Prosecution Insights
Last updated: August 18, 2026
Application No. 17/737,787

Anomaly Detection for Cloud Computing Platforms

Final Rejection §101
Filed
May 05, 2022
Examiner
VANG, MENG
Art Unit
2443
Tech Center
2400 — Computer Networks
Assignee
Palo Alto Networks Inc.
OA Round
4 (Final)
78%
Grant Probability
Favorable
5-6
OA Rounds
0m
Est. Remaining
99%
With Interview

Examiner Intelligence

Grants 78% — above average
78%
Career Allowance Rate
241 granted / 309 resolved
+20.0% vs TC avg
Strong +27% interview lift
Without
With
+27.2%
Interview Lift
resolved cases with interview
Typical timeline
2y 9m
Avg Prosecution
19 currently pending
Career history
337
Total Applications
across all art units

Statute-Specific Performance

§101
16.7%
-23.3% vs TC avg
§103
47.0%
+7.0% vs TC avg
§102
10.9%
-29.1% vs TC avg
§112
17.2%
-22.8% vs TC avg
Black line = Tech Center average estimate • Based on career data from 309 resolved cases

Office Action

§101
DETAILED ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Response to Amendment This office action is in reply to Applicant’s Response dated 03/16/2026. Claims 11 and 13 are amended. Claims 1-20 remain pending in the application. Response to Arguments In response to the Applicant’s argument (see page 8) with respect to the claim interpretation under 35 U.S.C. 112(f), the claim interpretations under 35 U.S.C. 112(f) has been withdrawn in view of the amendments made to claims 11 and 13. The Applicant argues (see page 9), with respect to the rejection under 35 U.S.C. 101, that the claims are directed to analysis of network segments having connectivity issues and the analysis being based on relevancy of factors. More particularly, the claims are directed to differentiating network segments having connectivity issues based on the analysis. The Applicant argues (see page 10) that The claimed technology for analysis of network segments having connectivity issues which can inform root cause analysis of those connectivity issues is not merely directed to analyzing information or performing mental processes. The Applicant argues (see pages 10-11) that the Specification also describes how clustering and visualization are used to enable identification of the underlying cause of network issues. These passages demonstrate that the purpose of the claimed analysis is not simply to display information, but to identify causal relationships between network factors and connectivity issues in order to inform root cause analysis that determines causality of the network issues. Claim 1 recites operations that implement the aforementioned analytical technique to address the technical challenge of diagnosing connectivity issues in a network environment. In response to the Applicant’s arguments, as the Applicant stated, the claims are directed to analysis of network segments and the analysis being based on relevancy of factors (Applicant’s arguments, page 9) and Claim 1 recites operations that implement the aforementioned analytical technique (page 11). The use of an “analytical technique” to analyze collected information is a mental process. The Applicant has not shown that the recited limitations in the claims integrate the abstract into a practical application or that the limitations improve computer functionality. The Applicant has not shown that the asserted improvement is technological . Instead, the Applicant argues the intended use or purpose of the claim limitations (“to identify causal relationships…to inform root cause analysis” (page 11 of the Arguments)). The intended use or purpose of the claim limitations is not an improvement to the technology or computer functionality and does not integrate the abstract idea into a practical application. The Applicant argues (see pages 13-14) that a human cannot determine connectivity issues based on analysis of network segments and that the claims recite specific operations for differentiating among network segments having connectivity issues based on relevancy of factors. The claims explicitly recite identifying segments having connectivity issues, calculating relevance of each factor describing those segments using a mutual information algorithm, selecting a subset of factors based on the calculated relevance, clustering the segments according to values for the selected subset of factors, and generating a visual representation of the clusters. The Office's "rationale" is to quote the claim language, then summarily state that "these features are mental processes as a human can perform selecting, clustering and calculating." At the very least, Applicant's representative requests clarification from the Office as to how the claims recite mental processes. The Examiner respectfully disagrees for the following reasons and clarifications is provided as follows. The Applicant has not explained how merely identifying segments having connectivity issues, calculating relevance, selecting a subset of factors, clustering the segments according to values and generating a visual representation cannot be performed in the human mind. The limitations in the claims are not recited at a level of complexity where they cannot be performed in the human mind. The identifying, calculating, selecting, clustering and generating steps require no specific techniques or features that would indicate that the steps cannot be performed in the human mind. Instead, the identifying, calculating, selecting and clustering steps are merely performed according “statistics”, “mutual algorithm”, “relevancies” and “values”. There’s nothing in the generating step that indicates how the generating is carried out. Identifying a set of segments of a plurality of segments having connectivity issues according to the statistics is looking at the statistics to see which segments have issues, calculating relevance is merely using an algorithm to compute values and selecting a subset of factors is using the computed values (information) to choose factors. These features can clearly be performed in the human mind or by using a pen and paper. The claims fail to recite limitations that explain how the visual representation is generated. Under the broadest reasonable interpretation, “generating a visual representation” is merely generating a graph, which can be done in the human mind or by using a pen and paper. Additionally, generating a visual representation is an insignificant extra-solution activity because it does nothing more than creating a visual representation of the result of the mental process without explaining how the generation of the visual representation is carried out. Accordingly, the claims recite an abstract idea. The Applicant argues (see page 15) that the claims should be found to integrate claim limitations into an improvement to the technology of network monitoring. Identifying the root cause of connectivity failures across network segments can be difficult because a large number of network attributes may influence connectivity behavior. The claimed technique addresses this technical problem by applying statistical relevance determination and clustering operations to network segments experiencing connectivity issues so that relationships between network factors and connectivity failures can be identified. The claimed method organizes network segments experiencing connectivity issues according to the most relevant network attributes and presents the resulting clusters in a visual representation that facilitates root cause analysis. Even assuming that the claims recite a mental process, the claims integrate that alleged concept into a practical application directed to improving network monitoring and diagnostic techniques. The claimed operations are not merely collecting or displaying data but rather apply the analytical operations in a specific technological context to improve the ability to diagnose connectivity issues in distributed network environments. In response to the Applicant’s argument, the Examiner respectfully disagrees. The Applicant states (see page 9) that the claims are directed to analysis of network segments having connectivity issues based on relevancy factors and that the claimed operations organize the segments experiencing connectivity issues according to values of factors associated with those segments (see page 11). The Examiner submits that the analysis technique recited in the claims is a mental process. The claims, as a whole, are merely directed to analyzing, identifying and organizing information such network connectivity information. Whether the information is statistics, segment information, relevance, factors or values, the information is being analyzed by a mental process. The claims, as a whole, are not directed to improvement in the technology. As explained above, the Applicant has not shown that the recited limitations in the claims integrate the abstract into a practical application or that the limitations improve computer functionality. The Applicant has not shown that the asserted improvement is technological . Instead, the Applicant argues the intended use or purpose of the claim limitations (“to identify causal relationships…to inform root cause analysis” (page 11 of the Arguments)). The intended use or purpose of the claim limitations is not an improvement to the technology or computer functionality and does not integrate the abstract idea into a practical application. In summary, the claims are not directed to a specific asserted solution or improvement in computer capabilities. Instead the claims focus on a process that qualifies as mental process and abstract idea for which computers are used to perform generic function or merely executing “apply it” to the abstract idea. Accordingly, the rejection under 35 U.S.C. 101 is maintained. Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-20 rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. Claims 1 and 11 satisfy the Step 1 because the claims are a process and machine respectively. In Step 2A prong 1, the claim 1 recites “measuring, by a computer system, statistics…identifying, by a computer system, a set of segments of a plurality of segments…calculating, by the computer system, relevance of each factor…selecting, by the computer system, a subset of factors…clustering, by the computer system, segments…”, which, under the broadest reasonable interpretation, are steps that are performed in the human mind. For example, a human analyzes information pertaining to connectivity issues and identifies the segments having the issues. A human also performs calculation to obtain relevance of the factors, selects segments based on their calculated relevance and clustering or grouping the segments. Under the broadest reasonable interpretation, the “measure” or “measuring” term is interpreted as “to estimate or appraise by a criterion”. Therefore, a human can “measure” or “estimate or appraise” statistics (data). If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea. Claim 11 recites similar features and therefore, claim 11 also recites the abstract idea. In Step 2A prong 2, the judicial exception is not integrated into a practical application because computer system, processors and memory devices are recited at a high-level of generality such that it amounts no more than mere instructions to apply the exception using a generic computer component. The claims also recite the additional step of “generating, by the computer system, a visual representation of the plurality of clusters”. However, this step is an insignificant extra-solution activity, e.g., mere data gathering or displaying data in conjunction with the abstract idea. In addition to the measuring step being a mental process, the measuring step is an insignificant extra-solution activity because it is recited merely to gather data (statistics) for processing. Adding insignificant extra-solution activity to the judicial exception is not enough to qualify as “significantly more”. The claims, as a whole, are merely directed to analyzing, identifying and organizing information. The additional elements or steps do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. In Step 2B, the claim do not include additional elements that are sufficient to amount to significantly more than the judicial exception because computer system, processing devices and memory devices are general purpose computer components, which are well-understood, routine and conventional (see Decasper et al. (U.S. PGPub 2007/0192474) paragraph 0004 where include conventional components such as a processor, a memory (e.g., RAM)… a network interface, such as a conventional modem), performing the steps recited in the claims and are not sufficient to transform a judicial exception into a patentable invention. Regarding claims 2-10 and 12-20, claims 2-10 and 12-20 recite additional “selecting…”, “clustering…”, “calculating…”, “Elbow Method”, “Silhouette Method”, “Goodman-Kruskal index”, “cloud computing platform”, “plurality of factors…”, “connectivity issues…failing to meet…threshold…” and “generating a Sankey diagram”. However, these features are mental processes as a human can perform selecting, clustering and calculating according to an Elbow Method, Silhouette Method or Goodman-Kruskal index. The feature “cloud computing platform” is conventional, well-understood and routine (Wu et al. (U.S. PGPub 2017/0289059), paragraph 0030 where the conventional cloud computing platform) and “plurality of factors” are merely data used in the selecting or calculating steps. Therefore, these features do not add meaningful limitation to the abstract idea. Hence, claims 2-10 and 12-20 fail to remedy the deficiencies of claims 1 and 11 and are likewise rejected. The elements recited in claims 1-20, when considered individually or in an ordered combination, fail to amount to significantly more than the abstract idea. Accordingly, claims 1-20 are not eligible. Conclusion THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to MENG VANG whose telephone number is (571)270-7023. The examiner can normally be reached M-F 8AM-2PM, 3PM-5PM. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, NICHOLAS TAYLOR can be reached at (571) 272-3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /MENG VANG/Primary Examiner, Art Unit 2443
Read full office action

Prosecution Timeline

Show 13 earlier events
Oct 27, 2025
Request for Continued Examination
Nov 02, 2025
Response after Non-Final Action
Dec 16, 2025
Non-Final Rejection mailed — §101
Mar 01, 2026
Interview Requested
Mar 09, 2026
Applicant Interview (Telephonic)
Mar 09, 2026
Examiner Interview Summary
Mar 16, 2026
Response Filed
May 27, 2026
Final Rejection mailed — §101 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12701130
SYSTEMS AND METHODS FOR USING MACHINE LEARNING MODELS FOR IMPROVED AND CUSTOMIZED CYBER THREAT INTELLIGENCE
2y 7m to grant Granted Aug 04, 2026
Patent 12693886
CYBER SECURITY SYSTEM WITH CLOUD ARCHITECTURE FORMATION AND VISUALIZATION
2y 7m to grant Granted Jul 28, 2026
Patent 12693922
Tracking Virtual Processes to Identify Anomalies
2y 8m to grant Granted Jul 28, 2026
Patent 12675600
Privacy Enhanced Language Model Prompt
2y 8m to grant Granted Jul 07, 2026
Patent 12634324
SYSTEM AND METHOD FOR TRAINING A GENERATIVE ADVERSERIAL MODEL IN A CYBERSECURITY RANGE
2y 3m to grant Granted May 19, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

5-6
Expected OA Rounds
78%
Grant Probability
99%
With Interview (+27.2%)
2y 9m (~0m remaining)
Median Time to Grant
High
PTA Risk
Based on 309 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month