DETAILED ACTION
Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Notice to Applicant
2. The following is a Final Office action. In response to Examiner’s Non-Final Action of 08/11/2025, Applicant, on 12/29/2025, amended independent Claims 1, 8 and 15. Claims 2-7, 9-14 and 16-20 are as originally or previously presented.
Claims 1-20 are pending in this application and have been rejected below.
Response to Amendment
3. Applicant’s amendments and arguments are acknowledged.
4. The prior Claim Objection withdrawn in light of Applicant’s amendments.
5. The prior 35 USC §101 rejection of Claims maintained despite Applicant's amendments and arguments.
Claim Rejections - 35 USC § 101
6. 35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
7. Claims 1-20 rejected under 35 U.S.C. 101 because, although they are drawn to statutory categories of system (machine), method (process), or medium (manufacture), they are also directed to a judicial exception (an abstract idea) without significantly more.
8. At Step 2A Prong One of the subject matter eligibility analysis, Claim 8 recites receiving .. a set of risk data associated with a set of risk factors that are organized in a hierarchy of groupings .., each risk factor of the set of risk factors being associated with one or more risk controls that each have a control strength value for reducing riskiness of the risk factor; determining .. an inherent risk value for each grouping of the hierarchy of groupings based on risk data associated with the grouping; generating .. a risk forecasting model of residual risk for each grouping, residual risk being an amount of riskiness after control strength values of the risk controls are applied to the inherent risk value, wherein generating the risk forecasting model further comprises: identifying, based on the risk data, a historical pattern of control strength values for the risk controls; generating, based on the historical pattern, a predicted variation of future control strength values; and generating, based on the predicted variation of future control strength values, a predicted residual risk for each grouping; determining .. based on the risk forecasting model and the predicted residual risk for a particular risk factor .. exceeding a predetermined acceptable risk level, a particular risk control to prioritize for the particular risk factor .. ; identifying .. a risk incident associated with the particular risk factor ..; and implementing .. the particular risk control, which is an abstract idea of Mental Processes - concepts performed in the human mind (including an observation, evaluation, judgment, opinion), because determining inherent risk values for hierarchical groupings of risk data and generating a risk forecasting model is a process that, under broadest reasonable interpretation, can be performed in the mind, because it involves evaluation, judgement or observation; it is also an abstract idea of Certain Methods of Organizing Human Activity, including fundamental economic principles or practices (including hedging, insurance, mitigating risk), because implementing a risk control is a business strategy for mitigating risk. Claims 1 and 15 recite a similar abstract idea.
At Step 2A Prong Two of the analysis, the judicial exception (abstract idea) is not integrated into a practical application because the independent Claims, including additional elements such as a processor; and a non-transitory computer-readable memory comprising instructions that are executable by the processor, a client device, a network system, wherein the particular risk factor comprises a cyber security risk factor and the particular risk control comprises an update to-a neural network configured to detect bot attacks to the network system, the risk incident comprising a successful hacking attempt of the network system, in response to identifying the successful hacking attempt, updating the neural network based on the successful hacking attempt, by a processor, A non-transitory computer-readable medium comprising program code that is executable by a processor, individually and in combination, when viewed as a whole, are not an improvement to a computer or a technology, the claims do not apply the judicial exception with a particular machine, and the claims do not effect a transformation or reduction of a particular article to a different state or thing. Generally linking the use of the judicial exception to a particular technological environment or field of use, as in the instant claims, is not indicative of integration into a practical application - see MPEP 2106.05(h); adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea, as in the instant claims, is also not indicative of integration into a practical application - see MPEP 2106.05(f).
At Step 2B of the analysis, the independent Claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception (abstract idea), because these additional elements such as those listed above, individually or in combination, do not recite anything that is beyond conventional and routine activity or use of computers (as evidenced by paragraphs 26-28 of the Specification in the instant Application and court decisions such as buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) discussed at 2106.05(d) of the MPEP), do not effect a transformation or reduction of a particular article to a different state or thing, nor do they apply the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular field of use or technological environment. Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (see MPEP 2106.05(f)), or merely adding insignificant extra-solution activity (see MPEP 2106.05(g)), or generally linking the use of the judicial exception to a particular technological environment or field of use (see MPEP 2106.05(h)), as in the instant claims, is not indicative of an inventive concept ("significantly more").
At Step 2A Prong One, dependent Claims 2-7, 9-14 and 16-20 incorporate (and therefore recite) the abstract idea noted in the independent claims and further recite extensions of that abstract idea.
At Step 2A Prong Two, dependent Claims 2-5, 7, 9-12,14 and 16-19 do not include any additional elements or activity beyond those included in the list above with respect to the independent Claims from which they depend. These dependent Claims therefore do not integrate the judicial exception (abstract idea) into a practical application for the same reasons as stated above at Step 2A Prong Two for the independent Claims.
At Step 2A Prong Two, dependent Claims 6, 13 and 20 do not integrate the judicial exception (abstract idea) into a practical application because these Claims, including additional elements such as those listed above for the independent Claims, individually and in combination, when viewed as a whole, are not an improvement to a computer or a technology, these Claims do not apply the judicial exception with a particular machine, and these Claims do not effect a transformation or reduction of a particular article to a different state or thing. Generally linking the use of the judicial exception to a particular technological environment or field of use, as in the instant Claims, is not indicative of integration into a practical application - see MPEP 2106.05(h); adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea, as in the instant Claims, is also not indicative of integration into a practical application - see MPEP 2106.05(f). Furthermore, output, to the client device, the risk forecasting model for display on a graphical user interface is merely insignificant extra-solution activity and therefore does not serve to integrate the judicial exception into a practical application (see MPEP 2106.05(g)).
At Step 2B, dependent Claims 2-5, 7, 9-12,14 and 16-19 do not include any additional elements or activity beyond those included in the list above with respect to the independent Claims from which they depend. These dependent Claims therefore do not recite anything that is sufficient to amount to significantly more than the judicial exception for the same reasons as stated above at Step 2B for the independent Claims.
At Step 2B, dependent Claims 6, 13 and 20 do not include additional elements that are sufficient to amount to significantly more than the judicial exception (abstract idea), because these additional elements such as those listed above, individually or in combination, do not recite anything that is beyond conventional and routine activity or use of computers (as evidenced by paragraphs 26-28 of the Specification in the instant Application and court decisions such as buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) discussed at 2106.05(d) of the MPEP), do not effect a transformation or reduction of a particular article to a different state or thing, nor do they apply the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular field of use or technological environment. Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely using a computer as a tool to perform an abstract idea (see MPEP 2106.05(f)), or merely adding insignificant extra-solution activity such as output, to the client device, the risk forecasting model for display on a graphical user interface (see MPEP 2106.05(g)), or generally linking the use of the judicial exception to a particular technological environment or field of use (see MPEP 2106.05(h)), as in the instant claims, is not indicative of an inventive concept ("significantly more").
Therefore, Claims 1-20 are rejected under 35 U.S.C. 101 as being directed to non-eligible subject matter. See Alice Corp. v. CLS Bank International, 573__ U.S. 2014.
Response to Arguments
9. Applicant's arguments filed 12/29/2025 have been fully considered, but they are found not persuasive with regard to the 35 U.S.C. 101 rejection.
10. Applicant argues (at pp. 10-12) that, at Step 2A Prong One of the subject matter analysis, “The claims are patent eligible because they do not recite an abstract idea” in the categories of Mental Processes or Certain Methods of Organizing Human Activity. Specifically, Applicant argues (at p. 11) that “the claimed risk control is implemented to address "a cyber security risk factor" of the network system, which is entirely separate from mitigating economic or financial risk”; and (at p.12) that “Updating a neural network that detects bot attacks based on a successful hacking attempt is not a mental process”.
Examiner respectfully disagrees. As explained in detail at paragraph 8 above in this office action, the independent claims recite an abstract idea at Step 2A Prong One of the subject matter analysis. With regard to the sub-groupings under Certain Methods of Organizing Human Activity, the abstract idea falls clearly under fundamental economic principles or practices (including hedging, insurance, mitigating risk), as can be seen at paragraph 18 of the Specification for example (“The highest level of the hierarchy 114 can be a group including all investment risks. .. The lowest level of the hierarchy 114 can include groupings that each include one or more risk factors 110 associated with investing in specific laptop or television products”). The abstract idea also clearly falls under Mental Processes, as can be seen at paragraph 3 of the Specification for example (“The operations can include generating a risk forecasting model of residual risk for each grouping”).
Examiner notes that “wherein the particular risk factor comprises a cyber security risk factor and the particular risk control comprises an update to a neural network configured to detect bot attacks to the network system” is an additional element that is taken into consideration in the subject matter analysis at Step 2A Prong Two.
11. Applicant argues (at pp. 12-13) that, at Step 2A Prong Two of the subject matter analysis, the independent claims when considered as a whole are integrated into a practical application by improving neural network detection of bot attacks, through the updating of the neural networks.
Examiner respectfully disagrees. As noted above, the update to the neural network is an additional element at Step 2A Prong Two. It is used as a tool to implement the abstract idea (of “the particular risk control, which was prioritized .. based on its predicted residual risk "exceeding a predetermined acceptable risk level””, as noted at p. 12 of Applicant’s arguments), and is therefore insufficient to integrate the abstract idea into a practical application – see MPEP 2106.05(f).
12. Applicant also argues (at p. 13) that “the independent claims are additionally directed to an improvement to a computer or a technology by reducing consumption of computing resources involved in monitoring and implementing risk controls in a network system”.
Examiner respectfully disagrees. As noted at MPEP 2106(f)(2), “Similarly, "claiming the improved speed or efficiency inherent with applying the abstract idea on a computer" does not integrate a judicial exception into a practical application or provide an inventive concept. Intellectual Ventures I LLC v. Capital One Bank (USA), 792 F.3d 1363, 1367, 115 USPQ2d 1636, 1639 (Fed. Cir. 2015)”.
Conclusion
13. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
14. Any inquiry concerning this communication or earlier communications from the examiner should be directed to SARJIT S BAINS whose telephone number is (571) 270-0317. The examiner can normally be reached M-F 9:30am-6:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Wu Rutao can be reached on (571)272-6045. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SARJIT S BAINS/Examiner, Art Unit 3623 /RUTAO WU/Supervisory Patent Examiner, Art Unit 3623
Prosecution Insights