Detailed Action
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claim 3 is objected to because of the following informalities: The phrase “…using at least one…” is repeated unnecessarily and in addition to the word “…of…” in “wherein processing the at least a portion of the obtained data using one or more unsupervised learning techniques comprises processing the at least a portion of the obtained data ”. Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea (mental process) without significantly more.
Regarding claim 1, in Step 1 of the 101-analysis set forth in MPEP 2106, the claim recites “A computer-implemented method”. A method is within one of the four statutory categories of invention.
In Step 2a Prong 1 of the 101-analysis set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process but for recitation of generic computer components:
“predicting one or more anomalies associated with the at least one messaging topology by processing at least a portion of the obtained data…” (A person can mentally evaluate a portion of a messaging topology and make a judgement to predict anomalies associated with it (MPEP 2106).)
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. According, the claim “recites” an abstract idea.
In Step 2a Prong 2 of the 101-analysis set forth in MPEP 2106, the examiner has
determined that the following additional elements do not integrate this judicial exception into a
practical application:
“A computer-implemented method… wherein the method is performed by at least one processing device comprising a processor coupled to a memory” (Uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).)
“obtaining data pertaining to at least one messaging topology associated with at least one message-oriented middleware” (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g)).)
“…using a first set of one or more machine learning techniques” (Uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).)
“recommending one or more alternate messaging topologies associated with the at least one message-oriented middleware by processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using a second set of one or more machine learning techniques” (Mere instructions to apply the judicial exception (MPEP 2106.05(f)).)
“performing one or more automated actions based at least in part on one or more of the one or more predicted anomalies and the one or more recommended alternate messaging topologies” (Mere instructions to apply the judicial exception (MPEP 2106.05(f)).)
Since the claim as a whole, looking at the additional elements individually and in combination, does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea.
In Step 2b of the 101-analysis set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
As discussed above, additional elements (ii) & (iv) recite use of a computer as a tool to perform the abstract idea, which is not indicative of significantly more. Additional element (iii) recites an insignificant extra-solution activity. Further, element (iii) recites steps of receiving/transmitting data via a network, which has been determined by the courts to recite a well-understood, routine, and conventional activity, which is not indicative of significantly more (Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362). Additional elements (v) & (vi) recite mere instructions to apply the judicial exception, which is not indicative of significantly more. Considering the additional elements individually and in combination, and the claim as a whole, the additional elements do not provide significantly more than the abstract idea. Therefore, the claim is not patent eligible.
Regarding claim 2, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 2 recites “wherein predicting one or more anomalies comprises processing the at least a portion of the obtained data using one or more unsupervised learning techniques” (In step 2a, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h).) In step 2B, generally linking the use of the judicial exception to a particular technological environment or field of use is not indicative of significantly more.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 3, it is dependent upon claim 2, and thereby incorporates the limitations of, and corresponding analysis applied to claim 2. Further, claim 3 recites the following additional abstract idea:
“wherein processing the at least a portion of the obtained data using one or more unsupervised learning techniques comprises processing the at least a portion of the obtained data using at least one of using at least one isolation forest algorithm” (This limitation is directly tied to the standard use of the isolation forest algorithm (to detect anomalies), which is a mathematical process, as defined at https://en.wikipedia.org/wiki/Isolation_forest. A mathematical process is an abstract idea (MPEP 2106).)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 4, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 4 recites “wherein predicting one or more anomalies comprises processing the at least a portion of the obtained data using one or more supervised learning techniques” (In step 2a, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h).) In step 2B, generally linking the use of the judicial exception to a particular technological environment or field of use is not indicative of significantly more.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 5, it is dependent upon claim 4, and thereby incorporates the limitations of, and corresponding analysis applied to claim 4. Further, claim 5 recites “wherein processing the at least a portion of the obtained data using one or more supervised learning techniques comprises processing the at least a portion of the obtained data using at least one of one or more support vector machines and one or more artificial neural networks” (In step 2a, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h).) In step 2B, generally linking the use of the judicial exception to a particular technological environment or field of use is not indicative of significantly more.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 6, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 6 recites “wherein recommending one or more alternate messaging topologies comprises processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using at least one machine learning-based classification algorithm” (In step 2a, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h).) In step 2B, generally linking the use of the judicial exception to a particular technological environment or field of use is not indicative of significantly more.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 7, it is dependent upon claim 6, and thereby incorporates the limitations of, and corresponding analysis applied to claim 6. Further, claim 7 recites the following additional abstract idea:
“wherein processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using at least one machine learning-based classification algorithm comprises processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using at least one random forest classifier” (This limitation is directly tied to the standard use of random forest classification, which is a mathematical process, as defined at https://en.wikipedia.org/wiki/Random_forest. A mathematical process is an abstract idea (MPEP 2106).)
Further, claim 7 recites “wherein using the at least one random forest classifier comprises implementing one or more bootstrap aggregating techniques in connection with multiple individual classifiers each trained on different data” (In step2A, prong 2, this recites mere instructions to apply the judicial exception (MPEP 2106.05(f).) In step 2B, mere instructions to apply the judicial exception is not indicative of significantly more.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 8, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 8 recites “wherein performing one or more automated actions comprises automatically routing at least one message to at least one of the one or more recommended alternate messaging topologies upon occurrence of at least one event related to the one or more predicted anomalies” (In step2A, prong 2, this recites mere instructions to apply the judicial exception (MPEP 2106.05(f).) In step 2B, mere instructions to apply the judicial exception is not indicative of significantly more.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 9, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 9 recites “wherein performing one or more automated actions comprises automatically training at least a portion of the first set of one or more machine learning techniques using feedback related to the one or more predicted anomalies” (In step2A, prong 2, this recites mere instructions to apply the judicial exception (MPEP 2106.05(f).) In step 2B, mere instructions to apply the judicial exception is not indicative of significantly more.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 10, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 10 recites “wherein performing one or more automated actions comprises automatically training at least a portion of the second set of one or more machine learning techniques using feedback related to the one or more recommended alternate messaging topologies” (In step2A, prong 2, this recites mere instructions to apply the judicial exception (MPEP 2106.05(f).) In step 2B, mere instructions to apply the judicial exception is not indicative of significantly more.)
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Regarding claim 11, in Step 1 of the 101-analysis set forth in MPEP 2106, the claim recites “A non-transitory processor-readable storage medium”. A non-transitory medium is within one of the four statutory categories of invention.
In Step 2a Prong 1 of the 101-analysis set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process but for recitation of generic computer components:
“predict one or more anomalies associated with the at least one messaging topology by processing at least a portion of the obtained data…” (A person can mentally evaluate a portion of a messaging topology and make a judgement to predict anomalies associated with it (MPEP 2106).)
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. According, the claim “recites” an abstract idea.
In Step 2a Prong 2 of the 101-analysis set forth in MPEP 2106, the examiner has
determined that the following additional elements do not integrate this judicial exception into a
practical application:
“A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device: to…” (Uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).)
“obtain data pertaining to at least one messaging topology associated with at least one message-oriented middleware” (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g)).)
“…using a first set of one or more machine learning techniques” (Uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).)
“recommend one or more alternate messaging topologies associated with the at least one message-oriented middleware by processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using a second set of one or more machine learning techniques” (Mere instructions to apply the judicial exception (MPEP 2106.05(f)).)
“perform one or more automated actions based at least in part on one or more of the one or more predicted anomalies and the one or more recommended alternate messaging topologies” (Mere instructions to apply the judicial exception (MPEP 2106.05(f)).)
Since the claim as a whole, looking at the additional elements individually and in combination, does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea.
In Step 2b of the 101-analysis set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
As discussed above, additional elements (ii) & (iv) recite use of a computer as a tool to perform the abstract idea, which is not indicative of significantly more. Additional element (iii) recites an insignificant extra-solution activity. Further, element (iii) recites steps of receiving/transmitting data via a network, which has been determined by the courts to recite a well-understood, routine, and conventional activity, which is not indicative of significantly more (Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362). Additional elements (v) & (vi) recite mere instructions to apply the judicial exception, which is not indicative of significantly more. Considering the additional elements individually and in combination, and the claim as a whole, the additional elements do not provide significantly more than the abstract idea. Therefore, the claim is not patent eligible.
Regarding claims 12-15, they are dependent upon claim 11, and thereby incorporate the limitations of, and corresponding analysis applied to claim 11. Further, claims 12-15 comprise similar additional limitations as claims 2, 4, 6, & 8, respectively, and are rejected under the same rationale.
Regarding claim 16, in Step 1 of the 101-analysis set forth in MPEP 2106, the claim recites “An apparatus”. An apparatus is within one of the four statutory categories of invention.
In Step 2a Prong 1 of the 101-analysis set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process but for recitation of generic computer components:
“predict one or more anomalies associated with the at least one messaging topology by processing at least a portion of the obtained data…” (A person can mentally evaluate a portion of a messaging topology and make a judgement to predict anomalies associated with it (MPEP 2106).)
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. According, the claim “recites” an abstract idea.
In Step 2a Prong 2 of the 101-analysis set forth in MPEP 2106, the examiner has
determined that the following additional elements do not integrate this judicial exception into a
practical application:
“An apparatus comprising: at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured: to…” (Uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).)
“obtain data pertaining to at least one messaging topology associated with at least one message-oriented middleware” (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g)).)
“…using a first set of one or more machine learning techniques” (Uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).)
“recommend one or more alternate messaging topologies associated with the at least one message-oriented middleware by processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using a second set of one or more machine learning techniques” (Mere instructions to apply the judicial exception (MPEP 2106.05(f)).)
“perform one or more automated actions based at least in part on one or more of the one or more predicted anomalies and the one or more recommended alternate messaging topologies” (Mere instructions to apply the judicial exception (MPEP 2106.05(f)).)
Since the claim as a whole, looking at the additional elements individually and in combination, does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea.
In Step 2b of the 101-analysis set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
As discussed above, additional elements (ii) & (iv) recite use of a computer as a tool to perform the abstract idea, which is not indicative of significantly more. Additional element (iii) recites an insignificant extra-solution activity. Further, element (iii) recites steps of receiving/transmitting data via a network, which has been determined by the courts to recite a well-understood, routine, and conventional activity, which is not indicative of significantly more (Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362). Additional elements (v) & (vi) recite mere instructions to apply the judicial exception, which is not indicative of significantly more. Considering the additional elements individually and in combination, and the claim as a whole, the additional elements do not provide significantly more than the abstract idea. Therefore, the claim is not patent eligible.
Regarding claims 17-20, they are dependent upon claim 16, and thereby incorporate the limitations of, and corresponding analysis applied to claim 16. Further, claims 17-20 comprise similar additional limitations as claims 2, 4, 6, & 8, respectively, and are rejected under the same rationale.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-3, 6, 8, 11-12, 14-17 & 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over Qin, J. et al. “Open Sourcing Kafka Cruise Control.” Available at https://www.linkedin.com/blog/engineering/open-source/open-sourcing-kafka-cruise-control on 28 August 2017 (hereafter, QIN), and further in view of Belacel, N. et al. “Online Anomaly Detection for Streaming Data Implemented on Top of Kafka, Scikit-Multiflow and River.” Available at https://www.scilit.com/publications/a6c6f766e8c437f35cd5d775adbd7b4c on 24 October 2021 (hereafter, BELACEL)
Regarding claim 1, QIN teaches “A computer-implemented method comprising: obtaining data pertaining to at least one messaging topology associated with at least one message-oriented middleware”:
([Page 1, paragraphs 1-2] “Apache Kafka's (a popular streaming platform that supports various messaging patterns/ messaging topology) popularity has grown tremendously over the past few years… In fact, LinkedIn's deployment recently surpassed 2 trillion messages per day, with over 1,800 Kafka servers (i.e., brokers) (showing it to be well-known)…
…Intelligent automation is critical under these circumstances, which is why we developed Cruise Control (a middleware): a general-purpose system that continually monitors our clusters and automatically adjusts the resources allocated to them to meet pre-defined performance goals (continuous monitoring of the clusters is equivalent to “obtaining data pertaining to at least one messaging topology associated with at least one message-oriented middleware”). In essence, users specify goals, Cruise Control monitors for violations of these goals, analyzes the existing workload on the cluster, and automatically executes administrative operations to satisfy those goals...”) Further, the “Cruise Control Architecture” figure on page 4 explicitly shows the Kafka Cluster/the data pertaining to the messaging topology being received in association with Cruise Control, the middleware.
Further, QIN teaches “predicting one or more anomalies associated with the at least one messaging topology by processing at least a portion of the obtained data using a first set of one or more… techniques”:
([Page 1, paragraph 2] “Intelligent automation is critical under these circumstances, which is why we developed Cruise Control: a general-purpose system that continually monitors our clusters and automatically adjusts the resources allocated to them to meet pre-defined performance goals. In essence, users specify goals, Cruise Control monitors for violations of these goals, analyzes the existing workload on the cluster, and automatically executes administrative operations to satisfy those goals...”) Here, we see that cruise control monitors for violations to goals / anomalies.
And further:
([Page 4, Anomaly Detector] “The anomaly detector identifies two types of anomalies (one or more techniques):
1. Broker failures: i.e., a non-empty broker leaves a cluster, which results in under-replicated partitions. Since this can happen during normal cluster bounces as well, the anomaly detector provides a configurable grace period before it triggers the notifier and fixes the cluster (meaning this issue is identified before being confirmed as an issue, which qualifies it as a “prediction”).
2. Goal violations: i.e., an optimization goal is violated. If self-healing is enabled, Cruise Control will proactively attempt to address the goal violation (proactively attempting to address an anomaly means it was “predicted” before it became an error.) by automatically analyzing the workload, and executing optimization proposals.”)
Further, QIN teaches “recommending one or more alternate messaging topologies associated with the at least one message-oriented middleware by processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using a second set of one or more… techniques”:
([Page 3, Analyzer, paragraph 1] “The Analyzer is the "brain" of Cruise Control. It uses a heuristic method (one or more techniques…) to generate optimization proposals based on the user-provided optimization goals and the cluster workload model from the Load Monitor. (generating “optimization proposals” equivalates to “recommending alternate messaging topologies” which are associated with the message-oriented middleware (“Cruise Control”) by processing the predicted anomalies)”)
Further, QIN teaches “performing one or more automated actions based at least in part on one or more of the one or more predicted anomalies and the one or more recommended alternate messaging topologies”:
([Page 4, Executor] “The executor is responsible for carrying out the optimization proposals from the analyzer…”) Here, we see that the executor carries out the optimization proposals/recommendations provided before, which means is performs the recommended actions based on the predicted anomalies and the alternate messaging topologies.
Further, QIN teaches “wherein the method is performed by at least one processing device comprising a processor coupled to a memory”:
([Page 5, Memory or speed?] “Cruise Control is very memory-intensive... It is also a CPU-intensive application...”) This section clearly explains that the application is both memory-intensive and CPU-intensive, meaning it is performed by at least one processing device that must comprise at least one processor coupled to a memory.
QIN fails to explicitly teach the first and second sets of techniques to be “machine learning techniques.” However, analogous art, BELACEL, does teach this:
([Abstract] “Identification of rare events is an important component in intrusion and fraud detection, system monitoring and event detection. Anomalies can represent problematic situations where early, accurate and actionable insights are critical to make situational assessments in the event of unexpected conditions. For many problems, the state of the art in machine learning (the use of machine learning) is batch learning… Online anomaly detection algorithms offer rapid access to useful insights with fewer computing capacity requirements and often need to be integrated with existing or legacy data streams in the enterprise. This work introduces a proof of concept integration of two online streaming anomaly detection algorithms (one or more sets of machine learning techniques) available in the scikit multiflow and River frameworks with the popular Kafka event streaming platform.”)
It would be obvious to one of ordinary skill in the art, prior to the effective filing date of the claimed invention, to combine the base reference of QIN with the teachings of BELACEL because both references explore anomaly detection methods in relation to streaming, and both even do so with the same “Kafka” event streaming platform.
One of ordinary skill in the art would be motivated to do so because, as pointed out by BELACEL in its’ introduction, “The ability to monitor processes in near real-time that online anomaly detection algorithms afford promises rapid access to useful insights with fewer computing capacity requirements”, “Integrating online anomaly detection algorithms with existing message oriented systems is key to leveraging existing technology investments”, and “Although there exists multiple machine learning frameworks for streaming data, these novel systems tend to be stand-alone and often need to be integrated with existing or legacy data streams in the enterprise. Our work presents a proof of concept integration of two online streaming anomaly detection algorithms available in the scikit-multiflow and River frameworks with the popular Kafka event streaming platform.”
Regarding claim 2, QIN in view of BELACEL teaches the limitations of claim 1. Further, BELACEL teaches “wherein predicting one or more anomalies comprises processing the at least a portion of the obtained data using one or more unsupervised learning techniques”:
([Page 828, 3. Method] “A simple online unsupervised learning problem was selected for the purposes of introducing our streaming anomaly detection solution. We focus on applying two popular online anomaly detection algorithms for raw data stream annotation and enrichment (both of which process at least a portion of the data to detect anomalies in an unsupervised learning environment). The first algorithm is the Half-Space Trees (HS-Trees) algorithm [7] and the second is the Isolation Forest (IForestASD) algorithm [8].”)
Regarding claim 3, QIN in view of BELACEL teaches the limitations of claim 2. Further, BELACEL teaches “wherein processing the at least a portion of the obtained data using one or more unsupervised learning techniques comprises processing the at least a portion of the obtained data using at least one of using at least one isolation forest algorithm”:
([Page 828, 3. Method] “A simple online unsupervised learning problem was selected for the purposes of introducing our streaming anomaly detection solution. We focus on applying two popular online anomaly detection algorithms for raw data stream annotation and enrichment). The first algorithm is the Half-Space Trees (HS-Trees) algorithm [7] and the second is the Isolation Forest (IForestASD) algorithm [8].”)
Regarding claim 6, QIN in view of BELACEL teaches the limitations of claim 1. Further, BELACEL teaches “wherein recommending one or more alternate messaging topologies comprises processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using at least one machine learning-based classification algorithm”:
([Page 828, 3. Method] “A simple online unsupervised learning problem was selected for the purposes of introducing our streaming anomaly detection solution. We focus on applying two popular online anomaly detection algorithms for raw data stream annotation and enrichment). The first algorithm is the Half-Space Trees (HS-Trees) algorithm [7] and the second is the Isolation Forest (IForestASD) algorithm [8].”) Both of the cited algorithms are machine learning-based classification algorithms.
Regarding claim 8, QIN in view of BELACEL teaches the limitations of claim 1. Further, QIN teaches “wherein performing one or more automated actions comprises automatically routing at least one message to at least one of the one or more recommended alternate messaging topologies upon occurrence of at least one event related to the one or more predicted anomalies”:
([Page 2, Cruise Control at LinkedIn] “…2. When a broker fails, we need to automatically reassign replicas that were on that broker to other brokers in the cluster and restore the original replication factor…”) In other words, when a broker/messaging topology fails (an event related to an anomaly), we automatically reassign the messages (routing at least one message), or replicas, to other brokers / alternate messaging topologies.
And further:
([Page 4, Anomaly Detector] “The anomaly detector identifies two types of anomalies:
1. Broker failures: i.e., a non-empty broker leaves a cluster, which results in under-replicated partitions. Since this can happen during normal cluster bounces as well, the anomaly detector provides a configurable grace period before it triggers the notifier and fixes the cluster.
2. Goal violations: i.e., an optimization goal is violated. If self-healing is enabled, Cruise Control will proactively attempt to address the goal violation. by automatically analyzing the workload, and executing optimization proposals.”)
Regarding claim 11, it comprises similar limitations as claim 1, and is rejected under the same rationale, with the following addition: QIN teaches “A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device…”:
([Page 5, Memory or speed?] “Cruise Control (a software program made up of program code) is very memory-intensive... It is also a CPU-intensive application because of the involved computation that is necessary to generate optimization proposals.”) Being both CPU-intensive and memory-intensive means that a CPU (a processing device which is a non-transitory medium itself), is connected to some form of memory which must store the program code, indicating a computer, which in and of itself, is a non-transitory processor-readable storage medium, which executes the program code, causing the processing device to perform the remaining limitations.
Regarding claims 12 & 14-15, QIN in view of BELACEL teaches the limitations of claim 11. Further, claims 12 & 14-15 comprise similar additional limitations as claims 2, 6, & 8, respectively, and are rejected under the same rationale.
Regarding claim 16, it comprises similar limitations as claim 1, and is rejected under the same rationale, with the following addition: QIN teaches “An apparatus comprising: at least one processing device comprising a processor coupled to a memory; the at least one processing device being configured:…”:
([Page 5, Memory or speed?] “Cruise Control (a software program made up of program code) is very memory-intensive... It is also a CPU-intensive application because of the involved computation that is necessary to generate optimization proposals.”) Being both CPU-intensive and memory-intensive means that a CPU, which is a processing device, is connected to some form of memory which must store the program code, indicating a computer, which in and of itself, is an apparatus, which executes the program code, causing the processing device to perform the remaining limitations.
Regarding claims 17 & 19-20, QIN in view of BELACEL teaches the limitations of claim 16. Further, claims 17 & 19-20 comprise similar additional limitations as claims 2, 6, & 8, respectively, and are rejected under the same rationale.
Claims 4, 5, 13, & 18 are rejected under 35 U.S.C. 103 as being unpatentable over QIN in view of BELACEL, as applied to claims above, and further in view of Sung, A. et al. “Identifying Important Features for Intrusion Detection Using Support Vector Machines and Neural Networks.” Available at https://www2.cs.uh.edu/~acl/cs6397/Presentation/2003-IEEE-identifying%20important%20features%20for%20ID%20using%20SVM%20and%20NN.pdf in 2003 (hereafter, SUNG)
Regarding claim 4, QIN in view of BELACEL teaches the limitations of claim 1. Further, QIN in view of BELACEL fails to explicitly teach “wherein predicting one or more anomalies comprises processing the at least a portion of the obtained data using one or more supervised learning techniques”. However, analogous art, SUNG, does teach this:
([Abstract] “Intrusion detection (anomaly detection) is a critical component of secure information systems. This paper addresses the issue of identifying important input features in building an intrusion detection system (IDS)…
…In this paper we apply the technique of deleting one feature at a time to perform experiments on SVMs (support vector machines) and neural networks to rank the importance of input features for the DARPA collected intrusion data. Important features for each of the 5 classes of intrusion patterns in the DARPA data are identified. (identifying “important features” for “intrusion patterns” is equivalent to “predicting anomalies”, and the use of support vector machines indicates a type of supervised learning technique.)”)
It would be obvious to one of ordinary skill in the art, prior to the effective filing date of the claimed invention, to combine the base reference of QIN in view of BELACEL with the teachings of SUNG because both references pertain to anomaly detection using machine learning techniques.
One of ordinary skill in the art would be motivated to do so because, as pointed out in the abstract of SUNG, “It is shown that SVM-based and neural network based IDSs using a reduced number of features can deliver enhanced or comparable performance.”
Regarding claim 5, QIN in view of BELACEL & SUNG teaches the limitations of claim 4. Further, SUNG teaches “wherein processing the at least a portion of the obtained data using one or more supervised learning techniques comprises processing the at least a portion of the obtained data using at least one of one or more support vector machines and one or more artificial neural networks”:
([Abstract] “Intrusion detection is a critical component of secure information systems. This paper addresses the issue of identifying important input features in building an intrusion detection system (IDS)…
…In this paper we apply the technique of deleting one feature at a time to perform experiments on SVMs (support vector machines) and neural networks (artificial neural networks) to rank the importance of input features (at least a portion of the obtained data) for the DARPA collected intrusion data. Important features for each of the 5 classes of intrusion patterns in the DARPA data are identified.”)
Regarding claims 13 & 18, QIN in view of BELACEL teaches the limitations of claims 11 & 16. Further, claims 13 & 18 both comprise similar additional limitations as claim 4, and are both rejected under the same rationale.
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over QIN in view of BELACEL, as applied to claims above, and further in view of Farnaaz, N. et al. “Random Forest Modeling for Network Intrusion Detection System.” Available at https://www.sciencedirect.com/science/article/pii/S1877050916311127 in 2016 (hereafter, FARNAAZ)
Regarding claim 7, QIN in view of BELACEL teaches the limitations of claim 6. Further, QIN in view of BELACEL fails to explicitly teach “wherein processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using at least one machine learning-based classification algorithm comprises processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using at least one random forest classifier, wherein using the at least one random forest classifier comprises implementing one or more bootstrap aggregating techniques in connection with multiple individual classifiers each trained on different data”.
However, analogous art, FARNAAZ, does teach “wherein processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using at least one machine learning-based classification algorithm comprises processing at least a portion of the one or more predicted anomalies and at least a portion of the obtained data using at least one random forest classifier”:
([Abstract] “With the growing usage of technology, intrusion detection (anomaly detection) became an emerging area of research. Intrusion Detection System (IDS) attempts to identify and notify the activities of users as normal (or) anomaly. IDS is a nonlinear and complicated problem and deals with network traffic data… In this paper, we have built a model for intrusion detection system using random forest classifier...”) Further, figure 1 on page 215 explicitly shows “Load dataset” (obtained data), “Classify features according to attacks -> Apply feature subset selection” (at least a portion of the one or more detected anomalies), followed by “Apply random forest algorithm”, which means that the random forest algorithm is explicitly used to process/classify obtained data and predicted anomalies.
Further, FARNAAZ teaches “wherein using the at least one random forest classifier comprises implementing one or more bootstrap aggregating techniques in connection with multiple individual classifiers each trained on different data”:
As disclosed above, FARNAAZ teaches the use of a random forest classifier, and this limitation simply describes how random forest classifiers traditionally work, as is defined at https://en.wikipedia.org/wiki/Random_forest and quoted below for convenience.
([Algorithm, Preliminaries: decision tree learning] “In particular, trees that are grown very deep tend to learn highly irregular patterns: they overfit their training sets, i.e. have low bias, but very high variance. Random forests are a way of averaging multiple deep decision trees, trained on different parts of the same training set, with the goal of reducing the variance.”)
And further:
([Algorithm: Bagging] “The training algorithm for random forests applies the general technique of bootstrap aggregating, or bagging, to tree learners. Given a training set X = x1, ..., xn with responses Y = y1, ..., yn, bagging repeatedly (B times) selects a random sample with replacement of the training set and fits trees to these samples…”)
It would be obvious to one of ordinary skill in the art, prior to the effective filing date of the claimed invention, to combine the base reference of QIN in view of BELACEL with the teachings of FARNAAZ because both references explore detection of anomalies using machine learning methods.
One of ordinary skill in the art would be motivated to do so because, as pointed out in the abstract of FARNAAZ, “Random Forest (RF) is an ensemble classifier and performs well compared to other traditional classifiers for effective classification of attacks” and “Empirical result show that proposed model is efficient with low false alarm rate and high detection rate.”
Claim 9 is rejected under 35 U.S.C. 103 as being unpatentable over QIN in view of BELACEL, as applied to claims above, and further in view of Du, M. et al. “DeepLog: Anomaly Detection and Diagnosis from System Logs through Deep Learning.” Available at https://dl.acm.org/doi/10.1145/3133956.3134015 on 30 October 2017 (hereafter, DU)
Regarding claim 9, QIN in view of BELACEL teaches the limitations of claim 1. However, QIN view of BELACEL fails to explicitly teach “wherein performing one or more automated actions comprises automatically training at least a portion of the first set of one or more machine learning techniques using feedback related to the one or more predicted anomalies”. However, analogous art, DU, does teach this:
([Abstract] “Anomaly detection is a critical step towards building a secure and trustworthy system… Log data is an important and valuable resource for understanding system status and performance issues… We propose DeepLog, a deep neural network model utilizing Long Short-Term Memory (LSTM), to model a system log as a natural language sequence. This allows DeepLog to automatically learn log patterns from normal execution, and detect anomalies when log patterns deviate from the model trained from log data under normal execution. In addition, we demonstrate how to incrementally update the DeepLog model in an online fashion so that it can adapt to new log patterns over time...”) Further, Figure 1 of page 1287 explicitly shows a diagnosis step that leads to “update model if false positive” which directly correlates to a automatically training the ML techniques using feedback related to the predicted anomalies.
It would be obvious to one of ordinary skill in the art, prior to the effective filing date of the claimed invention, to combine the base reference of QIN in view of BELACEL with the teachings of DU because both references explore anomaly detection using ML techniques.
One of ordinary skill in the art would be motivated to do so because, as pointed out in the abstract of DU, “Extensive experimental evaluations over large log data have shown that DeepLog has outperformed other existing log-based anomaly detection methods based on traditional data mining methodologies.”
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over QIN in view of BELACEL, as applied to claims above, and further in view of Zhang, J. et al. “CDBTune+: An efficient deep reinforcement learning-based automatic cloud database tuning system.” Available at https://link.springer.com/article/10.1007/s00778-021-00670-9 on 5 June 2021 (hereafter, ZHANG)
Regarding claim 10, QIN in view of BELACEL teaches the limitations of claim 1. However, QIN in view of BELACEL fails to explicitly teach “wherein performing one or more automated actions comprises automatically training at least a portion of the second set of one or more machine learning techniques using feedback related to the one or more recommended alternate messaging topologies”. However, analogous art, ZHANG, does teach “wherein performing one or more automated actions comprises automatically training at least a portion of the second set of one or more machine learning techniques using feedback related to the one or more recommended alternate…” configuration parameter settings:
([Abstract] “…we design an end-to-end automatic CDB tuning system, CDBTune+, using deep reinforcement learning (RL). CDBTune+ utilizes the deep deterministic policy gradient method to find the optimal configurations in a high-dimensional continuous space. CDBTune+ adopts a trial-and-error strategy to learn knob settings with a limited number of samples to accomplish the initial training, which alleviates the necessity of collecting a massive amount of high-quality samples. CDBTune+ adopts the reward-feedback mechanism in RL instead of traditional regression, which enables end-to-end learning and accelerates the convergence speed of our model and improves the efficiency of online tuning...”) “Reinforcement learning”, which uses a “reward-feedback” loop to learn appropriate configurations is a standard feature in the art. In this citation, it is used for determining appropriate configurations of knob settings, but when combined with QIN in view of BELACEL, it learns “alternate messaging topologies” to recommend, thus resulting in the configuration as claimed.
It would be obvious to one of ordinary skill in the art, prior to the effective filing date of the claimed invention, to combine the base reference of QIN in view of BELACEL with the teachings of ZHANG because both references use ML techniques to optimize a system based on recommended configurations.
One of ordinary skill in the art would be motivated to do so because, as pointed out in the abstract of ZHANG, adopting “the reward-feedback mechanism in RL instead of traditional regression… enables end-to-end learning and accelerates the convergence speed of our model and improves the efficiency of online tuning.”
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MATTHEW LEE LEWIS whose telephone number is (571)272-1906. The examiner can normally be reached Monday: 9:30AM - 3:30PM and Tuesday - Friday: 9:30AM - 6PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Tamara Kyle can be reached at (571)272-4241. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Matthew Lee Lewis/Examiner, Art Unit 2144
/TAMARA T KYLE/Supervisory Patent Examiner, Art Unit 2144