Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The present office action is responsive to communication received on 06/11/2025. Claims 1-20 are presented for examination.
Response to Arguments
Applicant’s arguments, filed 06/11/2025, with respect to previous 35 U.S.C 101, and 112 rejections as well as previous claim objections have been fully considered and are persuasive in light of amended claims and amendments to the specification. All previous objections to the claims and specification have been withdrawn. All previous 35 U.S.C 101 and 112 rejections have been withdrawn.
Applicant’s arguments, filed 06/11/2025, with respect to the rejection(s) of claim(s) 1,10,11,19,and 20 under 35 U.S.C 102 have been fully considered and are persuasive in that Prabhakar does iteratively execute the model. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Lee et al.( “Peak Anomaly Detection from Environmental Sensor-Generated Watershed Time Series Data” : hereafter Lee).
On page 9, Applicant argues Prabhakar does not recite or disclose that the model also receives a separate “first data slice”. However, Fig 2 of Prabhakar discloses that the anomaly detector model receives current time-series data 212, as a “first data slice”, as input. Therefore disclosing that the model also receives a separate “first data slice.”.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-2, 4, 10-11, 13, 19-20 and are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1,3,5, 8,10, 12, 15, and 17 of U.S. Patent No. 12,265,521(reference application). Although the claims at issue are not identical, they are not patentably distinct from each other because the instant claims are a broader version of the US Patent and they are claiming generating slices of aggregated data and iteratively adding data slices to detect an anomaly. Therefore, claims 1-2 and 4 are anticipated by claims 1,3,and 5 of the reference application. The other claims are rejected respectively and similarly for the same reason.
Claims 3,7, 12, and 16 are rejected on the ground of nonstatutory double patenting as being unpatentable over claim 1 of U.S. Patent No. 12,265,521(reference application) in view of Kursun et al. (US-20200167786-A1).
In regards to claim 3, Claim 1 of the reference application teaches the method of claim 1, but lacks wherein the set of data slices includes a second data slice corresponding to a second value for a second attribute, and wherein based on determining that a percentage of anomalous activity associated with one or more data records corresponding to the second data slice is above a threshold percentage, combining, by the server, the second data slice with a third data slice of the set of data slices. However, Kursun, in the same field of endeavor discloses a system for anomaly detection and remediation based on dynamic directed graph network flow analysis of transactions that teaches …wherein the set of data slices includes a second data slice corresponding to a second value for a second attribute, and wherein based on determining that a percentage of anomalous activity associated with one or more data records corresponding to the second data slice is above a threshold percentage, combining, by the server, the second data slice with a third data slice of the set of data slices (Kursun: The system groups the transaction data into nodal sets based on accounts associated with the transaction where the transactions represent edges and the accounts represents nodes. The system analyzes each edge to calculate custom entropy and divergence values for determining anomalous activity. When anomalous activity is determined based on the calculated entropy and divergence, the system may identify a first nodal set linked to the activity an execute a remedial action or identify a second nodal set and combining the set into a single super node for more analysis (Paragraphs 03-05) Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the reference application with the anomaly detection system taught by Kursun. The motivation to do so would be to improve anomaly identification success rate and address anomalous activity in real time (Kursun; Paragraph 01).
In regards to claim 7, Claim 1 of the reference application teaches the method of claim 1, but lacks determining, by the server based on the identification of the anomaly, a remediation action corresponding to the identified anomaly. Kursun, in the same field of endeavor, discloses an anomaly detection system based on clustered transactions that teaches… determining, by the server based on the identification of the anomaly, a remediation action corresponding to the identified anomaly (Kursun: The system groups the transaction data into nodal sets based on accounts associated with the transaction where the transactions represent edges and the accounts represents nodes. The system analyzes each edge to calculate custom entropy and divergence values for determining anomalous activity. When anomalous activity is determined based on the calculated entropy and divergence, the system may identify a first nodal set linked to the activity an execute a remedial action (Paragraph 03-04).) .Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the reference application with the anomaly detection system taught by Kursun. The motivation to do so would be to improve anomaly identification success rate and address anomalous activity in real time (Kursun; Paragraph 01).
In regards to claim 12, the claim recites analogous subject to claim 3. Therefore the claim is rejected based on the same rationale as claim 3 above.
In regards to claim 16, the claim recites analogous subject to claim 7. Therefore the claim is rejected based on the same rationale as claim 7 above.
Claims 5 and 14 are rejected on the ground of nonstatutory double patenting as being unpatentable over claim 1 of U.S. Patent No. 12,265,521(reference application) in view of Prabhakar et al. (US-20200210260-A1).
In regards to claim 5, Claim 1 of the reference application teaches the method of claim 1, but lacks wherein the third data slice has a common attribute with the first data slice and the second data slice. However, Prabhakar in the same field of endeavor teaches anomaly detection and monitoring system that discloses wherein the third data slice has a common attribute with the first data slice and the second data slice (Prabhakar: The time series data generated according to one attribute such as country code, or according to multiple attributes such as country code and financial instrument has a timestamp attribute in common (Paragraph 36).) . Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the reference application with the anomaly detection and monitoring system taught by Prabhakar. The motivation to do so would be enable large flows of aggregate data to detect anomalies in real-time (Paragraph 10).
In regards to claim 14, the claim recites analogous subject to claim 5. Therefore the claim is rejected based on the same rationale as claim 5 above.
Claims 6, 8, 15, and 17 are rejected on the ground of nonstatutory double patenting as being unpatentable over claim 1 of U.S. Patent No. 12,265,521(reference application) in view of Schleith et al. (US-20230195715-A1).
In regards to claim 6, Claim 1 of the reference application teaches the method of claim 1, but lacks determining, by the server, to generate the first data slice associated with the first attribute based on identifying that the first attribute corresponds to at one or more characteristics of a merchant. However, Schleith in the same field of endeavor, discloses an anomaly detection system based on clustered transactions that teaches… determining, by the server, to generate the first data slice associated with the first attribute based on identifying that the first attribute corresponds to at one or more characteristics of a merchant (Schleith: For example, the transactions may be clustered according to a single feature, such as an amount or value of the transaction, or multiple features, such as an amount or value of the transaction and the entities such as seller involved in the transaction (Paragraphs 20 &21).).Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the reference application with the anomaly detection system taught by Schleith. The motivation to do so would be to improve anomaly detection techniques and provide comprehensive anomaly detection.
In regards to claim 8, Claim 1 of the reference application teaches the method of claim 1, but lacks wherein the server determines the anomaly in accordance with an attribute of the input of the aggregated data and the input of at least the first data slice satisfying an anomaly threshold, the method further comprising predicting, by the server, the anomaly threshold. However, Schleith in the same field of endeavor, discloses an anomaly detection system based on clustered transactions that teaches… wherein the server determines the anomaly in accordance with an attribute of the input of the aggregated data and the input of at least the first data slice satisfying an anomaly threshold, the method further comprising predicting, by the server, the anomaly threshold (Schleith: Additionally or alternatively, embodiments may be used to predict expected values to be derived from a dataset obtained in the future and those predictions may be used to detect anomalies (e.g,. based on differences between the predicted values and actual values obtained from the dataset obtained in the future) (Paragraph 06).) .Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the reference application with the anomaly detection system taught by Schleith. The motivation to do so would be to improve anomaly detection techniques and provide comprehensive anomaly detection.
In regards to claim 15, the claim recites analogous subject to claim 6. Therefore the claim is rejected based on the same rationale as claim 6 above.
In regards to claim 17, the claim recites analogous subject to claim 8. Therefore the claim is rejected based on the same rationale as claim 8 above.
Claims 9 and 18 are rejected on the ground of nonstatutory double patenting as being unpatentable over claim 1 of U.S. Patent No. 12,265,521(reference application) in view of Schleith et al. (US-20230195715-A1), and in further view of Kursun et al. (US-20200167786-A1).
In regards to claim 9, Claim 1 of the reference application and Schleith teach the method of claim 8, but lacks wherein the anomaly threshold corresponds to the attribute of the first data slice. However, Kursun in the same field of endeavor discloses a system for anomaly detection and remediation based on dynamic directed graph network flow analysis of transactions that teaches … wherein the anomaly threshold corresponds to the attribute of the first data slice (Kursun: The anomalous determination may be based on an anomaly function for a particular subgraph that is based on account profile information, reputation profile or value information, confidence value information, historical information, flow profile information, and the like (Paragraph 69).).Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the reference application and Schleith with the anomaly detection taught by Kursun. The motivation to do so would be to improve anomaly identification success rate and address anomalous activity in real time (Kursun; Paragraph 01).
In regards to claim 18, the claim recites analogous subject to claim 9. Therefore the claim is rejected based on the same rationale as claim 9 above.
Claims
Instant Application
18/106340
Reference Application
US Patent No.12,265,521
1
A method comprising:
identifying, by a server, aggregated data comprising data corresponding to a set of attributes for a set of transactions, each attribute having one or more corresponding values;
generating, by the server, a set of data slices from the aggregated data, the set of data slices including a first data slice containing data corresponding to a first value of a plurality of values associated with a first attribute of the set of attributes; and
iteratively executing, by the server, a computer model that receives an input of the aggregated data and an input of at least the first data slice and outputs an identification of an anomaly associated with the aggregated data, wherein the server determines whether to add an additional data slice from the set of data slices to the first data slice to generate a revised first data slice.
A method comprising:
identifying, by a server, aggregated transaction data corresponding to a set of attributes for a set of transactions, each attribute having one or more corresponding values;
executing, by the server, a computer model that is configured to: generate a first data slice using the aggregated transaction data and at least one attribute; calculate, for the first data slice, a first entropy value indicating a difference between one or more values corresponding to one or more attributes of the first data slice compared with a previous value for the same one or more attributes of the first data slice from a previous time window; when the first entropy value does not satisfy a threshold, generate a set of data slices using the first data slice; calculate a second entropy value for each data slice within the set of data slices; generate an information gain value based on the first entropy value and each second entropy value for the set of data slices; generate a second set of data slices using at least one data slice within the set of data slices that has an information gain value that satisfies an information gain threshold; when at least one data slice within the second set of data slices satisfies the threshold,
iteratively combine the at least one data slice with another data slice of the second set of data slices to generate a combined data slice until the combined data slice has a respective entropy value that satisfies the threshold; and
outputting, by the server, a notification of an anomaly associated with the aggregated transaction data comprising an identification of the combined data slice.
2
The method of claim 1, further comprising:
receiving, by the server, an indication that a notification corresponds to a false positive; and
recalibrating, by the server, the computer model to revise at least one variable used by the computer model in accordance with an attribute of the false positive anomaly.
Claim 3:
The method of claim 1, further comprising: receiving, by the server, an indication of a false positive anomaly; and recalibrating, by the server, the computer model to revise at least one variable used by the computer model in accordance with an attribute of the false positive anomaly.
3
The method of claim 1, wherein the set of data slices includes a second data slice corresponding to a second value for a second attribute, and wherein based on determining that a percentage of anomalous activity associated with one or more data records corresponding to the second data slice is above a threshold percentage, combining, by the server, the second data slice with a third data slice of the set of data slices.
Claim 1 in view of Kursun
4
. The method of claim 3, further comprising
:training, by the server, a second computer model to identify a number of data slices that indicate the anomaly
Claim 5
The method of claim 1, further comprising: training, by the server, the computer model or a second computer model using at least one of: the at least one attribute used to generate the first data slice, the first entropy value, the second entropy value associated with at least one data slice within the set of data slices, or the information gain value of at least one data slice, such that the computer model or the second computer model is configured to predict at least one of: the at least one attribute used to generate the first data slice, whether to generate the set of data slices, or whether to generate the second set of data slices.
5
. The method of claim 3, wherein the third data slice has a common attribute with the first data slice and the second data slice.
Claim 1 in view of Prabhakar
6
The method of claim 1, further comprising: determining, by the server, to generate the first data slice associated with the first attribute based on identifying that the first attribute corresponds to at one or more characteristics of a merchant.
Claim 1 in view of Schleith
7
The method of claim 1, further comprising:
determining, by the server based on the identification of the anomaly, a remediation action corresponding to the identified anomaly.
.Claim 1 in view of Kursun
8
The method of claim 1, wherein the server determines the anomaly in accordance with an attribute of the input of the aggregated data and the input of at least the first data slice satisfying an anomaly threshold, the method further comprising predicting, by the server, the anomaly threshold.
.Claim 1 in view of Schleith
9
The method of claim 8, wherein the anomaly threshold corresponds to the attribute of the first data slice.
Claim 1 in view of Schleith and further view of Kursun
10
Analogous to Claim 1 above
Claim 8 (analogous to claim 1 above)
11
Analogous to Claim 2 above
Claim 10 (analogous to claim 3 above)
12
Analogous to Claim 3 above
.Claim 8 in view of Kursun
13
Analogous to Claim 4 above
Claim 12 (analogous to claim 5 above)
14
Analogous to Claim 5 above
Claim 8 in view of Prabhakar
15
Analogous to Claim 6 above
Claim 8 in view of Schleith
16
Analogous to Claim 7 above
Claim 8 in view of Kursun
17
Analogous to Claim 8 above
Claim 8 in view of Schleith
18
Analogous to Claim 9 above
Claim 8 in view of Schleith and further view of Kursun.
19
Analogous to Claim 1 above
Claim 15(analogous to claim 1 above)
20
Analogous to Claim 2 above
Claim 17(analogous to claim 3 above)
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 1,2,10,11,19,20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Prabhakar et al. (US-20200210260-A1) in view of Lee et al.( “Peak Anomaly Detection from Environmental Sensor-Generated Watershed Time Series Data” : hereafter Lee).
In regards to claim 1, Prabhakar teaches a method comprising:
identifying, by a server, aggregated data comprising data corresponding to a set of attributes for a set of transactions, each attribute having one or more corresponding values (Prabhakar: Flow detector 120 may be configured to identify different flows using one or more attributes of the flow (Paragraph 28).);
generating, by the server, a set of data slices from the aggregated data, the set of data slices including a first data slice containing data corresponding to a first value of a plurality of values associated with a first attribute of the set of attributes (Prabhakar: In some embodiments, time series data generator 204 may aggregate raw data 210A into time series data 212 according to one attribute such as country code, or according to multiple attributes such as country code and financial instrument (Paragraph 36).); and
anomaly associated with the aggregated data, wherein the server determines whether to add an additional data slice from the set of data slices to the first data slice(Prabhakar: FIG 2, An anomaly monitoring system may monitor data flows in real-time and detect anomalies in the data flows. The anomaly monitoring system may include various models that compare the data flow trends to the historical data flow trends and determine anomalies to the data flow trends (Paragraph 10), wherein, the time series data generator 204 may append time series data 212 to historical data 214 after anomaly detector 206 identifies anomalies in time series data (Paragraph 40).
But Prabhakar does not explicitly disclose iteratively adding data slices to generate a revised data slice.
However, Lee in a similar field of endeavor discloses iteratively adding data slices to generate a revised data slice (Lee: Each new batch of data is first used as test data and then appended to the existing training data. Thus, the training data size keeps increasing and so does the training time [Fig 9; Page 151].).
Therefore it would have been obvious to one of ordinary skill in the art, to modify the system of Prabhakar to include iteratively adding data slices as disclosed by Lee. The motivation to do so would be to allow the model to iteratively improve as more data becomes available.
In regards to claim 2, the combination of Prabhakar and Lee teach the method of claim 1, further comprising: receiving an indication that a notification corresponds to a false positive; and recalibrating the computer model to revise at least one variable used by the computer model in accordance with an attribute of the false positive anomaly (Prabhakar: The anomaly detector may generate alerts when one of models detects an anomaly and send the alerts to a system administrator (Paragraphs 47 & 54). The weight of each model can be automatically adjusted as user feedback on the correctness of the alerts(Paragraph 48).).
In regards to claim 10, Prabhakar teaches a system comprising: a non-transitory storage medium comprising a set of instructions that when executed, cause a processor to::
Identify aggregated data comprising data corresponding to a set of attributes for a set of transactions, each attribute having one or more corresponding values (Prabhakar: Flow detector 120 may be configured to identify different flows using one or more attributes of the flow (Paragraph 28).);
generate a set of data slices from the aggregated data, the set of data slices including a first data slice containing data corresponding to a first value of a plurality of values associated with a first attribute of the set of attributes (Prabhakar: In some embodiments, time series data generator 204 may aggregate raw data 210A into time series data 212 according to one attribute such as country code, or according to multiple attributes such as country code and financial instrument (Paragraph 36).); and
(Prabhakar: FIG 2, An anomaly monitoring system may monitor data flows in real-time and detect anomalies in the data flows. The anomaly monitoring system may include various models that compare the data flow trends to the historical data flow trends and determine anomalies to the data flow trends (Paragraph 10), wherein, the time series data generator 204 may append time series data 212 to historical data 214 after anomaly detector 206 identifies anomalies in time series data (Paragraph 40).
But Prabhakar does not explicitly disclose iteratively adding data slices to generate a revised data slice.
However, Lee in a similar field of endeavor discloses iteratively adding data slices to generate a revised data slice (Lee: Each new batch of data is first used as test data and then appended to the existing training data. Thus, the training data size keeps increasing and so does the training time [Fig 9; Page 151].).
Therefore it would have been obvious to one of ordinary skill in the art, to modify the system of Prabhakar to include iteratively adding data slices as disclosed by Lee. The motivation to do so would be to allow the model to iteratively improve as more data becomes available.
In regards to claim 11, the subject matter of this claim is analogous to the subject matter of claim 2. Therefore this claim is rejected based on the same rationale as cited for claim 2 above.
In regards to claim 19, Prabhakar teaches a system comprising: a memory; a processor configured to execute instructions stored in the memory to:
identify aggregated data comprising data corresponding to a set of attributes for a set of transactions, each attribute having one or more corresponding values (Prabhakar: Flow detector 120 may be configured to identify different flows using one or more attributes of the flow (Paragraph 28).);
generate a set of data slices from the aggregated data, the set of data slices including a first data slice containing data corresponding to a first value of a plurality of values associated with a first attribute of the set of attributes (Prabhakar: In some embodiments, time series data generator 204 may aggregate raw data 210A into time series data 212 according to one attribute such as country code, or according to multiple attributes such as country code and financial instrument (Paragraph 36).); and
(Prabhakar: FIG 2, An anomaly monitoring system may monitor data flows in real-time and detect anomalies in the data flows. The anomaly monitoring system may include various models that compare the data flow trends to the historical data flow trends and determine anomalies to the data flow trends (Paragraph 10), wherein, the time series data generator 204 may append time series data 212 to historical data 214 after anomaly detector 206 identifies anomalies in time series data (Paragraph 40).
But Prabhakar does not explicitly disclose iteratively adding data slices to generate a revised data slice.
However, Lee in a similar field of endeavor discloses iteratively adding data slices to generate a revised data slice (Lee: Each new batch of data is first used as test data and then appended to the existing training data. Thus, the training data size keeps increasing and so does the training time [Fig 9; Page 151].).
Therefore it would have been obvious to one of ordinary skill in the art, to modify the system of Prabhakar to include iteratively adding data slices as disclosed by Lee. The motivation to do so would be to allow the model to iteratively improve as more data becomes available.
In regards to claim 20, the subject matter of this claim is analogous to the subject matter of claim 2. Therefore this claim is rejected based on the same rationale as cited for claim 2 above.
Claim(s) 3,4,5,7,12-14, and 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Prabhakar et al. (US-20200210260-A1) in view of Lee et al.( “Peak Anomaly Detection from Environmental Sensor-Generated Watershed Time Series Data” : hereafter Lee), and in further view of Kursun et al. (US-20200167786-A1).
In regards to claim 3, the combination of Prabhakar and Lee teach the method of claim 1,
Although Prabhakar teaches segmenting aggregated into slices based on a transaction attribute, Prabhakar does not explicitly disclose… wherein the set of data slices includes a second data slice corresponding to a second value for a second attribute, and wherein based on determining that a percentage of anomalous activity associated with one or more data records corresponding to the second data slice is above a threshold percentage, combining, by the server, the second data slice with a third data slice of the set of data slices.
However, Kursun, in the same field of endeavor discloses a system for anomaly detection and remediation based on dynamic directed graph network flow analysis of transactions that teaches …wherein the set of data slices includes a second data slice corresponding to a second value for a second attribute, and wherein based on determining that a percentage of anomalous activity associated with one or more data records corresponding to the second data slice is above a threshold percentage, combining, by the server, the second data slice with a third data slice of the set of data slices (Kursun: The system groups the transaction data into nodal sets based on accounts associated with the transaction where the transactions represent edges and the accounts represents nodes. The system analyzes each edge to calculate custom entropy and divergence values for determining anomalous activity. When anomalous activity is determined based on the calculated entropy and divergence, the system may identify a first nodal set linked to the activity an execute a remedial action or identify a second nodal set and combining the set into a single super node for more analysis (Paragraphs 03-05)
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the anomaly detection system taught by Prabhakar with the anomaly detection system taught by Kursun. The motivation to do so would be to improve anomaly identification success rate and address anomalous activity in real time (Kursun; Paragraph 01).
In regards to claim 4, the combination of Prabhakar, Lee, and Kursun teach the method of claim 3, further comprising: training, by the server, a second computer model to identify a number of data slices that indicate the anomaly (Prabhakar: In an embodiment, anomaly detector 206 may include one or more anomaly detection models (Paragraph 42).) .
In regards to claim 5, the combination of Prabhakar, Lee, and Kursun teach the method of claim 3, wherein the third data slice has a common attribute with the first data slice and the second data slice (Prabhakar: The time series data generated according to one attribute such as country code, or according to multiple attributes such as country code and financial instrument has a timestamp attribute in common (Paragraph 36).) .
In regards to claim 7, the combination of Prabhakar and Lee teach the method of claim 1, further comprising:
However, the combination of Prabhakar and Lee does not explicitly disclose… determining, by the server based on the identification of the anomaly, a remediation action corresponding to the identified anomaly.
Kursun, in the same field of endeavor, discloses an anomaly detection system based on clustered transactions that teaches… determining, by the server based on the identification of the anomaly, a remediation action corresponding to the identified anomaly (Kursun: The system groups the transaction data into nodal sets based on accounts associated with the transaction where the transactions represent edges and the accounts represents nodes. The system analyzes each edge to calculate custom entropy and divergence values for determining anomalous activity. When anomalous activity is determined based on the calculated entropy and divergence, the system may identify a first nodal set linked to the activity an execute a remedial action (Paragraph 03-04).) .
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the anomaly detection system taught by Prabhakar with the anomaly detection system taught by Kursun. The motivation to do so would be to improve anomaly identification success rate and address anomalous activity in real time (Kursun; Paragraph 01).
In regards to claim 12, the subject matter of this claim is analogous to the subject matter of claim 3. Therefore this claim is rejected based on the same rationale as cited for claim 3 above.
In regards to claim 13, the subject matter of this claim is analogous to the subject matter of claim 4. Therefore this claim is rejected based on the same rationale as cited for claim 4 above.
In regards to claim 14, the subject matter of this claim is analogous to the subject matter of claim 5. Therefore this claim is rejected based on the same rationale as cited for claim 5 above.
In regards to claim 16, the subject matter of this claim is analogous to the subject matter of claim 7. Therefore this claim is rejected based on the same rationale as cited for claim 7 above.
Claim(s) 6, 8,15, and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Prabhakar et al. (US-20200210260-A1) in view of Lee et al.( “Peak Anomaly Detection from Environmental Sensor-Generated Watershed Time Series Data” : hereafter Lee), and in further view of Schleith et al. (US-20230195715-A1).
In regards to claim 6, the combination of Prabhakar and Lee teach the method of claim 1, further comprising:
But the combination of Prabhakar and Lee does not explicitly disclose… determining, by the server, to generate the first data slice associated with the first attribute based on identifying that the first attribute corresponds to at one or more characteristics of a merchant.
However, Schleith in the same field of endeavor, discloses an anomaly detection system based on clustered transactions that teaches… determining, by the server, to generate the first data slice associated with the first attribute based on identifying that the first attribute corresponds to at one or more characteristics of a merchant (Schleith: For example, the transactions may be clustered according to a single feature, such as an amount or value of the transaction, or multiple features, such as an amount or value of the transaction and the entities such as seller involved in the transaction (Paragraphs 20 &21).).
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the anomaly detection system taught by Prabhakar with the anomaly detection system taught by Schleith. The motivation to do so would be to improve anomaly detection techniques and provide comprehensive anomaly detection.
In regards to claim 8, the combination of Prabhakar and Lee teach the method of claim 1,
But the combination of Prabhakar and Lee does not explicitly disclose… wherein the server determines the anomaly in accordance with an attribute of the input of the aggregated data and the input of at least the first data slice satisfying an anomaly threshold, the method further comprising predicting, by the server, the anomaly threshold.
However, Schleith in the same field of endeavor, discloses an anomaly detection system based on clustered transactions that teaches… wherein the server determines the anomaly in accordance with an attribute of the input of the aggregated data and the input of at least the first data slice satisfying an anomaly threshold, the method further comprising predicting, by the server, the anomaly threshold (Schleith: Additionally or alternatively, embodiments may be used to predict expected values to be derived from a dataset obtained in the future and those predictions may be used to detect anomalies (e.g,. based on differences between the predicted values and actual values obtained from the dataset obtained in the future) (Paragraph 06).) .
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the anomaly detection system taught by Prabhakar with the anomaly detection system taught by Schleith. The motivation to do so would be to improve anomaly detection techniques and provide comprehensive anomaly detection.
In regards to claim 15, the subject matter of this claim is analogous to the subject matter of claim 6. Therefore this claim is rejected based on the same rationale as cited for claim 6 above.
In regards to claim 17, the subject matter of this claim is analogous to the subject matter of claim 8. Therefore this claim is rejected based on the same rationale as cited for claim 8 above.
Claim(s) 9 and 18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Prabhakar et al. (US-20200210260-A1) in view of Lee et al.( “Peak Anomaly Detection from Environmental Sensor-Generated Watershed Time Series Data” : hereafter Lee), and in further Schleith et al. (US-20230195715-A1) as applied to claims 8 and 17 above, and further in view of Kursun et al. (US-20200167786-A1).
In regards to claim 9, the combination of Prabhakar, Lee, and Schleith teach the method of claim 8,
But the combination of Prabhakar, Lee, and Schleith does not explicitly disclose…wherein the anomaly threshold corresponds to the attribute of the first data slice.
However, Kursun in the same field of endeavor discloses a system for anomaly detection and remediation based on dynamic directed graph network flow analysis of transactions that teaches … wherein the anomaly threshold corresponds to the attribute of the first data slice (Kursun: The anomalous determination may be based on an anomaly function for a particular subgraph that is based on account profile information, reputation profile or value information, confidence value information, historical information, flow profile information, and the like (Paragraph 69).).
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the anomaly detection system taught by the combination of Prabhakar, Lee, and Schleith with the anomaly detection system taught by Kursun. The motivation to do so would be to improve anomaly identification success rate and address anomalous activity in real time (Kursun; Paragraph 01).
In regards to claim 18, the subject matter of this claim is analogous to the subject matter of claim 9. Therefore this claim is rejected based on the same rationale as cited for claim 9 above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Jain et al (US-20190236177-A1) discloses a system for detecting anomalies in time series data by iteratively applying a selected detection technique to additional time-series data sets for other combinations of values of the second set of attributes of the time-series data in response to detecting an anomaly in the first time-series data set.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PHILLIP E WILSON JR whose telephone number is (703)756-1753. The examiner can normally be reached Monday- Friday, 8:00 am - 5:00 pm EST,.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/P.E.W./Examiner, Art Unit 2493
/CARL G COLIN/Supervisory Patent Examiner, Art Unit 2493