Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement submitted on 10/16/2025 and 12/22/2025 are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Response to Amendment
The Amendment filed 11/17/2025 has been entered. Claims 1-20 remain pending in this application.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 1, 4, 7, 9, 11, 14, 17 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over (Givental et al. US 11374953 B2 hereinafter Givental) in view of (Berls et al. US 20230103833 A1 hereinafter Berls) and Givental et al. (US 20210264025 A1 hereinafter Givental2)
As to independent claim 1, Givental teaches a method comprising: first inferring, by each anomaly detector of at least three anomaly detectors, a respective anomaly inference for each [[tuple of a plurality of tuples;]] [an ensemble of models (detectors) that generate labels and score (infer) using log data Col. 1 ln. 57-65 "a hybrid machine learning (ML) anomaly detector comprising an ensemble of unsupervised machine learning models and a semi-supervised machine learning model. The method comprises executing, by the hybrid ML anomaly detector, the ensemble of unsupervised machine learning models on log data to generate, for each entry in the log data, a predicted anomaly score and corresponding anomaly classification label of the entry as to whether the entry represents an anomalous event. "]
performing for each candidate anomaly detector of the at least three anomaly detectors: [candidates for inclusion to an ensemble Col. 19 ln. 15-25]
measuring, respectively for each particular anomaly detector of the at least three anomaly detectors that is not the candidate anomaly detector, a respective fitness score for the candidate anomaly detector that indicates how similar are said anomaly inferences of the candidate anomaly detector to said anomaly inferences of the particular anomaly detector, and [measures performance of individual models (fitness) Col. 11 ln. 32-50 "metrics may be maintained for each of the ML models with regard to their accuracy and/or precision in predicting classifications or labels for the inputs, as well as other performance metrics, and these metrics may be used as a basis for selecting the X number of ML models, e.g., X ML models having a relatively highest accuracy amongst the plurality of ML models "]
combining said fitness scores of the candidate anomaly detector into a combined fitness score for the candidate anomaly detector; [combines scores into a single score for anomaly detection from individual models Col. 13 ln .47-67 " combine the weighted anomaly scores from the individual unsupervised ML models 122-126 into a single anomaly score for the particular log entry/event that was evaluated by the ensemble 120"…"sum of the individual unsupervised ML models 122-126 scores"]
Givental does not specifically teach second inferring, by the single best anomaly detector that has a highest combined fitness score, an anomaly inference for a tuple that is not in the plurality of tuples.
However, Berls teaches second inferring, by the single best anomaly detector that has a highest combined fitness score, an anomaly inference for a tuple that is not in the plurality of tuples. [feature tuples (input for model or computing entity) used to infer ¶14 "predictive anomaly detection that are able to efficiently and reliably generate predictive inferences across datasets/databases/tables" ¶69 "predictive data analysis computing entity 106 determines a feature tuple anomaly score for each feature tuple that is associated with the particular non-constant defined interaction level"]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection disclosed by Givental by incorporating the second inferring, by the single best anomaly detector that has a highest combined fitness score, an anomaly inference for a tuple that is not in the plurality of tuples disclosed by Berls because both techniques address the same field of machine learning and by incorporating Berls into Givental improve the reliability and efficiency of predictions and inferences across datasets [Berls ¶14]
Givental and Berls do not specifically teach selecting a single best anomaly detector of the at least three anomaly detectors that has a highest combined fitness score;
However, Givental2 teaches selecting a single best anomaly detector of the at least three anomaly detectors that has a highest combined fitness score; [combines scores for ranking and selects the best suited model ¶32-34 "scores are combined to generate a relative ranking for each of the trained ML models,"… " select a corresponding ML model that is best suited for classifying the incoming log"…"best suited ML model for processing the input log and generating the most accurate classification, with the highest achievable confidence, and lowest risk achievable by the trained ML models"]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental and Berls by incorporating the selecting a single best anomaly detector of the at least three anomaly detectors that has a highest combined fitness score disclosed by Givental2 because all techniques address the same field of machine learning and by incorporating Givental2 into Givental and Berls enhances anomaly detection for more accurate identification and reducing false positives [Givental2 ¶18]
As to dependent claim 4, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated, Givental, Berls and Givental2 further teach wherein an anomaly inference of the single best anomaly detector is a binary detection class. [Givental2 binary output classification ¶26]
As to dependent claim 7, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated, Givental, Berls and Givental2 further teach constrained by at least one selected from the group consisting of:
a) the method occurs in polynomial time with respect to a count of at least one selected from the group consisting of the plurality of anomaly detectors and the plurality of tuples, and
b) the method occurs entirely within a machine learning (ML) pipeline. [Givental2 training process (pipeline) with splitting, training and classifying ¶27)
As to dependent claim 9, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated, Givental, Berls and Givental2 further teach wherein the single best anomaly detector does not comprise an artificial neural network (ANN). [Givental forest or SVM model Col. 4 ln. 5-18]
As to independent claim 11, Givental teaches one or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause: [processing devices and instruction on storage Col. 8 ln .4-18]
first inferring, by each anomaly detector of at least three anomaly detectors, a respective anomaly inference for each [[tuple of a plurality of tuples;]] [an ensemble of models (detectors) that generate labels and score (infer) using log data Col. 1 ln. 57-65 "a hybrid machine learning (ML) anomaly detector comprising an ensemble of unsupervised machine learning models and a semi-supervised machine learning model. The method comprises executing, by the hybrid ML anomaly detector, the ensemble of unsupervised machine learning models on log data to generate, for each entry in the log data, a predicted anomaly score and corresponding anomaly classification label of the entry as to whether the entry represents an anomalous event. "]
performing for each candidate anomaly detector of the at least three anomaly detectors: [candidates for inclusion to an ensemble Col. 19 ln. 15-25]
measuring, respectively for each particular anomaly detector of the at least three anomaly detectors that is not the candidate anomaly detector, a respective fitness score for the candidate anomaly detector that indicates how similar are said anomaly inferences of the candidate anomaly detector to said anomaly inferences of the particular anomaly detector, and [measures performance of individual models (fitness) Col. 11 ln. 32-50 "metrics may be maintained for each of the ML models with regard to their accuracy and/or precision in predicting classifications or labels for the inputs, as well as other performance metrics, and these metrics may be used as a basis for selecting the X number of ML models, e.g., X ML models having a relatively highest accuracy amongst the plurality of ML models "]
combining said fitness scores of the candidate anomaly detector into a combined fitness score for the candidate anomaly detector; [combines scores into a single score for anomaly detection from individual models Col. 13 ln .47-67 " combine the weighted anomaly scores from the individual unsupervised ML models 122-126 into a single anomaly score for the particular log entry/event that was evaluated by the ensemble 120"…"sum of the individual unsupervised ML models 122-126 scores"]
Givental does not specifically teach second inferring, by the single best anomaly detector that has a highest combined fitness score, an anomaly inference for a tuple that is not in the plurality of tuples.
However, Berls teaches second inferring, by the single best anomaly detector that has a highest combined fitness score, an anomaly inference for a tuple that is not in the plurality of tuples. [feature tuples (input for model or computing entity) used to infer ¶14 "predictive anomaly detection that are able to efficiently and reliably generate predictive inferences across datasets/databases/tables" ¶69 "predictive data analysis computing entity 106 determines a feature tuple anomaly score for each feature tuple that is associated with the particular non-constant defined interaction level"]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection disclosed by Givental by incorporating the second inferring, by the single best anomaly detector that has a highest combined fitness score, an anomaly inference for a tuple that is not in the plurality of tuples disclosed by Berls because both techniques address the same field of machine learning and by incorporating Berls into Givental improve the reliability and efficiency of predictions and inferences across datasets [Berls ¶14]
Givental and Berls do not specifically teach selecting a single best anomaly detector of the at least three anomaly detectors that has a highest combined fitness score;
However, Givental2 teaches selecting a single best anomaly detector of the at least three anomaly detectors that has a highest combined fitness score; [combines scores for ranking and selects the best suited model ¶32-34 "scores are combined to generate a relative ranking for each of the trained ML models,"… " select a corresponding ML model that is best suited for classifying the incoming log"…"best suited ML model for processing the input log and generating the most accurate classification, with the highest achievable confidence, and lowest risk achievable by the trained ML models"]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental and Berls by incorporating the selecting a single best anomaly detector of the at least three anomaly detectors that has a highest combined fitness score disclosed by Givental2 because all techniques address the same field of machine learning and by incorporating Givental2 into Givental and Berls enhances anomaly detection for more accurate identification and reducing false positives [Givental2 ¶18]
As to dependent claim 14, Givental, Berls and Givental2 teach the method of claim 11 above that is incorporated, Givental, Berls and Givental2 further teach wherein an anomaly inference of the single best anomaly detector is a binary detection class. [Givental2 binary output classification ¶26]
As to dependent claim 17, Givental, Berls and Givental2 teach the method of claim 11 above that is incorporated, Givental, Berls and Givental2 further teach constrained by at least one selected from the group consisting of:
a) the method occurs in polynomial time with respect to a count of at least one selected from the group consisting of the plurality of anomaly detectors and the plurality of tuples, and
b) the method occurs entirely within a machine learning (ML) pipeline. [Givental2 training process (pipeline) with splitting, training and classifying ¶27)
As to dependent claim 19, Givental, Berls and Givental2 teach the method of claim 11 above that is incorporated, Givental, Berls and Givental2 further teach wherein the single best anomaly detector does not comprise an artificial neural network (ANN). [Givental forest or SVM model Col. 4 ln. 5-18]
Claims 2-3, 6, 10, 12-13, 16 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Givental in view of Berls and Givental2, as applied in the rejection of claim 1 and 11 above, and further in view of Ranganathan et al. (US 11965399 B2 hereinafter Ranganathan)
As to dependent claim 2, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach repeating a particular step for each contamination factor of a plurality of predefined contamination factors, wherein the particular step is at least one selected from the group consisting of said first inferring and said measuring.
However, Ranganathan teaches repeating a particular step for each contamination factor of a plurality of predefined contamination factors, wherein the particular step is at least one selected from the group consisting of said first inferring and said measuring. [calculates several contamination values for anomalies Col. 4-5 ln. 61-6 "anomalies for each contamination value is recorded. The contamination value which has the highest variance or rate of change of the number points marked as anomalies is chosen as the ideal contamination value."]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the repeating a particular step for each contamination factor of a plurality of predefined contamination factors, wherein the particular step is at least one selected from the group consisting of said first inferring and said measuring disclosed by Ranganathan because all techniques address the same field of machine learning and by incorporating Ranganathan into Givental, Berls and Givental2 provides more ideal parameter values for models thereby improving anomaly detection [Ranganathan Col. 4 ln. 48-65]
As to dependent claim 3, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein an unknown of the plurality of tuples is at least one selected from the group consisting of an actual contamination factor and correct labels. Givental does teach label confidence or correctness of labels [Givental correct class (label) confidence Col. 12 ln. 30-40]
However, Ranganathan teaches wherein an unknown of the plurality of tuples is at least one selected from the group consisting of an actual contamination factor and correct labels. [score compared to contamination Col. 4 ln. 42-50]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the repeating a particular step for each contamination factor of a plurality of predefined contamination factors, wherein the particular step is at least one selected from the group consisting of said first inferring and said measuring disclosed by Ranganathan because all techniques address the same field of machine learning and by incorporating Ranganathan into Givental, Berls and Givental2 provides more ideal parameter values for models thereby improving anomaly detection [Ranganathan Col. 4 ln. 48-65]
As to dependent claim 6, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein the plurality of anomaly detectors contains a first anomaly detector and a second anomaly detector that has a different value for a same hyperparameter as the first anomaly detector.
However, Ranganathan teaches wherein the plurality of anomaly detectors contains a first anomaly detector and a second anomaly detector that has a different value for a same hyperparameter as the first anomaly detector. [Varies parameters like minPts and DBscan Col. 5 ln .7-40 " The minPts is varied within a range example: 50 to 300 (the range may be an empirical percentage of total number of depths) at a step of 5 or 10. The number of points marked as anomalies for each minPts value is recorded."]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the wherein the plurality of anomaly detectors contains a first anomaly detector and a second anomaly detector that has a different value for a same hyperparameter as the first anomaly detector disclosed by Ranganathan because all techniques address the same field of machine learning and by incorporating Ranganathan into Givental, Berls and Givental2 provides more ideal parameter values for models thereby improving anomaly detection [Ranganathan Col. 4 ln. 48-65]
As to dependent claim 10, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein contamination factor is not a hyperparameter of the single best anomaly detector.
However, Ranganathan teaches wherein contamination factor is not a hyperparameter of the single best anomaly detector. [Ranganathan algorithm/model/detector requires contamination Col. 4 ln. 48-60 "(28) The isolation forest algorithm requires a value for contamination at 203. There are three options to estimate contamination."]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the wherein contamination factor is not a hyperparameter of the single best anomaly detector disclosed by Ranganathan because all techniques address the same field of machine learning and by incorporating Ranganathan into Givental, Berls and Givental2 provides more ideal parameter values for models thereby improving anomaly detection [Ranganathan Col. 4 ln. 48-65]
As to dependent claim 12, Givental, Berls and Givental2 teach the method of claim 11 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach repeating a particular step for each contamination factor of a plurality of predefined contamination factors, wherein the particular step is at least one selected from the group consisting of said first inferring and said measuring.
However, Ranganathan teaches repeating a particular step for each contamination factor of a plurality of predefined contamination factors, wherein the particular step is at least one selected from the group consisting of said first inferring and said measuring. [calculates several contamination values for anomalies Col. 4-5 ln. 61-6 "anomalies for each contamination value is recorded. The contamination value which has the highest variance or rate of change of the number points marked as anomalies is chosen as the ideal contamination value."]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the repeating a particular step for each contamination factor of a plurality of predefined contamination factors, wherein the particular step is at least one selected from the group consisting of said first inferring and said measuring disclosed by Ranganathan because all techniques address the same field of machine learning and by incorporating Ranganathan into Givental, Berls and Givental2 provides more ideal parameter values for models thereby improving anomaly detection [Ranganathan Col. 4 ln. 48-65]
As to dependent claim 13, Givental, Berls and Givental2 teach the method of claim 11 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein an unknown of the plurality of tuples is at least one selected from the group consisting of an actual contamination factor and correct labels. Givental does teach label confidence or correctness of labels [Givental correct class (label) confidence Col. 12 ln. 30-40]
However, Ranganathan teaches wherein an unknown of the plurality of tuples is at least one selected from the group consisting of an actual contamination factor and correct labels. [score compared to contamination Col. 4 ln. 42-50]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the repeating a particular step for each contamination factor of a plurality of predefined contamination factors, wherein the particular step is at least one selected from the group consisting of said first inferring and said measuring disclosed by Ranganathan because all techniques address the same field of machine learning and by incorporating Ranganathan into Givental, Berls and Givental2 provides more ideal parameter values for models thereby improving anomaly detection [Ranganathan Col. 4 ln. 48-65]
As to dependent claim 16, Givental, Berls and Givental2 teach the method of claim 11 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein the plurality of anomaly detectors contains a first anomaly detector and a second anomaly detector that has a different value for a same hyperparameter as the first anomaly detector.
However, Ranganathan teaches wherein the plurality of anomaly detectors contains a first anomaly detector and a second anomaly detector that has a different value for a same hyperparameter as the first anomaly detector. [Varies parameters like minPts and DBscan Col. 5 ln .7-40 " The minPts is varied within a range example: 50 to 300 (the range may be an empirical percentage of total number of depths) at a step of 5 or 10. The number of points marked as anomalies for each minPts value is recorded."]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the wherein the plurality of anomaly detectors contains a first anomaly detector and a second anomaly detector that has a different value for a same hyperparameter as the first anomaly detector disclosed by Ranganathan because all techniques address the same field of machine learning and by incorporating Ranganathan into Givental, Berls and Givental2 provides more ideal parameter values for models thereby improving anomaly detection [Ranganathan Col. 4 ln. 48-65]
As to dependent claim 20, Givental, Berls and Givental2 teach the method of claim 11 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein contamination factor is not a hyperparameter of the single best anomaly detector.
However, Ranganathan teaches wherein contamination factor is not a hyperparameter of the single best anomaly detector. [Ranganathan algorithm/model/detector requires contamination Col. 4 ln. 48-60 "(28) The isolation forest algorithm requires a value for contamination at 203. There are three options to estimate contamination."]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the wherein contamination factor is not a hyperparameter of the single best anomaly detector disclosed by Ranganathan because all techniques address the same field of machine learning and by incorporating Ranganathan into Givental, Berls and Givental2 provides more ideal parameter values for models thereby improving anomaly detection [Ranganathan Col. 4 ln. 48-65]
Claims 5 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Givental in view of Berls and Givental2, as applied in the rejection of claim 1 and 11 above, and further in view of van Opijnen et al. (US 11591634 B1 hereinafter van Opijnen)
As to dependent claim 5, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein said measuring said fitness scores for the single best anomaly detector comprises applying at least one selected from the group consisting of: F1 scoring, balanced accuracy measurement, precision at n (PAN), mean squared error, normalized discounted cumulative gain (NDCG), mutual information, cross entropy, logistic loss, log loss, and Kullback-Leibler (KL) divergence.Givental does teach precision and loss [see Col. 11 ln. 35-40, Col. 3 ln. 21-30]
However, van Opijnen teaches wherein said measuring said fitness scores for the single best anomaly detector comprises applying at least one selected from the group consisting of: F1 scoring, balanced accuracy measurement, precision at n (PAN), mean squared error, normalized discounted cumulative gain (NDCG), mutual information, cross entropy, logistic loss, log loss, and Kullback-Leibler (KL) divergence. [balanced accuracy Col. 8 ln. 54-58 and mean squared error Col. 25-26 ln, 63-3]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the wherein said measuring said fitness scores for the single best anomaly detector comprises applying at least one selected from the group consisting of: F1 scoring, balanced accuracy measurement, precision at n (PAN), mean squared error, normalized discounted cumulative gain (NDCG), mutual information, cross entropy, logistic loss, log loss, and Kullback-Leibler (KL) divergence disclosed by van Opijnen because all techniques address the same field of machine learning and by incorporating van Opijnen into Givental, Berls and Givental2 enables improved predictions utilizing tuning, entropy for more optimized models [van Opijnen Col. 4 ln .18-32]
As to dependent claim 15, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein said measuring said fitness scores for the single best anomaly detector comprises applying at least one selected from the group consisting of: F1 scoring, balanced accuracy measurement, precision at n (PAN), mean squared error, normalized discounted cumulative gain (NDCG), mutual information, cross entropy, logistic loss, log loss, and Kullback-Leibler (KL) divergence.
Givental does teach precision and loss [see Col. 11 ln. 35-40, Col. 3 ln. 21-30]
However, van Opijnen teaches wherein said measuring said fitness scores for the single best anomaly detector comprises applying at least one selected from the group consisting of: F1 scoring, balanced accuracy measurement, precision at n (PAN), mean squared error, normalized discounted cumulative gain (NDCG), mutual information, cross entropy, logistic loss, log loss, and Kullback-Leibler (KL) divergence. [balanced accuracy Col. 8 ln. 54-58 and mean squared error Col. 25-26 ln, 63-3]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the wherein said measuring said fitness scores for the single best anomaly detector comprises applying at least one selected from the group consisting of: F1 scoring, balanced accuracy measurement, precision at n (PAN), mean squared error, normalized discounted cumulative gain (NDCG), mutual information, cross entropy, logistic loss, log loss, and Kullback-Leibler (KL) divergence disclosed by van Opijnen because all techniques address the same field of machine learning and by incorporating van Opijnen into Givental, Berls and Givental2 enables improved predictions utilizing tuning, entropy for more optimized models [van Opijnen Col. 4 ln .18-32]
Claims 8 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Givental in view of Berls and Givental2, as applied in the rejection of claim 1 and 11 above, and further in view of Marwah et al. (US 20200380117 A1 hereinafter Marwah)
As to dependent claim 8, Givental, Berls and Givental2 teach the method of claim 1 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein said combining said fitness scores of the single best anomaly detector comprises calculating at least one selected from the group consisting of an average and a median.
However, v Marwah teaches wherein said combining said fitness scores of the single best anomaly detector comprises calculating at least one selected from the group consisting of an average and a median. [¶18 "A naïve aggregation (e.g., computing the mean, median, mode, etc.) of the anomaly scores from the large number of anomaly detectors can produce inaccurate results, such as false positives or false negatives. "]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the wherein said combining said fitness scores of the single best anomaly detector comprises calculating at least one selected from the group consisting of an average and a median disclosed by Marwah because all techniques address the same field of machine learning and by incorporating Marwah into Givental, Berls and Givental2 help reduce issues and maintain performance against threats [Marwah ¶12]
As to dependent claim 18, Givental, Berls and Givental2 teach the method of claim 11 above that is incorporated,
Givental, Berls and Givental2 do not specifically teach wherein said combining said fitness scores of the single best anomaly detector comprises calculating at least one selected from the group consisting of an average and a median.
However, v Marwah teaches wherein said combining said fitness scores of the single best anomaly detector comprises calculating at least one selected from the group consisting of an average and a median. [¶18 "A naïve aggregation (e.g., computing the mean, median, mode, etc.) of the anomaly scores from the large number of anomaly detectors can produce inaccurate results, such as false positives or false negatives. "]
Accordingly, it would have been obvious to a person of ordinary skill in the art before the effective filling date of the claimed invention to modify the anomaly detection system disclosed by Givental, Berls and Givental2 by incorporating the wherein said combining said fitness scores of the single best anomaly detector comprises calculating at least one selected from the group consisting of an average and a median disclosed by Marwah because all techniques address the same field of machine learning and by incorporating Marwah into Givental, Berls and Givental2 help reduce issues and maintain performance against threats [Marwah ¶12]
Response to Arguments
Applicant's arguments filed 11/17/2025. In the remark, applicant argues that:
(1) Givental and Berls fail to teach “selecting a single best anomaly detector of the at least three anomaly detectors that has a highest combined fitness score; and” as recited by amended claim 1.
As to point (1), Applicant’s arguments with respect to claim 1 have been considered but are moot in view of a new ground of rejection as set forth above of Givental in view of Berls and Givental2.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Applicant is required under 37 C.F.R. § 1.111(c) to consider these references fully when responding to this action.
Zhu et al. (US 10275683 B2) teaches choosing based on the total similarity score (see Col. 3 ln. 45-54)
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BEAU SPRATT whose telephone number is (571)272-9919. The examiner can normally be reached M-F 8:30-5 PST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jennifer Welch can be reached on 5712127212. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BEAU D SPRATT/Primary Examiner, Art Unit 2143
Prosecution Insights