DETAILED ACTION
This action is in response to communications files on 12/22/2025. Claims 1, 2, 5, 8, 12, 15, 16, 17, 19, and 20 have been amended. Claim 14 has been cancelled. Claim 21 has been added. Claims 1-13 and 15-21 are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
Applicant has amended claims 1, 2, 5, 8, 12, 15, 16, 17, 19, and 20 as well as added claim 21. The applicant has further provided citations to the specification and originally filed claims in support of the amended/newly added claims and asserts that no new matter has been introduced by way of amendment.
The specification has been evaluated for support of the amended and added claims. The provided citations sufficiently provide support for the newly-added limitations such that it is apparent to the examiner that the applicant had possession of the claimed invention at the time of filing. Examiner agrees no new matter has been introduced by way of amendment.
Response to Arguments
Rejections under 35 U.S.C. § 112(b)
The applicant had presented amendments in response to the rejections previously set forth to claims 2, 5-6, and 8-20 under 35 U.S.C. § 112(b) and argues the amendments render the rejections moot.
Applicant’s arguments, see Pages 13-14 of response to rejections, filed 12/22/2025, with respect to the rejections of the claims under 35 U.S.C. § 112(b) have been fully considered and are persuasive. The rejections of claims 2, 5-6, and 8-20 under 35 U.S.C. § 112(b) have been withdrawn.
Rejections under 35 U.S.C. § 101
Applicant traverses the rejection set forth under 35 U.S.C. § 101. Particularly, the applicant states that the Office’s characterization of the claims as a mental process is erroneous because Claim 1 does not merely recite observing, evaluating, or judging information in the abstract because there are limitations in the claims that cannot be practically performed in the human mind or using pen and paper as assistive physical aids. Applicant makes this assertion because the claimed method performs computerized simulation and monitoring processes and does not merely manipulate information that exists independent of the computer.
Examiner disagrees. A human being is fully capable of generating alerts triggered by the reinforcement learning agent attempting to evade the plurality of scenarios. For example, a human being can observe the behavior of the reinforcement learning agent to make a judgement or indication that an activity of interest has occurred. The alert may be written on to a piece of paper as a physical expression of such judgment. A human being is further capable of evaluating data to determine an extent of overlap or similarity, by making observations and judgements. A human being is further capable of making a judgement that a scenario may be redundant according to the evaluation regarding the overlap. Lastly, a human being is further capable of signaling a process to halt- for example, using assistive physical aids such as a pen and paper to write the word “STOP”. Applicant notes that the steps of the claim are operations to execute interaction of a reinforcement learning agent with a monitoring system, and then analyze the interactions to reconfigure the monitoring system. This is an admission that the claims recite that which can be construed as a mental process. The analysis of the interactions is precisely what has been determined to be the recited judicial exception. Further, the reconfiguration of the monitoring system is merely a judgement of a human being applied using a generically-recited monitoring system, or computer, as an assistive physical aid to perform reconfigurations. The inclusion and execution of a reinforcement learning agent in a monitoring system appears to be the recitation of a generic computing component recited at a high level of generality in a given technological environment of transaction system monitoring.
Applicant further argues that even if the claims did recite a judicial exception, the claims would be integrated into a practical application because the claims allegedly integrate the recited judicial exception into a practical application by improving a monitoring system. The applicant makes references to the specification which set forth an alleged improvement, noting benefits such as made more efficient by reducing compute overhead, decrease in the number of cumulative alerts handled by the monitoring system, and enabling the monitoring system to surveil the same amount of activity (with similar detection power to identify suspicious activity) while using fewer compute resources. The applicant argues that the independent claims recite a specific structural technical solution to a technical problem in monitoring systems. The applicant notes that the ordered combination of the claims improves the functioning of a monitoring system by pruning redundant scenarios based on empirically generated alert behavior.
Examiner disagrees and further states that applicant’s arguments are again an admission to the mental process recited as providing the alleged improvement- See argument: “improves the functioning of a monitoring system by pruning redundant scenarios based on empirically generated alert behavior.” Accordingly, any purported improvement flows as a direct consequence to the recited judicial exception itself. Per MPEP 2106.05(a), “it is important to keep in mind that an improvement in the abstract idea itself … is not an improvement in technology”. The reduction of scenarios to evaluate within the monitoring system is effectively reduced as a consequence of the observations and judgements that can be provided by a human being, as mental processes. The inclusion of generic computing components to enable this task are not enough to demonstrate an improvement to technology. There are no limitations in the claim which reflect improvements of the way the reinforcement learning agent operates in the given environment and likewise there are no limitations in the claim which reflect improvements of the way the monitoring system effectively functions. By choosing to reduce the data observed (as a mental process), the compute resources needed are likewise reduced. The inventive concept MUST be furnished by one or more additional elements in the claims. The additional elements in the claims include: executing a reinforcement learning agent to attempt to evade a plurality of scenarios of a monitoring system which is simply using a generic computing component specified at a high level of generality (reinforcement learning agent) to perform an existing process of attempting to not get caught in a monitoring system. This tasks exists already such as in scenarios of people attempting to avoid being caught when performing fraudulent transactions. The use of the reinforcement learning agent is simply an automated tool by which to generate such data under a simulated environment in order to provide information to be assessed by the claimed mental processes. a monitoring system that monitors a transaction system / execute the monitoring system appears to be merely the recitation of a generic computer used as a tool as an assistive aid to enable observations that are performed by a human being. Likewise, automatically doing a task is just the utilization of generic computing components to automate a task. And furthermore, automatically…signaling the monitoring system would just be the recitation of using a generic computer to perform insignificant extra solution activity of transmitting and receiving data over a network, which has been found by the courts to be well-understood, routine, and conventional activity when claimed in a merely generic manner. Of particular note, per MPEP 2106.05(f), “”claiming the improved speed or efficiency inherent with applying the abstract idea on a computer" does not integrate a judicial exception into a practical application or provide an inventive concept.”.
Applicant argues that the claims contain an inventive concept beyond any alleged abstract idea and further points out that consideration of the elements in combination is particularly important because even if an additional element does not amount to significantly more on its own, it can still amount to significantly more when considered in combination with other elements. Applicant argues that the combination of elements presented in the independent claims is not well-understood, routine, or conventional and alleges that the Office failed to consider the ordered combination of the claim steps.
Examiner disagrees. When looking at the claim as a whole and with the additional elements as an ordered combination, the claim appears to be using generic computing components recited at a high level of generality and functioning in their normal capacity in a specified technological environment of transaction monitoring to enable a task that can be performed in the human mind. Merely using a reinforcement learning agent (as a generic computing component) to generate data that could otherwise be generated in an alternative real-life process and using a generic computer as a monitoring system to execute functionality automatically would not render the claim significantly more than the recited judicial exception because such limitations are merely including instructions to implement an abstract idea on a computer or using a computer as a tool to perform an abstract idea. Transmitting data using the computer as a signal likewise offers no inventive concept that would provide significantly more to the claim and is merely insignificant extra solution activity that has been found by the courts as being a well understood, routine, and conventional computer function when claimed in a merely generic manner such as in the instant claims. The claim further amounts to limit the judicial exception to a particular technological environment of transaction monitoring which does not impose meaningful limits on the claim that would render the claim significantly more than the judicial exception which encompasses the inventive concept. Under step 2B, the MPEP requires Does the claim recite additional elements that amount to significantly more than the judicial exception? Examiners should answer this question by first identifying whether there are any additional elements (features/limitations/steps) recited in the claim beyond the judicial exception(s), and then evaluating those additional elements individually and in combination to determine whether they contribute an inventive concept (i.e., amount to significantly more than the judicial exception(s)). As stated in this action, the additional elements have been evaluated individually and in combination but their presences does not contribute meaningfully to the inventive concept which is furnished entirely be the mental process itself.
Nonetheless, the applicant has amended the claims in response to the previously set forth rejection under 35 U.S.C. § 101 and argues that the rejections are moot in light of the amendments.
The examiner has evaluated the amended claims and concluded that the inclusion of execute the monitoring system to generate and automatically…by signaling the monitoring system to discontinue evaluating actions with the first scenario does not integrate the abstract idea into a practical application, nor impose meaningful limits on the claims. These additions are merely the invocation of generic computers to enable the performance of a mental process, along with the incorporation of well understood, routine, and conventional computer activities that do not impose meaningful limits on the claims. Accordingly, for reasons stated in this response, in conjunction with the updated rejection of this office action, the claims remain rejected under 35 U.S.C. § 101.
Rejections under 35 U.S.C. § 103
Applicant states that no art-based rejections were applied to dependent claims 14 or 18.
Examiner respectfully disagrees. Claim 14 is rejected under the grounds of Wachi in view of Kalusivalingam as presented on page 32, wherein the rejection is given on pages 38-39. Examiner acknowledges an inadvertent omission of stating claim 14 is rejected under that grounds in the header of the action; however, the rejection is clearly present under the heading. Page 46 presents a grounds of rejection under 35 U.S.C. § 103 over Wachi in view of Kalusivalingam and Pandya for Claim 18. The rejection is given on page 54. Accordingly, both dependent claims were rejected with prior art under 35 U.S.C. § 103.
Applicant has amended the claims to incorporate the limitation wherein the monitoring system monitors a transaction system which was previously present in originally filed dependent claim 14. Applicant argues that the independent claims are now allowable over the prior art because the prior art of record allegedly does not disclose the claimed limitation.
Examiner disagrees. This limitation is disclosed by Kalusivalingam, as rejected over the originally-filed dependent claim 14 and therefore, the inclusion of the limitation in the independent claim is likewise rejected under this same grounds of rejection.
Applicant argues that the rejections under 35 U.S.C. § 103 are improper and that several limitations are not taught by the prior art of record.
Examiner respectfully disagrees.
Applicant argues that recording alerts is not taught because Wachi discloses storing experiences of failures of a player agent, wherein Wachi’s failures include collisions, accidents, or traffic violations. Applicant asserts that none of these are an alert because an alert is supposedly a detection state of a scenario in the monitoring system.
Examiner disagrees that the limitation is not disclosed by Wachi. Under broadest reasonable interpretation, an experience can act as an alert, serving as a signal that prompts awareness or action. (See also Wachi ¶29). A failure may be induced/triggered by an adversarial agent causing a collision failure scenario or the like with the player agent. Accordingly, by recording the experience of failure of the player agent, the indication that a failure took place is the alert itself.
Applicant argues attempting to evade scenarios is not taught because Wachi describes adversarial agents that act to cause a player agent to fail in a simulation. Applicant further argues that the claim limitation RL agent attempting to evade … indicates that the agent is attempting to avoid an interaction.
Examiner disagrees that the limitation is not disclosed by Wachi. In ¶31 of Wachi, an adversarial agent may receive a personal reward if it does not collide with the player agent or other agents. Therefore, the adversarial agent would avoid such interaction (evading collision that would cause a failure) to obtain the personal reward, and accordingly Wachi discloses an RL agent evading such scenarios.
Applicant argues that identifying the first scenario to be redundant based on the extent of overlap is not disclosed by Wachi because Wachi discloses failure experiences as similar to prior experiences in order to suppress or reduce adversarial rewards and to promote diversity in training data for adversarial agents. Applicant argues this concept is distinct from identifying an entire scenario of a monitoring system as redundant because Wachi’s redundancy determination is directed to training-data diversity for adversarial scenario generation and not detecting duplicative monitoring scenarios in an operational monitoring system.
Examiner disagrees. There are no limitations in the claims that make the distinction asserted by the applicant abundantly clear. As stated in this response, failure experiences can be broadly interpreted as alerts, or indicators that prompt awareness. The failure experiences of Wachi are compared to identify similarity, which would be indicative of overlapping conditions, features, or the like. (See Wachi ¶21). The similarity is evaluated against a threshold (See Wachi ¶46) to quantify the extent of overlap. Some failure scenarios may be identified as trivial or obvious (See Wachi ¶18). Under broadest reasonable interpretation, the word redundant encompasses something unnecessary, superfluous, excessing or involving repetition. An obvious variant of a scenario or a scenario with trivial differences would indicate redundancy per this interpretation, as no distinguishing features would be present. Accordingly, Wachi discloses identifying a first scenario to be redundant based on an extent of overlap.
Applicant argues that decommissioning scenarios is not taught because decommissioning something calls for taking that something out of service or otherwise disabling it in the relevant system. The applicant argues that Wachi does not decommission anything and rather adjusts training incentives such as by assigning zero or low adversarial rewards to similar failure experiences so that such experiences are not favored for adversarial agents. Applicant further notes that the examiner’s assertion of providing no reward for using something so at to cause it not to be used cannot be reasonably the same as decommissioning…in the monitoring system.
Examiner disagrees. Wachi alone is not relied upon disclose the monitoring system of the claims. Wachi is relied on to disclose the decommissioning of scenarios in a simulation and the teachings of Wachi are applied to the monitoring system of Kalusivalingam. Under broadest reasonable interpretation, decommissioning encompasses neutralizing the effect by which something has. By assigning zero valued rewards for adversarial agent’s experiences in scenarios per Wachi, the scenario is effectively rendered to have a neutral effect and thereby considered decommissioned. Kalusivalingam is relied upon to disclose the monitoring system. Kalusivalingam suggests the integration of reinforcement learning and real-time stream processing as a cutting edge approach to handle complex decision making and large scale data processing. By incorporating the reinforcement learning system of Wachi into a different use case of transaction monitoring, as disclosed by Kalusivalingam, one would arrive at the claimed invention, as discussed in the previous action. Accordingly, the limitation as claimed is sufficiently disclosed by the prior art of record, and a prima facie case of obviousness exists for making such combination.
Accordingly, the rejections to previously-presented claims are proper. However, the applicant’s amendments to the claims modified the scope of the claimed invention such that further search and consideration was required. Upon further search, a new grounds of rejection has been set forth as stated in this action that fully discloses the claims with amended matter and newly-added claim. As such, the Applicant’s arguments with respect to the rejections of the claims under 35 U.S.C. § 103 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
The claims remain rejected under 35 U.S.C. § 103 as stated herein this action.
Claim Objections
Claim 1 objected to because of the following informalities:
Claim 1 recites “execute the monitoring system…” which should instead be written as “executing the monitoring system…” for grammatical correctness. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 17 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 17 recites on line 5 “overlapping alerts to overall alerts for each of the first scenario…”. It is unclear what “each of” of a singular first scenario would be referring to. For purposes of this examination, Examiner has interpreted the inclusion of the phrase “each of” a typographical mistake made during the amendments to the claims which should instead read “overlapping alerts to overall alerts of the first scenario…”.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-13 and 15-21 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The following section follows the 2019 Patent Eligibility Guidance (PEG) for analyzing subject matter eligibility:
Step 1 - Statutory Category:
Step 1 of the PEG analysis entails considering whether the claimed subject matter falls within the four statutory categories of patentable subject matter identified by 35 U.S.C. 101 (process, machine, manufacture, or composition of matter).
Step 2A Prong 1 - Judicial exception:
In Step 2A Prong 1, examiners evaluate whether the claim recites a judicial exception (an abstract idea, law of nature, or a natural phenomenon).
Step 2a Prong 2 - Integration into a practical application:
If claims recite a judicial exception, the claim requires further analysis in Step 2A Prong 2. In Step 2A Prong 2, examiners evaluate whether the claim as a whole integrates the exception into a practical application.
Step 2B - Significantly More:
If the additional elements identified in Step 2A Prong 2 do not integrate the exception into a practical application, then the claim is directed to the recited judicial exception and requires further analysis under Step 2B- Significantly More.
As noted in the MPEP 2106.05(II): The identification of the additional element(s) in the claim from Step 2A Prong 2, as well as the conclusions from Step 2A Prong 2 on the considerations discussed in MPEP 2106.05(a) -(c), (e), (f), and (h) are to be carried over. Claim limitations identified as Insignificant Extra-Solution Activities are further evaluated to determine if the elements are beyond what is well -understood, routine, and conventional (WURC) activity, as dictated by MPEP 2106.05(II).
Independent Claims:
Claim 1:
Step 1: Claim 1 and its dependent claims 2-7 and 21 are directed to a method which falls within one of the four statutory categories of a process.
Step 2A Prong 1: Claim 1 recites a judicial exception, noted in bold:
generate alerts triggered by the reinforcement learning agent attempting to evade the plurality of scenarios; The claim limitation can be reasonably read to entail observing and and making a judgement of alerts triggered by the reinforcement learning agent attempting to evade scenarios. This task can be performed within the human mind or using a pen and paper as an assistive physical aid, such as using pen and paper to write alert information acquired from the observations. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
determining an extent of overlap between first alerts of a first scenario of the monitoring system and second alerts of a second scenario of the monitoring system; The claim limitation can be reasonably read to entail
evaluating first alerts and second alerts against one another to make a judgment as to how much the alerts overlap. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
identifying the first scenario to be redundant based on the extent of overlap; The claim limitation can be reasonably read to entail making a judgment as to if the first scenario is redundant according to the evaluation of the overlap. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
Examiner notes that the method is noted to be a computer-implemented method. Despite the note in the specification [0020] that no action described or claimed herein is performed in the human mind, the courts do not distinguish between a mental process performed by humans and a mental process performed on a computer. Therefore, the claim recites a judicial exception.
Step 2A Prong 2: Additional elements were identified and are noted in italics.
executing a reinforcement learning agent to attempt to evade a plurality of scenarios of a monitoring system that monitors a transaction system;- This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation invokes the use of a reinforcement learning agent as a computing tool functioning in its normal capacity to perform an existing process.
execute the monitoring system to – This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) for invoking the use of generic computing components to perform an existing process
automatically decommissioning the first scenario in the monitoring system by signaling the monitoring system to discontinue evaluating actions with the first scenario. – This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation amounts to the invocation of generic computing components to perform a task automatically, wherein the task of signaling is the recitation of Insignificant Extra Solution Activity (MPEP 2106.05(g)) of receiving and transmitting data over a network.
The courts have found that merely including instructions to implement an abstract idea on a computer or merely reciting the words “apply it” or equivalent (Mere Instructions to Apply an Exception (MPEP 2106.05(f))) does not integrate the judicial exception into a practical application. Further, the courts have found that appending insignificant extra solution activity to the judicial exception does not integrate the judicial exception into a practical application.
When viewed independently and within the claim as a whole, the additional elements do not appear to integrate the judicial exception into a practical application.
Step 2B: As discussed in Step 2A Prong 2, automatically decommissioning the first scenario in the monitoring system by signaling the monitoring system to discontinue evaluating actions with the first scenario was identified as being the recitation of Insignificant Extra Solution Activity (MPEP 2106.05(g)) of sending/receiving data over a network. The courts have found that this computer functionality is well understood, routine, and conventional activity when claimed in a merely generic manner such as in the claims that would not provide an inventive concept or significantly more to the recited judicial exception. The courts have found the Additional elements identified otherwise and conclusions from Step 2A Prong 2 are carried over for evaluating if the claim, as a whole, amounts to an inventive concept that is significantly more than the judicial exception:
Other additional elements were identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)), as stated previously. The courts have found that merely using a computer as a tool to perform a mental process and reciting the words “apply it” with regard to the judicial exception does not qualify the limitations as “significantly more” than the recited judicial exception.
With the additional elements viewed independently and as part of the ordered combination, the claim as a whole does not appear to amount to significantly more than the recited judicial exception because the claim is using generic computing components recited at a high level of generality and functioning in their normal capacity to enable the performance of a task that can practically be performed within the human mind or using pen and paper as an assistive physical aid. Therefore, the claim does not include additional elements, alone or in combination that are sufficient to amount to significantly more than the recited judicial exception.
Conclusion: Based on this rationale, the claim has been deemed to be ineligible subject matter under 35 U.S.C. 101.
Claim 8:
Step 1: Claim 8 and its dependent claims 9-14 are directed to a system which falls within one of the four statutory categories of a machine.
Step 2A Prong 1: Claim 8 recites a judicial exception, noted in bold:
record alerts triggered for a plurality of scenarios of a monitoring system by a reinforcement learning agent attempting to evade the scenarios, wherein the monitoring system monitors a transaction system The claim limitation can be reasonably read to entail observing and keeping a record of alerts triggered by the reinforcement learning agent attempting to evade scenarios. This task can be performed within the human mind or using a pen and paper as an assistive physical aid, such as using pen and paper to document the alert information acquired from the observations. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
determine an extent of overlap between first alerts of a first scenario of the monitoring system and second alerts of a second scenario of the monitoring system; The claim limitation can be reasonably read to entail
evaluating first alerts and second alerts against one another to make a judgment as to how much the alerts overlap. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
identify the first scenario to be redundant based on the extent of overlap; and The claim limitation can be reasonably read to entail making a judgment as to if the first scenario is redundant according to the evaluation of the overlap. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
Despite the note in the specification [0020] that no action described or claimed herein is performed in the human mind, the courts do not distinguish between a mental process performed by humans and a mental process performed on a computer. Therefore, the claim recites a judicial exception.
Step 2A Prong 2: Additional elements were identified and are noted in italics.
a processor;- This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation invokes the use of a generic computing component as a tool to perform an existing process.
a memory operably connected to the processor; - This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation invokes the use of a generic computing component as a tool to perform an existing process.
a non-transitory computer-readable medium operably connected to the processor and memory and storing computer-executable instructions that when executed by at least the processor of the computing system cause the computing system to: - This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation invokes the use of a reinforcement learning agent as a computing tool functioning in its normal capacity to perform an existing process.
automatically decommission the first scenario in the monitoring system by signaling the monitoring system to discontinue evaluating actions with the first scenario. – This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation amounts to the invocation of generic computing components to perform a task automatically, wherein the task of signaling is the recitation of Insignificant Extra Solution Activity (MPEP 2106.05(g)) of receiving and transmitting data over a network.
The courts have found that merely including instructions to implement an abstract idea on a computer or merely reciting the words “apply it” or equivalent (Mere Instructions to Apply an Exception (MPEP 2106.05(f))) does not integrate the judicial exception into a practical application. Further, the courts have found that appending insignificant extra solution activity to the judicial exception does not integrate the judicial exception into a practical application.
When viewed independently and within the claim as a whole, the additional elements do not appear to integrate the judicial exception into a practical application.
Step 2B: As discussed in Step 2A Prong 2, automatically decommission the first scenario in the monitoring system by signaling the monitoring system to discontinue evaluating actions with the first scenario was identified as being the recitation of Insignificant Extra Solution Activity (MPEP 2106.05(g)) of sending/receiving data over a network. The courts have found that this computer functionality is well understood, routine, and conventional activity when claimed in a merely generic manner such as in the claims that would not provide an inventive concept or significantly more to the recited judicial exception. The courts have found the Additional elements identified otherwise and conclusions from Step 2A Prong 2 are carried over for evaluating if the claim, as a whole, amounts to an inventive concept that is significantly more than the judicial exception:
Other additional elements were identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)), as stated previously. The courts have found that merely using a computer as a tool to perform a mental process and reciting the words “apply it” with regard to the judicial exception does not qualify the limitations as “significantly more” than the recited judicial exception.
With the additional elements viewed independently and as part of the ordered combination, the claim as a whole does not appear to amount to significantly more than the recited judicial exception because the claim is using generic computing components recited at a high level of generality and functioning in their normal capacity to enable the performance of a task that can practically be performed within the human mind or using pen and paper as an assistive physical aid. Therefore, the claim does not include additional elements, alone or in combination that are sufficient to amount to significantly more than the recited judicial exception.
Conclusion: Based on this rationale, the claim has been deemed to be ineligible subject matter under 35 U.S.C. 101.
Claim 15:
Step 1: Claim 15 and its dependent claims 16-20 are directed to a non-transitory computer-readable medium which falls within one of the four statutory categories of a manufacture.
Step 2A Prong 1: Claim 15 recites a judicial exception, noted in bold:
record alerts triggered for a plurality of scenarios of a monitoring system by a reinforcement learning agent attempting to evade the scenarios, wherein the monitoring system monitors a transaction system; The claim limitation can be reasonably read to entail observing and keeping a record of alerts triggered by the reinforcement learning agent attempting to evade scenarios. This task can be performed within the human mind or using a pen and paper as an assistive physical aid, such as using pen and paper to document the alert information acquired from the observations. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
determine an extent of overlap between first alerts of a first scenario of the monitoring system second alerts of a second scenario alerts of second scenario of the monitoring system; The claim limitation can be reasonably read to entail a plurality of alerts of multiple scenarios against one another to make a judgment as to how much the alerts overlap. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
identify one or more of the multiple scenarios to be redundant based on the extent of overlap; and The claim limitation can be reasonably read to entail making a judgment as to if a scenario is redundant according to the evaluation of the overlap. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
Despite the note in the specification [0020] that no action described or claimed herein is performed in the human mind, the courts do not distinguish between a mental process performed by humans and a mental process performed on a computer. Therefore, the claim recites a judicial exception.
Step 2A Prong 2: Additional elements were identified and are noted in italics.
automatically decommission the first scenario in the monitoring system by signaling the monitoring system to discontinue evaluating actions with the first scenario. – This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation amounts to the invocation of generic computing components to perform a task automatically, wherein the task of signaling is the recitation of Insignificant Extra Solution Activity (MPEP 2106.05(g)) of receiving and transmitting data over a network.
The courts have found that merely including instructions to implement an abstract idea on a computer or merely reciting the words “apply it” or equivalent (Mere Instructions to Apply an Exception (MPEP 2106.05(f))) does not integrate the judicial exception into a practical application. Further, the courts have found that appending insignificant extra solution activity to the judicial exception does not integrate the judicial exception into a practical application.
When viewed independently and within the claim as a whole, the additional elements do not appear to integrate the judicial exception into a practical application.
Step 2B: As discussed in Step 2A Prong 2, automatically decommission the first scenario in the monitoring system by signaling the monitoring system to discontinue evaluating actions with the first scenario was identified as being the recitation of Insignificant Extra Solution Activity (MPEP 2106.05(g)) of sending/receiving data over a network. The courts have found that this computer functionality is well understood, routine, and conventional activity when claimed in a merely generic manner such as in the claims that would not provide an inventive concept or significantly more to the recited judicial exception. The courts have found the Additional elements identified otherwise and conclusions from Step 2A Prong 2 are carried over for evaluating if the claim, as a whole, amounts to an inventive concept that is significantly more than the judicial exception:
The additional elements were identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)), as stated previously. The courts have found that merely using a computer as a tool to perform a mental process and reciting the words “apply it” with regard to the judicial exception does not qualify the limitations as “significantly more” than the recited judicial exception.
With the additional elements viewed independently and as part of the ordered combination, the claim as a whole does not appear to amount to significantly more than the recited judicial exception because the claim is using generic computing components recited at a high level of generality and functioning in their normal capacity to enable the performance of a task that can practically be performed within the human mind or using pen and paper as an assistive physical aid. Therefore, the claim does not include additional elements, alone or in combination that are sufficient to amount to significantly more than the recited judicial exception.
Conclusion: Based on this rationale, the claim has been deemed to be ineligible subject matter under 35 U.S.C. 101.
Dependent Claims:
Examiner notes limitations identified as judicial exceptions are indicated in italicized bold and limitations identified as additional elements are indicated using italics.
Claim 2
Step 1: Regarding dependent claim 2, the judicial exception of independent claim 1 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 2 additionally recites the wherein the determining the extent of overlap further comprises counting a number of times that one of the first alerts occurs at a time step in which one of the second alerts occurs, which can reasonably be read to entail observing the number of times one of the first alerts occurs at a step in which the second alerts occurs. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process. Furthermore, this claim limitation includes the mathematical calculation of counting which is an addition of numbers. Therefore, this claim limitation additionally includes the recitation of the judicial exception of abstract ideas as a mathematical concept.
Step 2A Prong 2 & Step 2B: Claim 2 does not recite any additional elements that would integrate the judicial exception into a practical application nor amount to significantly more than the judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 3
Step 1: Regarding dependent claim 3, the judicial exception of independent claim 1 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 3 additionally recites the determining that the first scenario is weaker than the second scenario based on a comparison of a first ratio of overlapping alerts to overall alerts for the first scenario to a second ratio of overlapping alerts to overall alerts of the second scenario; and, which can reasonably be read to entail evaluating and comparing two ratios of overlapping alerts. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process. Furthermore, because this limitation includes the recitation of comparing ratios, this claim additionally includes the recitation of mathematical relationships. Therefore, this claim limitation additionally includes the recitation of the judicial exception of abstract ideas as a mathematical concept. Claim 3 further recites the limitation selecting the first scenario for decommissioning based on the determination that the first scenario is weaker than the second scenario which can be reasonably red to entail using the insights to make a judgement (selecting) for the decommissioning of the first scenario. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
Step 2A Prong 2 & Step 2B: Claim 3 does not recite any additional elements that would integrate the judicial exception into a practical application nor amount to significantly more than the judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 4
Step 1: Regarding dependent claim 4, the judicial exception of independent claim 1 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 4 does not include any additional recitations of judicial exceptions.
Step 2A Prong 2: Claim 4 additionally recites the limitation further comprising operating the reinforcement learning agent in a simulation of a monitored system that is monitored by the monitoring system, wherein the reinforcement learning agent attempts to evade the scenarios in the simulation. This limitation has been identified as Field of Use and Technological Environment (MPEP 2106.05(h)) because it generally links the use of the judicial exception to the particular technological environment of a simulation of a monitored system. The limitation has further been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation further invokes the use of generic computing components as a simulation of a monitoring system as a tool to perform an existing task. The courts have ruled that generally linking the use of a judicial exception to a particular technological environment and invoking generic computing components to perform existing tasks in conjunction with the judicial exception does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to generally linking the use of the judicial exception to a particular technological environment and merely invoking the use of computers as tool to perform existing functionality are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 5
Step 1: Regarding dependent claim 5, the judicial exception of independent claim 1 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 5 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 5 additionally recites the limitation displaying a recommendation to decommission the first scenario in a user interface;, the limitation presenting user-selectable elements to accept the decommissioning of the first scenario in the user interface; and and the limitation accepting a user selection of an element of the user-selectable elements to accept the decommissioning of the first scenario through the user interface. These three limitations have been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitations invoke the use of computers functioning in their normal capacity to perform existing processes such as displaying data in a user interface, presenting user-selectable elements in a user interface, and acquiring data from a user interface. The limitation wherein the decommissioning the first scenario in the monitoring system is performed in response to the user selection has also been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) but because the limitation amounts to the recitation of the words “apply it”. Specifically, the limitation recites the idea of an outcome but fails to recite details of how a solution to a problem is accomplished. The courts have ruled using a computer as a tool to perform an existing process and merely reciting the words “apply it” does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to using a computer as a tool to perform an existing process and merely reciting the words “apply it” are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 6
Step 1: Regarding dependent claim 6, the judicial exception of independent claim 1 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 6 additionally recites generating information about an effect of decommissioning the first scenario; and which can be reasonably read to entail observing the effect of decommissioning the first scenario and forming an opinion as information. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
Step 2A Prong 2: Claim 6 additionally recites the limitation presenting the information about the effect of decommissioning in the user interface. This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation merely invokes the use of computers functioning in their normal capacity to display data to a user interface. The courts have ruled that using computers as a tool to perform an existing process does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to using a computer as a tool to perform an existing process are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 7
Step 1: Regarding dependent claim 7, the judicial exception of independent claim 1 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 7 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 7 additionally recites the limitation wherein the decommissioning the first scenario in the monitoring system further comprises, in response to the identifying the first scenario to be redundant, automatically instructing the monitoring system to discontinue analyzing actions in a monitored system to determine whether the actions trigger the first scenario. This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation merely recites “apply it” by providing the idea of a solution or outcome without particularly providing the details on how the result is accomplished and no description of the mechanism for accomplishing the result. The courts have ruled merely reciting the words “apply it” does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to reciting the words “apply it” are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 9
Step 1: Regarding dependent claim 9, the judicial exception of independent claim 8 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 9 additionally recites the wherein the instructions to determine an extent of overlap further cause the computing system to count a number of times that one of the first alerts occurs in a time range in which one of the second alerts occurs, which can reasonably be read to entail observing the number of times one of the first alerts occurs in a time range in which the second alerts occurs. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process. Furthermore, this claim limitation includes the mathematical calculation of counting which is an addition of numbers. Therefore, this claim limitation additionally includes the recitation of the judicial exception of abstract ideas as a mathematical concept.
Step 2A Prong 2 & Step 2B: Claim 9 does not recite any additional elements that would integrate the judicial exception into a practical application nor amount to significantly more.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 10
Step 1: Regarding dependent claim 10, the judicial exception of independent claim 8 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 10 additionally recites the determine that the first scenario is weaker than the second scenario based on a comparison of a first ratio of overlapping alerts to overall alerts for the first scenario to a second ratio of overlapping alerts to overall alerts of the second scenario; and which can reasonably be read to entail evaluating and comparing two ratios of overlapping alerts. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process. Furthermore, because this limitation includes the recitation of comparing ratios, this claim additionally includes the recitation of mathematical relationships. Therefore, this claim limitation additionally includes the recitation of the judicial exception of abstract ideas as a mathematical concept. Claim 10 further recites the limitation select the first scenario for decommissioning based on the determination that the first scenario is weaker than the second scenario which can be reasonably red to entail using the insights to make a judgement (selecting) for the decommissioning of the first scenario. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
Step 2A Prong 2: Claim 10 does not recite any additional elements that would integrate the judicial exception into a practical application nor amount to significantly more than the judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 11
Step 1: Regarding dependent claim 11, the judicial exception of independent claim 8 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 11 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 11 additionally recites the limitation wherein the instructions further cause the computing system to operate the reinforcement learning agent in a simulation of a monitored system that is monitored by the monitoring system, wherein the reinforcement learning agent attempts to evade the scenarios in the simulation. This limitation has been identified as Field of Use and Technological Environment (MPEP 2106.05(h)) because it generally links the use of the judicial exception to the particular technological environment of a simulation of a monitored system. The limitation has further been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation further invokes the use of generic computing components as a simulation of a monitoring system as a tool to perform an existing task. The courts have ruled that generally linking the use of a judicial exception to a particular technological environment and invoking generic computing components to perform existing tasks in conjunction with the judicial exception does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to generally linking the use of the judicial exception to a particular technological environment and merely invoking the use of computers as tool to perform existing functionality are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 12
Step 1: Regarding dependent claim 12, the judicial exception of independent claim 8 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 12 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 12 additionally recites the limitation display a recommendation to decommission the first scenario in a user interface; the limitation present a user-selectable element to accept the decommissioning of the first scenario in the user interface; and and the limitation accept a user selection of the element to accept the decommissioning of the first scenario through the user interface,. These three limitations have been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitations invoke the use of computers functioning in their normal capacity to perform existing processes such as displaying data in a user interface, presenting user-selectable elements in a user interface, and acquiring data from a user interface. The limitation wherein the decommissioning the first scenario in the monitoring system is performed in response to the user selection has also been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) but because the limitation amounts to the recitation of the words “apply it”. Specifically, the limitation recites the idea of an outcome but fails to recite details of how a solution to a problem is accomplished. The courts have ruled using a computer as a tool to perform an existing process and merely reciting the words “apply it” does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to using a computer as a tool to perform an existing process and merely reciting the words “apply it” are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 13
Step 1: Regarding dependent claim 13, the judicial exception of independent claim 8 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 13 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 13 additionally recites the limitation wherein the instructions to decommission the first scenario in the monitoring system further cause the computing system to, in response to the identifying the first scenario to be redundant, automatically instruct the monitoring system to discontinue analyzing actions in a monitored system to determine whether the actions trigger the first scenario. This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation merely recites “apply it” by providing the idea of a solution or outcome without particularly providing the details on how the result is accomplished and no description of the mechanism for accomplishing the result. The courts have ruled merely reciting the words “apply it” does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to reciting the words “apply it” are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 16
Step 1: Regarding dependent claim 16, the judicial exception of independent claim 15 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 16 additionally recites the wherein the instructions to determine an extent of overlap further cause the computer to count a number of times that one of the first alerts occur in a time range in which one of the second alerts occurs which can reasonably be read to entail observing the number of times one of the first alerts occurs at a step in which the second alerts occurs. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process. Furthermore, this claim limitation includes the mathematical calculation of counting which is an addition of numbers. Therefore, this claim limitation additionally includes the recitation of the judicial exception of abstract ideas as a mathematical concept.
Step 2A Prong 2 & Step 2B: Claim 16 does not recite any additional elements that would integrate the judicial exception into a practical application nor amount to significantly more.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 17
Step 1: Regarding dependent claim 17, the judicial exception of independent claim 15 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 17 additionally recites the determine that the first scenario is weaker than the second scenario based on a comparison of a ratio of overlapping alerts to overall alerts for each of the first scenario to a ratio of overlapping alerts to overall alerts of the second scenario; and which can reasonably be read to entail evaluating and comparing two ratios of overlapping alerts. This task can be performed within the human mind or using a pen and paper as an assistive physical aid. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process. Furthermore, because this limitation includes the recitation of comparing ratios, this claim additionally includes the recitation of mathematical relationships. Therefore, this claim limitation additionally includes the recitation of the judicial exception of abstract ideas as a mathematical concept. Claim 17 further recites the limitation select the first scenario for decommissioning based on the determination that the first scenario is weaker than the second scenario. which can be reasonably red to entail using the insights to make a judgement (selecting) for the decommissioning of the first scenario. Therefore, this claim limitation includes the recitation of the judicial exception of abstract ideas of a mental process.
Step 2A Prong 2 & Step 2B: Claim 17 does not recite any additional elements that would integrate the judicial exception into a practical application nor amount to significantly more than the judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 18
Step 1: Regarding dependent claim 18, the judicial exception of independent claim 15 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 18 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 18 additionally recites the limitation wherein the instructions further cause the computer to operate the reinforcement learning agent in a simulation of a monitored system, wherein the reinforcement learning agent attempts to evade the scenarios in the simulation. This limitation has been identified as Field of Use and Technological Environment (MPEP 2106.05(h)) because it generally links the use of the judicial exception to the particular technological environment of a simulation of a monitored system. The limitation has further been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation further invokes the use of generic computing components as a simulation of a monitoring system as a tool to perform an existing task. The courts have ruled that generally linking the use of a judicial exception to a particular technological environment and invoking generic computing components to perform existing tasks in conjunction with the judicial exception does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to generally linking the use of the judicial exception to a particular technological environment and merely invoking the use of computers as tool to perform existing functionality are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 19
Step 1: Regarding dependent claim 19, the judicial exception of independent claim 15 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 19 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 19 additionally recites the limitation display a recommendation to decommission first scenario in a user interface;, the limitation present a user-selectable element to accept the decommissioning of the first scenario in the user interface; and and the limitation accept a user selection of the element to accept the decommissioning the first scenario through the user interface,. These three limitations have been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitations invoke the use of computers functioning in their normal capacity to perform existing processes such as displaying data in a user interface, presenting user-selectable elements in a user interface, and acquiring data from a user interface. The limitation wherein the decommissioning the first scenario in the monitoring system is performed in response to the user selection has also been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) but because the limitation amounts to the recitation of the words “apply it”. Specifically, the limitation recites the idea of an outcome but fails to recite details of how a solution to a problem is accomplished. The courts have ruled using a computer as a tool to perform an existing process and merely reciting the words “apply it” does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to using a computer as a tool to perform an existing process and merely reciting the words “apply it” are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 20
Step 1: Regarding dependent claim 20, the judicial exception of independent claim 15 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 20 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 20 additionally recites the limitation wherein the instructions to decommission the first scenario in the monitoring system further cause the computer to, in response to the identifying the first scenario to be redundant, automatically instruct the monitoring system to discontinue analyzing actions in a monitored system to determine whether the actions trigger the first scenario, wherein the monitoring system produces no further alerts under the first scenario following execution of the instruction. This limitation has been identified as Mere Instructions to Apply an Exception (MPEP 2106.05(f)) because the limitation merely recites “apply it” by providing the idea of a solution or outcome without particularly providing the details on how the result is accomplished and no description of the mechanism for accomplishing the result. The courts have ruled merely reciting the words “apply it” does not integrate the judicial exception into a practical application. With the additional element viewed in conjunction with the other limitations, the claim as a whole does not appear to integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to reciting the words “apply it” are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim 21
Step 1: Regarding dependent claim 21, the judicial exception of independent claim 1 is further incorporated. The claim falls within the corresponding statutory category as stated previously.
Step 2A Prong 1: Claim 21 does not recite any additional judicial exceptions.
Step 2A Prong 2: Claim 21 additionally recites the limitation wherein the scenarios are models or deterministic rules that detect a form of activity that is not permitted by the monitoring system. This claim has been identified as Field of Use and Technological Environment (MPEP 2106.05(h)) for generally linking the judicial exception to a particular technological environment or field of use. The courts have ruled that generally linking the judicial exception to a particular technological environment or field of use does not integrate the judicial exception into a practical application.
Step 2B: The courts have found that limitations that amount to generally linking the use of the judicial exception to a particular technological environment and field of use are not enough to qualify the claim as significantly more than the abstract idea. Therefore, the claim does not include additional elements, alone or in the ordered combination that are sufficient to amount to significantly more than the recited judicial exception.
This claim is not eligible subject matter under 35 U.S.C. 101.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-5, 7-13, and 15-21 are rejected under 35 U.S.C. 103 as being unpatentable over Avner et al (US 11,314,572 B1), hereinafter referred to as Avner, in view of Mead et al (Mead, A., Lewris, T., Prasanth, S., Adams, S., Alonzi, P., and Beling, P., “Detecting Fraud in Adversarial Environments: A Reinforcement Learning Approach”, 2018, 2018 Systems and Information Engineering Design Symposium (SIEDS), pp. 118-122), hereinafter referred to as Mead, and further in view of Kala et al (US 2021/0081948 A1), hereinafter referred to as Kala.
Regarding claim 1, Avner discloses (except the limitations surrounded by brackets ([[..]])) A computer-implemented method, comprising: The method is described as being performed by a server and likewise, features of the technique described are disclosed as being performed by a variety of computing systems ((Avner, Col 11, Lines 51-55) "In an example, one or more steps of method 500 may be performed by an alert server (e.g. , alert server 220 of FIG. 2) or lineage server ( e.g., lineage server 230 of FIG. 2). Other steps of method 500 may be performed by a storage server (e.g., storage server 240 of FIG. 2)."); ((Avner, Col 17, Lines 41-44) "The features of the techniques described herein are system-independent, meaning that the techniques may be implemented on a variety of computing systems having a variety of processors.")
[[executing a reinforcement learning agent to attempt to evade]] a plurality of scenarios of a monitoring system [[that monitors a transaction system;]]
execute the monitoring system to generate alerts [[triggered by the reinforcement learning agent attempting to evade the plurality of scenarios;]] ((Avner, Col 3, Lines 45-52) " Most enterprises monitor the operation of their computer systems and data environments to ensure system reliability and availability. This may be achieved by running various tests and/or utilizing monitoring tools that detect system and/or data issues (e.g., failures or erroneous system behavior). When a failure or erroneous behavior is detected, a mechanism is often used to alert an administrator (e.g., one or more engineering team members) to the detected issues "); ((Avner, Col 6, Lines 8-10) " The monitoring server 210 may include and/or execute a monitoring service 212, while the alert server 220 may 10 include and/or execute an alert service 222. "); ((Avner, Col 12, Lines 61-67 and Col 13, Lines 1-5) " When the new error is not identified as redundant (no at step 535), method 500 may proceed to generate an alert for the new error, at 545. This may involve, automatic creation and transmission of an alert for the new error to one or more administrators responsible for managing the dataset to which the error relates. In some implementations, the record for the error is updated to indicate that an alert has been generated and/or transmitted for the error. Additionally, and/or alternatively, an alert record may be created for the new alert in an alert data structure (e.g., log of active alerts). The alert may include data about the error and the dataset to which it relates. ")
determining an extent of overlap between first alerts of a first scenario of the monitoring system and second alerts of a second scenario of the monitoring system; ((Avner, Col 9, Lines 17-36) " When the lineage service 232 receives a request from the alert service 222 to identify dependencies for a new error, it may examine the lineage of the dataset to which the error relates and identify one or more currently active errors for upstream datasets. This may be achieved by comparing the lineage of the dataset (e.g., all other datasets on which the dataset depends) with the list of datasets having active errors, and determining if there is an overlap between those datasets. When a dataset having an active error is upstream to the dataset at issue, the new error may be identified as being redundant since it is likely caused by the same error. For example, in the environment 100 of FIG. 1, if an error relating to Dataset 5 is received, and an error relating to Dataset 1 is currently active, the error relating to Dataset 5 is identified as an upstream error and, as such, redundant. In some implementations, other information such as the type of error, the time/date it was detected, the time/date the dataset at issue was generated, and the like may also be considered in determining if the new error is redundant to an active error relating to an upstream dataset. ")
identifying the first scenario to be redundant based on the extent of overlap; and ((Avner, Col 12, Lines 24-31) " Once the upstream datasets are identified, method 500 may proceed to retrieve alert data for the upstream datasets, at 525, before determining if the new error is redundant to an existing error for which an alert has been issued, at 530. This may involve examining the list of active alerts in the system and comparing this list to the list of upstream datasets to identify upstream datasets for which one or more active alerts exists. ")
automatically [[decommissioning]] the first scenario in the monitoring system by
signaling the monitoring system to [[discontinue]] evaluating actions with the first scenario. The tests performed by the monitoring system may be initiated automatically, wherein the tests characterize erroneous behavior and different tests may be used to detect different errors that trigger alerts ((Avner, Col 6, Lines 42-47) "The monitoring and tests performed by the monitoring service 212 may be initiated automatically or by a user (e.g., an engineering team member). Different 45 monitoring tools and/or tests may be utilized for different types of datasets and/or system components to detect erroneous behaviors.").
While Avner does disclose the utilization of a monitoring system, Avner does not disclose the utilization of a reinforcement learning agent interacting with the monitoring system to avoid detection and the triggering of alerts in the monitoring system.
However, Mead discloses executing a reinforcement learning agent to attempt to evade detection that monitors a transaction system; ((Mean, Page 119, Col 2, ¶2) "In our experiments, the fraudster (agent) is trying to determine the best set of transactions (actions) to steal as much money as possible by beating the bank’s fraud classifier (environment). "). The fraud classifier is transaction-based ((Mead, Page 120, Col 1, ¶2) "This fraud classifier is fairly simple with just 3 predictors: # of low $-amount transactions, # of high $-amount transactions, and whether the action is a low or high $-amount."); ((Mead, Page 118, Col 1, ¶Abstract) "Our MDP takes on the perspective of an agent (in this case the fraudster with a stolen credit card) who interacts with an environment (merchants and a fraud classifier), by taking actions (transactions), and receiving rewards (relating to whether the transactions were successful/declined).")
Mead further discloses flagged transactions triggered by the reinforcement learning agent attempting to evade the plurality of scenarios; ((Mead, Page 118, Col 1, ¶1) "Credit card companies must walk a fine line between minimizing the number of instances where a customer’s card gets declined (false positive) and allowing fraudulent transactions (false negatives). Hence, credit card firms need to strike a balance between the volume of flagged transactions and losses due to fraud, especially as consumers expect safety and surety from their credit card company"). The reinforcement learning agent is described as performing transactions that may trigger such flags ((Mead, Page 118, Col 1, ¶Abstract) "Our MDP takes on the perspective of an agent (in this case the fraudster with a stolen credit card) who interacts with an environment (merchants and a fraud classifier), by taking actions (transactions), and receiving rewards (relating to whether the transactions were successful/declined).")
Avner is analogous to the claimed invention because it is reasonably pertinent to the problem faced by the inventor, which is reducing alert rates in monitoring systems based on redundant data. Mead is analogous to the claimed invention because it pertains to fraud monitoring in transaction systems. It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have combined the prior art references in order to arrive at the claimed invention because some teaching, suggestion, or motivation would have led one having skill in the art to do so in order to arrive at the claimed invention. Both arts focus on improvements to monitoring systems that detect either anomalous or fraudulent data, though each is directed towards a different application. Avner discloses that monitoring systems can be made more effective by reducing alerts triggered by redundant errors. Mead discloses that a reinforcement learning agent can be leveraged to simulate fraudulent behaviors without requiring the online testing of sensitive data in order to tune the sensitivity of the detection classifier thresholding rules ((Mead, Page 120, Col 2, ¶1) " To test this we took our logistic regression fraud classifier and varied the classification threshold (the value at which the model declares a transaction either fraud or not fraud), between 0 and 1 and calculated the total value associated with the optimal policy (how much money the fraudster could steal). Armed with this knowledge we found the region of classification thresholds that were sensitive to precision and recall (that is, not all false positives or all false negatives). "); ((Mead, Page 121, Col 1, ¶1) " When the classification threshold is sufficiently low, then all transactions are counted as fraud and any transactions the fraudster puts on the card are promptly declined (as are all real transactions, it should be noted). When the classification threshold is sufficiently high, all transactions are successful and it is in the fraudster’s best interest to make as many large transactions as possible. In between there is a small region where the behavior is slightly more nuanced. It is in this small region that the actual fraud classifier would operate, and these are the classification thresholds we used when varying our classifier at regular intervals to confuse the fraudster."). By combining the benefits of the alert transmission reduction as disclosed by Avner into the transaction monitoring system that classifies fraudulent behavior and optimizes the classification threshold according to the activities of a reinforcement learning agent, one having skill in the art could reasonably expect a robust and comprehensive monitoring system optimization approach for transaction fraud applications. Accordingly, the combination would have been obvious.
While Avner discloses the suppression of the transmission of alerts and the automated initialization of tests for monitoring, Avner does not explicitly disclose suppressing the generation of alerts through decommissioning of particular tests that are used to determine alertable behavior.
However, Kala discloses decommissioning fraud detection rules that are used to evaluate transaction data so as to discontinue detecting fraudulent events according to such rules. A GUI is presented for a user to be able to modify (and by deselecting, effectively decommissioning) fraud rules that dictate the detection of fraudulent activity, thereby providing a signal to the monitoring system ((Kala, ¶40) "The GUI 200 may also include a fraud rules interface 210 that may include a list of fraud parameters found to most likely correspond to fraudulent transactions. For the purposes of illustration, generic fraud parameters (e.g., Fraud Parameters 1-4) are listed in the GUI 200, but transaction parameters such as MCC, Transaction Amount, etc., may be used. In some embodiments, the GUI 200 may provide a list of selectable fraud rules 212 for each identified fraud parameter."). The fraud rules may be applied by the computer-implemented method, thereby indicating automatic application (See Kala claim 14 demonstrating a computer-implemented method, and Kala claim 18 which depends from 14 describing the fraud rule application.
Kala is analogous to the claimed invention because it is related to the same field of endeavor of the claimed invention of improving fraud detection in transaction monitoring systems. It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have modified the prior art to include the teachings of Kala because some teaching, suggestion, or motivation in the prior art would have led one having ordinary skill in the art to do so in order to arrive at the claimed invention. Avner discloses a monitoring system where alert transmission is suppressed in order to reduce unnecessary further evaluation of falsely triggered or redundant alerts. ((Avner, Col. 7, Lines 25-27) "When the response received from the lineage service 232 indicates that the error is redundant, the alert service 222 may suppress transmission of an alert for the error"). Kala discloses alternatively tuning detection rules to minimize falsely triggered fraud detections ((Kala, ¶42) "In some embodiments, the GUI 200 may also provide additional details based on percentages of false positive findings of fraudulent transactions ( e.g., known legitimate transactions identified by the test as likely fraudulent). Based on the test results, the issuer may tweak the fraud rules, acceptable risk threshold, fraud rate thresholds, or other parameters in order to improve the fraud detection rate and minimize false positive findings."). Accordingly, by incorporating the fraud rule parameter tuning disclosed by Kala as an alternative to the alert transmission suppression disclosed by Avner, one having skill in the art would one would arrive at the claimed invention and could reasonably expect the modification to achieve reduced unwanted (either redundant or false positive) detections/alerts in a monitoring environment.
Regarding claim 2, the proposed combination discloses The computer-implemented method of claim 1, as stated previously. The proposed combination in further view of Avner discloses wherein the determining the extent of overlap further comprises counting a number of times that one of the first alerts occurs at a time step in which one of the second alerts occurs. Timelines for two datasets (wherein each dataset depicts the time at which data was generated) are shown in Fig. 4, indicating that an evaluation can be done at time steps. Examples are provided for determining overlap based on the presence of errors in given data generation times, wherein the presence of an error includes counting the number of times an alert occurs (1 if occurred, 0 if not occurred) ((Avner, Col 11, Lines 19-35) “In this example, if an error relating to the first dataset occurs during the time period 412 (e.g., on Tuesday), an error relating to the second dataset occurring on Tuesday may be identified as redundant, because the second dataset is being generated on the same date as when the error in the downstream dataset (first dataset) occurs. However, when the active error for the first dataset is for time period 412, a new error relating to the second dataset which is received during or after the time period 426 may not be redundant to the active error, because both the first dataset and the second datasets were generated again subsequent to time period 412. Thus, the new error for the second dataset is likely not redundant to the active error as they relate to different time periods.”).
Regarding claim 3, the proposed combination discloses The computer-implemented method of claim 1, further comprising: as stated previously. The proposed combination in view of Kala further discloses determining that the first scenario is weaker than the second scenario based on a comparison of a first ratio of overlapping alerts to overall alerts for the first scenario to a second ratio of overlapping alerts to overall alerts of the second scenario; and Individual dependencies of alerts are evaluated for multiple datasets comprising properties with corresponding errors according to a dependency tree, which can be used to evaluate the overlap of alerts compared to overall alerts for each dataset. Datasets which are identified as being dependent on other datasets would be understood to have weaker basis. ((Avner, Col 10, Lines 27-46) " Data environment 300 includes Datasets 302, 304, 306, 308, 310 and 312. Each of the Datasets 302, 306 and 312 may include multiple different properties. For example, 30 Dataset 302 includes a property 320 and another property 322. Similarly, Dataset 306 includes a property 324 and a different property 326, while Dataset 312 includes properties 328, 330 and 332. When a dataset depends on one of the35 Datasets 302, 306 or 312, it may not depend on the entire dataset, but rather on one of their properties. For example, while Dataset 306 depends on the Dataset 302, it does not depend on the entire dataset, but only on property 322 of the Dataset 302. As a result, when a new error relating to Dataset 306 is examined, it may be prudent to determine which property the error relates to. If the error relates to property 324 and an active error exits for property 322 of Dataset 302, then the new error should result in alert suppression. However, if the active error relating to Dataset 302 is related to property 320 or if the new error of Dataset 306 relates to property 326, the alert should not be suppressed.").
PNG
media_image1.png
756
1075
media_image1.png
Greyscale
selecting the first scenario for decommissioning based on the determination that
the first scenario is weaker than the second scenario. If an error in a dataset (say dataset 306) depends on a property in another dataset (say dataset 302), the error is suppressed ((Avner, Col 10, Lines 27-46) " Data environment 300 includes Datasets 302, 304, 306, 308, 310 and 312. Each of the Datasets 302, 306 and 312 may include multiple different properties. For example, 30 Dataset 302 includes a property 320 and another property 322. Similarly, Dataset 306 includes a property 324 and a different property 326, while Dataset 312 includes properties 328, 330 and 332. When a dataset depends on one of the35 Datasets 302, 306 or 312, it may not depend on the entire dataset, but rather on one of their properties. For example, while Dataset 306 depends on the Dataset 302, it does not depend on the entire dataset, but only on property 322 of the Dataset 302. As a result, when a new error relating to Dataset 306 is examined, it may be prudent to determine which property the error relates to. If the error relates to property 324 and an active error exits for property 322 of Dataset 302, then the new error should result in alert suppression. However, if the active error relating to Dataset 302 is related to property 320 or if the new error of Dataset 306 relates to property 326, the alert should not be suppressed.").
Regarding claim 4, the proposed combination discloses The computer-implemented method of claim 1 as stated previously. The proposed combination in further view of Mead discloses further comprising operating the reinforcement learning agent in a simulation of a monitored system that is monitored by the monitoring system, wherein the reinforcement learning agent attempts to evade the scenarios in the simulation. ((Mead, Page 118, Col 2, ¶3) " This approach simulates the manner in which a fraudster learns how to beat a classifier by implementing states, actions, and rewards that resemble the risks and payoffs that fraudsters actually experience"); ((Page 118, Col 1, ¶5- Col 2, ¶1) " Our analysis is rooted primarily in reinforcement learning. In contrast to supervised and unsupervised methods, the reinforcement learning approach has no labels or clusters, but rather simulates episodes that produce strings of rewards which are used as signal for updating the model.")
It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have further modified the proposed combination to include the reinforcement learning agent operating in a simulation of a monitored system because some teaching, suggestion, or motivation in the prior at would have led one having skill in the art to do so in order to arrive at the claimed invention. Mead explicitly notes that simulating an RL agent in such an applicant enables mimicking of real world behaviors that would be experienced by the monitoring system ((Mead, Page 119, Col 2, ¶2) " Credit card fraud lends itself well to the reinforcement learning paradigm. In our experiments, the fraudster (agent) is trying to determine the best set of transactions (actions) to steal as much money as possible by beating the bank’s fraud classifier (environment). This novel approach allows us to simulate the learning process for an adversary in an environment meant to mimic the real world and closely aligned with actual fraudster incentives. ")
Regarding claim 5, the proposed combination discloses The computer-implemented method of claim 1, wherein the decommissioning the first scenario in the monitoring system further comprises: as stated previously. The proposed combination in further view of Kala discloses displaying a recommendation to decommission the first scenario in a user interface; If fraud rules fail to detect a desired percentage of fraudulent transactions, the issuer determines that the rules should be altered or replaced (and thereby decommissioning the current rule set) ((Kala, ¶14) " Accordingly, if the fraud rules created tend to be successful in detecting an acceptable threshold number or percentage of fraudulent transactions in the test data, the issuer may be fairly confident that the rules will be similarly effective for real-life transactions moving forward. Likewise, if the tested fraud rules fail to detect a threshold number or percentage of fraudulent transactions in the test data, the issuer may determine that the rules should be altered or replaced."). The fraud rules are presented in the user interface ((Kala, ¶15) " The method may include providing a graphical user interface including one or more fraud rules for selection by a user, where the one or more fraud rules each relates to at least the one or more fraud transaction parameters, high frequency merchants, or high risk merchants."). The GUI may provide transaction parameters that have been identified as most likely related to fraudulent transactions, thereby suggesting utilization of said parameters over currently-selected parameters ((Kala, ¶38) " In some embodiments, the GUI may additionally provide the transaction parameters that the risk management system may have determined to be most likely associated with fraudulent transactions.");
presenting user-selectable elements to accept the decommissioning of the first scenario in the user interface; and The fraud rules are presented in the user interface wherein the rules can be modified ((Kala, ¶15) " The method may include providing a graphical user interface including one or more fraud rules for selection by a user, where the one or more fraud rules each relates to at least the one or more fraud transaction parameters, high frequency merchants, or high risk merchants."). Kala Figure 4 depicts an exemplary graphical user interface wherein there exists a “RUN TEST” button that proceeds to run a risk test according to an updated set of selected fraud rules ((Kala, ¶42) " The GUI 200 may include a button 220 that may be selectable by the issuer to run a risk test using the selected fraud rules. In some embodiments, the risk test may include applying the selected one or more fraud rules to the test transaction data to determine one or more suspected fraudulent transactions in the test transaction data.")
accepting a user selection of an element of the user-selectable elements to accept the decommissioning of the first scenario through the user interface, ((Kala, ¶44) " At 314, the method may include receiving a selection of one or more fraud rules via the risk management GUI. The selection of fraud rules may include an indication of an issuer's preferences regarding how to apply and/or interpret the presence of each fraud parameter.")
wherein the decommissioning the first scenario in the monitoring system is performed in response to the user selection. ((Kala, ¶42) "The GUI 200 may include a button 220 that may be selectable by the issuer to run a risk test using the selected fraud rules. In some embodiments, the risk test may include applying the selected one or more fraud rules to the test transaction data to determine one or more suspected fraudulent transactions in the test transaction data.");((Kala, ¶44) " At 314, the method may include receiving a selection of one or more fraud rules via the risk management GUI. The selection of fraud rules may include an indication of an issuer's preferences regarding how to apply and/or interpret the presence of each fraud parameter.")
Regarding claim 7, the proposed combination discloses The computer-implemented method of claim 1, wherein the decommissioning the first scenario in the monitoring system further comprises as stated previously. The proposed combination in further view of Avner discloses (except the limitations surrounded by brackets ([[..]])) in response to the identifying the first scenario to be redundant, automatically instructing the monitoring system to discontinue [[analyzing actions in a monitored system to determine whether the actions trigger the first scenario.]] When alerts corresponding to unique tests are identified as being redundant, the transmission of alerts is suppressed ((Avner, Col 4, Lines 24-27) " Once the alert is identified as a redundant alert, it may be suppressed such that the alert is not transmitted to the responsible administrator or team. ")
Avner is not relied upon to disclose discontinuing the generation of alerts triggered by an analysis of actions in a monitored system.
However, as stated previously in the rejection of claim 1, Kala is relied upon to disclose discontinuing analyzing actions in a monitored system to determine whether the actions trigger the first scenario by modifying the fraud rules of the monitoring system that dictate the analysis of transactions to detect fraud. A GUI is presented for a user to be able to modify (and by deselecting, effectively decommissioning) fraud rules that dictate the detection of fraudulent activity, thereby providing a signal to the monitoring system ((Kala, ¶40) "The GUI 200 may also include a fraud rules interface 210 that may include a list of fraud parameters found to most likely correspond to fraudulent transactions. For the purposes of illustration, generic fraud parameters (e.g., Fraud Parameters 1-4) are listed in the GUI 200, but transaction parameters such as MCC, Transaction Amount, etc., may be used. In some embodiments, the GUI 200 may provide a list of selectable fraud rules 212 for each identified fraud parameter.").
It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have modified the prior art further in view of Kala because some teaching, suggestion, or motivation in the prior art would have led one having ordinary skill in the art to do so in order to arrive at the claimed invention. Avner discloses a monitoring system where alert transmission is automatically suppressed by the alert service in order to reduce unnecessary further evaluation of falsely triggered or redundant alerts. ((Avner, Col. 7, Lines 25-27) "When the response received from the lineage service 232 indicates that the error is redundant, the alert service 222 may suppress transmission of an alert for the error"). Kala discloses alternatively tuning detection rules to minimize falsely triggered fraud detections ((Kala, ¶42) "In some embodiments, the GUI 200 may also provide additional details based on percentages of false positive findings of fraudulent transactions ( e.g., known legitimate transactions identified by the test as likely fraudulent). Based on the test results, the issuer may tweak the fraud rules, acceptable risk threshold, fraud rate thresholds, or other parameters in order to improve the fraud detection rate and minimize false positive findings."). Accordingly, by incorporating the fraud rule parameter tuning disclosed by Kala as an alternative to the automated alert transmission suppression disclosed by Avner, one having skill in the art would one would arrive at the claimed invention and could reasonably expect the modification to achieve reduced unwanted (either redundant or false positive) detections/alerts in a monitoring environment.
Regarding claim 8, Avner discloses (except the limitations surrounded by brackets ([[..]])) A computing system comprising: ((Avner, Col 17, Lines 33-37) "Generally, functions described herein (for example, the features illustrated in FIGS. 1-5) can be implemented using software, firmware, hardware (for example, fixed logic, 35
finite state machines, and/or other circuits), or a combination of these implementations.")
a processor; ((Avner, Col 17, Lines 37-39) "In the case of a software implementation, program code performs specified tasks when executed on a processor (for example, a CPU or CPUs).")
a memory operably connected to the processor; ((Avner, Col 17, Lines 33-41) "In the case of a software implementation, program code performs specified tasks when executed on a processor (for example, a CPU or CPUs). The program code can be stored in one or more machine- 40 readable memory devices.")
a non-transitory computer-readable medium operably connected to the processor
and memory and storing computer-executable instructions that when executed by at least the processor of the computing system cause the computing system to: ((Avner, col 15, Lines 44-52) "As used herein, "machine-readable medium" refers to a device able to temporarily or permanently store instructions and data that cause machine 700 to operate in a specific fashion. The term "machine-readable medium," as used herein, does not encompass transitory electrical or electromagnetic signals per se (such as on a carrier wave propagating through a medium); the term "machine-readable medium" may therefore be considered tangible and nontransitory."); ((Avner, col 15, lines 60-66) "The term "machine-readable medium" applies to a single medium, or combination of multiple media, used to store instructions (for example, instructions 716) for execution by a machine 700 such that the instructions, when executed by one or more processors 710 of the machine 700, cause the machine 700 to perform and one or
more of the features described herein.")
record alerts triggered for a plurality of scenarios of a monitoring system [[by
a reinforcement learning agent attempting to evade the scenarios,]] ((Avner, Col 3, Lines 45-52) " Most enterprises monitor the operation of their computer systems and data environments to ensure system reliability and availability. This may be achieved by running various tests and/or utilizing monitoring tools that detect system and/or data issues (e.g., failures or erroneous system behavior). When a failure or erroneous behavior is detected, a mechanism is often used to alert an administrator (e.g., one or more engineering team members) to the detected issues "); ((Avner, Col 6, Lines 8-10) " The monitoring server 210 may include and/or execute a monitoring service 212, while the alert server 220 may 10 include and/or execute an alert service 222. "); ((Avner, Col 12, Lines 61-67 and Col 13, Lines 1-5) " When the new error is not identified as redundant (no at step 535), method 500 may proceed to generate an alert for the new error, at 545. This may involve, automatic creation and transmission of an alert for the new error to one or more administrators responsible for managing the dataset to which the error relates. In some implementations, the record for the error is updated to indicate that an alert has been generated and/or transmitted for the error. Additionally, and/or alternatively, an alert record may be created for the new alert in an alert data structure (e.g., log of active alerts). The alert may include data about the error and the dataset to which it relates. ")
wherein the monitoring system monitors [[a transaction system;]] The monitoring system monitors datasets and system components to detect erroneous behaviors ((Avner, Col 6, Lines 34-47) "The monitoring service 212 may be responsible for monitoring for errors and/or failures in various datasets and/or 35 other system components. As such, the monitoring service 212 may include and be representative of various monitoring tools and/or tests executed by one or more administrators and/or engineering teams for determining the health, avail- ability (e.g., system up-time) and reliability (e.g., ability to 40 meet performance requirements) of various datasets and/or system components. .")
determine an extent of overlap between first alerts of a first scenario of the monitoring system and second alerts of a second scenario of the monitoring system; ((Avner, Col 9, Lines 17-36) " When the lineage service 232 receives a request from the alert service 222 to identify dependencies for a new error, it may examine the lineage of the dataset to which the error relates and identify one or more currently active errors for upstream datasets. This may be achieved by comparing the lineage of the dataset (e.g., all other datasets on which the dataset depends) with the list of datasets having active errors, and determining if there is an overlap between those datasets. When a dataset having an active error is upstream to the dataset at issue, the new error may be identified as being redundant since it is likely caused by the same error. For example, in the environment 100 of FIG. 1, if an error relating to Dataset 5 is received, and an error relating to Dataset 1 is currently active, the error relating to Dataset 5 is identified as an upstream error and, as such, redundant. In some implementations, other information such as the type of error, the time/date it was detected, the time/date the dataset at issue was generated, and the like may also be considered in determining if the new error is redundant to an active error relating to an upstream dataset. ")
identify the first scenario to be redundant based on the extent of overlap; and ((Avner, Col 12, Lines 24-31) " Once the upstream datasets are identified, method 500 may proceed to retrieve alert data for the upstream datasets, at 525, before determining if the new error is redundant to an existing error for which an alert has been issued, at 530. This may involve examining the list of active alerts in the system and comparing this list to the list of upstream datasets to identify upstream datasets for which one or more active alerts exists. ")
automatically [[decommission]] the first scenario in the monitoring system by signaling the monitoring system to [[discontinue]] evaluating actions with the first scenario. The tests performed by the monitoring system may be initiated automatically, wherein the tests characterize erroneous behavior and different tests may be used to detect different errors that trigger alerts ((Avner, Col 6, Lines 42-47) "The monitoring and tests performed by the monitoring service 212 may be initiated automatically or by a user (e.g., an engineering team member). Different 45 monitoring tools and/or tests may be utilized for different types of datasets and/or system components to detect erroneous behaviors.").
While Avner does disclose the utilization of a monitoring system, Avner does not disclose the utilization of a reinforcement learning agent interacting with the monitoring system to avoid detection and the triggering of alerts in the monitoring system.
However, Mead discloses the detection of fraudulent activity performed by a reinforcement learning agent attempting to evade the scenarios, ((Mean, Page 119, Col 2, ¶2) "In our experiments, the fraudster (agent) is trying to determine the best set of transactions (actions) to steal as much money as possible by beating the bank’s fraud classifier (environment). "); ((Mead, Page 118, Col 1, ¶Abstract) "Our MDP takes on the perspective of an agent (in this case the fraudster with a stolen credit card) who interacts with an environment (merchants and a fraud classifier), by taking actions (transactions), and receiving rewards (relating to whether the transactions were successful/declined).")
Avner is analogous to the claimed invention because it is reasonably pertinent to the problem faced by the inventor, which is reducing alert rates in monitoring systems based on redundant data. Mead is analogous to the claimed invention because it pertains to fraud monitoring in transaction systems. It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have combined the prior art references in order to arrive at the claimed invention because some teaching, suggestion, or motivation would have led one having skill in the art to do so in order to arrive at the claimed invention. Both arts focus on improvements to monitoring systems that detect either anomalous or fraudulent data, though each is directed towards a different application. Avner discloses that monitoring systems can be made more effective by reducing alerts triggered by redundant errors. Mead discloses that a reinforcement learning agent can be leveraged to simulate fraudulent behaviors without requiring the online testing of sensitive data in order to tune the sensitivity of the detection classifier thresholding rules ((Mead, Page 120, Col 2, ¶1) " To test this we took our logistic regression fraud classifier and varied the classification threshold (the value at which the model declares a transaction either fraud or not fraud), between 0 and 1 and calculated the total value associated with the optimal policy (how much money the fraudster could steal). Armed with this knowledge we found the region of classification thresholds that were sensitive to precision and recall (that is, not all false positives or all false negatives). "); ((Mead, Page 121, Col 1, ¶1) " When the classification threshold is sufficiently low, then all transactions are counted as fraud and any transactions the fraudster puts on the card are promptly declined (as are all real transactions, it should be noted). When the classification threshold is sufficiently high, all transactions are successful and it is in the fraudster’s best interest to make as many large transactions as possible. In between there is a small region where the behavior is slightly more nuanced. It is in this small region that the actual fraud classifier would operate, and these are the classification thresholds we used when varying our classifier at regular intervals to confuse the fraudster."). By combining the benefits of the alert transmission reduction as disclosed by Avner into the transaction monitoring system that classifies fraudulent behavior and optimizes the classification threshold according to the activities of a reinforcement learning agent, one having skill in the art could reasonably expect a robust and comprehensive monitoring system optimization approach for transaction fraud applications. Accordingly, the combination would have been obvious.
While Avner discloses the suppression of the transmission of alerts and the automated initialization of tests for monitoring, Avner does not explicitly disclose suppressing the generation of alerts through decommissioning of particular tests that are used to determine alertable behavior.
However, Kala discloses decommissioning fraud detection rules that are used to evaluate transaction data so as to discontinue detecting fraudulent events according to such rules. A GUI is presented for a user to be able to modify (and by deselecting, effectively decommissioning) fraud rules that dictate the detection of fraudulent activity, thereby providing a signal to the monitoring system ((Kala, ¶40) "The GUI 200 may also include a fraud rules interface 210 that may include a list of fraud parameters found to most likely correspond to fraudulent transactions. For the purposes of illustration, generic fraud parameters (e.g., Fraud Parameters 1-4) are listed in the GUI 200, but transaction parameters such as MCC, Transaction Amount, etc., may be used. In some embodiments, the GUI 200 may provide a list of selectable fraud rules 212 for each identified fraud parameter."). The fraud rules may be applied by the computer-implemented method, thereby indicating automatic application (See Kala claim 14 demonstrating a computer-implemented method, and Kala claim 18 which depends from 14 describing the fraud rule application.
Kala is analogous to the claimed invention because it is related to the same field of endeavor of the claimed invention of improving fraud detection in transaction monitoring systems. It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have modified the prior art to include the teachings of Kala because some teaching, suggestion, or motivation in the prior art would have led one having ordinary skill in the art to do so in order to arrive at the claimed invention. Avner discloses a monitoring system where alert transmission is suppressed in order to reduce unnecessary further evaluation of falsely triggered or redundant alerts. ((Avner, Col. 7, Lines 25-27) "When the response received from the lineage service 232 indicates that the error is redundant, the alert service 222 may suppress transmission of an alert for the error"). Kala discloses alternatively tuning detection rules to minimize falsely triggered fraud detections ((Kala, ¶42) "In some embodiments, the GUI 200 may also provide additional details based on percentages of false positive findings of fraudulent transactions ( e.g., known legitimate transactions identified by the test as likely fraudulent). Based on the test results, the issuer may tweak the fraud rules, acceptable risk threshold, fraud rate thresholds, or other parameters in order to improve the fraud detection rate and minimize false positive findings."). Accordingly, by incorporating the fraud rule parameter tuning disclosed by Kala as an alternative to the alert transmission suppression disclosed by Avner, one having skill in the art would one would arrive at the claimed invention and could reasonably expect the modification to achieve reduced unwanted (either redundant or false positive) detections/alerts in a monitoring environment.
Regarding claim 9, the limitations The computing system of claim 8, wherein the instructions to determine an extent of overlap further cause the computing system to count a number of times that one of the first alerts occurs in a time range in which one of the second alerts occurs are substantially similar to that recited in claim 2 but with respect to independent claim 8. For brevity the rationale is not restated and follows the rejection given for claim 2.
Regarding claim 10, the limitations The computing system of claim 8, wherein the instructions further cause the computing system to:
determine that the first scenario is weaker than the second scenario based on a comparison of a first ratio of overlapping alerts to overall alerts for the first scenario to a second ratio of overlapping alerts to overall alerts of the second scenario; and
select the first scenario for decommissioning based on the determination that the first scenario is weaker than the second scenario are substantially similar to that recited in claim 3 but with respect to independent claim 8. For brevity the rationale is not restated and follows the rejection given for claim 3.
Regarding claim 11, the limitations The computing system of claim 8, wherein the instructions further cause the computing system to operate the reinforcement learning agent in a simulation of a monitored system that is monitored by the monitoring system, wherein the reinforcement learning agent attempts to evade the scenarios in the simulation. are substantially similar to that recited in claim 4 but with respect to independent claim 8. For brevity the rationale is not restated and follows the rejection given for claim 4.
Regarding claim 12, the limitations The computing system of claim 8, wherein the instructions to decommission the first scenario in the monitoring system further cause the computing system to:
display a recommendation to decommission the first scenario in a user interface;
present a user-selectable element to accept the decommissioning of the first scenario in the user interface; and
accept a user selection of the element to accept the decommissioning of the first scenario through the user interface, wherein the decommissioning the first scenario in the monitoring system is performed in response to the user selection. are substantially similar to that recited in claim 5 but with respect to independent claim 8. For brevity the rationale is not restated and follows the rejection given for claim 5.
Regarding claim 13, the limitations The computing system of claim 8, wherein the instructions to decommission the first scenario in the monitoring system further cause the computing system to, in response to the identifying the first scenario to be redundant, automatically instruct the monitoring system to discontinue analyzing actions in a monitored system to determine whether the actions trigger the first scenario. are substantially similar to that recited in claim 7 but with respect to independent claim 8. For brevity the rationale is not restated and follows the rejection given for claim 7.
Regarding claim 15, Avner discloses (except the limitations surrounded by brackets ([[..]])) A non-transitory computer-readable medium having stored thereon computer-executable instructions that, when executed by a processor accessing memory of a computer cause the computer to: : ((Avner, col 15, Lines 44-52) "As used herein, "machine-readable medium" refers to a device able to temporarily or permanently store instructions and data that cause machine 700 to operate in a specific fashion. The term "machine-readable medium," as used herein, does not encompass transitory electrical or electromagnetic signals per se (such as on a carrier wave propagating through a medium); the term "machine-readable medium" may therefore be considered tangible and nontransitory."); ((Avner, col 15, lines 60-66) "The term "machine-readable medium" applies to a single medium, or combination of multiple media, used to store instructions (for example, instructions 716) for execution by a machine 700 such that the instructions, when executed by one or more processors 710 of the machine 700, cause the machine 700 to perform and one or
more of the features described herein.")
record alerts triggered for a plurality of scenarios of a monitoring system [[by a
reinforcement learning agent attempting to evade the scenarios]], wherein the monitoring system monitors [[a transaction system]]; ((Avner, Col 3, Lines 45-52) " Most enterprises monitor the operation of their computer systems and data environments to ensure system reliability and availability. This may be achieved by running various tests and/or utilizing monitoring tools that detect system and/or data issues (e.g., failures or erroneous system behavior). When a failure or erroneous behavior is detected, a mechanism is often used to alert an administrator (e.g., one or more engineering team members) to the detected issues "); ((Avner, Col 6, Lines 8-10) " The monitoring server 210 may include and/or execute a monitoring service 212, while the alert server 220 may 10 include and/or execute an alert service 222. "); ((Avner, Col 12, Lines 61-67 and Col 13, Lines 1-5) " When the new error is not identified as redundant (no at step 535), method 500 may proceed to generate an alert for the new error, at 545. This may involve, automatic creation and transmission of an alert for the new error to one or more administrators responsible for managing the dataset to which the error relates. In some implementations, the record for the error is updated to indicate that an alert has been generated and/or transmitted for the error. Additionally, and/or alternatively, an alert record may be created for the new alert in an alert data structure (e.g., log of active alerts). The alert may include data about the error and the dataset to which it relates. "). The monitoring system monitors datasets and system components to detect erroneous behaviors ((Avner, Col 6, Lines 34-47) "The monitoring service 212 may be responsible for monitoring for errors and/or failures in various datasets and/or 35 other system components. As such, the monitoring service 212 may include and be representative of various monitoring tools and/or tests executed by one or more administrators and/or engineering teams for determining the health, avail- ability (e.g., system up-time) and reliability (e.g., ability to 40 meet performance requirements) of various datasets and/or system components. .")
determine an extent of overlap between first alerts of a first scenario of the monitoring system and second alerts of a second scenario of the monitoring system; ((Avner, Col 9, Lines 17-36) " When the lineage service 232 receives a request from the alert service 222 to identify dependencies for a new error, it may examine the lineage of the dataset to which the error relates and identify one or more currently active errors for upstream datasets. This may be achieved by comparing the lineage of the dataset (e.g., all other datasets on which the dataset depends) with the list of datasets having active errors, and determining if there is an overlap between those datasets. When a dataset having an active error is upstream to the dataset at issue, the new error may be identified as being redundant since it is likely caused by the same error. For example, in the environment 100 of FIG. 1, if an error relating to Dataset 5 is received, and an error relating to Dataset 1 is currently active, the error relating to Dataset 5 is identified as an upstream error and, as such, redundant. In some implementations, other information such as the type of error, the time/date it was detected, the time/date the dataset at issue was generated, and the like may also be considered in determining if the new error is redundant to an active error relating to an upstream dataset. ")
identify one or more of the multiple scenarios to be redundant based on the extent
of overlap; and ((Avner, Col 12, Lines 24-31) " Once the upstream datasets are identified, method 500 may proceed to retrieve alert data for the upstream datasets, at 525, before determining if the new error is redundant to an existing error for which an alert has been issued, at 530. This may involve examining the list of active alerts in the system and comparing this list to the list of upstream datasets to identify upstream datasets for which one or more active alerts exists. ")
automatically [[decommission]] first scenario in the monitoring system by signaling the monitoring system to [[discontinue]] evaluating actions with the first scenario. The tests performed by the monitoring system may be initiated automatically, wherein the tests characterize erroneous behavior and different tests may be used to detect different errors that trigger alerts ((Avner, Col 6, Lines 42-47) "The monitoring and tests performed by the monitoring service 212 may be initiated automatically or by a user (e.g., an engineering team member). Different 45 monitoring tools and/or tests may be utilized for different types of datasets and/or system components to detect erroneous behaviors.").
While Avner does disclose the utilization of a monitoring system, Avner does not disclose the utilization of a reinforcement learning agent interacting with the monitoring system to avoid detection and the triggering of alerts in the monitoring system.
However, Mead discloses the detection of fraudulent activity performed by a reinforcement learning agent attempting to evade the scenarios, in a transaction system ((Mean, Page 119, Col 2, ¶2) "In our experiments, the fraudster (agent) is trying to determine the best set of transactions (actions) to steal as much money as possible by beating the bank’s fraud classifier (environment). "); The fraud classifier is transaction-based ((Mead, Page 120, Col 1, ¶2) "This fraud classifier is fairly simple with just 3 predictors: # of low $-amount transactions, # of high $-amount transactions, and whether the action is a low or high $-amount."); ((Mead, Page 118, Col 1, ¶Abstract) "Our MDP takes on the perspective of an agent (in this case the fraudster with a stolen credit card) who interacts with an environment (merchants and a fraud classifier), by taking actions (transactions), and receiving rewards (relating to whether the transactions were successful/declined).")
Avner is analogous to the claimed invention because it is reasonably pertinent to the problem faced by the inventor, which is reducing alert rates in monitoring systems based on redundant data. Mead is analogous to the claimed invention because it pertains to fraud monitoring in transaction systems. It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have combined the prior art references in order to arrive at the claimed invention because some teaching, suggestion, or motivation would have led one having skill in the art to do so in order to arrive at the claimed invention. Both arts focus on improvements to monitoring systems that detect either anomalous or fraudulent data, though each is directed towards a different application. Avner discloses that monitoring systems can be made more effective by reducing alerts triggered by redundant errors. Mead discloses that a reinforcement learning agent can be leveraged to simulate fraudulent behaviors without requiring the online testing of sensitive data in order to tune the sensitivity of the detection classifier thresholding rules ((Mead, Page 120, Col 2, ¶1) " To test this we took our logistic regression fraud classifier and varied the classification threshold (the value at which the model declares a transaction either fraud or not fraud), between 0 and 1 and calculated the total value associated with the optimal policy (how much money the fraudster could steal). Armed with this knowledge we found the region of classification thresholds that were sensitive to precision and recall (that is, not all false positives or all false negatives). "); ((Mead, Page 121, Col 1, ¶1) " When the classification threshold is sufficiently low, then all transactions are counted as fraud and any transactions the fraudster puts on the card are promptly declined (as are all real transactions, it should be noted). When the classification threshold is sufficiently high, all transactions are successful and it is in the fraudster’s best interest to make as many large transactions as possible. In between there is a small region where the behavior is slightly more nuanced. It is in this small region that the actual fraud classifier would operate, and these are the classification thresholds we used when varying our classifier at regular intervals to confuse the fraudster."). By combining the benefits of the alert transmission reduction as disclosed by Avner into the transaction monitoring system that classifies fraudulent behavior and optimizes the classification threshold according to the activities of a reinforcement learning agent, one having skill in the art could reasonably expect a robust and comprehensive monitoring system optimization approach for transaction fraud applications. Accordingly, the combination would have been obvious.
While Avner discloses the suppression of the transmission of alerts and the automated initialization of tests for monitoring, Avner does not explicitly disclose suppressing the generation of alerts through decommissioning of particular tests that are used to determine alertable behavior.
However, Kala discloses decommissioning fraud detection rules that are used to evaluate transaction data so as to discontinue detecting fraudulent events according to such rules. A GUI is presented for a user to be able to modify (and by deselecting, effectively decommissioning) fraud rules that dictate the detection of fraudulent activity, thereby providing a signal to the monitoring system ((Kala, ¶40) "The GUI 200 may also include a fraud rules interface 210 that may include a list of fraud parameters found to most likely correspond to fraudulent transactions. For the purposes of illustration, generic fraud parameters (e.g., Fraud Parameters 1-4) are listed in the GUI 200, but transaction parameters such as MCC, Transaction Amount, etc., may be used. In some embodiments, the GUI 200 may provide a list of selectable fraud rules 212 for each identified fraud parameter."). The fraud rules may be applied by the computer-implemented method, thereby indicating automatic application (See Kala claim 14 demonstrating a computer-implemented method, and Kala claim 18 which depends from 14 describing the fraud rule application.
Kala is analogous to the claimed invention because it is related to the same field of endeavor of the claimed invention of improving fraud detection in transaction monitoring systems. It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have modified the prior art to include the teachings of Kala because some teaching, suggestion, or motivation in the prior art would have led one having ordinary skill in the art to do so in order to arrive at the claimed invention. Avner discloses a monitoring system where alert transmission is suppressed in order to reduce unnecessary further evaluation of falsely triggered or redundant alerts. ((Avner, Col. 7, Lines 25-27) "When the response received from the lineage service 232 indicates that the error is redundant, the alert service 222 may suppress transmission of an alert for the error"). Kala discloses alternatively tuning detection rules to minimize falsely triggered fraud detections ((Kala, ¶42) "In some embodiments, the GUI 200 may also provide additional details based on percentages of false positive findings of fraudulent transactions ( e.g., known legitimate transactions identified by the test as likely fraudulent). Based on the test results, the issuer may tweak the fraud rules, acceptable risk threshold, fraud rate thresholds, or other parameters in order to improve the fraud detection rate and minimize false positive findings."). Accordingly, by incorporating the fraud rule parameter tuning disclosed by Kala as an alternative to the alert transmission suppression disclosed by Avner, one having skill in the art would one would arrive at the claimed invention and could reasonably expect the modification to achieve reduced unwanted (either redundant or false positive) detections/alerts in a monitoring environment.
Regarding claim 16, the limitations The non-transitory computer-readable medium of claim 15, wherein the instructions to determine an extent of overlap further cause the computer to count a number of times that one of the first alerts occur in a time range in which one of the second alerts occurs. are substantially similar to that recited in claim 2 and are therefore rejected under the same rationale.
Regarding claim 17, the limitations The non-transitory computer-readable medium of claim 15, wherein the instructions further cause the computer to:
determine that the first scenario is weaker than the second scenario based on a comparison of a ratio of overlapping alerts to overall alerts for each of the first scenario to a ratio of overlapping alerts to overall alerts of the scenario; and
select the first scenario for decommissioning based on the determination that the first scenario is weaker than the second scenario. are substantially similar to that recited in claim 3 and are therefore rejected under the same rationale.
Regarding claim 18, the limitations The non-transitory computer-readable medium of claim 15, wherein the instructions further cause the computer to operate the reinforcement learning agent in a simulation of a monitored system, wherein the reinforcement learning agent attempts to evade the scenarios in the simulation. are substantially similar to that recited in claim 4 but with respect to independent claim 15. For brevity, the rationale is not restated and follows the rejection given for claim 4.
Regarding claim 19, the limitations The non-transitory computer-readable medium of claim 15, wherein the instructions to decommission the first scenario further cause the computer to:
display a recommendation to decommission the first scenario in a user interface;
present a user-selectable element to accept the decommissioning of the first scenario in the user interface; and
accept a user selection of the element to accept the decommissioning of the first scenario through the user interface, wherein the decommissioning the first scenario in the monitoring system is performed in response to the user selection. are substantially similar to that recited in claim 5 but with respect to independent claim 15 and are therefore rejected under the same rationale.
Regarding claim 20, the proposed combination discloses The non-transitory computer-readable medium of claim 15, wherein the instructions to decommission the first scenario in the monitoring system further cause the computer to as stated previously. The proposed combination in further view of Avner discloses (except the limitations surrounded by brackets ([[..]])) in response to the identifying the first scenario to be redundant, automatically instruct the monitoring system to [[discontinue]] analyzing actions in a monitored system to determine whether the actions trigger the first scenario, An alert is determined as redundant and the alert service suppresses transmission of an alert ((Avner, Col 7, Lines 25-27) " When the response received from the lineage service 232 25 indicates that the error is redundant, the alert service 222 may suppress transmission of an alert for the error"). The tests performed by the monitoring system may be initiated automatically, wherein the tests characterize erroneous behavior and different tests may be used to detect different errors that trigger alerts ((Avner, Col 6, Lines 42-47) "The monitoring and tests performed by the monitoring service 212 may be initiated automatically or by a user (e.g., an engineering team member). Different 45 monitoring tools and/or tests may be utilized for different types of datasets and/or system components to detect erroneous behaviors.").
[[wherein the monitoring system produces no further alerts under the first scenario following execution of the instruction.]]
While Avner discloses the suppression of the transmission of alerts and the automated initialization of tests for monitoring, Avner does not explicitly disclose suppressing the production of alerts through discontinuing analyzing actions by modifying particular tests that are used to determine alertable behavior such that the monitoring system would no longer produce alerts.
However, Kala discloses altering fraud detection rules that are used to evaluate transaction data so as to discontinue detecting fraudulent events according to such rules wherein the monitoring system produces no further alerts under the first scenario following execution of the instruction. A GUI is presented for a user to be able to modify (and by deselecting, effectively decommissioning) fraud rules that dictate the detection of fraudulent activity, thereby providing a signal to the monitoring system ((Kala, ¶40) "The GUI 200 may also include a fraud rules interface 210 that may include a list of fraud parameters found to most likely correspond to fraudulent transactions. For the purposes of illustration, generic fraud parameters (e.g., Fraud Parameters 1-4) are listed in the GUI 200, but transaction parameters such as MCC, Transaction Amount, etc., may be used. In some embodiments, the GUI 200 may provide a list of selectable fraud rules 212 for each identified fraud parameter."). The fraud rules may be applied by the computer-implemented method, thereby indicating automatic application (See Kala claim 14 demonstrating a computer-implemented method, and Kala claim 18 which depends from 14 describing the fraud rule application. The modification of rules in the interface correspond directly to the detection of fraudulent actions, thereby indicating if the rules are deselected, alerts would not be detected and subsequently would not trigger any sort of alerting mechanism ((Kala, ¶14) " The risk management platform may help issuers or other entities optimize fraud loss prevention and maximize profitability by providing its clients with an effective transaction risk management decision system In some embodiments, issuers may use the risk management platform to create or select rules using a graphical user interface (GUI) for detecting and/or taking action relating to suspected fraudulent transactions."). The modification of rules may result in failed detections or reduction in false positive findings, thereby indicating that alerts are no longer triggered for the corresponding rule set ((Kala, ¶14) " Likewise, if the tested fraud rules fail to detect a threshold number or percentage of fraudulent transactions in the test data, the issuer may determine that the rules should be altered or replaced."); ((Kala, ¶42) " Based on the test results, the issuer may tweak the fraud rules, acceptable risk threshold, fraud rate thresholds, or other parameters in order to improve the fraud detection rate and minimize false positive findings.")
Regarding claim 21, the proposed combination discloses The computer-implemented method of claim 1, as stated previously. The proposed combination in further view of Avner discloses wherein the scenarios are models or deterministic rules that detect a form of activity that is not permitted by the monitoring system. Various tests are evaluated for each data set to detect issues that are erroneous behaviors, wherein a test is understood to be the evaluation of data against some given criteria that enables the determination of abnormal behavior ((Avner, Col 3, Lines45-52) " Most enterprises monitor the operation of their computer systems and data environments to ensure system reliability and availability. This may be achieved by running various tests and/or utilizing monitoring tools that detect system and/or data issues (e.g., failures or erroneous system behavior). When a failure or erroneous behavior is detected, a mechanism is often used to alert an administrator (e.g., one or more engineering team members) to the detected issues. "); ((Avner, Col 6, lines 44-49) " Different 45 monitoring tools and/or tests may be utilized for different types of datasets and/or system components to detect erroneous behaviors. The tests may be performed periodically, for example, based on a predetermined schedule ( e.g., once a day) and/or may be triggered by specific events, as needed. ")
Claim 6, is rejected under 35 U.S.C. 103 as being unpatentable over the proposed combination of references as applied to claim 5 above, and further in view of Tensorboard (Tensorboard, “Model Understanding with the What-If Tool Dashboard”, 2021, Tensorflow.org/tensorboard/what_if_tool), hereinafter referred to as Tensorboard.
Regarding claim 6, the proposed combination discloses The computer-implemented method of claim 5, wherein the decommissioning the first scenario in the monitoring system further comprises: as stated previously. The proposed combination in further view of Kala discloses decommissioning the first scenario as stated previously, by altering the monitoring rules via the user interface. The proposed combination does not disclose, however Tensorboard discloses generating information about an effect of changing a model. What-if scenarios for machine learning models can be generated and the resulting change can be generated and visualized ((Tensorboard, Demo model and dataset, ¶8) " Some things to try with the What-If Tool on this demo include: Editing a single datapoint and seeing the resulting change in inference.")
presenting the information about the effect of changing the model in the user interface. Machine learning models can be edited and visualized in an interface for understanding how changes affect model performance ((Tensorboard, Model Understanding with the What-If Tool Dashboard, ¶1) "The What-If Tool (WIT) provides an easy-to-use interface for expanding understanding of black-box classification and regression ML models. With the plugin, you can perform inference on a large set of examples and immediately visualize the results in a variety of ways. Additionally, examples can be edited manually or programmatically and re-run through the model in order to see the results of the changes. It contains tooling for investigating model performance and fairness over subsets of a dataset.")
Tensorboard is analogous art in that it reasonably pertains to the problem faced by the inventor- that is, visualization and control tools for modeling applications. It would have been obvious to one of ordinary skill to which said subject matter pertains at the time the invention was filed to have modified the proposed combination to incorporate the teachings of Tensorboard because combining known prior art elements according to known methods would yield predictable results. The proposed combination in light of Mead, as stated in the rejection of claim 1 above, leverages a classifier as the detector mechanism for the transaction monitoring system. The proposed combination in light of Kala discloses that the monitoring system may be modified by users in a user interface. In the proposed combination, the detector is being modeled by a machine learning algorithm (classifier), and the detector of the monitoring system is editable via a user interface. It would be reasonably obvious to incorporate known methods in the art that could be applied to visualizing the effect of changes to machine learning models- such as the “what-if” tool disclosed by Tensorboard. The predictable result of combining this feature into the system of the proposed combination would be to enable real-time feedback for users for changes made to how the monitoring system will operate- in turn, reducing unnecessary trial-and-error in order to tune the monitoring system effectively.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to EMILY GORMAN LEATHERS whose telephone number is (571)272-1880. The examiner can normally be reached Monday-Friday, 9:00 am-5:00 pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, EMERSON PUENTE can be reached at (571) 272-3652. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/E.G.L./ Examiner, Art Unit 2187
/EMERSON C PUENTE/ Supervisory Patent Examiner, Art Unit 2187
Prosecution Insights