges solely
because two metrics co-appear within one administrator rule, nor does it create
self-loops solely because a rule contains a single metric.
Examiner's response:
Examiner respectfully disagrees. Ge teaches:
"Initially, the operator provides, specifies, and/or defines an initial set of rules that the root cause analyzer applies, implements and/or uses to identify root cause(s) of detected, reported and/or identified network events" ([0019]).
"the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule." "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest" ((Fig. 8 and [0043]).
Ambichl teaches a self-loop causal link 413e (paragraph [0251]).
Citations:
• Ambichl: Edges encode causality among events; self-loops are introduced for
certain event types to stabilize centrality-not because a rule contains only one
metric-condition pair.
As such, the claimed limitations are absent from both references.
Examiner's response:
Examiner respectfully disagrees. Ambichl teaches a self-loop causal link 413e (paragraph [0251]).
Therefore, Ambichl and Ge teach the claimed limitations.
Argument (pages 13-14)
Claim 1 also recites in part: "assigning each of the edges with an edge weight
corresponding to a severity level of the corresponding rule that defined the edge"
• Ge: Mentions priority values used in reasoning rules for selecting root causes,
but Ge never teaches severity-as-edge-weight in a metric graph derived from
alert rules, nor operator-type modulation (AND vs. OR) of edge weights as the
spec describes.
• Ambichl: Weights are causality/impact factors driven by topology/timing/evidence-not rule severity mapped to edges between metric nodes.
Neither reference teaches or suggests severity driven edge weighting bound to
rule semantics, as claimed.
Examiner's response:
Examiner respectfully disagrees. The claim does not explicitly recite “severity-as-edge-weight in a metric graph derived from alert rules, nor operator-type modulation (AND vs. OR) of edge weights as the spec describes.”
Ge teaches further “assigning each of the edges with an edge weight corresponding to a severity level of the corresponding rule that defined the edge” in Fig. 8 and [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule." "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest.") the severity level of each of the rules being selected from within a continuous range; (Fig. 8, example priority levels (corresponding to severity levels) shown are drawn from the range of positive integers, including 20, 30, 35, 40, 45, and 50.)
Argument (page 14)
Claim 1 also recites in part: "receiving, in real time, system metrics and logs
from a plurality of networked resources; detecting anomalies by comparing the
system metrics relative to the rules, wherein the system metrics include at least current system state or activity; wherein the defining occurs before the detecting"
• Ge: Collects network data (SNMP/logs) but uses joins and reasoning to identify
root causes of symptom events; Ge does not disclose rule-relative anomaly
detection (current state/activity) in the claimed temporal order ("defining occurs
before detecting").
• Ambichl: Detects events and constructs event causality networks; it does not
detect anomalies by comparing metrics to administrator rules, nor require
defining to precede detecting.
As such, the claimed pipeline ordering and rule-relative anomaly detection are
not taught/suggested by the cited art.
Examiner's response:
Examiner respectfully disagrees. Biswas et al. (US 2013/0318233 A1) (new ground(s) of rejection) teach “receiving, in real time, system metrics from a plurality of networked resources (paragraphs [0017] and [0094]-[0095]; see rejection above).
Argument (page 14)
Claim 1 also recites in part: "ranking detected anomalies based on the ranking
of the nodes determined from the edge weights and corresponding to the metrics of the graph"
• Ge: Ranks candidate root causes within a symptom graph via priorities; Ge
does not rank anomaly alerts across metrics by node importance derived from
rule-severity edge weights.
• Ambichl: Computes centrality in event causality graphs to pick root-cause
events; Ambichl does not rank alerts based on metric-node importance
The claimed ranking anomalies by metric node rank from severity weights is
absent from Ge/ Ambichl.
Examiner's response:
Examiner respectfully disagrees. The claim does not explicitly teach “rank anomaly alerts.” Ge teaches the limitation as shown in the rejection above. (paragraphs [0045-0046]).
Argument (page 15)
No Motivation to Combine/ No Reasonable Expectation of Success
Fundamental goal/architecture mismatch (diagnosis vs. triage):
Ge/Ambichl are event-causality RCA engines (edges= cause/effect among
events; weights= causality/priority) aimed at root-cause selection for a presented
episode. The claims require a metric-graph (edges exist only due to co-appearance in a single rule; weights= rule severity) aimed at global anomaly triage. A POSITA would not be motivated to abandon event-causality semantics and adopt rule-co-appearance edges + severity weights, as that undermines the diagnostic objectives and yields a different output (triage, not diagnosis).
No teaching to map administrator severity to causality/priority models:
Ge's "priorities" serve reasoning paths; Ambichl's impact factors are evidence-driven.
The art does not teach mapping administrator severity (with operator-type modulation, AND/OR) to graph weights for metric nodes. A POSITA would lack a reasonable expectation of success in transposing such differing semantics.
Examiner's response:
Examiner respectfully disagrees. Claim does not explicitly recite: “mapping administrator severity (with operator-type modulation, AND/OR.”
A POSITA would not lack a reasonable expectation of success in transposing such differing semantics.
Argument (page 15)
Continuation Consistency-PTO Is Already On the Record (Parent Allowance)
This application is a continuation of U.S. Appl. No. 15/152,379. The Notice of
Allowance in the parent '379 case concluded that the combination of Ge and Ambichl
did not teach or suggest the following limitations:
• "defining a plurality of rules;"
• "generating a graph of the plurality of rules;"
• "detecting anomalies by comparing system metrics relative to the rules;"
• "wherein the defining occurs before the detecting."
Each of those limitations is present in the instant claims (see Claim 1). In a
continuation, the PTO's prior reasoning is persuasive authority for consistency. If the
Office now departs from that record, Applicant respectfully requests a specific
explanation identifying the new facts or claim differences and articulating a
non-hindsight motivation to combine with a reasonable expectation of success (see MPEP 2141 and 2143 on the requirement to articulate reasoning, not conclusory
assertions).
Examiner's response:
Examiner respectfully disagrees. Ge teaches:
rule defining a plurality of rules (“rules that are defined” (paragraph [0019])).
generating a graph of the plurality of rules (reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734 (paragraphs [0041]- [0042] Fig. 7).
detecting anomalies by comparing system metrics relative to the rules
(Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest.");
[ ... ]
wherein the defining occurs before the detecting (Fig. 7, reasoning rules 715 are provided to the Rule Based Reasoning Module 705 in the Root Cause identifier 225 and used to produce rule graphs 730-734; Fig. 8 and paragraph [0043] "the reasoning rule contains priority values [corresponds to severity level] for each edge of the reasoning rule."; "The higher the priority value, the more likely the root cause event is the actual root cause of the symptom event of interest.")
With regard to the parent 15/152,379, Applicant is reminded that each case is examined
based on its own merits.
The combination of references in the office action are sufficient evidence to support a prima facie case of obviousness. Examiner respectfully maintains the rejection.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ABABACAR SECK whose telephone number is (571)270-7146. The examiner can normally be reached Monday-Friday 8:00 A.M.-6:00 P.M..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Viker Lamardo can be reached on 571-270-5871. The fax phone number for the organization where this appli1cation or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ABABACAR SECK/Examiner, Art Unit 2147
/VIKER A LAMARDO/Supervisory Patent Examiner, Art Unit 2147