Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Detailed Action
The following action is in response to the communication(s) received on 02/01/2026.
As of the claims filed 02/01/2026:
Claims 1, 17, and 20 have been amended.
Claims 1-20 are pending.
Claims 1, 17, and 20 are independent claims.
Applicant's arguments regarding the art rejection under 35 USC § 103 over Assaf further in view of Qiu, further in view of Thalheim, filed 02/01/2026, that the previous Office Action fails to address the limitation in claim 1, where “accessing… key performance indicators…; channeling…n KPI values…; and feeding initial KPI values are done continuously". Examiner agrees. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made, properly addressing the limitation, as set forth below. This action is NON-FINAL.
Response to Arguments
Applicant’s arguments filed 02/01/2026 have been fully considered. Examiner’s response to the arguments are presented below.
With respect to the indefiniteness rejection under 35 USC § 112:
Applicant’s amendment has overcome the rejection and has been withdrawn.
With respect to the art rejection under 35 USC § 103:
Applicant further asserts that the office action does not address “accessing… key performance indicators…; channeling…n KPI values…; and feeding initial KPI values are done continuously," which have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of properly addressing the limitation set forth below by Qiu via Assaf/Qiu. (Qiu [fig.1 “APM system”; p.4 2nd ¶]… real production environments.) . As pointed out in the rejection, Qiu’s APM system monitoring and alerting based on real KPI monitoring data corresponds to the continuous analysis and real-time anomaly detection for the computerized system of interest.
Applicant further asserts that the prior art does not teach the KPI models being categorized prior to being fed to the cognitive models. Examiner respectfully disagrees, as Assaf does teach that the categorization is performed prior to being fed to the cognitive model (in the embedding step) ([Assaf Fig.1 a)]
PNG
media_image1.png
326
651
media_image1.png
Greyscale
[p.5228 1st col 1st ¶] The performance of a system is gauged by a set of key performance indicators, each of which measures a particular system characteristic. These indicators are made available via a data collection tool and are collected at system level. Example indicators are: Overall Back-end Response Time ms/op, Port Send I/O Rate ops/s, and Read Data Rate MiB/s. In other words, the KPIs which are monitored are categorized by example indicators prior to being fed to the encoder, which corresponds to the cognitive model.
Applicant further asserts that Qiu’s “real production environments” does not teach characterizing in real- time the computerized system based on the reconstruction errors obtained to detect anomalies in the computerized system in real-time. Examiner respectfully disagrees, as Qiu shows that the monitoring is performed in real production environments corresponds to characterizing and detecting anomalies in real-time. Additionally, the anomaly detector role in APM platform, which Qiu is about, depicts alerting anomalies from cloud applications, i.e., applying the monitoring method to cloud-based environments which are deployed in real-time.
The dependent claims remain rejected at least by virtue of dependency on their respective rejected parent claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-5, 13-17, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Assaf et al., “An Anomaly Detection and Explainability Framework using Convolutional Autoencoders for Data Storage Systems” (hereinafter Assaf), further in view of Qiu et al., “KPI-TSAD: A Time-Series Anomaly Detector for KPI Monitoring in Cloud Applications” (hereinafter Qiu), further in view of Thalheim et al., “Sieve: Actionable Insights from Monitored Metrics in Microservices” (hereinafter Thalheim).
Regarding Claim 1, Assaf teaches:
A computer-implemented method of characterizing a computerized system, (Assaf [p.5229 1st col 2nd ¶] We train the network for a maximum of 120 epochs and use the Adam optimizer…with a learning rate set to 0.0001.) (Note: training a network corresponds to performing the method on a computer.)
wherein the method comprises: accessing … key performance indicators, or KPIs, for the computerized system, where each of the KPIs is a timeseries of KPI values and is categorized prior to being fed into a cognitive model into one of n types of KPIs, where n ≥ 2… (Assaf [p.5228 1st col 1st ¶] The performance of a system is gauged by a set of key performance indicators, each of which measures a particular system characteristic. These indicators are made available via a data collection tool and are collected at system level. Example indicators are: Overall Back-end Response Time ms/op, Port Send I/O Rate ops/s, and Read Data Rate MiB/s.
[p.5228 2nd col 1st ¶] Considering the multivariate time-series nature of the data…
[p.5228 2nd col last ¶] Therefore, we use an autoencoder architecture with stacked 1D convolutional layers. The multivariate time series are handled by m × n kernels where n is the total number of indicators…
[Fig.1 a)]
PNG
media_image1.png
326
651
media_image1.png
Greyscale
) (Note: the original data to the encoding layer corresponds to accessing the KPIs; the KPIs are fed to the encoder, which corresponds to the cognitive model.)
channeling … n KPI values of the KPIs through n buffer channels, in accordance with the n types, whereby each of the n buffer channels buffers KPI values of KPIs of a respective one of the categorized n types; (Assaf [p.5228 2nd col last ¶] Therefore, we use an autoencoder architecture with stacked 1D convolutional layers. The multivariate time series are handled by m × n kernels where n is the total number of indicators…
[Fig.1 a)]
PNG
media_image1.png
326
651
media_image1.png
Greyscale
) (Note: each layer in the encoder corresponds to each buffer channel of the KPIs)
obtaining reconstructions errors by … feeding initial KPI values, as buffered in the n buffer channels, to n respective input channels of a cognitive model, wherein the cognitive model is implemented as an autoencoder by a trained neural network, the autoencoder including an encoder with temporal convolutional layer blocks connected by each of the n input channels and a decoder comprising deconvolution layer blocks connected by the encoder, (Assaf [p.5228 2nd col last ¶] Therefore, we use an autoencoder architecture with stacked 1D convolutional layers [LeCun et al., 1995]. The multivariate time series are handled by m × n kernels… their weights are optimized for all data samples which allows the network to learn associations between all indicators across time…
[p.5229 1st col 2nd ¶] The architecture of the encoder network consists of three convolutional layers that use ReLU activation with 64, 128 and 256 filter maps and kernel size 8, 6 and 4 respectively. The decoder is symmetric to the encoder.
PNG
media_image2.png
480
1076
media_image2.png
Greyscale
)
whereby the initial KPI values are independently processed in the n input channels, then compressed via the temporal convolutional layer blocks of the encoder, prior to being reconstructed via the deconvolution layer blocks of the decoder, and the reconstruction errors are obtained by comparing the reconstructed KPI values with the initial KPI values; (Assaf [p.5228 1st col 2nd ¶] The multivariate time series are handled by m × n kernels where n is the total number of indicators, and m the number of time steps considered by the kernels.
After the reconstruction errors are computed, we post-process these by first summing up the errors across all indicators per time step as
PNG
media_image3.png
34
273
media_image3.png
Greyscale
,
where x i is the time series of indicator i and t is the time step.
[p.5229 1st col last¶] Accordingly, a relative threshold is extracted following a k-sigma rule and is adjusted based on validation feedback. If the smoothed reconstruction error es exceeds this threshold it is considered an anomaly.) (Note: the inner summation corresponds to the reconstruction error corresponding to each independently processed KPI values (n).)
and characterizing the computerized system based on the reconstruction errors obtained. (Assaf [p.5229 1st col last¶] Accordingly, a relative threshold is extracted following a k-sigma rule and is adjusted based on validation feedback. If the smoothed reconstruction error es exceeds this threshold it is considered an anomaly.) (Note: determining an anomaly corresponds to the characterization.)
Assaf does not teach, but Qiu further teaches:
Accessing… key performance indicators…; channeling…n KPI values…; and feeding initial KPI values are done continuously and in a real-time stream from a computerized system of interest… to detect anomalies in the computerized system in real-time (Qiu [p.4 2nd ¶] Finally, KPI-TSAD was successfully applied to the time-series anomaly detection of the KPI monitoring data from real production environments.
PNG
media_image4.png
709
879
media_image4.png
Greyscale
) (Note: the APM system monitoring and alerting based on real KPI monitoring data corresponds to the continuous analysis and real-time anomaly detection for the computerized system of interest)
Qiu and Assaf are analogous to the present invention because both are from the same field of endeavor of LSTM-based anomaly detection methods in servers. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to deploy the continuous data in a real-time environment using Qiu’s method with Assaf’s anomaly detection method. The motivation would be to “monitor and manage the performance and availability of software applications” (Qiu [p.2 2nd ¶]).
Assaf/Qiu/Thalheim does not teach, but Thalheim further teaches:
the categorization of each of the KPIs occurring via a clustering process; (Thalheim [p.3 2nd col 2nd ¶] Step #2: Reduce metrics. After collecting the metrics, Sieve analyzes each component and organizes its metrics into fewer groups via clustering, so that similar-behaving metrics are clustered together.)
Thalheim and Assaf/Qiu/Thalheim are analogous to the present invention because both are from the same field of endeavor of server tools in identifying anomalies. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the clustering algorithm from Thalheim into Assaf/Qiu/Thalheim’s anomaly detection method. The motivation would be to “to transform the huge space of monitored metrics into useful insights.” (Thalheim [Abstract]).
Regarding Claim 2, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 1. Assaf, via Assaf/Qiu/Thalheim, further teaches:
The method according to claim 1, wherein: the method further comprises obtaining time-dependent indicators based on the reconstruction errors obtained and identifying abnormal values of the time-dependent indicators; and the computerized system is characterized based on a selection of the KPIs that contribute the most to the abnormal values identified. (Assaf [p.5229 2nd col 1st ¶] Once an anomaly is detected, we perform the explainability step. First, the reconstruction error can be traced back to each indicator. Then the indicators are sorted based on the cumulative error registered within the anomalous time period. This in turn allows us to compile a list of top-k most influential indicators that explain the model’s decision.) (Note: the top-k most influential indicators correspond to the selection of KPIs that contribute the most to the abnormal values that influences the characterization)
Regarding Claim 3, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 2. Assaf, via Assaf/Qiu/Thalheim, further teaches:
The method according to claim 2, wherein: obtaining the time-dependent indicators includes summing the reconstructions errors obtained for the KPI values over all of the KPIs, for each time point of the time points spanned by the KPIs; (Assaf [p.5228 2nd col last ¶] The multivariate time series are handled by m × n kernels where n is the total number of indicators, and m the number of time steps considered by the kernels.
[p.5229 1st col 3rd ¶] After the reconstruction errors are computed, we post-process these by first summing up the errors across all indicators per time step as
PNG
media_image3.png
34
273
media_image3.png
Greyscale
,
where x i is the time series of indicator i and t is the time step.
[p.5229 1st col last¶] Accordingly, a relative threshold is extracted following a k-sigma rule and is adjusted based on validation feedback. If the smoothed reconstruction error es exceeds this threshold it is considered an anomaly.) (Note: determining an anomaly corresponds to the characterization.)
and said abnormal values are identified by identifying critical time points of the time points, at which the time-dependent indicators exceed a threshold value. (Assaf [p.5229 2nd col 1st ¶] Once an anomaly is detected, we perform the explainability step. First, the reconstruction error can be traced back to each indicator. Then the indicators are sorted based on the cumulative error registered within the anomalous time period. This in turn allows us to compile a list of top-k most influential indicators that explain the model’s decision.) (Note: each indicator corresponds to the critical time points)
Regarding Claim 4, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 3. Assaf, via Assaf/Qiu/Thalheim, further teaches:
The method according to claim 3, wherein the reconstruction errors are obtained by computing distances between the reconstructed KPI values and the initial KPI values, for each of the KPIs and for each of the time points; (Assaf [p.5228 2nd col last ¶] The multivariate time series are handled by m × n kernels where n is the total number of indicators, and m the number of time steps considered by the kernels.
[p.5229 1st col 3rd ¶] After the reconstruction errors are computed, we post-process these by first summing up the errors across all indicators per time step as
PNG
media_image3.png
34
273
media_image3.png
Greyscale
,
where x i is the time series of indicator i and t is the time step.) (Note: each inner difference corresponds to the distance between the reconstructed KPI values and the initial KPI values.)
and obtaining the time-dependent indicators further includes smoothing the summed reconstructions errors over time, such that the time-dependent indicators are obtained as smoothed values for each of the time points, (Assaf [p.5229 1st col 3rd ¶] Then, we apply a 1D convolution filter with equal weights, identical to a moving average as
PNG
media_image5.png
35
226
media_image5.png
Greyscale
,
where v is the filter of size w of identical values
PNG
media_image6.png
31
26
media_image6.png
Greyscale
. A larger w indicates more smoothing. This is done so that point anomalies are damped and allows us to focus on range anomalies. This is important since in data storage systems we are concerned with sustained performance anomalies.) (Note: the 1D convolution filter identical to a moving average corresponds to smoothing the summed reconstruction errors over time.)
and the critical time points identified correspond to time points at which the smoothed values exceed said threshold value. (Assaf [p.5229 1st col last¶] Accordingly, a relative threshold is extracted following a k-sigma rule and is adjusted based on validation feedback. If the smoothed reconstruction error es exceeds this threshold it is considered an anomaly)
Regarding Claim 5, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 4. Assaf, via Assaf/Qiu/Thalheim, further teaches:
The method according to claim 4, wherein the time points are identified according to a K-sigma thresholding method, based on a mean value and a dispersion value obtained for the smoothed values. (Assaf [p.5229 1st col last¶] Accordingly, a relative threshold is extracted following a k-sigma rule and is adjusted based on validation feedback. If the smoothed reconstruction error es exceeds this threshold it is considered an anomaly)
Regarding Claim 13, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 1. Assaf, via Assaf/Qiu/Thalheim, further teaches:
The method according to claim 1, wherein characterizing the state of the computerized system comprises detecting an anomaly in the system, based on the reconstruction errors produced. (Assaf [p.5229 1st col last¶] Accordingly, a relative threshold is extracted following a k-sigma rule and is adjusted based on validation feedback. If the smoothed reconstruction error es exceeds this threshold it is considered an anomaly.) (Note: determining an anomaly corresponds to the characterization.)
Regarding Claim 14, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 13. Assaf, via Assaf/Qiu/Thalheim, further teaches:
The method according to claim 13, wherein characterizing the state of the computerized system further comprises instructing to take action in respect of the computerized system, based on the reconstruction errors produced, so as to modify a functioning of the computerized system. (Assaf [p.5229 2nd col 1st ¶] Once an anomaly is detected, we perform the explainability step.) (Note: According to the Specifications [0059], modifying the functioning of the computerized system includes troubleshooting the anomaly. Thus, performing the explainability step corresponds to modifying the functioning of the computerized system)
Regarding Claim 15, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 13. Assaf, via Assaf/Qiu/Thalheim, further teaches:
The method according to claim 13, wherein characterizing the state of the computerized system further comprises troubleshooting the computerized system by analyzing only a selection of the KPIs, the latter identified based on the reconstruction errors obtained. (Assaf [p.5229 2nd col 1st ¶] Once an anomaly is detected, we perform the explainability step. First, the reconstruction error can be traced back to each indicator. Then the indicators are sorted based on the cumulative error registered within the anomalous time period. This in turn allows us to compile a list of top-k most influential indicators that explain the model’s decision. Second, we perform cosine similarity on the embedding space with historic anomalies. This allows us to identify the most similar anomalies and therefore explain the anomaly via association.) (Note: performing the explainability step corresponds to troubleshooting and thus modifying the functioning of the computerized system)
Regarding Claim 16, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 1. Assaf, via Assaf/Qiu/Thalheim, further teaches:
The method according to claim 1, wherein the method further comprises, prior to channeling the data, collecting KPI values based on data streams of data collected from the computerized system and aggregating the KPI values computed to form said KPIs as timeseries. (Assaf [p1 1st col 1st ¶] The performance of a system is gauged by a set of key performance indicators, each of which measures a particular system characteristic. These indicators are made available via a data collection tool and are collected at system level. Example indicators are: Overall Back-end Response Time ms/op, Port Send I/O Rate ops/s, and Read Data Rate MiB/s.
[p.5228 2nd col 1st ¶] Considering the multivariate time-series nature of the data…
[p.5229 1st col last¶] Therefore, we use an autoencoder architecture with stacked 1D convolutional layers. The multivariate time series are handled by m × n kernels where n is the total number of indicators…) (Note: using the KPI for training the autoencoder which handles multivariate timeseries data corresponds to the computerized system aggregating the KPI values to form the KPIs as timeseries.)
Independent Claim 17 recites A characterization system for characterizing a computerized system, wherein the characterization system comprises: a communication unit configured to access data from the computerized system; and a processing unit connected to the communication unit and configured to (Assaf [p.5229 1st col 2nd ¶] We train the network for a maximum of 120 epochs and use the Adam optimizer…with a learning rate set to 0.0001.) perform precisely the methods of Claim 1. Thus, Claim 17 is rejected for reasons set forth in Claim 1. (Note: training a network corresponds to performing the method on a characterization system comprising a communication unit and a processing unit.)
Independent Claim 20 recites A computer program for characterizing a computerized system, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by processing means to cause the latter to (Assaf [p.5229 1st col 2nd ¶] We train the network for a maximum of 120 epochs and use the Adam optimizer…with a learning rate set to 0.0001.) perform precisely the methods of Claim 1. Thus, Claim 20 is rejected for reasons set forth in Claim 1. (Note: training a network corresponds to performing the method on a computer comprising a computer readable storage medium with programs executed by processing means.)
Claim 6 and 18 is rejected under 35 U.S.C. 103 as being unpatentable over Assaf/Qiu/Thalheim, further in view of Tensorflow, “tf.keras.layers.DepthwiseConv2D” (hereinafter Tensorflow).
Regarding Claim 6, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 1. Assaf/Qiu/Thalheimdoes not teach, but Tensorflow further teaches:
The method according to claim 1, wherein each of the n input channels comprises one or more depth-wise convolutional layers, or DWC layers, and the initial KPI values are independently processed in the n input channels by performing depth-wise spatial convolutions separately on each of the n input channels, thanks to said DWC layers. (Tensorflow [p.2] Depthwise Separable convolutions consist of performing just the first step in a depthwise spatial convolution (which acts on each input channel separately). The depth_multiplier argument controls how many output channels are generated per input channel in the depthwise step.)
Tensorflow and Assaf/Qiu/Thalheim are analogous to the present invention because both are from the same field of endeavor of implementing convolutional networks. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate Tensorflow’s depthwise separable convolutions into Assaf/Qiu/Thalheim’s anomaly detection method. The motivation would be to “controls how many output channels are generated per input channel in the depthwise step” (Tensorflow [p.2]).
Claim 18, dependent on Claim 17, also recites the system configured to perform precisely the methods of Claim 6. Thus, Claims 18 is rejected for reasons set forth in Claim 6.
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Assaf/Qiu/Thalheim/Tensorflow, further in view of Park et al., “Anomaly Detection for HTTP Using Convolutional Autoencoders” (hereinafter Park).
Regarding Claim 7, Assaf/Qiu/Thalheim/Tensorflow respectively teaches and incorporates the claimed limitations and rejections of Claim 6. Assaf/Qiu/Thalheim/Tensorflow does not teach, but Park further teaches:
The method according to claim 6, wherein the method further comprises, prior to accessing the KPIs, training the cognitive model based on initial weights that are differently scaled in the DWC layers of the n input channels. (Park [p.9 1st col last¶] We collected around 155,000 HTTP messages from more than 600 websites in 2018 for this experiment. Security engineers from Penta Security Systems Inc. deliberately reviewed the collected messages to classify them as normal or anomalous messages. The numbers of normal and anomalous HTTP messages were around 147,000 and 8,000, respectively. The training set consisted of around 129,000 randomly selected normal messages. The test set consisted of the remaining messages, i.e., around 18,000 normal messages and 8,000 anomalous messages…
[p.9 1st col 2nd ¶] The proposed scheme was trained using a training set consisting of only normal messages over 100 epochs. Then, the test set with normal and anomalous messages was used to evaluate the empirical CDF.) (Note: the training set with a size of 129,000 corresponds to the differently scaled initial weights; the test set being used to evaluate the network corresponds to accessing the KPIs)
Park and Assaf/Qiu/Thalheim/Tensorflow are analogous to the present invention because both are from the same field of endeavor of convolutional autoencoders for anomaly detection methods in servers. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the training of the model by Park into Assaf/Qiu/Thalheim/Tensorflow’s anomaly detection method. The motivation would be to “detect an anomalous message if its BCE is larger than a prespecified threshold value.” (Park [Abstract]).
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Assaf/Qiu/Thalheim, further in view of Park.
Regarding Claim 8, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 1. Assaf/Qiu/Thalheim does not teach, but Park further teaches:
The method according to claim 1, wherein the encoder includes two temporal convolutional layer blocks and the decoder includes two deconvolutional layer blocks. (Park
PNG
media_image7.png
972
823
media_image7.png
Greyscale
) (Note: Each Conv. block corresponds to each temporal convolutional layer block; each TransConv. block corresponds to each deconvolutional layer block)
Park and Assaf/Qiu/Thalheim are analogous to the present invention because both are from the same field of endeavor of convolutional autoencoders for anomaly detection methods in servers. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the two temporal convolutional blocks from Park into Assaf/Qiu/Thalheim’s anomaly detection method. The motivation would be to “detect an anomalous message if its BCE is larger than a prespecified threshold value.” (Park [Abstract]).
Claim 9 is rejected under 35 U.S.C. 103 as being unpatentable over Assaf/Qiu/Thalheim/Park, further in view of Yu et al., “Network Intrusion Detection through Stacking Dilated Convolutional Autoencoders” (hereinafter Yu)
Regarding Claim 9, Assaf/Qiu/Thalheim/Park respectively teaches and incorporates the claimed limitations and rejections of Claim 8. Assaf/Qiu/Thalheim/Park does not teach, but Yu further teaches:
The method according to claim 8, wherein each of the two temporal convolutional layer blocks comprises one or more dilated temporal convolutional filter layers. (Yu [p.2 1st col 3rd ¶] In this paper, we propose a network intrusion detection model by stacking dilated convolutional autoencoders which actually combines the concepts of self-taught learning [6] and representation learning [7].
PNG
media_image8.png
267
414
media_image8.png
Greyscale
)
Yu and Assaf/Qiu/Thalheim/Park are analogous to the present invention because both are from the same field of endeavor of convolutional autoencoders in anomaly detection. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement the dilated convolutional autoencoder from Yu into Assaf/Qiu/Thalheim/Park’s anomaly detection method. The motivation would be to “Automatically learn essential features from large-scale and more various unlabeled raw network traffic data consisting of real-world traffics from botnets, web-based malwares, exploits, APTs (Advanced Persistent Threats), scans, and normal traffics” (Yu [p.2 2nd col 3rd ¶]).
Claim 10 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Assaf/Qiu/Thalheim/Park/Yu, further in view of Wang et al., “Batch-normalized deep neural networks for achieving fast intelligent fault diagnosis of machines” (hereinafter Wang).
Regarding Claim 10, Assaf/Qiu/Thalheim/Park/Yu respectively teaches and incorporates the claimed limitations and rejections of Claim 9. Assaf/Qiu/Thalheim/Park/Yu does not teach, but Wang further teaches:
The method according to claim 9, wherein each of the two temporal convolutional layer blocks further comprises, in output of the dilated temporal convolutional filter layers, a batch normalization layer, an activation layer, and a spatial dropout layer. (Wang [p.55 2nd col 1st ¶] Therefore, BN transform introduces normalized activations into the network, and ensures the layers can continue learning on input distributions that reduce the influence of internal covariate shift, so that an easy starting condition can be constructed for training and further accelerating the training.
Here we apply the batch normalization immediately before the activation layers of SAEs. Generally, the mapping function of the autoencoder is an affine transformation as show in Eq. (1), and the BN transform is employed to normalize Wxn+b1. Note that, the bias b1 is not used since its effect will be canceled in the following mean subtraction process [28]. So Eq. (1) is replaced with:(16)hn=f(BNWxn)
The BN transform is used independently on each dimension of Wxn with a separate pair of learned parameters γn and βn. In addition, the activation functionf( · ) we applied is ReLU function which owns non-saturation and is able to perfectly alleviate gradient vanishing problem in the training process [21]. Thus it is a natural choice to combine it with batch normalization for fault diagnosis system)
Wang and Assaf/Qiu/Thalheim/Park/Yu are analogous to the present invention because both are from the same field of endeavor of anomaly detection with autoencoders. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement the batch normalization from Wang into Assaf/Qiu/Thalheim/Park/Yu’s anomaly detection method. The motivation would be to “so that an easy starting condition can be constructed for training, and thus the gradients are able to originate from extremely shallow paths.” (Wang [p.54 2nd col 1st ¶]).
Claim 19, dependent on Claim 17, also recites the system configured to perform precisely the methods of Claim 8-10 combined. Thus, Claim 19 is rejected for reasons set forth in Claim 8-10 combined.
Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Assaf/Qiu/Thalheim, further in view of Sarvani et al., “Anomaly Detection Using K-means Approach and Outliers Detection Technique” (hereinafter Sarvani)
Regarding Claim 11, The combination of Assaf/Qiu/Thalheim respectively teaches and incorporates the claimed limitations and rejections of Claim 1. Assaf does not teach, but Thalheim further teaches:
The method according to claim 1, wherein the method further comprises, prior to channeling the KPI values: clustering the KPIs to obtain k clusters, each including at least m KPIs, where m > n and k ≥ 2; (Thalheim [p.3 2nd col 2nd ¶] Step #2: Reduce metrics. After collecting the metrics, Sieve analyzes each component and organizes its metrics into fewer groups via clustering, so that similar-behaving metrics are clustered together. [Fig.2]
PNG
media_image9.png
261
375
media_image9.png
Greyscale
) (Note: the original KPIs corresponds to m KPIS; the KPIs from the reduced metrics correspond to n KPIs. Fig 2 shows at least 3 clusters generated, thus >= 2.)
and for each cluster of the k clusters obtained, identifying n representative KPIs in said each cluster as objects of the n respective types, respectively, wherein the n representative KPIs identified for said each cluster include a central KPI... (Thalheim [p.3 2nd col 2nd ¶] After clustering, Sieve picks a representative metric from each cluster. These representative metrics as well as their clusters in a sense characterize each component.)
Assaf/Qiu/Thalheim does not teach, but Sarvani further teaches:
and a peripheral KPI (Sarvani
PNG
media_image10.png
409
750
media_image10.png
Greyscale
) (Note: O1 corresponds to the outlier of cluster 1; O2 corresponds to the outlier of cluster 2.)
Sarvani and Assaf/Qiu/Thalheim are analogous to the present invention because both are from the same field of endeavor of clustering methods. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the outlier detection method from Sarvani into Assaf/Qiu/Thalheim’s anomaly detection method. The motivation would be to address the issue that “the outliers affect the overall performance and result so the focus is on to detect the outliers in the dataset” (Sarvani [Abstract]).
Allowable Subject Matter
Claim 12 is objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOSEP HAN whose telephone number is (703)756-1346. The examiner can normally be reached Mon-Fri 9am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kakali Chaki can be reached on (571) 272-3719. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.H./Examiner, Art Unit 2122 /KAKALI CHAKI/Supervisory Patent Examiner, Art Unit 2122