DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is in response to the amendment filed on Mar. 18th, 2026. The amendments are linked to the original application filed on May 18th, 2022.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on Mar. 18th, 2026 has been entered.
Specification
The title of the invention is not descriptive. A new title is required that is clearly indicative of the invention to which the claims are directed.
Response to Amendment
The Examiner thanks the applicant for the remarks, edits and arguments.
Regarding Claim Rejections – 35 U.S.C. 103
The applicant has amended the claims and believes that the current proposed arts fail to properly teach key elements of the amended claims. The applicant believes the arts proposed fails to teach, as claimed, “a cross-event classification comprising a per-event classification for a predictive event of the plurality of predictive events, wherein the per-event classification identifies a relative contribution of the predictive event, relative to the plurality of predictive events, to the predictive entity”. Further, the applicant believes that Letham fails to disclose the cross-event classification as amended in the independent claims. Finally, the applicant believes the remaining proposed arts also fail to teach this element as well.
The examiner has reviewed the arts as well as the amended claims and the examiner has found the applicants arguments persuasive. The examiner believes that amendments made further disclose the cross-event classification and Letham fails to teach these elements. After each amendment the examiner must evaluate the amended claims and perform a complete and thorough search to ensure the claims comply with 35 U.S.C. 103. After completing this search, the examiner has discovered new art and a combination of new arts that is able to disclose the elements of the amended claims. The examiner believes that a person of ordinary skill in the art would have the motivation to combine elements of the newly proposed arts to disclose the current invention. Therefore, the examiner has upheld the rejection under 35 USC 103, see 103 rejection below.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al, (Zhang et al, “EventKE: Event-Enhanced Knowledge Graph Embedding”, 2021, hereinafter “Zhang”) in view of Liu et al, (Liu et al, “Log2vec: A Heterogeneous Graph Embedding Based Approach for Detecting Cyber Threats within Enterprise”, 2019, hereinafter “Liu”) and Park et al, (Park et al, “Estimating Node Importance in Knowledge Graphs Using Graph Neural Networks”, 2019, hereinafter “Park”).
Regarding claim 1, Zhang discloses, “A computer-implemented method comprising:” (Introduction, pp. 1390; “In this paper, we propose EventKE, an event-enhanced knowledge graph embedding model to incorporate event information into KG representations.” This article discloses a method to embed events into a knowledge graph and process the relationships of the events to produce predictions.)
“generating, by the one or more processors, using a network-based inference machine learning model and based at least in part on the event relationship network data object:” (Overview, pp. 1391; “Given a knowledge graph G = (V,E) and a set of events E, we consider events as an additional set of nodes, and build a heterogeneous network where the entity nodes V and event nodes E are distributed on two sides. As shown in Figure 2, the entity nodes and event nodes are inter-connected by event argument links, while both of the entity set and event set are also inner-connected by relations from the original KG and event-event temporal links, respectively.” This model will evaluate the different nodes and their relationships in a knowledge graph using a machine learning model.)
“(i) a plurality of final predictive event embeddings corresponding to the plurality of predictive events, and” (3.2 Evet-aware Aggregation, pp. 1392; “We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use
N
(
j
)
to denote the set of event nodes.” In generating the updated relationships, this model will take a set of events, or nodes, and update the relationships between the nodes in the knowledge graph.)
“(ii) a plurality of final relationship embeddings corresponding to the plurality of event relationship links,” (3.2 Evet-aware Aggregation, pp. 1392; “We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use
N
(
j
)
to denote the set of event nodes.” In generating the updated relationships, this model will take a set of events, or nodes, and update the relationships between the nodes in the knowledge graph.)
“wherein: (i) the network-based inference machine learning model comprises a sequential network update layer configured to update the event relationship network data object,” (Event-aware Information Aggregation, pp. 1391; “As shown in Figure 2, given the heterogeneous network with entity and event nodes, each layer of the event-aware bipartite information aggregation model consists of four stages. First, we compute the event representations using a graph attention mechanism on the event argument links. Then, we conduct message passing on the event nodes with temporal relations to update the event representations.” This model has a sequential updating process. This will use machine learning on a knowledge graph to update the relationships and nodes in the given graph.)
“(ii) the plurality of final predictive event embeddings and the plurality of final relationship embeddings are determined based at least in part on a final sequential network update layer, and” (Event-aware Information Aggregation, pp. 1391; “After that, we aggregate the event information back to the entities based on another graph attention mechanism on event argument links. Finally, the entity representations are updated by incorporating the event information and the neighborhood message from the original KG relations.” The final links and embeddings are updated using the sequential process disclosed in this article.)
“(iii) the predictive event embedding machine learning model and the network-based inference machine learning model are trained end-to-end by processing a training event relationship network data object associated with a training predictive entity;” (Overview, pp. 1391; “As shown in Figure 2, the entity nodes and event nodes are inter-connected by event argument links, while both of the entity set and event set are also inner-connected by relations from the original KG and event-event temporal links, respectively. We design an L-layer event-aware bipartite information aggregation model to enforce the entities to aggregate information from both knowledge graph neighbors and relevant events, where the illustration for each layer is shown in Figure 2. The whole model is trained end-to-end by optimizing the convolution based scoring function on ground-truth knowledge triples with output embeddings from the last layer.” This model will use an end-to-end training process to train machine learning model which will process the relationships in a separately generated knowledge graph.)
Zhang fails to explicitly disclose the remaining elements of this claim. However, Liu discloses, “inputting, by one or more processors, a plurality of predictive events to a predictive event embedding machine learning model to receive a plurality of predictive event embeddings;” (Architecture, pp. 1780; “Graph embedding. Graph embedding, also graph representation learning, is a machine learning approach, capable of converting nodes (log entries) in the heterogeneous graph into low-dimension vectors [11, 14, 39, 54].” This model will take in log entries which are events created by a user and embed them into graph nodes.) and (Architecture, pp. 1780; “The word2vec model is used to calculate vector of each node with its paths (context). To be specific, these paths are taken as sentences in natural language and processed by this model to learn vector of each word (node) (see Section 4.2). This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” This model will encode the information in the log entries and ensure they can be placed into a graph structure.)
“generating, by the one or more processors, an event relationship network data object for a predictive entity associated with the plurality of predictive events, wherein the event relationship network data object comprises:” (Architecture, pp. 1779; “Graph construction. Log2vec’s first component is a rule-based heuristic approach to map relationships among log entries that reflect users’ typical behavior and expose malicious operations, into a graph. According to the existing methods [4, 38, 41, 50, 57], log2vec mainly takes three relationships into account: (1) causal and sequential relationships within a day; (2) logical relationships among days (3) logical relationships among objects. (Section 3.2).” and (Graph Construction, pp. 1780; “In Section 3.1, we formally define a log entry. Section 3.2 details rules to construct heterogeneous graphs.” This model will generate a graph which will contain different events or log entries which is used in making predictions on malicious software.))
“(i) the plurality of predictive event embeddings, and” (Architecture, pp. 1780; “This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” The graph will contain nodes, which are events or log entries.)
“(ii) a plurality of event relationship links corresponding to a plurality of predictive event pairs comprising a first predictive event and a second predictive event, and” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta-attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” The graph will contain a set of nodes and their relationships and links with the other nodes in the graph.)
“(iii) a plurality of relationship embeddings corresponding to the plurality of event relationship links;” (Architecture, pp. 1780; “Further, log2vec improves the existing graph embedding [11, 14, 39, 54] (see Section 4.1.2, Section 4.1.3 and comparison with baselines [11, 14] in Section 6.2). The novel version is capable of determining importance of each relationship among log entries based on attack scenarios and processing them differentially.” The knowledge graph in this article will contain the embedded log entries and their relationships between the nodes. The knowledge graph itself is a mutable object where other nodes can be added or removed.)
“initiating, by the one or more processors, one or more prediction-based actions based at least in part on the cross-event classification.” (Threshold Detector, pp. 1784; “After clustering, log2vec ranks clusters according to the number of log entries they contain. Smaller clusters tend to be suspicious. Table 1 and Table 2 demonstrate two examples of the clustering algorithm’s output. In Table 1, the smallest cluster is larger than a threshold, δ2 (e.g. 80) and thereby identified as legitimate operations. Table 2 shows several small clusters (< 80), indicative of insider threat. Therefore, log entries in these clusters are detected as malicious.” This model is designed to predict malicious software on a computing system. This will initiate general actions based on the discovery of malicious software from the analysis of the input data.)
Zhang and Liu fail to explicitly disclose the remaining elements of this claim. However, Park discloses, “generating, by the one or more processors, a plurality of predictive event significance classifications corresponding to the plurality of predictive events based at least in part on the plurality of final predictive event embeddings and the plurality of final relationship embeddings, wherein a predictive event significance classification of the plurality of predictive event significance classifications indicates a positive, neutral, or negative significance associated with a particular predictive event;” (Method, pp. 598; “Neighborhood Importance Awareness: GNN normally propagates information between neighbors through node embedding. This is to model the assumption that an entity and its neighbors affect each other, and thus the representation of an entity can be better represented in terms of the representation of its neighbors. In the context of node importance estimation, neighboring importance scores play a major role on the importance of a node, whereas other neighboring features may have little effect, if any. We thus directly aggregate importance scores from neighbors (Section 3.1), and show empirically that it outperforms embedding propagation (Section 4.4).” This model will evaluate the relationships of different nodes in a generated knowledge graph. This will evaluate the nodes and determine and score nodes based on their importance to the main concept of graph. This will score based on how close the node is to the center of a graph. A higher score will denote a more positive connection while a maximum or lower can denote neutral or negative significance.) And (Score Aggregation, pp. 599; “To directly model the relationship between the importance of neighboring nodes, we propose a score aggregation framework, rather than embedding aggregation.”)
“generating, by the one or more processors and based on the plurality of predictive event significance classifications, a cross-event classification comprising a per-event classification for a predictive event of the plurality of predictive events, wherein the per-event classification identifies a relative contribution of the predictive event, relative to the plurality of predictive events, to the predictive entity; and” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will cross examine different nodes in the graph to review and update their relationship links. This model will identify different nodes of a graph as being the most significant.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to combine Zhang, Liu and Park. Zhang teaches a machine learning system that uses knowledge graphs with embedded entities and events to find temporal relationships of those embedded objects. Liu teaches a machine learning system that is able to embed events or log entries into a knowledge graph and predict or identify malicious software or actions. Park teaches machine learning system that evaluates and updates knowledge graphs to determine node importance. One of ordinary skill would have motivation to combine different methods that embeds information into knowledge graphs and evaluates the relationships between the generated nodes. One of ordinary skill would have motivation to use knowledge graph generation disclosed in Liu to generate a knowledge graph which can be processed and evaluated using the methods disclosed in Zhang or Park, “Table 4 summarizes in-domain prediction performance. GENI outperforms all baselines on four datasets in terms of both NDCG@100 and Spearman. It is noteworthy that supervised approaches generally perform better in-domain prediction than non-trainable ones, especially on fb15k and imdb, which are more complex and larger than the other two. It demonstrates the applicability of supervised models to our problem. On all KGs except music10k, GAT outperforms other supervised baselines, which use the same node features but do not explicitly take the graph network structure into account. This shows the benefit of directly utilizing network connectivity. By modeling the relation between scores of neighboring entities, GENI achieves further performance improvement over GAT. Among non-trainable baselines, HAR often performs worse than PR and PPR, which suggests that considering predicates could hurt performance if predicate weight adjustment is not done properly.” (Park, Importance Estimation on Real-World Data, pp. 602) and “In Section 4.1, we present an improved random walk capable of extracting context of each node (also log entry) from the above heterogeneous graph and Section 4.2 introduces a specific word2vec model, to represent each node.” (Liu, Graph Embedding, pp. 1783).
Regarding claim 2, Park discloses, “wherein generating the cross-event classification comprises: generating a plurality of per-event classifications corresponding to plurality of predictive events, wherein generating a per-event classification, of the plurality of per-event classifications, associated with a predictive event, of the plurality of predictive events, is based at least in part on a final predictive event embedding for the predictive event; and” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will evaluate the different nodes on a knowledge graph and is able to score different nodes to locate the most important node. This will evaluate each node in the graph.)
“generating the cross-event classification based at least in part on the plurality of per-event classifications.” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will score or classify the different nodes in a knowledge graph based on their importance scores.)
Regarding claim 3, Liu discloses, “wherein generating the per-event classification for the particular predictive event comprises: generating the per-event classification based at least in part on whether an ith value of the final predictive event embedding for the particular predictive event satisfies a threshold value defined based at least in part on a jth value of the final predictive event embedding for the particular predictive event.” (Threshold Detector, pp. 1784; “After clustering, log2vec ranks clusters according to the number of log entries they contain. Smaller clusters tend to be suspicious. Table 1 and Table 2 demonstrate two examples of the clustering algorithm’s output. In Table 1, the smallest cluster is larger than a threshold, δ2 (e.g. 80) and thereby identified as legitimate operations. Table 2 shows several small clusters (< 80), indicative of insider threat. Therefore, log entries in these clusters are detected as malicious.” This model will evaluate the final embeddings and final relationships of a knowledge graph. This will then cluster the noes and based on a threshold value will produce a cluster.)
Regarding claim 4, Park discloses, “wherein generating the per-event classification for the particular predictive event comprises: determining a maximal value position indicator for a maximal value of the final predictive event embedding of the particular predictive event;” (Centrality Adjustment, pp. 600; “In the context of KGs, it is also natural to assume that more central nodes would be more important than less central ones, unless the given importance scores present contradictory evidence. Making use of this prior knowledge becomes especially beneficial in cases where we are given a small number of importance scores compared to the total number of entities, and in cases where the importance scores are given for entities of a specific type out of the many types in KG. Given that the in-degree d(i) of node i is a common proxy for its centrality and popularity, we define the initial centrality c(i) of node i to be [See Equation (6)] where ϵ is a small positive constant.” This model will use the center of a cluster to denote the maximum importance. This will initialize a node as the center of the graph.)
“selecting, from a group of defined predictive event significance classifications, a selected predictive event significance classification for the particular predictive event based at least in part on the maximal value position indicator; and” (Model Architecture, pp. 600; “Centrality adjustment is applied to the output from the final SA layer. In order to enable independent scaling and shifting by each SA head, separate parameters
γ
h
and βh are used for each head h.” This model will adjust the centricity of a node when processing graph. As stated below this process is performed on each node in the knowledge graph.)
“generating the per-event classification based at least in part on the selected predictive event significance classification.” (Model Architecture, pp. 600-601; “Then centrality adjustment by h-th SA head in the final layer is: [See Equation (12)] With HL SA heads in the final L-th layer, we perform additional aggregation of centrality-adjusted scores by averaging, and apply a non-linearity σs, obtaining the final estimation s∗(i): [See Equation (13)]” This model will process each node of the knowledge graph and generate a final estimation.)
Regarding claim 5, Zhang discloses, “the network-based inference machine learning model comprises a plurality of sequential network update layers,” (Overview, pp. 1391; “We design an L-layer event-aware bipartite information aggregation model to enforce the entities to aggregate information from both knowledge graph neighbors and relevant events, where the illustration for each layer is shown in Figure 2.” This model uses a sequential process to update a knowledge graph.)
“the plurality of sequential network update layers are configured to update the event relationship network data object based at least in part on a trained parameter set associated with the plurality of sequential network update layers,” (Overview, pp. 1391; “We use
v
i
l
to denote the representation vector for the i-th entity in layer l, and the relation type embedding is denoted as
r
i
,
j
. We use
t
j
,
c
j
to denote the embedding vectors for the event trigger and event type of event
e
j
respectively. For event arguments, since each of them is also an entity, we use
v
j
,
k
l
to represent the embedding for the k-th argument of event
e
j
, and the corresponding role type embedding is denoted as
z
j
,
k
. Note that only the entity embeddings are updated in each layer, while other embeddings are identical in each layer and uniformly optimized through end-to-end training to reduce the model size.”) and (Implementation Details, pp. 1394; “We train the models on NVIDIA Tesla V100 GPUs using the Adam (Kingma and Ba, 2015) optimizer with a learning rate of 10-4. The average runtime is about 3 hours for the ACE- 2005 dataset and 5 days for the large KG in the WikiEvents dataset.” This article discloses the use of training datasets to train their model.)
“an ith sequential network update layer is configured to: (i) identify a second event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to a plurality of preceding predictive event values associated with the event relationship network data object, and” (Event-aware Information Aggregation, pp. 1392; “Information aggregation from entities to events. We first use an entity-to-event graph attention mechanism to aggregate entity information to events through the event argument links. For each event
e
j
with the number of arguments
|
A
j
|
, we first compute the attention weights
α
j
,
k
according to the concatenation of embeddings of event trigger, event type, entity, and role type: [See Equation (1)] where σ(ꞏ) is a LeakyReLU activation function as in (Velickovic et al., 2018), and
W
α
denotes a trainable parameter for linear transformation. Here,
v
j
,
k
l
denotes the entity embedding for the k-th event argument for event j.” During the updating process this model will evaluate the entries and the different events embedded on the knowledge graph.)
“(ii) process the event relationship network data object to transform the second event-related two-dimensional data object to a third event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to a plurality of subsequent predictive event values, and” (Event-aware Information Aggregation, pp. 1392; “Message passing on event-event relations. We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use N(j) to denote the set of event nodes that have temporal relations with
e
j
, then the event representation is updated similar to graph convolution network (Kipf and Welling, 2017).” This model will process the links in the graph and update their relationship links.)
“the trained parameter set for the ith sequential network update layer comprises a two-dimensional event-related parameter data object describing event-related trained parameter values having a first dimension corresponding to the plurality of preceding predictive event values and a second dimension corresponding to the plurality of subsequent predictive event values.” (Event-aware Information Aggregation, pp. 1393; “Message passing on entity-entity relations. In the final stage, we conduct message passing on the original entity-entity relations from the original KG to further incorporate information from the original static relations between entities. To handle the different relation types, we adopt Composition GCN (Vashishth et al., 2020) to model the relation types using different relation type embeddings. We use
N
(
i
)
to denote the set of entity nodes that are connected with
v
i
through the original entity-entity relations in knowledge graphs, and the entity representations are updated by [See Equation (8)] where
σ
e
(
∙
)
is the ReLU activation function,
r
i
,
j
is the relation type embedding, and
ϕ
(
∙
)
denotes a circular correlation operator3 (Nickel et al., 2016) between two vectors. Finally, we obtain the updated entity representation
v
i
l
+
1
that incorporates both the information from the original KGs and the rich event information from event nodes. We use the final layer output
v
i
L
for model optimization and knowledge graph representation learning.” This model is initially trained using a training datasets. Further this will process a knowledge graph containing events and entities.)
Zhang fails to explicitly disclose the remaining elements of this claim. However, Liu discloses, “prior to performing a plurality of updates on the event relationship network data object by the plurality of sequential network update layers: (i) a predictive event embedding comprises a plurality of initial predictive event values, and” (Architecture, pp. 1780; “This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” This article discloses the embedding of log entries or events into a knowledge graph. These nodes will contain an initial set of values.)
“(ii) the event relationship network data object comprises a first event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to the plurality of initial predictive event values,” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” The knowledge graph in this article contains different nodes and relationship links which link the nodes to each other. The nodes in the graph are represented as vectors of given dimensions which represent log entries. These log entries represent different events in a computing system.)
Regarding claim 6, Zhang discloses, “an ith sequential network update layer is configured to: (i) identify a second relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to a plurality of preceding event relationship values associated with the event relationship network data object, and” (Event-aware Information Aggregation, pp. 1392; “Information aggregation from entities to events. We first use an entity-to-event graph attention mechanism to aggregate entity information to events through the event argument links. For each event
e
j
with the number of arguments
|
A
j
|
, we first compute the attention weights
α
j
,
k
according to the concatenation of embeddings of event trigger, event type, entity, and role type: [See Equation (1)] where σ(ꞏ) is a LeakyReLU activation function as in (Velickovic et al., 2018), and
W
α
denotes a trainable parameter for linear transformation. Here,
v
j
,
k
l
denotes the entity embedding for the k-th event argument for event j.” This model will contain a set of relationships and different nodes contained in a knowledge graph.)
“(ii) process the event relationship network data object to transform the second relationship-related two-dimensional data object to a third relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to a plurality of subsequent event relationship values, and” (Event-aware Information Aggregation, pp. 1392; “Message passing on event-event relations. We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use N(j) to denote the set of event nodes that have temporal relations with
e
j
, then the event representation is updated similar to graph convolution network (Kipf and Welling, 2017).” This model will process and evaluate the different relationships in the generated graph.)
“the trained parameter set for the ith sequential network update layer comprises a two-dimensional relationship-related parameter data object describing relationship-related trained parameter values having a first dimension corresponding to the plurality of preceding event relationship values and a second dimension corresponding to the plurality of subsequent event relationship values.” (Event-aware Information Aggregation, pp. 1393; “Message passing on entity-entity relations. In the final stage, we conduct message passing on the original entity-entity relations from the original KG to further incorporate information from the original static relations between entities. To handle the different relation types, we adopt Composition GCN (Vashishth et al., 2020) to model the relation types using different relation type embeddings. We use
N
(
i
)
to denote the set of entity nodes that are connected with
v
i
through the original entity-entity relations in knowledge graphs, and the entity representations are updated by [See Equation (8)] where
σ
e
(
∙
)
is the ReLU activation function,
r
i
,
j
is the relation type embedding, and
ϕ
(
∙
)
denotes a circular correlation operator3 (Nickel et al., 2016) between two vectors. Finally, we obtain the updated entity representation
v
i
l
+
1
that incorporates both the information from the original KGs and the rich event information from event nodes. We use the final layer output
v
i
L
for model optimization and knowledge graph representation learning.” This model is initially trained using a training datasets. Further this will process a knowledge graph containing events and entities.)
Zhang fails to explicitly disclose the remaining elements of the claim. However, Liu discloses, “prior to performing the plurality of updates on the event relationship network data object by the plurality of sequential network update layers: (i) a relationship embedding comprises a plurality of initial event relationship values, and” (Architecture, pp. 1780; “Further, log2vec improves the existing graph embedding [11, 14, 39, 54] (see Section 4.1.2, Section 4.1.3 and comparison with baselines [11, 14] in Section 6.2). The novel version is capable of determining importance of each relationship among log entries based on attack scenarios and processing them differentially.” The knowledge graph in this article will contain the embedded log entries and their relationships between the nodes. The nodes are given initial relationship values and links. This process occurs prior to another model updating and evaluating the generated graph.)
“(ii) the event relationship network data object comprises a first relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to the plurality of initial event relationship values,” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” This model will use different relationships to connect nodes. Each of the nodes in this graph contain fixed length representations of log entries.)
Regarding claim 7, Liu discloses, “wherein the plurality of event relationship links comprise event relationship links corresponding to pairs of predictive events in the plurality of predictive events.” Liu (Clustering Algorithm, pp. 1784; “We adopt an alternative method, adept at log entries’ pair-wise similarity comparison. Formally, we suppose clusters (C1, C2, ..., Cn) have been obtained and they must satisfy the following conditions: [See Equation on pp. 1784] where V is a set including all log entries and δ1 is a threshold. Note that C1 is chosen arbitrarily and sim is employed to measure similarity between log entries using cosine distance (two log entries become similar when their sim is 0→1).” This model is able to embed different events or log entries into a knowledge graph and is able to locate pairs of events based on similarity and clustering.)
Regarding claim 8, Zhang discloses, “A system comprising: “one or more processors; and at least one memory storing processor-executable instructions that, when executed by the one or more processors, cause the one or more processors to:” (Implementation Details, pp. 1394; “We train the KG embedding models for a maximum of 200 epochs and apply an early stopping strategy of 10 epochs (if the validation loss is not lower than the previous best for 10 consecutive epochs, we will stop training the model). We train the models on NVIDIA Tesla V100 GPUs using the Adam (Kingma and Ba, 2015) optimizer with a learning rate of 10-4. The average runtime is about 3 hours for the ACE- 2005 dataset and 5 days for the large KG in the WikiEvents dataset.” This article discloses the hardware used which includes processors, GPUs, which evaluate the different training datasets stored in memory.)
“generate, using a network-based inference machine learning model and based at least in part on the event relationship network data object:” (Overview, pp. 1391; “Given a knowledge graph G = (V,E) and a set of events E, we consider events as an additional set of nodes, and build a heterogeneous network where the entity nodes V and event nodes E are distributed on two sides. As shown in Figure 2, the entity nodes and event nodes are inter-connected by event argument links, while both of the entity set and event set are also inner-connected by relations from the original KG and event-event temporal links, respectively.” This model will evaluate the different nodes and their relationships in a knowledge graph using a machine learning model.)
“(i) a plurality of final predictive event embeddings corresponding to the plurality of predictive events, and” (3.2 Evet-aware Aggregation, pp. 1392; “We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use
N
(
j
)
to denote the set of event nodes.” In generating the updated relationships, this model will take a set of events, or nodes, and update the relationships between the nodes in the knowledge graph.)
“(ii) a plurality of final relationship embeddings corresponding to the plurality of event relationship links,” (3.2 Evet-aware Aggregation, pp. 1392; “We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use
N
(
j
)
to denote the set of event nodes.” In generating the updated relationships, this model will take a set of events, or nodes, and update the relationships between the nodes in the knowledge graph.)
“wherein: (i) the network-based inference machine learning model comprises a sequential network update layer configured to update the event relationship network data object,” (Event-aware Information Aggregation, pp. 1391; “As shown in Figure 2, given the heterogeneous network with entity and event nodes, each layer of the event-aware bipartite information aggregation model consists of four stages. First, we compute the event representations using a graph attention mechanism on the event argument links. Then, we conduct message passing on the event nodes with temporal relations to update the event representations.” This model has a sequential updating process. This will use machine learning on a knowledge graph to update the relationships and nodes in the given graph.)
“(ii) the plurality of final predictive event embeddings and the plurality of final relationship embeddings are determined based at least in part on a final sequential network update layer, and” (Event-aware Information Aggregation, pp. 1391; “After that, we aggregate the event information back to the entities based on another graph attention mechanism on event argument links. Finally, the entity representations are updated by incorporating the event information and the neighborhood message from the original KG relations.” The final links and embeddings are updated using the sequential process disclosed in this article.)
“(iii) the predictive event embedding machine learning model and the network-based inference machine learning model are trained end-to-end by processing a training event relationship network data object associated with a training predictive entity;” (Overview, pp. 1391; “As shown in Figure 2, the entity nodes and event nodes are inter-connected by event argument links, while both of the entity set and event set are also inner-connected by relations from the original KG and event-event temporal links, respectively. We design an L-layer event-aware bipartite information aggregation model to enforce the entities to aggregate information from both knowledge graph neighbors and relevant events, where the illustration for each layer is shown in Figure 2. The whole model is trained end-to-end by optimizing the convolution based scoring function on ground-truth knowledge triples with output embeddings from the last layer.” This model will use an end-to-end training process to train machine learning model which will process the relationships in a separately generated knowledge graph.)
Zhang fails to explicitly disclose the remaining elements of this claim. However, Liu discloses, “input a plurality of predictive events to a predictive event embedding machine learning model to receive a plurality of predictive event embeddings;” (Architecture, pp. 1780; “Graph embedding. Graph embedding, also graph representation learning, is a machine learning approach, capable of converting nodes (log entries) in the heterogeneous graph into low-dimension vectors [11, 14, 39, 54].” This model will take in log entries which are events created by a user and embed them into graph nodes.) and (Architecture, pp. 1780; “The word2vec model is used to calculate vector of each node with its paths (context). To be specific, these paths are taken as sentences in natural language and processed by this model to learn vector of each word (node) (see Section 4.2). This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” This model will encode the information in the log entries and ensure they can be placed into a graph structure.)
“generate an event relationship network data object for a predictive entity associated with the plurality of predictive events, wherein the event relationship network data object comprises:” (Architecture, pp. 1779; “Graph construction. Log2vec’s first component is a rule-based heuristic approach to map relationships among log entries that reflect users’ typical behavior and expose malicious operations, into a graph. According to the existing methods [4, 38, 41, 50, 57], log2vec mainly takes three relationships into account: (1) causal and sequential relationships within a day; (2) logical relationships among days (3) logical relationships among objects. (Section 3.2).” and (Graph Construction, pp. 1780; “In Section 3.1, we formally define a log entry. Section 3.2 details rules to construct heterogeneous graphs.” This model will generate a graph which will contain different events or log entries which is used in making predictions on malicious software.))
“(i) the plurality of predictive event embeddings, and” (Architecture, pp. 1780; “This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” The graph will contain nodes, which are events or log entries.)
“(ii) a plurality of event relationship links corresponding to a plurality of predictive event pairs comprising a first predictive event and a second predictive event, and” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta-attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” The graph will contain a set of nodes and their relationships and links with the other nodes in the graph.)
“(iii) a plurality of relationship embeddings corresponding to the plurality of event relationship links;” (Architecture, pp. 1780; “Further, log2vec improves the existing graph embedding [11, 14, 39, 54] (see Section 4.1.2, Section 4.1.3 and comparison with baselines [11, 14] in Section 6.2). The novel version is capable of determining importance of each relationship among log entries based on attack scenarios and processing them differentially.” The knowledge graph in this article will contain the embedded log entries and their relationships between the nodes. The knowledge graph itself is a mutable object where other nodes can be added or removed.)
“initiate one or more prediction-based actions based at least in part on the cross-event classification.” (Threshold Detector, pp. 1784; “After clustering, log2vec ranks clusters according to the number of log entries they contain. Smaller clusters tend to be suspicious. Table 1 and Table 2 demonstrate two examples of the clustering algorithm’s output. In Table 1, the smallest cluster is larger than a threshold, δ2 (e.g. 80) and thereby identified as legitimate operations. Table 2 shows several small clusters (< 80), indicative of insider threat. Therefore, log entries in these clusters are detected as malicious.” This model is designed to predict malicious software on a computing system. This will initiate general actions based on the discovery of malicious software from the analysis of the input data.)
Zhang and Liu fail to explicitly disclose the remaining elements of this claim. However, Park discloses, “generate a plurality of predictive event significance classifications corresponding to the plurality of predictive events based at least in part on the plurality of final predictive event embeddings and the plurality of final relationship embeddings, wherein a predictive event significance classification of the plurality of predictive event significance classifications indicates a positive, neutral, or negative significance associated with a particular predictive event; ” (Method, pp. 598; “Neighborhood Importance Awareness: GNN normally propagates information between neighbors through node embedding. This is to model the assumption that an entity and its neighbors affect each other, and thus the representation of an entity can be better represented in terms of the representation of its neighbors. In the context of node importance estimation, neighboring importance scores play a major role on the importance of a node, whereas other neighboring features may have little effect, if any. We thus directly aggregate importance scores from neighbors (Section 3.1), and show empirically that it outperforms embedding propagation (Section 4.4).” This model will evaluate the relationships of different nodes in a generated knowledge graph. This will evaluate the nodes and determine and score nodes based on their importance to the main concept of graph. This will score based on how close the node is to the center of a graph. A higher score will denote a more positive connection while a maximum or lower can denote neutral or negative significance.) And (Score Aggregation, pp. 599; “To directly model the relationship between the importance of neighboring nodes, we propose a score aggregation framework, rather than embedding aggregation.”)
“generate, based on the plurality of predictive event significance classifications, a cross-event classification comprising a per-event classification for a predictive event of the plurality of predictive events, wherein the per-event classification identifies a relative contribution of the predictive event, relative to the plurality of predictive events, to the predictive entity; and” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will cross examiner different nodes in the graph to review and update their relationship links. This model will identify different nodes of a graph as being the most significant.)
Regarding claim 9, Park discloses, “wherein generating the cross-event classification comprises: generating a plurality of per-event classifications corresponding to plurality of predictive events, wherein generating a per-event classification, of the plurality of per-event classifications, associated with a predictive event, of the plurality of predictive events, is based at least in part on a final predictive event embedding for the predictive event; and” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will evaluate the different nodes on a knowledge graph and is able to score different nodes to locate the most important node. This will evaluate each node in the graph.)
“generating the cross-event classification based at least in part on the plurality of per-event classifications.” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will score or classify the different nodes in a knowledge graph based on their importance scores.)
Regarding claim 10, Liu discloses, “wherein generating the per-event classification for the particular predictive event comprises: generating the per-event classification based at least in part on whether an ith value of the final predictive event embedding for the particular predictive event satisfies a threshold value defined based at least in part on a jth value of the final predictive event embedding for the particular predictive event.” (Threshold Detector, pp. 1784; “After clustering, log2vec ranks clusters according to the number of log entries they contain. Smaller clusters tend to be suspicious. Table 1 and Table 2 demonstrate two examples of the clustering algorithm’s output. In Table 1, the smallest cluster is larger than a threshold, δ2 (e.g. 80) and thereby identified as legitimate operations. Table 2 shows several small clusters (< 80), indicative of insider threat. Therefore, log entries in these clusters are detected as malicious.” This model will evaluate the final embeddings and final relationships of a knowledge graph. This will then cluster the noes and based on a threshold value will produce a cluster.)
Regarding claim 11, Park discloses, “wherein generating the per-event classification for the particular predictive event comprises: determining a maximal value position indicator for a maximal value of the final predictive event embedding of the particular predictive event;” (Centrality Adjustment, pp. 600; “In the context of KGs, it is also natural to assume that more central nodes would be more important than less central ones, unless the given importance scores present contradictory evidence. Making use of this prior knowledge becomes especially beneficial in cases where we are given a small number of importance scores compared to the total number of entities, and in cases where the importance scores are given for entities of a specific type out of the many types in KG. Given that the in-degree d(i) of node i is a common proxy for its centrality and popularity, we define the initial centrality c(i) of node i to be [See Equation (6)] where ϵ is a small positive constant.” This model will use the center of a cluster to denote the maximum importance. This will initialize a node as the center of the graph.)
“selecting, from a group of defined predictive event significance classifications, a selected predictive event significance classification for the particular predictive event based at least in part on the maximal value position indicator; and” (Model Architecture, pp. 600; “Centrality adjustment is applied to the output from the final SA layer. In order to enable independent scaling and shifting by each SA head, separate parameters
γ
h
and βh are used for each head h.” This model will adjust the centricity of a node when processing graph. As stated below this process is performed on each node in the knowledge graph.)
“generating the per-event classification based at least in part on the selected predictive event significance classification.” (Model Architecture, pp. 600-601; “Then centrality adjustment by h-th SA head in the final layer is: [See Equation (12)] With HL SA heads in the final L-th layer, we perform additional aggregation of centrality-adjusted scores by averaging, and apply a non-linearity σs, obtaining the final estimation s∗(i): [See Equation (13)]” This model will process each node of the knowledge graph and generate a final estimation.)
Regarding claim 12, Zhang discloses, “the network-based inference machine learning model comprises a plurality of sequential network update layers,” (Overview, pp. 1391; “We design an L-layer event-aware bipartite information aggregation model to enforce the entities to aggregate information from both knowledge graph neighbors and relevant events, where the illustration for each layer is shown in Figure 2.” This model uses a sequential process to update a knowledge graph.)
“the plurality of sequential network update layers are configured to update the event relationship network data object based at least in part on a trained parameter set associated with the plurality of sequential network update layers,” (Overview, pp. 1391; “We use
v
i
l
to denote the representation vector for the i-th entity in layer l, and the relation type embedding is denoted as
r
i
,
j
. We use
t
j
,
c
j
to denote the embedding vectors for the event trigger and event type of event
e
j
respectively. For event arguments, since each of them is also an entity, we use
v
j
,
k
l
to represent the embedding for the k-th argument of event
e
j
, and the corresponding role type embedding is denoted as
z
j
,
k
. Note that only the entity embeddings are updated in each layer, while other embeddings are identical in each layer and uniformly optimized through end-to-end training to reduce the model size.”) and (Implementation Details, pp. 1394; “We train the models on NVIDIA Tesla V100 GPUs using the Adam (Kingma and Ba, 2015) optimizer with a learning rate of 10-4. The average runtime is about 3 hours for the ACE- 2005 dataset and 5 days for the large KG in the WikiEvents dataset.” This article discloses the use of training datasets to train their model.)
“an ith sequential network update layer is configured to: (i) identify a second event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to a plurality of preceding predictive event values associated with the event relationship network data object, and” (Event-aware Information Aggregation, pp. 1392; “Information aggregation from entities to events. We first use an entity-to-event graph attention mechanism to aggregate entity information to events through the event argument links. For each event
e
j
with the number of arguments
|
A
j
|
, we first compute the attention weights
α
j
,
k
according to the concatenation of embeddings of event trigger, event type, entity, and role type: [See Equation (1)] where σ(ꞏ) is a LeakyReLU activation function as in (Velickovic et al., 2018), and
W
α
denotes a trainable parameter for linear transformation. Here,
v
j
,
k
l
denotes the entity embedding for the k-th event argument for event j.” During the updating process this model will evaluate the entries and the different events embedded on the knowledge graph.)
“(ii) process the event relationship network data object to transform the second event-related two-dimensional data object to a third event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to a plurality of subsequent predictive event values, and” (Event-aware Information Aggregation, pp. 1392; “Message passing on event-event relations. We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use N(j) to denote the set of event nodes that have temporal relations with
e
j
, then the event representation is updated similar to graph convolution network (Kipf and Welling, 2017).” This model will process the links in the graph and update their relationship links.)
“the trained parameter set for the ith sequential network update layer comprises a two-dimensional event-related parameter data object describing event-related trained parameter values having a first dimension corresponding to the plurality of preceding predictive event values and a second dimension corresponding to the plurality of subsequent predictive event values.” (Event-aware Information Aggregation, pp. 1393; “Message passing on entity-entity relations. In the final stage, we conduct message passing on the original entity-entity relations from the original KG to further incorporate information from the original static relations between entities. To handle the different relation types, we adopt Composition GCN (Vashishth et al., 2020) to model the relation types using different relation type embeddings. We use
N
(
i
)
to denote the set of entity nodes that are connected with
v
i
through the original entity-entity relations in knowledge graphs, and the entity representations are updated by [See Equation (8)] where
σ
e
(
∙
)
is the ReLU activation function,
r
i
,
j
is the relation type embedding, and
ϕ
(
∙
)
denotes a circular correlation operator3 (Nickel et al., 2016) between two vectors. Finally, we obtain the updated entity representation
v
i
l
+
1
that incorporates both the information from the original KGs and the rich event information from event nodes. We use the final layer output
v
i
L
for model optimization and knowledge graph representation learning.” This model is initially trained using a training datasets. Further this will process a knowledge graph containing events and entities.)
Zhang fails to explicitly disclose the remaining elements of this claim. However, Liu discloses, “prior to performing a plurality of updates on the event relationship network data object by the plurality of sequential network update layers: (i) a predictive event embedding comprises a plurality of initial predictive event values, and” (Architecture, pp. 1780; “This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” This article discloses the embedding of log entries or events into a knowledge graph. These nodes will contain an initial set of values.)
“(ii) the event relationship network data object comprises a first event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to the plurality of initial predictive event values,” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” The knowledge graph in this article contains different nodes and relationship links which link the nodes to each other. The nodes in the graph are represented as vectors of given dimensions which represent log entries. These log entries represent different events in a computing system.)
Regarding claim 13, Zhang discloses, “an ith sequential network update layer is configured to: (i) identify a second relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to a plurality of preceding event relationship values associated with the event relationship network data object, and” (Event-aware Information Aggregation, pp. 1392; “Information aggregation from entities to events. We first use an entity-to-event graph attention mechanism to aggregate entity information to events through the event argument links. For each event
e
j
with the number of arguments
|
A
j
|
, we first compute the attention weights
α
j
,
k
according to the concatenation of embeddings of event trigger, event type, entity, and role type: [See Equation (1)] where σ(ꞏ) is a LeakyReLU activation function as in (Velickovic et al., 2018), and
W
α
denotes a trainable parameter for linear transformation. Here,
v
j
,
k
l
denotes the entity embedding for the k-th event argument for event j.” This model will contain a set of relationships and different nodes contained in a knowledge graph.)
“(ii) process the event relationship network data object to transform the second relationship-related two-dimensional data object to a third relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to a plurality of subsequent event relationship values, and” (Event-aware Information Aggregation, pp. 1392; “Message passing on event-event relations. We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use N(j) to denote the set of event nodes that have temporal relations with
e
j
, then the event representation is updated similar to graph convolution network (Kipf and Welling, 2017).” This model will process and evaluate the different relationships in the generated graph.)
“the trained parameter set for the ith sequential network update layer comprises a two-dimensional relationship-related parameter data object describing relationship-related trained parameter values having a first dimension corresponding to the plurality of preceding event relationship values and a second dimension corresponding to the plurality of subsequent event relationship values.” (Event-aware Information Aggregation, pp. 1393; “Message passing on entity-entity relations. In the final stage, we conduct message passing on the original entity-entity relations from the original KG to further incorporate information from the original static relations between entities. To handle the different relation types, we adopt Composition GCN (Vashishth et al., 2020) to model the relation types using different relation type embeddings. We use
N
(
i
)
to denote the set of entity nodes that are connected with
v
i
through the original entity-entity relations in knowledge graphs, and the entity representations are updated by [See Equation (8)] where
σ
e
(
∙
)
is the ReLU activation function,
r
i
,
j
is the relation type embedding, and
ϕ
(
∙
)
denotes a circular correlation operator3 (Nickel et al., 2016) between two vectors. Finally, we obtain the updated entity representation
v
i
l
+
1
that incorporates both the information from the original KGs and the rich event information from event nodes. We use the final layer output
v
i
L
for model optimization and knowledge graph representation learning.” This model is initially trained using a training datasets. Further this will process a knowledge graph containing events and entities.)
Zhang fails to explicitly disclose the remaining elements of the claim. However, Liu discloses, “prior to performing the plurality of updates on the event relationship network data object by the plurality of sequential network update layers:” (Architecture, pp. 1780; “Further, log2vec improves the existing graph embedding [11, 14, 39, 54] (see Section 4.1.2, Section 4.1.3 and comparison with baselines [11, 14] in Section 6.2). The novel version is capable of determining importance of each relationship among log entries based on attack scenarios and processing them differentially.” The knowledge graph in this article will contain the embedded log entries and their relationships between the nodes. The nodes are given initial relationship values and links. This process occurs prior to another model updating and evaluating the generated graph.)
“(ii) the event relationship network data object comprises a first relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to the plurality of initial event relationship values,” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” This model will use different relationships to connect nodes. Each of the nodes in this graph contain fixed length representations of log entries.)
Regarding claim 14, Liu discloses, “wherein the plurality of event relationship links comprise event relationship links corresponding to pairs of predictive events in the plurality of predictive events.” Liu (Clustering Algorithm, pp. 1784; “We adopt an alternative method, adept at log entries’ pair-wise similarity comparison. Formally, we suppose clusters (C1, C2, ..., Cn) have been obtained and they must satisfy the following conditions: [See Equation on pp. 1784] where V is a set including all log entries and δ1 is a threshold. Note that C1 is chosen arbitrarily and sim is employed to measure similarity between log entries using cosine distance (two log entries become similar when their sim is 0→1).” This model is able to embed different events or log entries into a knowledge graph and is able to locate pairs of events based on similarity and clustering.)
Regarding claim 15, Zhang discloses, “One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to:” (Implementation Details, pp. 1394; “We train the KG embedding models for a maximum of 200 epochs and apply an early stopping strategy of 10 epochs (if the validation loss is not lower than the previous best for 10 consecutive epochs, we will stop training the model). We train the models on NVIDIA Tesla V100 GPUs using the Adam (Kingma and Ba, 2015) optimizer with a learning rate of 10-4. The average runtime is about 3 hours for the ACE- 2005 dataset and 5 days for the large KG in the WikiEvents dataset.” This article discloses the hardware used which includes processors, GPUs, which evaluate the different training datasets stored in memory.)
“generate, using a network-based inference machine learning model and based at least in part on the event relationship network data object:” (Overview, pp. 1391; “Given a knowledge graph G = (V,E) and a set of events E, we consider events as an additional set of nodes, and build a heterogeneous network where the entity nodes V and event nodes E are distributed on two sides. As shown in Figure 2, the entity nodes and event nodes are inter-connected by event argument links, while both of the entity set and event set are also inner-connected by relations from the original KG and event-event temporal links, respectively.” This model will evaluate the different nodes and their relationships in a knowledge graph using a machine learning model.)
“(i) a plurality of final predictive event embeddings corresponding to the plurality of predictive events, and” (3.2 Evet-aware Aggregation, pp. 1392; “We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use
N
(
j
)
to denote the set of event nodes.” In generating the updated relationships, this model will take a set of events, or nodes, and update the relationships between the nodes in the knowledge graph.)
“(ii) a plurality of final relationship embeddings corresponding to the plurality of event relationship links,” (3.2 Evet-aware Aggregation, pp. 1392; “We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use
N
(
j
)
to denote the set of event nodes.” In generating the updated relationships, this model will take a set of events, or nodes, and update the relationships between the nodes in the knowledge graph.)
“wherein: (i) the network-based inference machine learning model comprises a sequential network update layer configured to update the event relationship network data object,” (Event-aware Information Aggregation, pp. 1391; “As shown in Figure 2, given the heterogeneous network with entity and event nodes, each layer of the event-aware bipartite information aggregation model consists of four stages. First, we compute the event representations using a graph attention mechanism on the event argument links. Then, we conduct message passing on the event nodes with temporal relations to update the event representations.” This model has a sequential updating process. This will use machine learning on a knowledge graph to update the relationships and nodes in the given graph.)
“(ii) the plurality of final predictive event embeddings and the plurality of final relationship embeddings are determined based at least in part on a final sequential network update layer, and” (Event-aware Information Aggregation, pp. 1391; “After that, we aggregate the event information back to the entities based on another graph attention mechanism on event argument links. Finally, the entity representations are updated by incorporating the event information and the neighborhood message from the original KG relations.” The final links and embeddings are updated using the sequential process disclosed in this article.)
“(iii) the predictive event embedding machine learning model and the network-based inference machine learning model are trained end-to-end by processing a training event relationship network data object associated with a training predictive entity;” (Overview, pp. 1391; “As shown in Figure 2, the entity nodes and event nodes are inter-connected by event argument links, while both of the entity set and event set are also inner-connected by relations from the original KG and event-event temporal links, respectively. We design an L-layer event-aware bipartite information aggregation model to enforce the entities to aggregate information from both knowledge graph neighbors and relevant events, where the illustration for each layer is shown in Figure 2. The whole model is trained end-to-end by optimizing the convolution based scoring function on ground-truth knowledge triples with output embeddings from the last layer.” This model will use an end-to-end training process to train machine learning model which will process the relationships in a separately generated knowledge graph.)
Zhang fails to explicitly disclose the remaining elements of this claim. However, Liu discloses, “input a plurality of predictive events to a predictive event embedding machine learning model to receive a plurality of predictive event embeddings;” (Architecture, pp. 1780; “Graph embedding. Graph embedding, also graph representation learning, is a machine learning approach, capable of converting nodes (log entries) in the heterogeneous graph into low-dimension vectors [11, 14, 39, 54].” This model will take in log entries which are events created by a user and embed them into graph nodes.) and (Architecture, pp. 1780; “The word2vec model is used to calculate vector of each node with its paths (context). To be specific, these paths are taken as sentences in natural language and processed by this model to learn vector of each word (node) (see Section 4.2). This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” This model will encode the information in the log entries and ensure they can be placed into a graph structure.)
“generate an event relationship network data object for a predictive entity associated with the plurality of predictive events, wherein the event relationship network data object comprises:” (Architecture, pp. 1779; “Graph construction. Log2vec’s first component is a rule-based heuristic approach to map relationships among log entries that reflect users’ typical behavior and expose malicious operations, into a graph. According to the existing methods [4, 38, 41, 50, 57], log2vec mainly takes three relationships into account: (1) causal and sequential relationships within a day; (2) logical relationships among days (3) logical relationships among objects. (Section 3.2).” and (Graph Construction, pp. 1780; “In Section 3.1, we formally define a log entry. Section 3.2 details rules to construct heterogeneous graphs.” This model will generate a graph which will contain different events or log entries which is used in making predictions on malicious software.))
“(i) the plurality of predictive event embeddings, and” (Architecture, pp. 1780; “This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” The graph will contain nodes, which are events or log entries.)
“(ii) a plurality of event relationship links corresponding to a plurality of predictive event pair comprising a first predictive event and a second predictive event, and” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta-attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” The graph will contain a set of nodes and their relationships and links with the other nodes in the graph.)
“(iii) a plurality of relationship embeddings corresponding to the plurality of event relationship links;” (Architecture, pp. 1780; “Further, log2vec improves the existing graph embedding [11, 14, 39, 54] (see Section 4.1.2, Section 4.1.3 and comparison with baselines [11, 14] in Section 6.2). The novel version is capable of determining importance of each relationship among log entries based on attack scenarios and processing them differentially.” The knowledge graph in this article will contain the embedded log entries and their relationships between the nodes. The knowledge graph itself is a mutable object where other nodes can be added or removed.)
“initiate one or more prediction-based actions based at least in part on the cross-event classification.” (Threshold Detector, pp. 1784; “After clustering, log2vec ranks clusters according to the number of log entries they contain. Smaller clusters tend to be suspicious. Table 1 and Table 2 demonstrate two examples of the clustering algorithm’s output. In Table 1, the smallest cluster is larger than a threshold, δ2 (e.g. 80) and thereby identified as legitimate operations. Table 2 shows several small clusters (< 80), indicative of insider threat. Therefore, log entries in these clusters are detected as malicious.” This model is designed to predict malicious software on a computing system. This will initiate general actions based on the discovery of malicious software from the analysis of the input data.)
Zhang and Liu fail to explicitly disclose the remaining elements of this claim. However, Park discloses, “generate a plurality of predictive event significance classifications corresponding to the plurality of predictive events based at least in part on the plurality of final predictive event embeddings and the plurality of final relationship embeddings, wherein a predictive event significance classification of the plurality of predictive event significance classifications indicates a positive, neutral, or negative significance associated with a particular predictive event; ” (Method, pp. 598; “Neighborhood Importance Awareness: GNN normally propagates information between neighbors through node embedding. This is to model the assumption that an entity and its neighbors affect each other, and thus the representation of an entity can be better represented in terms of the representation of its neighbors. In the context of node importance estimation, neighboring importance scores play a major role on the importance of a node, whereas other neighboring features may have little effect, if any. We thus directly aggregate importance scores from neighbors (Section 3.1), and show empirically that it outperforms embedding propagation (Section 4.4).” This model will evaluate the relationships of different nodes in a generated knowledge graph. This will evaluate the nodes and determine and score nodes based on their importance to the main concept of graph. This will score based on how close the node is to the center of a graph. A higher score will denote a more positive connection while a maximum or lower can denote neutral or negative significance.) And (Score Aggregation, pp. 599; “To directly model the relationship between the importance of neighboring nodes, we propose a score aggregation framework, rather than embedding aggregation.”)
“generate, based on the plurality of predictive event significance classifications, a cross-event classification comprising a per-event classification for a predictive event of the plurality of predictive events, wherein the per-event classification identifies a relative contribution of the predictive event, relative to the plurality of predictive events, to the predictive entity; and” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will cross examiner different nodes in the graph to review and update their relationship links. This model will identify different nodes of a graph as being the most significant.)
Regarding claim 16, Park discloses, “wherein generating the cross-event classification comprises: generating a plurality of per-event classifications corresponding to plurality of predictive events, wherein generating a per-event classification, of the plurality of per-event classifications, associated with a predictive event, of the plurality of predictive events, is based at least in part on a final predictive event embedding for the predictive event; and” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will evaluate the different nodes on a knowledge graph and is able to score different nodes to locate the most important node. This will evaluate each node in the graph.)
“generating the cross-event classification based at least in part on the plurality of per-event classifications.” (Model Architecture, pp. 600; “The simple architecture depicted in Figure 3(a) consists of a scoring network and a single score aggregation (SA) layer (i.e., L = 1), followed by a centrality adjustment component. Figure 3(b) extends it to a more general architecture in two ways. First, we extend the framework to contain multiple SA layers; that is, L > 1. As a single SA layer aggregates the scores of direct neighbors, stacking multiple SA layers enables aggregating scores from a larger neighborhood. Second, we design each SA layer to contain a variable number of SA heads, which perform score aggregation and attention computation independently of each other.” This model will score or classify the different nodes in a knowledge graph based on their importance scores.)
Regarding claim 17, Liu discloses, “wherein generating the per-event classification for the particular predictive event comprises: generating the per-event classification based at least in part on whether an ith value of the final predictive event embedding for the particular predictive event satisfies a threshold value defined based at least in part on jth value of the final predictive event embedding for the particular predictive event.” (Threshold Detector, pp. 1784; “After clustering, log2vec ranks clusters according to the number of log entries they contain. Smaller clusters tend to be suspicious. Table 1 and Table 2 demonstrate two examples of the clustering algorithm’s output. In Table 1, the smallest cluster is larger than a threshold, δ2 (e.g. 80) and thereby identified as legitimate operations. Table 2 shows several small clusters (< 80), indicative of insider threat. Therefore, log entries in these clusters are detected as malicious.” This model will evaluate the final embeddings and final relationships of a knowledge graph. This will then cluster the noes and based on a threshold value will produce a cluster.)
Regarding claim 18, Park discloses, “wherein generating the per-event classification for the particular predictive event comprises: determining a maximal value position indicator for a maximal value of the final predictive event embedding of the particular predictive event;” (Centrality Adjustment, pp. 600; “In the context of KGs, it is also natural to assume that more central nodes would be more important than less central ones, unless the given importance scores present contradictory evidence. Making use of this prior knowledge becomes especially beneficial in cases where we are given a small number of importance scores compared to the total number of entities, and in cases where the importance scores are given for entities of a specific type out of the many types in KG. Given that the in-degree d(i) of node i is a common proxy for its centrality and popularity, we define the initial centrality c(i) of node i to be [See Equation (6)] where ϵ is a small positive constant.” This model will use the center of a cluster to denote the maximum importance. This will initialize a node as the center of the graph.)
“selecting, from a group of defined predictive event significance classifications, a selected predictive event significance classification for the particular predictive event based at least in part on the maximal value position indicator; and” (Model Architecture, pp. 600; “Centrality adjustment is applied to the output from the final SA layer. In order to enable independent scaling and shifting by each SA head, separate parameters
γ
h
and βh are used for each head h.” This model will adjust the centricity of a node when processing graph. As stated below this process is performed on each node in the knowledge graph.)
“generating the per-event classification based at least in part on the selected predictive event significance classification.” (Model Architecture, pp. 600-601; “Then centrality adjustment by h-th SA head in the final layer is: [See Equation (12)] With HL SA heads in the final L-th layer, we perform additional aggregation of centrality-adjusted scores by averaging, and apply a non-linearity σs, obtaining the final estimation s∗(i): [See Equation (13)]” This model will process each node of the knowledge graph and generate a final estimation.)
Regarding claim 19, Zhang discloses, “the network-based inference machine learning model comprises a plurality of sequential network update layers,” (Overview, pp. 1391; “We design an L-layer event-aware bipartite information aggregation model to enforce the entities to aggregate information from both knowledge graph neighbors and relevant events, where the illustration for each layer is shown in Figure 2.” This model uses a sequential process to update a knowledge graph.)
“the plurality of sequential network update layers are configured to update the event relationship network data object based at least in part on a trained parameter set associated with the plurality of sequential network update layers,” (Overview, pp. 1391; “We use
v
i
l
to denote the representation vector for the i-th entity in layer l, and the relation type embedding is denoted as
r
i
,
j
. We use
t
j
,
c
j
to denote the embedding vectors for the event trigger and event type of event
e
j
respectively. For event arguments, since each of them is also an entity, we use
v
j
,
k
l
to represent the embedding for the k-th argument of event
e
j
, and the corresponding role type embedding is denoted as
z
j
,
k
. Note that only the entity embeddings are updated in each layer, while other embeddings are identical in each layer and uniformly optimized through end-to-end training to reduce the model size.”) and (Implementation Details, pp. 1394; “We train the models on NVIDIA Tesla V100 GPUs using the Adam (Kingma and Ba, 2015) optimizer with a learning rate of 10-4. The average runtime is about 3 hours for the ACE- 2005 dataset and 5 days for the large KG in the WikiEvents dataset.” This article discloses the use of training datasets to train their model.)
“an ith sequential network update layer is configured to: (i) identify a second event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to a plurality of preceding predictive event values associated with the event relationship network data object, and” (Event-aware Information Aggregation, pp. 1392; “Information aggregation from entities to events. We first use an entity-to-event graph attention mechanism to aggregate entity information to events through the event argument links. For each event
e
j
with the number of arguments
|
A
j
|
, we first compute the attention weights
α
j
,
k
according to the concatenation of embeddings of event trigger, event type, entity, and role type: [See Equation (1)] where σ(ꞏ) is a LeakyReLU activation function as in (Velickovic et al., 2018), and
W
α
denotes a trainable parameter for linear transformation. Here,
v
j
,
k
l
denotes the entity embedding for the k-th event argument for event j.” During the updating process this model will evaluate the entries and the different events embedded on the knowledge graph.)
“(ii) process the event relationship network data object to transform the second event-related two-dimensional data object to a third event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to a plurality of subsequent predictive event values, and” (Event-aware Information Aggregation, pp. 1392; “Message passing on event-event relations. We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use N(j) to denote the set of event nodes that have temporal relations with
e
j
, then the event representation is updated similar to graph convolution network (Kipf and Welling, 2017).” This model will process the links in the graph and update their relationship links.)
“the trained parameter set for the ith sequential network update layer comprises a two-dimensional event-related parameter data object describing event-related trained parameter values having a first dimension corresponding to the plurality of preceding predictive event values and a second dimension corresponding to the plurality of subsequent predictive event values.” (Event-aware Information Aggregation, pp. 1393; “Message passing on entity-entity relations. In the final stage, we conduct message passing on the original entity-entity relations from the original KG to further incorporate information from the original static relations between entities. To handle the different relation types, we adopt Composition GCN (Vashishth et al., 2020) to model the relation types using different relation type embeddings. We use
N
(
i
)
to denote the set of entity nodes that are connected with
v
i
through the original entity-entity relations in knowledge graphs, and the entity representations are updated by [See Equation (8)] where
σ
e
(
∙
)
is the ReLU activation function,
r
i
,
j
is the relation type embedding, and
ϕ
(
∙
)
denotes a circular correlation operator3 (Nickel et al., 2016) between two vectors. Finally, we obtain the updated entity representation
v
i
l
+
1
that incorporates both the information from the original KGs and the rich event information from event nodes. We use the final layer output
v
i
L
for model optimization and knowledge graph representation learning.” This model is initially trained using a training datasets. Further this will process a knowledge graph containing events and entities.)
Zhang fails to explicitly disclose the remaining elements of this claim. However, Liu discloses, “prior to performing a plurality of updates on the event relationship network data object by the plurality of sequential network update layers: (i) a predictive event embedding comprises a plurality of initial predictive event values, and” (Architecture, pp. 1780; “This method preserves the proximity between a node and its context [11, 14, 39, 54], meaning that a node (log entry) and its neighbors (log entries having close relationships with it) share similar embeddings (vectors).” This article discloses the embedding of log entries or events into a knowledge graph. These nodes will contain an initial set of values.)
“(ii) the event relationship network data object comprises a first event-related two-dimensional data object having a first dimension corresponding to the plurality of predictive events and a second dimension corresponding to the plurality of initial predictive event values,” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” The knowledge graph in this article contains different nodes and relationship links which link the nodes to each other. The nodes in the graph are represented as vectors of given dimensions which represent log entries. These log entries represent different events in a computing system.)
Regarding claim 20, Zhang discloses, “an ith sequential network update layer is configured to: (i) identify a second relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to a plurality of preceding event relationship values associated with the event relationship network data object, and” (Event-aware Information Aggregation, pp. 1392; “Information aggregation from entities to events. We first use an entity-to-event graph attention mechanism to aggregate entity information to events through the event argument links. For each event
e
j
with the number of arguments
|
A
j
|
, we first compute the attention weights
α
j
,
k
according to the concatenation of embeddings of event trigger, event type, entity, and role type: [See Equation (1)] where σ(ꞏ) is a LeakyReLU activation function as in (Velickovic et al., 2018), and
W
α
denotes a trainable parameter for linear transformation. Here,
v
j
,
k
l
denotes the entity embedding for the k-th event argument for event j.” This model will contain a set of relationships and different nodes contained in a knowledge graph.)
“(ii) process the event relationship network data object to transform the second relationship-related two-dimensional data object to a third relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to a plurality of subsequent event relationship values, and” (Event-aware Information Aggregation, pp. 1392; “Message passing on event-event relations. We then update the event representations
e
j
by conducting message passing on event-event temporal links. We use N(j) to denote the set of event nodes that have temporal relations with
e
j
, then the event representation is updated similar to graph convolution network (Kipf and Welling, 2017).” This model will process and evaluate the different relationships in the generated graph.)
“the trained parameter set for the ith sequential network update layer comprises a two-dimensional relationship-related parameter data object describing relationship-related trained parameter values having a first dimension corresponding to the plurality of preceding event relationship values and a second dimension corresponding to the plurality of subsequent event relationship values” (Event-aware Information Aggregation, pp. 1393; “Message passing on entity-entity relations. In the final stage, we conduct message passing on the original entity-entity relations from the original KG to further incorporate information from the original static relations between entities. To handle the different relation types, we adopt Composition GCN (Vashishth et al., 2020) to model the relation types using different relation type embeddings. We use
N
(
i
)
to denote the set of entity nodes that are connected with
v
i
through the original entity-entity relations in knowledge graphs, and the entity representations are updated by [See Equation (8)] where
σ
e
(
∙
)
is the ReLU activation function,
r
i
,
j
is the relation type embedding, and
ϕ
(
∙
)
denotes a circular correlation operator3 (Nickel et al., 2016) between two vectors. Finally, we obtain the updated entity representation
v
i
l
+
1
that incorporates both the information from the original KGs and the rich event information from event nodes. We use the final layer output
v
i
L
for model optimization and knowledge graph representation learning.” This model is initially trained using a training datasets. Further this will process a knowledge graph containing events and entities.)
Zhang fails to explicitly disclose the remaining elements of the claim. However, Liu discloses, “prior to performing the plurality of updates on the event relationship network data object by the plurality of sequential network update layers: (i) a relationship embedding comprises a plurality of initial event relationship values, and” (Architecture, pp. 1780; “Further, log2vec improves the existing graph embedding [11, 14, 39, 54] (see Section 4.1.2, Section 4.1.3 and comparison with baselines [11, 14] in Section 6.2). The novel version is capable of determining importance of each relationship among log entries based on attack scenarios and processing them differentially.” The knowledge graph in this article will contain the embedded log entries and their relationships between the nodes. The nodes are given initial relationship values and links. This process occurs prior to another model updating and evaluating the generated graph.)
“(ii) the event relationship network data object comprises a first relationship-related two-dimensional data object having a first dimension corresponding to the plurality of event relationship links and a second dimension corresponding to the plurality of initial event relationship values,” (Architecture, pp. 1779; “To deeply mining and analyzing relationships among log entries within a day/host, we divide a log entry into five primary attributes (subject, object, operation type, time and host), named as meta attributes (see Section 3.1). When designing rules regarding the three relationships, we consider different combinations of these meta-attributes to correlate fewer log entries and map finer logs’ relationships into the graph.” This model will use different relationships to connect nodes. Each of the nodes in this graph contain fixed length representations of log entries.)
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PAUL MICHAEL GALVIN-SIEBENALER whose telephone number is (571)272-1257. The examiner can normally be reached Monday - Friday 8AM to 5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Viker Lamardo can be reached at (571) 270-5871. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PAUL M GALVIN-SIEBENALER/Examiner, Art Unit 2147 /ERIC NILSSON/Primary Examiner, Art Unit 2151
Prosecution Insights