Prosecution Insights
Last updated: April 19, 2026
Application No. 17/862,190

SYSTEMS AND METHODS FOR OPERATOR ASSISTED RESPONSE TO REAL-TIME ALERTS IN CYBER-PHYSICAL SYSTEMS

Non-Final OA §103
Filed
Jul 11, 2022
Examiner
AMBAYE, SAMUEL
Art Unit
2433
Tech Center
2400 — Computer Networks
Assignee
The MITRE Corporation
OA Round
4 (Non-Final)
82%
Grant Probability
Favorable
4-5
OA Rounds
3y 0m
To Grant
99%
With Interview

Examiner Intelligence

Grants 82% — above average
82%
Career Allow Rate
550 granted / 670 resolved
+24.1% vs TC avg
Strong +25% interview lift
Without
With
+25.1%
Interview Lift
resolved cases with interview
Typical timeline
3y 0m
Avg Prosecution
28 currently pending
Career history
698
Total Applications
across all art units

Statute-Specific Performance

§101
7.2%
-32.8% vs TC avg
§103
71.7%
+31.7% vs TC avg
§102
6.4%
-33.6% vs TC avg
§112
4.6%
-35.4% vs TC avg
Black line = Tech Center average estimate • Based on career data from 670 resolved cases

Office Action

§103
DETAILED ACTION Continued Examination Under 37 CFR 1.114 A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on January 21, 2026 has been entered. Status of Claims 2. Claims 1-21 are pending. Claims 1, 8, and 15 are in independent forms. Response to Arguments 3. Applicant's arguments filed on 01/21/2026 have been fully considered but they are not persuasive. A new prior art applied as shown below in the rejection.. Drawings 4. The drawings filed on 07/11/2022 are accepted by the examiner. Claim Rejections - 35 USC § 103 5. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 6. Claims 1, 3-8, 10-15, and 17-21 are rejected under 35 U.S.C. 103 as being unpatentable over Meshi et al. US Patent Application Publication NO. 2023/0224311 (hereinafter Meshi) in view of Damodaran et al. US Patent No. 10,521,331 (hereinafter Damodaran). Regarding claim 1, Meshi discloses a method for providing alerts and response options to an edge computing system operator (see Meshi par. 0038, systems implementing embodiments of the present invention can enrich alerts in the SOC with relevant information, and thereby efficiently prioritize the incidents for the SOC analysts so as to improve recall (i.e., the percentage of true positive cases covered), precision, response time, while at the same time reducing alert fatigue), the method comprising: “receiving one or more messages transmitted between a plurality of components of the edge computing system” (see Meshi Fig. 4, par. 175, In step 112, processor 36 receives, from the SOC servers at the plurality of sources 28, respective sets of alerts 30 and/or incidents 32, wherein each of the sets comprises alerts 30 and/or incidents 32 from a given source 28); “receiving one or more specifications of conditions to search for within the received one or more messages” (see Meshi par. 0180, In step 120, processor 36 applies labeling rules 50 to the alerts and/or incidents in the identified subset so as to assign respective rule-base alert labels 74 and rule-based incident labels 96 to the identified alerts and/or incidents); if the one or more patterns within the received data are determined to be present: “generating an alert to be displayed to the edge computing system operator on a graphical user interface, wherein the graphical user interface includes information pertaining to the one or patterns determined to be within the received data” (see Meshi Fig. 5, step 146, par. 0236-0237, in step 154, in response to a predicted label comprising the computed incident risk score, the given SOC processor in the given SOC server prioritizes the additional incident for handling by an SOC analyst, the given SOC processor in the given SOC server can prioritize the additional incident by prioritizing a notification in response to the predicted label. For example, presenting, on display 33, a notification (e.g., a warning message) comprising an ID, description and the computed incident risk score for the additional incidents); and “displaying the response list associated with the watchpoint pertaining to the one or more patterns determined to be present in the received data” (see Meshi par. 0237, the given SOC processor in the given SOC server can prioritize the additional incident by prioritizing a notification in response to the predicted label. For example, presenting, on display 33, a notification (e.g., a warning message) comprising an ID, description and the computed incident risk score for the additional incidents. In another embodiment, the given SOC processor can prioritize the notification by presenting the notification in different colors responsively to the computed risk score (e.g., green for lower risks and red for higher risks). Meshi does not explicitly discloses converting the one or more conditions into one or more watchpoints, wherein each watchpoint defines a pattern to be searched for in the data transmitted between the plurality of components. However, in analogues art, Damodaran discloses converting the one or more conditions into one or more watchpoints, wherein each watch point defines a pattern to be searched for in the data transmitted between the plurality of components (see Damodaran col. 21, lines 46-56, determine if the one or more user provided watchpoint declarations include one or more errors, convert the one or more user provided watchpoint declarations into one or more regular expressions, determine the presence of one or patterns within the one or more log files based on the one or more regular expressions, and generate one or more visual indications on the visual progress bar, wherein the one or more visual indications on the visual progress bar are based on the one or more log files in which the presence of the one or more patterns is determined); Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Damodaran in to the system of Meshi in order to provide a user's specification can be converted into a regular expression, which can then be executed by on a plurality of message logs to identify patterns that match the user's specification (see Damodaran col. 15, lines 55-59). Meshi in view of Damodaran does not explicitly discloses receiving one or more response lists, wherein in a response list of the one or more response lists is associated with a watchpoint of the one or more watchpoints and comprises a set of response options for the edge computing system operator to evaluate for responding to an alert associated with the watchpoint; determining the presence of one or more patterns within the received data based on the one or more watchpoints. However, in analogues art, Alagar discloses receiving one or more response lists, wherein in a response list of the one or more response lists is associated with a watchpoint of the one or more watchpoints and comprises a set of response options for the edge computing system operator to evaluate for responding to an alert associated with the watchpoint (see Alagar pars.0031-0032, The intrusion analyzer engine 116 is configured to determine whether the attack vector array 136 comprises any set flag bits 402 and to trigger an event 137 (e.g. an alert or instructions) in response to determining that at least one flag bit 402 is set in the attack vector array 136. For instance, the intrusion analyzer engine 116 may block or redirect communications between the user device 102 and the web server 104 in response to determining that at least one flag bit 402 is set. The intrusion dashboard 118 may receive information 140 from the intrusion analyzer engine 116 about detected intrusions based on the attack vector array 136. The intrusion dashboard 118 may share or display the received information 140 which allows an operator to view the information about any detected attacks and to take appropriate action. For example, the information 140 may identify one or more detected attacks and may provide suggested actions to isolate or block the detected attacks); determining the presence of one or more patterns within the received data based on the one or more watchpoints (see Alagar par. 0031, the intrusion analyzer engine 116 is configured to determine whether the attack vector array 136 comprises any set flag bits 402 and to trigger an event 137 (e.g. an alert or instructions) in response to determining that at least one flag bit 402 is set in the attack vector array 136). Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Alagar in to the system of Meshi and Damodaran in order to include an intrusion analyzer engine is configured to determine whether the attack vector array comprises any set flag bits and to trigger an event (e.g. an alert or instructions) in response to determining that at least one flag bit is set in the attack vector array (see Alagar par. 0031). Regarding claim 3, 10, and 17, Meshi in view of Damodaran in further view of Alagar discloses the method of claim 1, the system of claim 8, the non-transitory computer readable storage medium of claim 15, Damodaran further discloses wherein the generated alert comprises information pertaining to one or more components of the edge computing system from which transmitted the received one or messages included the one or more patterns within the received data (see Damodaran col. 14, lines 20-27, when a user is specifying a watchpoint, in essence, they are instructing the system to parse through the various message logs to search for logs in which the condition specified by the user is true. In order to execute such a search, in one or more examples, the system can initiate a pattern search through the plurality of message log files generated during the execution of the distributed software program). Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Damodaran in to the system of Meshi in order to provide a user's specification can be converted into a regular expression, which can then be executed by on a plurality of message logs to identify patterns that match the user's specification (see Damodaran col. 15, lines 55-59). Regarding claims 4, 11, and 18, Meshi in view of Damodaran in further view of Alagar discloses the method of claim 1, the system of claim 8, the non-transitory computer readable storage medium of claim 15, Damodaran further discloses wherein receiving one or more specifications of conditions to search for within the received one or more messages is specified using a domain-specific language (see Damodaran col. 21, lines 38-46, receiving one or more log files, wherein the one or more log files are based on a plurality of messages generated by a plurality of components in a distributed computing system during an execution of a distributed software program implemented on the plurality of components, and wherein each log file of the one or more log files includes a time stamp, and wherein in response to a user providing one or more watchpoints in a domain-specific language via the interface) Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Damodaran in to the system of Meshi in order to provide a user's specification can be converted into a regular expression, which can then be executed by on a plurality of message logs to identify patterns that match the user's specification (see Damodaran col. 15, lines 55-59). Regarding claims 5, 12, and 19, Meshi in view of Damodaran in further view of Alagar discloses the method of claim 4, the system of claim 11, the non-transitory computer readable storage medium of claim 18, Damodaran further discloses wherein converting the one or more conditions into one or more watchpoints comprises converting the received one or more specifications of conditions to search for within the received one or more messages is specified using the domain-specific language into one or more regular expressions or variable expressions (see Damodaran col. 19, lines 30-35, the watchpoint is found to not detect any errors at step 804, the process can move to step 808, wherein the watchpoint is converted from the domain-specific language such as HBL into a regular expression that will be ultimately used to search for matching patterns in the log files.). Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Damodaran in to the system of Meshi in order to provide a user's specification can be converted into a regular expression, which can then be executed by on a plurality of message logs to identify patterns that match the user's specification (see Damodaran col. 15, lines 55-59). Regarding claims 6, 13, and 20, Meshi in view of Damodaran in further view of Alagar discloses the method of claim 5, the system of claim 12, the non-transitory computer readable storage medium of claim 19, Damodaran further discloses wherein determining the presence of one or more patterns within the received data based on the one or more watchpoints comprises determining the presence of one or patterns within the one or more messages based on the one or more regular expressions or variable expressions (see Damodaran col. 19, lines 44-49, Once the domain specific language specified watchpoints have been converted to regular expressions at step 808, and the ILFs have been created at step 816, the process can move to step 810, wherein the regular expressions can be applied to the ILFs. In other words, at step 810, the regular expressions are used to search for matching patterns in the ILFs). Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Damodaran in to the system of Meshi in order to provide a user's specification can be converted into a regular expression, which can then be executed by on a plurality of message logs to identify patterns that match the user's specification (see Damodaran col. 15, lines 55-59). Regarding claim 7, 14, and 21, Meshi in view of Damodaran in further view of Alagar discloses the method of claim 1, the system of claim 8, the non-transitory computer readable storage medium of claim 15, Damodaran further discloses wherein the response list is displayed to the operator on a graphical user interface, and wherein the response list comprises one or more actions for the operator to take on the edge computing system in response to the generated alert (see Damodaran col. 20, lines 15-28, Based on the extracted time stamps, the process can move to step 906, wherein a highlight or highlights similar to highlight 620 of FIG. 6 is generated on the visual progress bar at a location that correlates with the chronological time stamp extracted at step 904. In this way, the user is alerted to the moments in time during the execution of the distributed software program that the condition that they specified using the watchpoint occurs. Once the visualization has been provided at step 906, the method 900 can move to step 908, wherein the process is terminated. The conclusion of method 900 thus yields a visual reference on a graphical user interface that can allow the user to visually see the moments during an execution of a distributed software program in which a specified watchpoint occurs). Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Damodaran in to the system of Meshi in order to provide a user's specification can be converted into a regular expression, which can then be executed by on a plurality of message logs to identify patterns that match the user's specification (see Damodaran col. 15, lines 55-59). Regarding claim 8, Meshi discloses a computing system for providing alerts and response options to an edge computing system operator, comprising: “a display” (Fig. 1, SOC display 33); “a memory” (Fig. 1, memory 38); “one or more processors” (Fig. 1 processor 36); and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors (see Meshi par. 0067, Processors 31 and 36 comprises a general-purpose central processing units (CPU) or special-purpose embedded processors, which are programmed in software or firmware to carry out the functions described herein. This software may be downloaded to security server 20 or SOC server(s) 26 in electronic form, over a network), the one or more programs when executed by the one or more processors cause the processor to: “receive one or more messages transmitted between a plurality of components of the edge computing system” (see Meshi Fig. 4, par. 175, In step 112, processor 36 receives, from the SOC servers at the plurality of sources 28, respective sets of alerts 30 and/or incidents 32, wherein each of the sets comprises alerts 30 and/or incidents 32 from a given source 28); “receive one or more specifications of conditions to search for within the received one or more messages” (see Meshi par. 0180, In step 120, processor 36 applies labeling rules 50 to the alerts and/or incidents in the identified subset so as to assign respective rule-base alert labels 74 and rule-based incident labels 96 to the identified alerts and/or incidents); if the one or more patterns within the received data are determined to be present: “generate an alert to be displayed to the edge computing system operator on a graphical user interface, wherein the graphical user interface includes information pertaining to the one or patterns determined to be within the received data” (see Meshi Fig. 5, step 146, par. 0236-0237, in step 154, in response to a predicted label comprising the computed incident risk score, the given SOC processor in the given SOC server prioritizes the additional incident for handling by an SOC analyst, the given SOC processor in the given SOC server can prioritize the additional incident by prioritizing a notification in response to the predicted label. For example, presenting, on display 33, a notification (e.g., a warning message) comprising an ID, description and the computed incident risk score for the additional incidents); and “display the response list associated with the watchpoint pertaining to the one or more patterns determined to be present in the received data” (see Meshi par. 0237, the given SOC processor in the given SOC server can prioritize the additional incident by prioritizing a notification in response to the predicted label. For example, presenting, on display 33, a notification (e.g., a warning message) comprising an ID, description and the computed incident risk score for the additional incidents. In another embodiment, the given SOC processor can prioritize the notification by presenting the notification in different colors responsively to the computed risk score (e.g., green for lower risks and red for higher risks). Meshi does not explicitly discloses a user interface configured to receive inputs from a user of the system; convert the one or more conditions into one or more watchpoints, wherein each watchpoint defines a pattern to be searched for in the data transmitted between the plurality of components. However, in analogues art, Damodaran discloses a user interface configured to receive inputs from a user of the system (see Damodaran col. 21, lines 35-38, an electronic device with a display and an interface configured to accept one or more inputs from a user of the electronic device); converting the one or more conditions into one or more watchpoints, wherein each watch point defines a pattern to be searched for in the data transmitted between the plurality of components (see Damodaran col. 21, lines 46-56, determine if the one or more user provided watchpoint declarations include one or more errors, convert the one or more user provided watchpoint declarations into one or more regular expressions, determine the presence of one or patterns within the one or more log files based on the one or more regular expressions, and generate one or more visual indications on the visual progress bar, wherein the one or more visual indications on the visual progress bar are based on the one or more log files in which the presence of the one or more patterns is determined Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Damodaran in to the system of Meshi in order to provide a user's specification can be converted into a regular expression, which can then be executed by on a plurality of message logs to identify patterns that match the user's specification (see Damodaran col. 15, lines 55-59). Meshi in view of Damodaran does not explicitly discloses receive one or more response lists, wherein in a response list of the one or more response lists is associated with a watchpoint of the one or more watchpoints and comprises a set of response options for the edge computing system operator to evaluate for responding to an alert associated with the watchpoint; determine the presence of one or more patterns within the received data based on the one or more watchpoints. However, in analogues art, Alagar discloses receive one or more response lists, wherein in a response list of the one or more response lists is associated with a watchpoint of the one or more watchpoints and comprises a set of response options for the edge computing system operator to evaluate for responding to an alert associated with the watchpoint (see Alagar pars.0031-0032, The intrusion analyzer engine 116 is configured to determine whether the attack vector array 136 comprises any set flag bits 402 and to trigger an event 137 (e.g. an alert or instructions) in response to determining that at least one flag bit 402 is set in the attack vector array 136. For instance, the intrusion analyzer engine 116 may block or redirect communications between the user device 102 and the web server 104 in response to determining that at least one flag bit 402 is set. The intrusion dashboard 118 may receive information 140 from the intrusion analyzer engine 116 about detected intrusions based on the attack vector array 136. The intrusion dashboard 118 may share or display the received information 140 which allows an operator to view the information about any detected attacks and to take appropriate action. For example, the information 140 may identify one or more detected attacks and may provide suggested actions to isolate or block the detected attacks); determine the presence of one or more patterns within the received data based on the one or more watchpoints (see Alagar par. 0031, the intrusion analyzer engine 116 is configured to determine whether the attack vector array 136 comprises any set flag bits 402 and to trigger an event 137 (e.g. an alert or instructions) in response to determining that at least one flag bit 402 is set in the attack vector array 136). Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Alagar in to the system of Meshi and Damodaran in order to include an intrusion analyzer engine is configured to determine whether the attack vector array comprises any set flag bits and to trigger an event (e.g. an alert or instructions) in response to determining that at least one flag bit is set in the attack vector array (see Alagar par. 0031). Regarding claim 15, Meshi discloses a non-transitory computer readable storage medium storing one or more programs for providing alerts and response options to an edge computing system operator, the one or more programs comprising instructions, which, when executed by an electronic device with a display and a user input interface, cause the device to: “receive one or more messages transmitted between a plurality components of the edge computing system” (see Meshi Fig. 4, par. 175, In step 112, processor 36 receives, from the SOC servers at the plurality of sources 28, respective sets of alerts 30 and/or incidents 32, wherein each of the sets comprises alerts 30 and/or incidents 32 from a given source 28); “receive one or more specifications of conditions to search for within the received one or more messages” (see Meshi par. 0180, In step 120, processor 36 applies labeling rules 50 to the alerts and/or incidents in the identified subset so as to assign respective rule-base alert labels 74 and rule-based incident labels 96 to the identified alerts and/or incidents); if the one or more patterns within the received data are determined to be present: “generate an alert to be displayed to the edge computing system operator on a graphical user interface, wherein the graphical user interface includes information pertaining to the one or patterns determined to be within the received data” (see Meshi Fig. 5, step 146, par. 0236-0237, in step 154, in response to a predicted label comprising the computed incident risk score, the given SOC processor in the given SOC server prioritizes the additional incident for handling by an SOC analyst, the given SOC processor in the given SOC server can prioritize the additional incident by prioritizing a notification in response to the predicted label. For example, presenting, on display 33, a notification (e.g., a warning message) comprising an ID, description and the computed incident risk score for the additional incidents); and “display the response list associated with the watchpoint pertaining to the one or more patterns determined to be present in the received data” (see Meshi par. 0237, the given SOC processor in the given SOC server can prioritize the additional incident by prioritizing a notification in response to the predicted label. For example, presenting, on display 33, a notification (e.g., a warning message) comprising an ID, description and the computed incident risk score for the additional incidents. In another embodiment, the given SOC processor can prioritize the notification by presenting the notification in different colors responsively to the computed risk score (e.g., green for lower risks and red for higher risks). Meshi does not explicitly discloses convert the one or more conditions into one or more watchpoints, wherein each watch point defines a pattern to be searched for in the data transmitted between the plurality of components. However, in analogues art, Damodaran discloses convert the one or more conditions into one or more watchpoints, wherein each watch point defines a pattern to be searched for in the data transmitted between the plurality of components (see Damodaran col. 21, lines 46-56, determine if the one or more user provided watchpoint declarations include one or more errors, convert the one or more user provided watchpoint declarations into one or more regular expressions, determine the presence of one or patterns within the one or more log files based on the one or more regular expressions, and generate one or more visual indications on the visual progress bar, wherein the one or more visual indications on the visual progress bar are based on the one or more log files in which the presence of the one or more patterns is determined); Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Damodaran in to the system of Meshi in order to provide a user's specification can be converted into a regular expression, which can then be executed by on a plurality of message logs to identify patterns that match the user's specification (see Damodaran col. 15, lines 55-59). Meshi in view of Damodaran does not explicitly discloses receive one or more response lists, wherein in a response list of the one or more response lists is associated with a watchpoint of the one or more watchpoints and comprises a set of response options for the edge computing system operator to evaluate for responding to an alert associated with the watchpoint; determine the presence of one or more patterns within the received data based on the one or more watchpoints. However, in analogues art, Alagar discloses receive one or more response lists, wherein in a response list of the one or more response lists is associated with a watchpoint of the one or more watchpoints and comprises a set of response options for the edge computing system operator to evaluate for responding to an alert associated with the watchpoint (see Alagar pars.0031-0032, The intrusion analyzer engine 116 is configured to determine whether the attack vector array 136 comprises any set flag bits 402 and to trigger an event 137 (e.g. an alert or instructions) in response to determining that at least one flag bit 402 is set in the attack vector array 136. For instance, the intrusion analyzer engine 116 may block or redirect communications between the user device 102 and the web server 104 in response to determining that at least one flag bit 402 is set. The intrusion dashboard 118 may receive information 140 from the intrusion analyzer engine 116 about detected intrusions based on the attack vector array 136. The intrusion dashboard 118 may share or display the received information 140 which allows an operator to view the information about any detected attacks and to take appropriate action. For example, the information 140 may identify one or more detected attacks and may provide suggested actions to isolate or block the detected attacks); determine the presence of one or more patterns within the received data based on the one or more watchpoints (see Alagar par. 0031, the intrusion analyzer engine 116 is configured to determine whether the attack vector array 136 comprises any set flag bits 402 and to trigger an event 137 (e.g. an alert or instructions) in response to determining that at least one flag bit 402 is set in the attack vector array 136). Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Alagar in to the system of Meshi and Damodaran in order to include an intrusion analyzer engine is configured to determine whether the attack vector array comprises any set flag bits and to trigger an event (e.g. an alert or instructions) in response to determining that at least one flag bit is set in the attack vector array (see Alagar par. 0031). 7. Claims 2, 9, and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Meshi et al. US Patent Application Publication NO. 2023/0224311 (hereinafter Meshi) in view of Damodaran et al. US Patent No. 10,521,331 (hereinafter Damodaran) in further view of Cook et al. US Patent Application Publication No. 2018/0196730 (hereinafter Cook). Regarding claims 2, 9, and 16, Meshi in view of Damodaran in further view of Alagar discloses the method of claim 1, Meshi in view of Damodaran in further view of Alagar does not explicitly discloses wherein the edge computing system comprises one or more streaming analytic engines configured to receive the one or more messages transmitted between the plurality components of the edge computing system, and wherein determining the presence of one or more patterns within the received data based on the one or more watchpoints comprises applying the one or more watchpoints to one or more of the streaming analytic engines of the edge computing system. However, in analogues art, Cook discloses wherein the edge computing system comprises one or more streaming analytic engines configured to receive the one or more messages transmitted between the plurality components of the edge computing system, and wherein determining the presence of one or more patterns within the received data based on the one or more watchpoints comprises applying the one or more watchpoints to one or more of the streaming analytic engines of the edge computing system (see Cook Fig. 9, pars. 0085-0094, FIG. 9 relate to firing a breakpoint based on a determination that a data block achieves a debug criterion. Aspects of the disclosure relate to the recognition that, in some distributed data batch processing environments, debugging streaming data may be associated with challenges as it may not be known which portions of streaming data encountered errors, as well as when, where, and why the errors occurred. Detecting the data block may include utilizing a streams management engine to scan the distributed batch data processing environment and identify one or more data blocks. At block 950, the data block may be analyzed by a debug management engine. The data block may be analyzed with respect to the debug criterion. Generally, analyzing can include determining information regarding the characteristics or properties of the data block (e.g., contents, parameters, configuration settings). Achievement of the debug criterion by the data block may be determined by the debug management engine. As an example, the breakpoint may include a watchpoint (e.g., type of breakpoint configured to stop execution of an application when the value of a specified expression achieves a particular value)). Therefore it would have been obvious to a person of ordinary skill in the art before the effective filing date of the application to incorporate the teachings of Cook in to the system of Meshi, Damodaran, and Alagar in order to include a data block may be analyzed by a debug management engine with respect to the debug criterion. Achievement of the debug criterion by the data block may be determined by the debug management engine. In response to determining the achievement of the debug criterion by the data block, the breakpoint may be fired based on the achievement of the debug criterion (see Cook par. 0028). Conclusion 8. Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAMUEL AMBAYE whose telephone number is (571)270-7635. The examiner can normally be reached M-F 9:00 AM - 6:00 PM. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached at (571) 272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /SAMUEL AMBAYE/Examiner, Art Unit 2433 /JEFFREY C PWU/Supervisory Patent Examiner, Art Unit 2433
Read full office action

Prosecution Timeline

Jul 11, 2022
Application Filed
Sep 19, 2024
Non-Final Rejection — §103
Jan 16, 2025
Response Filed
Apr 09, 2025
Non-Final Rejection — §103
Jun 23, 2025
Applicant Interview (Telephonic)
Jun 23, 2025
Examiner Interview Summary
Jul 14, 2025
Response Filed
Oct 18, 2025
Final Rejection — §103
Jan 21, 2026
Request for Continued Examination
Jan 22, 2026
Response after Non-Final Action
Jan 27, 2026
Non-Final Rejection — §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12603912
AUTOMATED SECURITY TESTING SYSTEM AND METHOD
2y 5m to grant Granted Apr 14, 2026
Patent 12596834
METHOD OF PROCESSING DATA FOR PERSONAL INFORMATION PROTECTION AND APPARATUS USING THE SAME
2y 5m to grant Granted Apr 07, 2026
Patent 12598057
SIMILARITY CALCULATION SYSTEM, SIMILARITY CALCULATION APPARATUS, SIMILARITY CALCULATION METHOD, AND SIMILARITY CALCULATION PROGRAM
2y 5m to grant Granted Apr 07, 2026
Patent 12593203
Remote identity verification and dynamic storage of identity data
2y 5m to grant Granted Mar 31, 2026
Patent 12574363
SYSTEM FOR USER-INITIATED AUTHENTICATION OF AN ELECTRONIC COMMUNICATION CHANNEL USING A SECURE COMPUTING APPLICATION TOKEN
2y 5m to grant Granted Mar 10, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

4-5
Expected OA Rounds
82%
Grant Probability
99%
With Interview (+25.1%)
3y 0m
Median Time to Grant
High
PTA Risk
Based on 670 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month