DETAILED ACTION
This action is responsive to communications filed on August 25, 2022. This action is made Non-Final.
Claims 1-10 are pending in the case.
Claims 1 and 6 are independent claims.
Claims 1, 2, 6, and 7 are rejected.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Receipt is acknowledged of papers submitted under 35 U.S.C. 119(a)-(d), which papers have been placed of record in the file.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are semantic processing module, a feature and vector processing module, a training module, a predicting module, in claim 6.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, 2, 6, and 7 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Step 1: Independent claims 1 and 6 are directed towards a method and system, respectively. Therefore, these claims, as well as their dependent claims, are directed towards one of the four statutory categories (process, machine (i.e. apparatus), manufacture, or composition of matter.
With respect to claim 1:
2A Prong 1:
Claim 1 recites the following judicial exceptions:
preliminarily processing a log data set to obtain a log entry word group corresponding to all semantics of a log sequence in the log data set, and using the log entry word group as a semantic feature of the log sequence, wherein the log data comprises more than one log sequence (mental process –can be performed in the human mind, or by a human using a pen and paper (e.g. a person may process log data to obtain sematic word groupings and using the semantic word groupings as semantic features).
extracting a type feature, a time feature and a quantity feature of the log sequence, and encoding the semantic feature, the type feature, the time feature and the quantity feature into a log feature vector set of the log sequence, wherein the log feature vector set comprises a type feature vector, a time feature vector, a quantity feature vector and a semantic feature vector (mental process –can be performed in the human mind, or by a human using a pen and paper (e.g. a person may identify features and construct vectors of features).
inputting the log data set to be detected into ... for prediction, and determining whether the log sequence is a normal or abnormal log sequence according to a prediction result (mental process –can be performed in the human mind, or by a human using a pen and paper (e.g. a person may identify features and construct vectors of features and apply rules or models to make inferences).
2A Prong 2: The additional elements recited in the claim do not integrate the judicial exception into a practical application.
Additional elements:
and the log sequence is formed by logs generated at intervales or by different processes; the log sequence comprises multiple log entries (mere instructions to apply the exception or implement the exception on a computer (e.g. a computer may be used to generate logs or records; see MPEP §2106.05(f).). The additional elements do not effectively integrate the abstract idea into a practical application. 2B: revisiting the additional elements, the additional elements do not amount to significantly more than the judicial exception – recited high level of generality and corresponds to storing and retrieving information in memory and performing calculations).
training an attention-mechanism-based BiGRU neural network model with all log feature vector sets to obtain a trained BiGRU neural network model; ... into the trained BiGRU neural network model (generally linking the use of a judicial exception to a particular technological environment or field of use (e.g. various neural networks may be trained and used to processes inputs and produce outputs; see MPEP §2106.05(h).). The additional elements do not effectively integrate the abstract idea into a practical application. 2B: revisiting the additional elements, the additional elements do not amount to significantly more than the judicial exception – recited high level of generality and corresponds to storing and retrieving information and performing calculations.).
With respect to claim 2:
2A Prong 1:
Claim 2 recites the following judicial exceptions:
marking log entries in the log sequence with word segmentation of natural language, in such a manner that each of the log entries obtains a marked word set, wherein words are marked as nouns or verbs; splitting the marked word set with a delimiter, wherein the delimiter comprises spaces, colons and commas; converting uppercase letters in a split word set into lowercase letters and deleting all non-characters marks to obtain the log entry word group corresponding to all semantics of the log sequence, which means the semantic feature of the log sequence is obtained, wherein the non-character marks comprise operators, punctuation, and numbers (mental process –can be performed in the human mind, or by a human using a pen and paper (e.g. a person may process log data and perform preprocessing of the log data to determine semantic features.).
With respect to claim 6:
Claim 6 corresponds to claim 1 and is rejected under the same rationale.
With respect to claim 7:
Claim 7 corresponds to claim 2 and is rejected under the same rationale.
2B continued: After considering all claim elements individually and as an ordered combination, it is determined that the claims do not include any additional elements that are sufficient to amount to significantly more than the judicial exception.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1 and 6 is/are rejected under 35 U.S.C. 103 as being unpatentable over Semichev et al., US Publication 2022/0084371 (“Semichev”), and further in view of Ahmadi et al., US Publication 2022/0108181 (“Ahmadi”).
Claim 1:
Semichev teaches or suggests a multi-feature log anomaly detection method based on log full semantics comprising steps of:
1: preliminarily preprocessing a log data set to obtain a log entry word group corresponding ... a log sequence in the log data set, and using the log entry word group as a semantic feature of the log sequence, wherein the log data set comprises more than one log sequence, and the log sequence is formed by logs generated at intervals or by different processes; the log sequence comprises multiple log entries (see Fig. 1A-5; para. 0026 – split and encode raw sequences of ATM logs (text or binary) to a machine-readable form consumable by a machine learning model. It may consist of process of normalizing data as well as converting it through an established vocabulary ( e.g., data dictionary) of possible ATM session activities to be encoded as sequence of numbers. build a finite vocabulary (e.g., data dictionary) on potentially infinite amount of ATM logs which enables the system to lookup a distinct numerical representation for each token ( e.g., word) that might be seen in the ATM logs. the tokenization process comprises transforming a plain text corpus of the ATM logs 102 into ATM session activities encoded sequences; para. 0027 – anomaly detection that may be understood as determining semantically similar activities between different ATM sessions; para. 0036 - ATM logs may be generated by respective ATMs and stored in a data lake or other storage mechanism associated with the respective financial institution, although in some embodiments, the ATM logs may be received in a continuous stream from the respective ATM directly.);
2: extracting a type feature, a time feature and a quantity feature of the log sequence, and encoding ... the type feature, the time feature and the quantity feature into a log feature vector set of the log sequence, wherein the log feature vector set comprises a type feature vector, a time feature vector, a quantity feature vector ... (see Fig. 1A-5; para. 0007 – first portion may be indicative of a first subgroup of ATM customer interactions for a first subgroup of customers and associated with a respective time period or geographic location; para. 0027 – ATM encoded sequences 108 (e.g. customer session activities) may be preprocessed into an input vector (e.g., paragraph vector 110A). input paragraph vector 110A may be the input of the self-supervised learning method. anomaly detection that may be understood as determining semantically similar activities between different ATM sessions; para. 0028 - input vectors (e.g. paragraph/ input vectors 110A) as a compressed data structure of an embedding vector; para. 0029 - iteratively calculate global latent vectors 114 for all the available ATM logs 102. a global latent vector 114 (e.g. a vector embedding); para. 0030 - encrypt every customer session activity encoded sequence 108 into a vector (e.g., a global latent vector 114) that may include 256 or more components; para. 0035 - determine a security measurement between the global latent vector 114 and a previously generated global latent vector 114 that is based on previous ATM customer activity. segment subgroups of customers based on behavioral anomalies to predict anomalous activity. For example, the system may identify subgroups based on potentially anomalous behaviors such as a customer making multiple small withdrawals to avoid a transaction being flagged for review, timing of actions ( e.g., button inputs to the ATM not corresponding to human control), etc.; para. 0039 - determine anomalous activity across a population (e.g., anomalous activity for a particular subgroup of the population across a respective geographical area or a respective time period) or for a particular customer ( e.g., by comparing previously generated embedding vectors corresponding to previous customer interaction data for a respective customer to a new embedding vector; para. 0043 – first portion of first global latent vector may be indicative of a first subgroup of customers of the aggregate customer ATM activity data (e.g., ATM data logs 102) for a specific geographical area or a specific time period; para. 0066 - isolate a first portion of the global latent vector indicative of a Customer Subgroup B ATM interactions associated with a particular geographic area or time period.);
3: training an attention-mechanism based BiGRU neural network model with all log feature vector sets to obtain a trained BiGRU neural network mode (see Fig. 1A-5; para. 0004 - training procedure to learn how to represent complicated customer ATM interaction data in a tokenized format of a plurality of tensors. The model may employ a bidirectional recurrent neural network (RNN) in order to enable the detection of anomalous ATM customer interactions to secure and authenticate a customer session. Once the model has completed the unsupervised learning process of latent vectors (e.g., latent vector embeddings), the system may additionally receive a second data array that includes customer interaction data, encrypt the second data array into a customer session vector using the trained model, and calculate a security measurement between the customer session vector and a portion of the first global latent vector from the training portion of the model; para. 0005 - system may reduce a difference (e.g., minimize an error) between the first plurality of tensors and the second plurality of tensors according to an objective function of the bidirectional RNN model; para. 0006 - sufficient unsupervised training; para. 0023 – system may implement a bidirectional implementation of a recurrent neural network in order to encrypt the ATM customer activity into a compressed data structure (e.g., a global latent vector, as describe in more detail with respect to FIGS. lA-1B and FIG. 2), and decrypt the compressed data structure. a bidirectional neural network model to receive context information from past states and future states simultaneously during training, improving quality of latent vectors. In some embodiments the bidirectional RNN model may be combined with a mechanism to improve the ability of the model to create contextual connection between session activities that are distant in the input sequence. For example, the mechanism may comprise an attention mechanism that is combined with an input to the RNN allowing the RNN to focus on certain parts of the input sequence when predicting other parts of the output sequence, which may enable superior self-supervised learning of the model. In other embodiments, the mechanism may comprise one of a long short-term memory mechanism (LSTM) and/or a gated recurrent unit (GRU). In some embodiments, a GRU may be implemented in tandem with an attention mechanism to improve to bidirectional RNN model.); and
4: inputting the log data set to be detected into the trained BiGRU neural network model for prediction, and determining whether the log sequence is a normal or abnormal log sequence according to a prediction result (see Fig. 1A-5; para. 0004 - training procedure to learn how to represent complicated customer ATM interaction data in a tokenized format of a plurality of tensors. The model may employ a bidirectional recurrent neural network (RNN) in order to enable the detection of anomalous ATM customer interactions to secure and authenticate a customer session. Once the model has completed the unsupervised learning process of latent vectors (e.g., latent vector embeddings), the system may additionally receive a second data array that includes customer interaction data, encrypt the second data array into a customer session vector using the trained model, and calculate a security measurement between the customer session vector and a portion of the first global latent vector from the training portion of the model; para. 0005 - system may reduce a difference (e.g., minimize an error) between the first plurality of tensors and the second plurality of tensors according to an objective function of the bidirectional RNN model; para. 0006 - sufficient unsupervised training; para. 0023 – system may implement a bidirectional implementation of a recurrent neural network in order to encrypt the ATM customer activity into a compressed data structure (e.g., a global latent vector, as describe in more detail with respect to FIGS. lA-1B and FIG. 2), and decrypt the compressed data structure. a bidirectional neural network model to receive context information from past states and future states simultaneously during training, improving quality of latent vectors. In some embodiments the bidirectional RNN model may be combined with a mechanism to improve the ability of the model to create contextual connection between session activities that are distant in the input sequence. For example, the mechanism may comprise an attention mechanism that is combined with an input to the RNN allowing the RNN to focus on certain parts of the input sequence when predicting other parts of the output sequence, which may enable superior self-supervised learning of the model. In other embodiments, the mechanism may comprise one of a long short-term memory mechanism (LSTM) and/or a gated recurrent unit (GRU). In some embodiments, a GRU may be implemented in tandem with an attention mechanism to improve to bidirectional RNN model.).
Semichev does not explicitly disclose corresponding to all semantics of ... as a semantic feature; the semantic feature ... a semantic feature vector.
Ahmadi teaches or suggests corresponding to all semantics of ... as a semantic feature; the semantic feature ... a semantic feature vector (see para. 0014 - train a recurrent neural network (RNN) with residual blocks and sequences of log messages in order to perform both feature embedding and anomaly detection; para. 0017 - RNN model suits the inherent sequential nature of log data. Feature embedding by the autoencoder model provides more generalization of input samples and denser semantic feature vectors such as discussed herein. Such improved feature extraction and encoding reduces computational complexity of the entire deep network; para. 0043 - autoencoder 181 extracts semantic features of a log entry in isolation and regardless of which log entries are adjacent to it in log 110. In some ways, autoencoder 181 acts as a transcoder of semantic features of a log entry from the entry's original format into a natural vocabulary that emerges within autoencoder 181 during training.).
Accordingly, it would have been obvious to one having ordinary skill before the effective filing date of the claimed invention to modify the system and method, taught in Semichev, to include corresponding to all semantics of ... as a semantic feature; the semantic feature ... a semantic feature vector for the purpose of efficiently encoding features extracted from logs, using an autoencoder model, into denser semantic feature vectors, reducing computational complexity of a deep neural network, as taught by Ahmadi (0017).
Claim(s) 6:
Claim(s) 6 correspond to Claim 1, and thus, Semichev and Ahmadi teach or suggest the limitations of claim(s) 6 as well.
Claim(s) 2 and 7 is/are rejected under 35 U.S.C. 103 as being unpatentable over Semichev, in view of Ahmadi, in view of Krishnamurthy et al., US Publication 2022/0036175 (“Krishnamurthy”), and further in view of Garty et al., US Publication 2021/0383801 (“Garty”).
Claim 2:
As indicated above, Semichev and Ahmadi teach or suggests to obtain the log entry word group corresponding to all the semantics of the log sequence, which means the semantic feature of the log sequence is obtained.
Krishnamurthy further teaches or suggests marking the log entries in the log sequence with word segmentation of natural language, in such a manner that each of the log entries obtains a marked word set, wherein words are marked as nouns or verbs; ... and deleting all non-character marks ... wherein the non-character marks comprise operators, punctuation, and numbers (see para. 0070 - data clean-up module 341 and a part-of-speech tagger 343. data clean-up module 341 obtains the issues 309 from the issue intake module 327 and the system logs 329 from the log intake module 331, and performs various preprocessing on the issues 309 and system logs 329; pre-processing may include: removing digits, punctuation and symbols; removing alphanumeric characters; removing identifiers. part-of-speech tagger 343 leverages a Natural Language Tool Kit (NLTK) package and assigns one of the parts of speech to each word in a sentence (e.g., as nouns, verbs, adverbs, adjectives, pronouns, conjunction, sub-categories thereof, etc.).
Accordingly, it would have been obvious to one having ordinary skill before the effective filing date of the claimed invention to modify the system and method, taught in Semichev, to include marking the log entries in the log sequence with word segmentation of natural language, in such a manner that each of the log entries obtains a marked word set, wherein words are marked as nouns or verbs; ... and deleting all non-character marks ... wherein the non-character marks comprise operators, punctuation, and numbers for the purpose of efficiently preprocessing and cleansing system logs for further processing, reducing resource usage, as taught by Krishamurthy (0070).
Garty further teaches or suggests splitting the marked word set with a delimiter, wherein the delimiter comprises spaces, colons and commas; converting uppercase letters in a split word set into lowercase letters (see para. 0014 - normalizing the token words ( e.g., removing special characters and/or numbers, converting uppercase to lowercase, etc.), filtering out high frequency keywords that are considered non-differentiating (e.g., based on a term frequency-inverse document frequency (TD-IDF) or similar approach), and stemming token words; para. 0027 - token words are extracted by regarding the block of text as token words separated by specified delimiters ( e.g., blank spaces, periods, slashes, numerical values, specific character sequences, etc.) that define boundaries of token words; para. 0028 - processing can be regarded as removing noise to arrive at a subset of eligible token words that are more likely to be descriptive of the specific process grouping; para. 0031 - set of token words is generated based on utilizing such punctuation (e.g., periods, commas, colons, semi-colons, etc.), blank spaces, numbers, and special characters (e.g., slashes, dashes, asterisks, ampersands, etc.) as delimiters to separate instances of token words; Claim 5 - identifying sequences of text characters bounded by one or more specified delimiting text characters.).
Accordingly, it would have been obvious to one having ordinary skill before the effective filing date of the claimed invention to modify the system and method, taught in Semichev, to include splitting the marked word set with a delimiter, wherein the delimiter comprises spaces, colons and commas; converting uppercase letters in a split word set into lowercase letters for the purpose of efficiently normalizing and separating tokens, improving token identification, extraction, and optimizing further processing, as taught by Garty (0027, 0028, and 0031).
Claim(s) 7:
Claim(s) 7 correspond to Claim 2, and thus, Semichev, Ahmadi, Krishnamurthy, and Garty teach or suggest the limitations of claim(s) 7 as well.
Allowable Subject Matter
Claims 3, 4, 5, 8, 9, and 10 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Andrew T McIntosh whose telephone number is (571)270-7790. The examiner can normally be reached M-Th 8:00am-5:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Tamara Kyle can be reached at 571-272-4241. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ANDREW T MCINTOSH/Primary Examiner, Art Unit 2144
Prosecution Insights