Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are presented for examination.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on April 11 2023, May 3 2024, and October 21 2024 was filed. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an
abstract idea without significantly more.
Claim 1
Step 1: The claim recites a method; therefore, it is directed to the statutory category of
processes.
Step2A Prong 1: The claim recites, inter alia:
[I]dentifying a group of ambient time series signals that overlaps more than one of the clusters: This limitation recites a mental process since it deals with the identification of time series that are overlapped in a group of clusters.
[A]dding the group of the ambient time series signals into the one cluster of the clusters that corresponds to the one machine: This limitation recites a mental process because it deals with adding ambient signals to a cluster.
determining from the time series signals a plurality of clusters that correspond to the plurality of the machines and separating the time series signals into the plurality of clusters, wherein one cluster of the clusters corresponds to one machine of the plurality of machines and includes the time series signals that are associated with the one machine of the plurality of machines: This limitation encompasses a mental process dealing with the determination of time series in clusters corresponding to separate machines.
Step2A Prong 2: This judicial exception is not integrated into a practical application because the
additional elements are as follows:
[R]eceiving time series signals associated with a plurality of machines, wherein the time series signals are unlabeled as to which of the machines the time series signals are associated with: Data Gather- Mere data gathering recited at a high level of generality, and thus are insignificant extra-solution activity (MPEP 2106.05(g)).
Automatically... and training a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one machine without using the time series signals not included in the one cluster: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly
more than the judicial exception because the additional elements are as follows:
[R]eceiving time series signals associated with a plurality of machines, wherein the time series signals are unlabeled as to which of the machines the time series signals are associated with: The additional element of “receiving” does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of receiving steps amounts to no more than mere data gathering. This element amounts to receiving data over a network and are well-understood, routine, conventional activity. See MPEP 2106.05(d), subsection II (i). This cannot provide an inventive concept.
[A]utomatically… and training a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one machine without using the time series signals not included in the one cluster: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
The elements in combination as an ordered whole still do not amount to significantly more than the judicial exception (i.e., the abstract ideas of identifying and adding time series signals). The claim merely describes a process of applying known mathematical tools (clustering and machine learning models) and standard computing functions (receiving data, training a model).
Therefore, the claim as a whole remains focused on the abstract idea and fails Step 2B of the
eligibility analysis.
Claim 2
Step 1: A process, as above.
Step2A Prong 1: The claim recites, inter alia:
…determining from the time series signals the plurality of clusters that correspond to the plurality of machines further comprises identifying a quantity for the plurality of the clusters: This limitation recites a mental concept as it deals with grouping time series signals into clusters that correspond to machines.
at which intra-cluster correlations within the clusters are maximized and inter-cluster correlations between the clusters are minimized: This limitation recites a mathematical concept since it deals with using gap statistic analysis of clusters which is an algorithm that uses mathematical functions to calculate dispersions in intra-clusters. See paragraph 0063 in the instant specification, “Gap statistics for the clusters are then generated. Automatic clustering method 200 generates a gap statistic that indicates a difference between the first intra-cluster dispersions (in the clusters of actual signals) and other, intra-cluster dispersions in additional clusters of random noise signals.” Similarly, the same gap statistic analysis in inter-clusters to make sure that different clusters have very little relationship to each other.
Step2A Prong 2: This judicial exception is not integrated into a practical application because the
additional elements are as follows:
Automatically…: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly
more than the judicial exception because the additional elements are as follows:
Automatically…: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
Even when considered in combination, these additional elements represent mere instructions to apply
an exception and therefore do not provide an inventive concept. The claim is ineligible.
Claim 3
Step 1: A process, as above.
Step2A Prong 1: The claim recites, inter alia:
…determining from the time series signals the plurality of clusters that correspond to the plurality of machines further comprises: This limitation recites a mental process as it deals with determining time series in different clusters correspond to different machines.
identifying first intra-cluster dispersions in the plurality of clusters based on performing an inverse Fourier transform of a cross power spectral density of a pair of the time series signals to determine a distance between the pair of the time series signals: This limitation recites a mathematical concept as it deals with calculating a frequency-domain statistical measure using the inverse Fourier transform and calculates the distance using geometric and algebraic calculations.
generating a gap statistic that indicates a difference between the first intra- cluster dispersions and second intra-cluster dispersions in additional clusters of random noise signals: This limitation recites a mathematical concept as it involves using a gap statistic to calculate the difference between two numerical values. See paragraph 0063 in the instant specification, “The gap statistic therefore indicates a difference between what an intra-cluster dispersion is for a quantity (or number) of clusters k of signals that are uncorrelated random noise and what an intra-cluster dispersion is for the quantity of clusters k of signals that are actually correlated. The quantity of clusters k of signals that shows the greatest difference from uncorrelated noise has greatest correspondence to the underlying actual number of machines, asset components, or other signal sources.”.
and selecting a quantity for the plurality of the clusters at which the gap statistic is maximized: This limitation is viewed as a mental process because it requires evaluating a set of gap statistics for clusters and exercising a judgment to select the single cluster that yields the highest value.
Step2A Prong 2: This judicial exception is not integrated into a practical application because the
additional elements are as follows:
automatically…: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly
more than the judicial exception because the additional elements are as follows:
automatically…: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
Even when considered in combination, these additional elements represent mere instructions to apply
an exception and therefore do not provide an inventive concept. The claim is ineligible.
Claim 4
Step 1: A process, as above.
Step2A Prong 1: The claim recites, inter alia:
identifying the group of ambient time series that overlaps more than one of the clusters further comprises… selecting signals from the time series signals that have a correlation between the more than one of the clusters that satisfies a threshold: This limitation is viewed as a mental process because it involves the act of comparing numerical correlation values against a threshold to select specific signals.
Step2A Prong 2: This judicial exception is not integrated into a practical application because the
additional elements are as follows:
…automatically…: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly
more than the judicial exception because the additional elements are as follows:
…automatically…: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
Even when considered in combination, these additional elements represent mere instructions to apply
an exception and therefore do not provide an inventive concept. The claim is ineligible.
Claim 5
Step 1: A process, as above.
Step2A Prong 1: The claim recites, inter alia:
for each individual cluster in the plurality of clusters that corresponds to an individual machine: adding the group of the ambient time series signals to the individual cluster of time series signals associated with the individual machine: This limitation is viewed as a mental process because it involves grouping ambient signals into clusters associated with different individual machines.
detect anomalies for the individual machine based on the time series signals from the given cluster and the group of ambient time series signals: This limitation is a mental process as it involves identifying a time series signal from a cluster as an anomaly.
Step2A Prong 2: This judicial exception is not integrated into a practical application because the
additional elements are as follows:
and training a separate machine learning model that is specific to the individual machine that corresponds to the individual cluster, wherein the machine learning model is trained to…: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly
more than the judicial exception because the additional elements are as follows:
and training a separate machine learning model that is specific to the individual machine that corresponds to the individual cluster, wherein the machine learning model is trained to…: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
Even when considered in combination, these additional elements represent mere instructions to apply
an exception and therefore do not provide an inventive concept. The claim is ineligible.
Claim 6
Step 1: A process, as above.
Step2A Prong 1: The claim recites, inter alia:
monitoring the one cluster of the plurality of clusters of the time series signals… to detect the anomaly: This limitation is viewed as a mental process because it involves monitoring a cluster containing time series to detect anomalies.
Step2A Prong 2: This judicial exception is not integrated into a practical application because the
additional elements are as follows:
…with the trained machine learning model…: The limitation amounts to merely indicating a field of use or technological environment in which to apply a judicial exception. This does not amount to significantly more than the exception itself (MPEP 2106.05(h)).
and in response to detecting the anomaly in the one cluster of the clusters of the time series signals, generating an electronic alert that the anomaly has occurred for the one machine of the machines that corresponds to the one cluster: Insignificant extra-solution as the limitation amounts to necessary data outputting (MPEP 2106.05(g)(3)).
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly
more than the judicial exception because the additional elements are as follows:
…with the trained machine learning model…: The limitation amounts to merely indicating a field of use or technological environment in which to apply a judicial exception. This does not amount to significantly more than the exception itself which cannot provide inventive concept (MPEP 2106.05(h)).
and in response to detecting the anomaly in the one cluster of the clusters of the time series signals, generating an electronic alert that the anomaly has occurred for the one machine of the machines that corresponds to the one cluster: Insignificant extra-solution as the limitation amounts to necessary data outputting (MPEP 2106.05(g)(3)). This falls under Well-Understood, Routine, Conventional activity -see MPEP 2106.05(d)(II)(vi).
Even when considered in combination, these additional elements represent mere instructions to apply an exception and therefore do not provide an inventive concept. The claim is ineligible.
Claim 7
Step 1: A process, as above.
Step2A Prong 1: The claim recites, inter alia:
…the ambient time series signals are not produced by the machines: This limitation recites a mental process as it involves observation of the data source.
Step2A Prong 2 and Step 2B: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception under step 2B. Thus, the judicial exception is not integrated into a practical application (see MPEP 2106.04(d) I.), failing step 2A prong 2. The claim is ineligible.
Even when considered in combination, these additional elements represent mere instructions to apply an exception and therefore do not provide an inventive concept. The claim is ineligible.
Claim 8
Step 1: The claim recites an apparatus; therefore, it is directed to the statutory category of
apparatus.
Step2A Prong 1: The claim recites, inter alia:
identify a group of ambient time series signals that overlaps more than one of the clusters: This limitation recites a mental process since it deals with the identification of time series that are overlapped in a group of clusters.
add the group of the ambient time series signals into the one cluster of the clusters that corresponds to the one source: This limitation recites a mental process because it deals with adding ambient signals to a cluster.
…separate the time series signals into a plurality of clusters that corresponding to the plurality of the sources, wherein one cluster of the clusters corresponds to one source of the plurality of sources and includes the time series signals that are associated with the one source of the plurality of sources: This limitation is seen as a mathematical concept as it deals with separating time series signals into clusters using k-mediods clustering method which is an algorithm that incorporates using math equations to group time series into clusters. See paragraph 0073, “For example, the automatic clustering process presented herein may use tri-point clustering (TPC)… k-medoids clustering methods. As a result, in one embodiment, the automatic clustering process presented herein removes the need for input of the correct number k of clusters.”
Step2A Prong 2: This judicial exception is not integrated into a practical application because the
additional elements are as follows:
A non-transitory computer-readable medium that includes stored thereon computer-executable instructions that when executed by at least a processor of a computer cause the computer to: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
receive time series signals associated with a plurality of sources of the time series signals, wherein the sources that the time series signals are associated with are not identified from labels of the time series signals: Data Gather- Mere data gathering recited at a high level of generality, and thus are insignificant extra-solution activity (MPEP 2106.05(g)).
Automatically… and train a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one source without using the time series signals not included in the one cluster: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly
more than the judicial exception because the additional elements are as follows:
A non-transitory computer-readable medium that includes stored thereon computer-executable instructions that when executed by at least a processor of a computer cause the computer to: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
receive time series signals associated with a plurality of sources of the time series signals, wherein the sources that the time series signals are associated with are not identified from labels of the time series signals: The additional element of “receiving” does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of receiving steps amounts to no more than mere data gathering. This element amounts to receiving data over a network and are well-understood, routine, conventional activity. See MPEP 2106.05(d), subsection II (i). This cannot provide an inventive concept.
Automatically… and train a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one source without using the time series signals not included in the one cluster: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
The elements in combination as an ordered whole still do not amount to significantly more than the judicial exception (i.e., the abstract ideas of identifying and adding time series signals). The claim merely describes a process of applying known mathematical tools (clustering and machine learning models) and standard computing functions (receiving data, training a model) using a generic computer.
Therefore, the claim as a whole remains focused on the abstract idea and fails Step 2B of the
eligibility analysis.
Claims 9-14
Step 1: Claims 9-14 recite an apparatus; therefore, it is directed to the statutory category of
apparatus.
Step 2A Prong 1: Claims 9–14 recite judicial exceptions similar to those in claims 2–7. Although these claims substitute the term 'sources' for 'machines,' this change does not alter the substance of the judicial exception, as 'sources' encompasses 'machines' and remains a high-level description of a data origin within the same technological environment.
Step 2A Prong 2: The judicial exceptions are not integrated into a practical application. The analysis at this step mirrors that of claims 2-7 respectively, except insofar as claims 9-14 additionally recite:
when executed by at least the processor, further cause the computer to…[method]: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The judicial exception is not integrated into a practical application. The analysis at this step mirrors that of claims 2-7, respectively, except insofar as claims 9-14 recite the non-transitory medium limitation, which is mere instructions to apply and exception using a generic computer for the same reasons given above.
Even when considered in combination, these additional elements represent mere instructions to apply an exception and therefore do not provide an inventive concept. The claim is ineligible.
Claim 15
Step 1: The claim recites an apparatus; therefore, it is directed to the statutory category of
apparatus.
Step2A Prong 1: The claim recites, inter alia:
identify a group of ambient time series signals that overlaps more than one of the clusters: This limitation recites a mental process since it deals with the identification of time series that are overlapped in a group of clusters.
add the group of the ambient time series signals into the one cluster of the clusters that corresponds to the one component: This limitation recites a mental process because it deals with adding ambient signals to a cluster.
separate the time series signals into a plurality of clusters corresponding to the plurality of the components, wherein one cluster of the clusters corresponds to one component of the plurality of components and includes the time series signals that are associated with the one component of the plurality of components: This limitation is seen as a mathematical concept as it deals with separating time series signals into clusters using k-mediods clustering method which is an algorithm that incorporates using math equations to group time series into clusters. See paragraph 0073, “For example, the automatic clustering process presented herein may use tri-point clustering (TPC)… k-medoids clustering methods. As a result, in one embodiment, the automatic clustering process presented herein removes the need for input of the correct number k of clusters.”
Step2A Prong 2: This judicial exception is not integrated into a practical application because the
additional elements are as follows:
A computing system, comprising: at least one processor; at least one memory connected to the at least one processor; a non-transitory computer readable medium including instructions stored thereon that when executed by at least the processor cause the computing system to: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
receive time series signals associated with a plurality of components of an asset, wherein the time series signals are unlabeled as to which of the components the time series signals are associated with: Data Gather- Mere data gathering recited at a high level of generality, and thus are insignificant extra-solution activity (MPEP 2106.05(g)).
Automatically… and train a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one component without using the time series signals not included in the one cluster: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly
more than the judicial exception because the additional elements are as follows:
A computing system, comprising: at least one processor; at least one memory connected to the at least one processor; a non-transitory computer readable medium including instructions stored thereon that when executed by at least the processor cause the computing system to: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
receive time series signals associated with a plurality of components of an asset, wherein the time series signals are unlabeled as to which of the components the time series signals are associated with: The additional element of “receiving” does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of receiving steps amounts to no more than mere data gathering. This element amounts to receiving data over a network and are well-understood, routine, conventional activity. See MPEP 2106.05(d), subsection II (i). This cannot provide an inventive concept.
and train a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one component without using the time series signals not included in the one cluster: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea and cannot provide inventive concept (MPEP 2106.05(f)).
The elements in combination as an ordered whole still do not amount to significantly more than the judicial exception (i.e., the abstract ideas of identifying and adding time series signals). The claim merely describes a process of applying known mathematical tools (clustering and machine learning models) and standard computing functions (receiving data, training a model) using a generic computer.
Therefore, the claim as a whole remains focused on the abstract idea and fails Step 2B of the
eligibility analysis.
Claims 16-20
Step 1: Claims 16-20 recite an apparatus; therefore, it is directed to the statutory category of
apparatus.
Step 2A Prong 1: Claims 16-20 recite judicial exceptions similar to those in claims 2–7. Although these claims substitute the term 'components' for 'machines,' this change does not alter the substance of the judicial exception, as 'sources' encompasses 'machines' and remains a high-level description of a data origin within the same technological environment.
Step 2A Prong 2: The judicial exceptions are not integrated into a practical application. The analysis at this step mirrors that of claims 2-7 respectively, except insofar as claims 16-20 additionally recite:
further cause the computing system to… [method]: Adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea (MPEP 2106.05(f)).
Step 2B: The judicial exception is not integrated into a practical application. The analysis at this step mirrors that of claims 2-7, respectively, except insofar as claims 16-20 recite the computing system limitation, which is mere instructions to apply and exception using a generic computer for the same reasons given above.
Even when considered in combination, these additional elements represent mere instructions to apply an exception and therefore do not provide an inventive concept. The claim is ineligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 4-5, 7-8, 11-12, 14-15, 17-18, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Servajean (WO 2018224669 A1) in view of Fani (US 20210217093 A1).
Regarding claim 1,
Servajean teaches [a] computer-implemented method, comprising: receiving time series signals associated with a plurality of machines, wherein the time series signals are unlabeled as to which of the machines the time series signals are associated with (Page 2 Line 20 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device”, Page 4 Line 31, “Thus, for the set of time series each time series can be converted to a feature vector as input to a clustering algorithm such as k-means.”
Servajean receives time series data that lacks any origin datum identifying the specific machine source (Page 2), and subsequently processes this unlabeled data using an unsupervised k-means algorithm (Page 4) to group characteristics without prior knowledge of machine associations. In this context, 'devices' correspond to 'machines' because the system identifies the physical or virtual computing units as the source of the signals since the network traffic is communicated by the devices.);
automatically determining from the time series signals a plurality of clusters that correspond to the plurality of the machines and separating the time series signals into the plurality of clusters (Page 4 Line 26, of Servajean “A clustering process 208 is performed to cluster the set of time series into a plurality of clusters each constituting a subset of the set… In a preferred embodiment, each cluster is defined based on an autoencoder as input to a clustering algorithm such as k-means… In one embodiment, such clustering results in devices 202 having similar network 35 communication characteristics being clustered together.”
The clustering process is automatically performed to cluster the time series data corresponding to the devices for network communication.),
wherein one cluster of the clusters corresponds to one machine of the plurality of machines and includes the time series signals that are associated with the one machine of the plurality of machines (Page 2 Line 22 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster; receiving a new time series including a plurality of time windows of data corresponding to network communication characteristics for a device; for each time window of the new time series, generating a vector of reconstruction errors for the device for each autoencoder based on testing the autoencoder with data from the time window; evaluating a derivative of each vector; training a machine learning model based on the derivatives so as to define a filter for identifying subsequent time series for a device being absent anomalous communication.”
The reference discloses receiving time series data for a specific device, training an autoencoder 'for the first cluster' based on that specific data, and using the results to filter data 'for a device'. This implies a dedicated data grouping (a 'cluster') that is specific to one unique device/machine, thus mapping the limitation that one cluster corresponds to one machine.);
adding the group of the ambient time series signals into the one cluster of the clusters that corresponds to the one machine (Page 4 Line 30 of Servajean, “An autoencoder can then be employed to inform a clustering algorithm (such as k-means) to separate traffic into clusters.”, Page 2 Line 20, “a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster…”
The time series correspond to ambient network communication characteristics because it represents passively collected, continuously occurring background network. Servajean’s clustering of the time series using an autoencoder and k-means adds the group of ambient time series signals into the cluster corresponding to the device (machine).)
and training a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one machine without using the time series signals not included in the one cluster (Page 2 Line 22 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster; receiving a new time series including a plurality of time windows of data corresponding to network communication characteristics for a device; for each time window of the new time series, generating a vector of reconstruction errors for the device for each autoencoder based on testing the autoencoder with data from the time window; evaluating a derivative of each vector; training a machine learning model based on the derivatives so as to define a filter for identifying subsequent time series for a device being absent anomalous communication.”
The reference teaches training a machine learning model (the autoencoder and subsequent filter) based on a specific cluster to detect anomalies. Specifically, it discloses training the model 'for the first cluster based on time series in the cluster,' which maps to the claim’s requirement of using only signals included in that cluster. The training is isolated to that cluster's data, which is used to generate a model that is specific to that device/machine without influence from external signals.).
Servajean does not teach identifying a group of ambient time series signals that overlaps more than one of the clusters.
Fani, in the same field of endeavor, teaches identifying a group of… time series signals that overlaps more than one of the clusters (Paragraph 0116 of Fani, “During customer clustering, the customers who have similar spatio-temporal events patterns, as represented by their time series data, are grouped as a cluster. Various techniques can be used to detect clusters such as, but not limited to, overlapping clustering algorithms like the Gaussian Mixture Model [3] or non-overlapping clustering methods like the k-means method [4] or the Louvain method [5] may be utilized.”
Fani teaches the identification of time series signals that overlap multiple clusters by utilizing overlapping clustering algorithms, such as the Gaussian Mixture Model. This reference directly addresses the limitation of traditional hard clustering methods, like k-means, which restrict each data point to a single group and fail to capture signals with characteristics shared across multiple clusters.)
Therefore, it would have been obvious to one of ordinary skill in the art to combine Servajean’s teaching of clustering unlabeled time series signals associated with machines for anomaly detection with Fani’s teaching of overlapping clustering algorithms for time series data in order to improve the flexibility and accuracy of clustering in environments where signals may not belong to a single cluster (Paragraphs 22 and 0110 of Fani).
Regarding claim 4,
Servajean teaches ambient time series (Page 2 Line 20 of Servajean, “a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device”
The time series correspond to ambient network communication characteristics because it represents passively collected, continuously occurring background network.).
Servajean does not teach identifying the group of… time series that overlaps more than one of the clusters further comprises automatically selecting signals from the time series signals that have a correlation between the more than one of the clusters that satisfies a threshold.
Fani, in the same field of endeavor, teaches identifying the group of… time series that overlaps more than one of the clusters further comprises automatically selecting signals from the time series signals that have a correlation between the more than one of the clusters that satisfies a threshold (Paragraph 0116 of Fani, “During customer clustering, the customers who have similar spatio-temporal events patterns, as represented by their time series data, are grouped as a cluster. Various techniques can be used to detect clusters such as, but not limited to, overlapping clustering algorithms like the Gaussian Mixture Model [3] or non-overlapping clustering methods like the k-means method [4] or the Louvain method [5] may be utilized.”, Paragraph 0118, “At act 556, a customer cluster from the customer cluster data 518 is determined for the given customer. This may be determined based on the similarity between the data of a new cluster and the centroid of each cluster based on a given threshold.”
Fani teaches the identification of time series signals that overlap multiple clusters by using overlapping clustering algorithms, such as the Gaussian Mixture Model. This reference directly addresses the limitation of traditional hard clustering methods like k-means, which restrict each data point to a single group and fail to capture signals with characteristics shared across multiple clusters. Additionally, Fani determines cluster membership based on similarity comparison between time series data and cluster centroids using a predefined threshold. The time series correspond to ambient network communication characteristics because it represents passively collected, continuously occurring background network. The time series correspond to ambient network communication characteristics because it represents passively collected, continuously occurring background network.).
Therefore, it would have been obvious to one of ordinary skill in the art to combine Servajean’s teaching of processing ambient time series for machine-specific anomaly detection with Fani’s teaching of overlapping clustering and threshold similarity selection in order to improve the identification of shared or ambiguous ambient signals based on the signals that correlate with more than one cluster (Paragraph 0110 of Fani).
Regarding claim 5,
Servajean teaches for each individual cluster in the plurality of clusters that corresponds to an individual machine: adding the group of the ambient time series signals to the individual cluster of time series signals associated with the individual machine (Page 4 Line 24, “Thus, a set of time series are generated, each for a different device 25 202, and each comprising characteristics over fixed length time windows.”, Page 4 Line 30 of Servajean, “An autoencoder can then be employed to inform a clustering algorithm (such as k-means) to separate traffic into clusters.”, Page 2 Line 20, “a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster…”
The time series correspond to ambient network communication characteristics because it represents passively collected, continuously occurring background network. Servajean’s clustering of the time series using an autoencoder and k-means adds the group of ambient time series signals into the cluster corresponding to the device (machine). Because Servajean receives and processes time series corresponding to network communication characteristics for a device, and trains autoencoders and clusters based on those device-specific time series, each cluster corresponds to an individual machine’s network communication behavior.);
and training a separate machine learning model that is specific to the individual machine that corresponds to the individual cluster, wherein the machine learning model is trained to detect anomalies for the individual machine based on the time series signals from the given cluster and the group of ambient time series signals (Page 4 Line 24, “Thus, a set of time series are generated, each for a different device 25 202, and each comprising characteristics over fixed length time windows.”, Page 2 Line 22 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster; receiving a new time series including a plurality of time windows of data corresponding to network communication characteristics for a device; for each time window of the new time series, generating a vector of reconstruction errors for the device for each autoencoder based on testing the autoencoder with data from the time window; evaluating a derivative of each vector; training a machine learning model based on the derivatives so as to define a filter for identifying subsequent time series for a device being absent anomalous communication.”
Servajean teaches training a machine learning model (including the autoencoder and subsequent filter) for each cluster using only the time series signals in that cluster. Because each cluster corresponds to a specific device and includes both the cluster-specific and ambient time series signals, the model is trained to detect anomalies specific to that device without influence from other devices’ signals.).
Regarding claim 7,
Servajean teaches the ambient time series signals are not produced by the machines (Page 2 Line 20 of Servajean, “a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device”
The time series correspond to ambient network communication characteristics because it represents passively collected, continuously occurring background network.).
Regarding claim 8,
Servajean teaches receiv[ing] time series signals associated with a plurality of sources of the time series signals, wherein the sources that the time series signals are associated with are not identified from labels of the time series signals (Page 2 Line 20 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device”, Page 4 Line 31, “Thus, for the set of time series each time series can be converted to a feature vector as input to a clustering algorithm such as k-means.”
The time series data being fed into the k-means algorithm corresponds to the time series signals being unlabeled because k-means is an unsupervised learning model which deals with unlabeled datasets. In this context, 'devices' correspond to sources because the system identifies the physical or virtual computing units as the source of the signals since the network traffic is communicated by the devices.);
automatically separate the time series signals into a plurality of clusters that corresponding to the plurality of the sources (Page 4 Line 26, of Servajean “A clustering process 208 is performed to cluster the set of time series into a plurality of clusters each constituting a subset of the set… In a preferred embodiment, each cluster is defined based on an autoencoder as input to a clustering algorithm such as k-means… In one embodiment, such clustering results in devices 202 having similar network 35 communication characteristics being clustered together.”
The clustering process is automatically performed to cluster the time series data corresponding to the devices for network communication.),
wherein one cluster of the clusters corresponds to one source of the plurality of sources and includes the time series signals that are associated with the one source of the plurality of sources (Page 2 Line 22 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster; receiving a new time series including a plurality of time windows of data corresponding to network communication characteristics for a device; for each time window of the new time series, generating a vector of reconstruction errors for the device for each autoencoder based on testing the autoencoder with data from the time window; evaluating a derivative of each vector; training a machine learning model based on the derivatives so as to define a filter for identifying subsequent time series for a device being absent anomalous communication.”
The reference discloses receiving time series data for a specific device, training an autoencoder 'for the first cluster' based on that specific data, and using the results to filter data 'for a device'. This implies a dedicated data grouping (a 'cluster') that is specific to one unique device/source, thus mapping the limitation that one cluster corresponds to one machine.);
add the group of the ambient time series signals into the one cluster of the clusters that corresponds to the one source (Page 4 Line 6, “An autoencoder can then be employed to inform a clustering algorithm (such as k-means) to separate traffic into clusters.”, Page 2 Line 20, “a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster…”
The time series correspond to ambient network communication characteristics because it represents passively collected, continuously occurring background network. Servajean’s clustering of the time series using an autoencoder and k-means adds the group of ambient time series signals into the cluster corresponding to the device (machine));
and train a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one source without using the time series signals not included in the one cluster (Page 2 Line 22 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster; receiving a new time series including a plurality of time windows of data corresponding to network communication characteristics for a device; for each time window of the new time series, generating a vector of reconstruction errors for the device for each autoencoder based on testing the autoencoder with data from the time window; evaluating a derivative of each vector; training a machine learning model based on the derivatives so as to define a filter for identifying subsequent time series for a device being absent anomalous communication.”
The reference teaches training a machine learning model (the autoencoder and subsequent filter) based on a specific cluster to detect anomalies. Specifically, it discloses training the model 'for the first cluster based on time series in the cluster,' which maps to the claim’s requirement of using only signals included in that cluster. The training is isolated to that cluster's data, which is used to generate a model that is specific to that device/source without influence from external signals.).
Servajean does not teach a non-transitory computer-readable medium that includes stored thereon computer-executable instructions that when executed by at least a processor of a computer and identifying a group of… time series signals that overlaps more than one of the clusters.
Fani, in the same field of endeavor, teaches [a] non-transitory computer-readable medium that includes stored thereon computer-executable instructions that when executed by at least a processor of a computer cause the computer to (Paragraph 0059 of Fani, “Furthermore, at least some of the programs associated with the systems and methods of the embodiments described herein may be capable of being distributed in a computer program product comprising a computer readable medium that bears computer usable instructions, such as program code, for one or more processors. The program code may be preinstalled and embedded during manufacture and/or may be later installed as an update for an already deployed computing system. The medium may be provided in various forms, including non-transitory forms such as, but not limited to, one or more diskettes, compact disks, tapes, chips, and magnetic and electronic storage.”):
identifying a group of… time series signals that overlaps more than one of the clusters (Paragraph 0116 of Fani, “During customer clustering, the customers who have similar spatio-temporal events patterns, as represented by their time series data, are grouped as a cluster. Various techniques can be used to detect clusters such as, but not limited to, overlapping clustering algorithms like the Gaussian Mixture Model [3] or non-overlapping clustering methods like the k-means method [4] or the Louvain method [5] may be utilized.”
Fani teaches the identification of time series signals that overlap multiple clusters by utilizing overlapping clustering algorithms, such as the Gaussian Mixture Model. This reference directly addresses the limitation of traditional hard clustering methods, like k-means, which restrict each data point to a single group and fail to capture signals with characteristics shared across multiple clusters.)
Therefore, it would have been obvious to one of ordinary skill in the art to combine Servajean’s teaching of clustering unlabeled time series signals associated with machines for anomaly detection with Fani’s teaching of overlapping clustering algorithms for time series data in order to improve the flexibility and accuracy of clustering in environments where signals may not belong to a single cluster (Paragraphs 22 and 25 of Fani).
Claims 11-12 and 14 are rejected using the same rationale as claims 4-5, and 7. Although these claims substitute the term 'sources' for 'machines,' this change does not alter the interpretation as 'sources' encompasses 'machines' and remains a high-level description of a data origin within the same technological environment.
Claim 11 is a non-transitory computer-readable medium corresponding to method claim 4 and is rejected using the same rationale as claim 4.
Claim 12 is a non-transitory computer-readable medium corresponding to method claim 5 and is rejected using the same rationale as claim 5.
Claim 14 is a non-transitory computer-readable medium corresponding to method claim 7 and is rejected using the same rationale as claim 7.
Regarding claim 15,
Servajean teaches receive time series signals associated with a plurality of components of an asset, wherein the time series signals are unlabeled as to which of the components the time series signals are associated with (Page 2 Line 20 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device”, Page 4 Line 31, “Thus, for the set of time series each time series can be converted to a feature vector as input to a clustering algorithm such as k-means.”
The time series data being fed into the k-means algorithm corresponds to the time series signals being unlabeled because k-means is an unsupervised learning model which deals with unlabeled datasets. In this context, 'devices' correspond to 'components' because the system identifies the physical or virtual computing units as the source of the signals since the network traffic is communicated by the devices.);
automatically separate the time series signals into a plurality of clusters corresponding to the plurality of the components (Page 4 Line 26, of Servajean “A clustering process 208 is performed to cluster the set of time series into a plurality of clusters each constituting a subset of the set… In a preferred embodiment, each cluster is defined based on an autoencoder as input to a clustering algorithm such as k-means… In one embodiment, such clustering results in devices 202 having similar network 35 communication characteristics being clustered together.”
The clustering process is automatically performed to cluster the time series data corresponding to the components for network communication.),
wherein one cluster of the clusters corresponds to one component of the plurality of components and includes the time series signals that are associated with the one component of the plurality of components (Page 2 Line 22 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster; receiving a new time series including a plurality of time windows of data corresponding to network communication characteristics for a device; for each time window of the new time series, generating a vector of reconstruction errors for the device for each autoencoder based on testing the autoencoder with data from the time window; evaluating a derivative of each vector; training a machine learning model based on the derivatives so as to define a filter for identifying subsequent time series for a device being absent anomalous communication.”
The reference discloses receiving time series data for a specific device, training an autoencoder 'for the first cluster' based on that specific data, and using the results to filter data 'for a device'. This implies a dedicated data grouping (a 'cluster') that is specific to one unique device/component, thus mapping the limitation that one cluster corresponds to one machine.);
add the group of the ambient time series signals into the one cluster of the clusters that corresponds to the one component (Page 4 Line 6, “An autoencoder can then be employed to inform a clustering algorithm (such as k-means) to separate traffic into clusters.”, Page 2 Line 20, “a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster…”
The time series correspond to ambient network communication characteristics because it represents passively collected, continuously occurring background network. Servajean’s clustering of the time series using an autoencoder and k-means adds the group of ambient time series signals into the cluster corresponding to the device (machine));
and train a machine learning model to detect an anomaly based on the one cluster to generate a trained machine learning model that is specific to the one component without using the time series signals not included in the one cluster (Page 2 Line 22 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster, wherein a state of the autoencoder is periodically recorded after a predetermined fixed number of training examples to define a set of trained autoencoders for the cluster; receiving a new time series including a plurality of time windows of data corresponding to network communication characteristics for a device; for each time window of the new time series, generating a vector of reconstruction errors for the device for each autoencoder based on testing the autoencoder with data from the time window; evaluating a derivative of each vector; training a machine learning model based on the derivatives so as to define a filter for identifying subsequent time series for a device being absent anomalous communication.”
The reference teaches training a machine learning model (the autoencoder and subsequent filter) based on a specific cluster to detect anomalies. Specifically, it discloses training the model 'for the first cluster based on time series in the cluster,' which maps to the claim’s requirement of using only signals included in that cluster. The training is isolated to that cluster's data, which is used to generate a model that is specific to that device/machine without influence from external signals.).
Servajean does not teach [a] computing system, comprising: at least one processor; at least one memory connected to the at least one processor; a non-transitory computer readable medium including instructions stored thereon that when executed by at least the processor cause the computing system and identify a group of ambient time series signals that overlaps more than one of the clusters;
Fani, in the same field of endeavor, teaches [a] computing system, comprising: at least one processor; at least one memory connected to the at least one processor; a non-transitory computer readable medium including instructions stored thereon that when executed by at least the processor cause the computing system to (Paragraph 0059 of Fani, “Furthermore, at least some of the programs associated with the systems and methods of the embodiments described herein may be capable of being distributed in a computer program product comprising a computer readable medium that bears computer usable instructions, such as program code, for one or more processors. The program code may be preinstalled and embedded during manufacture and/or may be later installed as an update for an already deployed computing system. The medium may be provided in various forms, including non-transitory forms such as, but not limited to, one or more diskettes, compact disks, tapes, chips, and magnetic and electronic storage.”, Paragraph 0068, “The processor 130 may be a standard processor that controls the operation of the device 122n and becomes a specific processing device when executing certain programs to allow it to submit electronic claims to the device 142 and to interact with the server 100. The memory unit 132 generally includes RAM and ROM and is used to store an operating system and programs as is commonly known by those skilled in the art.”):
identify a group of ambient time series signals that overlaps more than one of the clusters (Paragraph 0116 of Fani, “During customer clustering, the customers who have similar spatio-temporal events patterns, as represented by their time series data, are grouped as a cluster. Various techniques can be used to detect clusters such as, but not limited to, overlapping clustering algorithms like the Gaussian Mixture Model [3] or non-overlapping clustering methods like the k-means method [4] or the Louvain method [5] may be utilized.”
Fani teaches the identification of time series signals that overlap multiple clusters by utilizing overlapping clustering algorithms, such as the Gaussian Mixture Model. This reference directly addresses the limitation of traditional hard clustering methods, like k-means, which restrict each data point to a single group and fail to capture signals with characteristics shared across multiple clusters.)
Therefore, it would have been obvious to one of ordinary skill in the art to combine Servajean’s teaching of clustering unlabeled time series signals associated with machines for anomaly detection with Fani’s teaching of overlapping clustering algorithms for time series data in order to improve the flexibility and accuracy of clustering in environments where signals may not belong to a single cluster (Paragraphs 22 and 0110 of Fani).
Claims 17-18 and 20 are rejected using the same rationale as claims 4-5, and 7. Although these claims substitute the term 'components' for 'machines,' this change does not alter the interpretation as 'components' encompasses 'machines' and remains a high-level description of a data origin within the same technological environment.
Claim 17 is a computing system corresponding to method claim 4 and is rejected using the same rationale as claim 4.
Claim 18 is a computing system corresponding to method claim 5 and is rejected using the same rationale as claim 5.
Claim 20 is a computing system corresponding to method claim 7 and is rejected using the same rationale as claim 7.
Claims 2, 6, 9, 13, 16, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Servajean (WO 2018224669 A1) in view of Fani (US 20210217093 A1) and Garvey (US 20190102155 A1).
Regarding claim 2,
Servajean teaches automatically determining from the time series signals the plurality of clusters that correspond to the plurality of machines further comprises identifying a quantity for the plurality of the clusters at which… (Page 4 Line 26, of Servajean “A clustering process 208 is performed to cluster the set of time series into a plurality of clusters each constituting a subset of the set… In a preferred embodiment, each cluster is defined based on an autoencoder as input to a clustering algorithm such as k-means… In one embodiment, such clustering results in devices 202 having similar network 35 communication characteristics being clustered together.”
The clustering process is automatically performed to cluster the time series data corresponding to the devices for network communication. The identification of a quantity corresponds to the time series signals that is grouped into clusters.),
Servajean does not teach intra-cluster correlations within the clusters are maximized and inter-cluster correlations between the clusters are minimized.
Garvey, in the same field of endeavor, teaches …intra-cluster correlations within the clusters are maximized (Paragraph 0094, “A gap statistic may then be used to select the optimal k…The number of clusters k is then selected to maximize the gap statistic, which is defined as:
PNG
media_image1.png
39
204
media_image1.png
Greyscale
where E.sub.n* denotes expectation under a sample size of n from the random distribution and W.sub.k is the pooled within-cluster sum of squares around the cluster mode or means.”
The reference explicitly describes selecting the number of clusters k by maximizing the gap statistic, which is defined in terms of minimizing the pooled within-cluster sums of squares W_k. Minimizing within-cluster dispersion directly corresponds to maximizing similarity (i.e., correlation or cohesion) among data points within the same cluster. The maximization of the gap statistic groups data points that are most similar, which maximizes the correlation between them.)
…and inter-cluster correlations between the clusters are minimized (Paragraph 0093, “The set of operations further comprises partitioning the feature vectors into a plurality of clusters (Operation 504)…With k-mode clustering, for instance, the clustering process may randomly select k unique feature vectors as initial cluster centers. The cluster process may then calculate the distance between each feature vector and the cluster mode and assign the feature vector to the cluster whose center has the shortest distance to the feature vector.”
The reference paragraph and operation 504 describe assigning each feature vector to the cluster whose center has the shortest distance, which separates feature vectors into distinct clusters based on distance. Since it is partitioning feature vectors by grouping the data point to the nearest cluster center, the method increases separation between clusters, minimizing similarity (correlation) across different clusters over time. The algorithm always chooses the nearest cluster center for a datapoint over time, so the algorithm will keep clusters separate and distinct, thus minimizing the similarity between the clusters.)
Therefore, it would have been obvious to one of ordinary skill in the art to combine Servajean’s teaching of automatically clustering time series signals for machines with Garvey’s teaching of selecting cluster quantities and assigning points to clusters as to maximize intra-cluster and minimize inter-cluster similarities in order to determine an optimal number of clusters that have high correlation within each cluster for improving model predictions (Paragraph 0005 and 0110 of Garvey).
Regarding claim 6,
Servajean teaches monitoring the one cluster of the plurality of clusters of the time series signals with the trained machine learning model to detect the anomaly; and in response to detecting the anomaly in the one cluster of the clusters of the time series signals… that the anomaly has occurred for the one machine of the machines that corresponds to the one cluster (Page 2 Line 22 of Servajean, “The present invention accordingly provides, in a first aspect, a method of anomaly detection for network traffic communicated by devices via a computer network, the method comprising: receiving a set of training time series each including a plurality of time windows of data corresponding to network communication characteristics for a device; training an autoencoder for the first cluster based on time series in the cluster… training a machine learning model based on the derivatives so as to define a filter for identifying subsequent time series for a device being absent anomalous communication.”, Page 4 Lines 24-27, “Thus, a set of time series are generated, each for a different device 25 202, and each comprising characteristics over fixed length time windows. A clustering process 208 is performed to cluster the set of time series into a plurality of clusters each constituting a subset of the set.”
Servajean teaches monitoring each cluster of the plurality of clusters with a trained machine learning model, where the model is trained using only the time series signals in that cluster. Because each cluster corresponds to a specific device and includes both cluster-specific and ambient time series signals, any anomaly detected in the cluster can be directly attributed to the device corresponding to that cluster.).
Servajean does not teach generating an electronic alert.
Garvey, in the same field of endeavor, teaches generating an electronic alert (Paragraph 0193 of Garvey, “The in-application alerts may trigger alerts to the user while logged into the application, or may trigger alerts to the user using default or user-selected alert mechanisms available within the microservice application itself, rather than through other applications plugged into the microservices manager.”)
Therefore, it would have been obvious to one of ordinary skill in the art to combine Servajean’s teaching of monitoring a cluster of time series signals with a trained machine learning model to detect anomalies for a specific machine with Garvey’s teaching of generating electronic alerts in response to detected events in order to provide a mechanism for notifying a user based on a triggered event that occurred (Paragraph 0193 of Garvey).
Claims 9, 13, 16, and 19 are rejected using the same rationale as claims 2 and 6. Although these claims substitute the term ‘sources’ and 'components' for 'machines,' this change does not alter the interpretation as 'components' encompasses 'machines' and remains a high-level description of a data origin within the same technological environment.
Claim 9 is a non-transitory computer-readable medium corresponding to method claim 2 and is rejected using the same rationale as claim 2.
Claim 13 is a non-transitory computer-readable medium corresponding to method claim 6 and is rejected using the same rationale as claim 6.
Claim 16 is a computing system corresponding to method claim 2 and is rejected using the same rationale as claim 2.
Claim 19 is a computing system corresponding to method claim 6 and is rejected using the same rationale as claim 6.
Claims 3 and 10 are rejected under 35 U.S.C. 103 as being unpatentable over Servajean (WO 2018224669 A1) in view of Fani (US 20210217093 A1), Garvey (US 20190102155 A1), and Yoshitaka (JP 2018157386 A).
Regarding claim 3,
Servajean teaches automatically determining from the time series signals the plurality of clusters that correspond to the plurality of machines further comprises (Page 4 Line 26, of Servajean “A clustering process 208 is performed to cluster the set of time series into a plurality of clusters each constituting a subset of the set… In a preferred embodiment, each cluster is defined based on an autoencoder as input to a clustering algorithm such as k-means… In one embodiment, such clustering results in devices 202 having similar network 35 communication characteristics being clustered together.”
The clustering process is automatically performed to cluster the time series data corresponding to the devices for network communication):
Servajean does not teach identifying first intra-cluster dispersions in the plurality of clusters based on performing an inverse Fourier transform of a cross power spectral density of a pair of the time series signals to determine a distance between the pair of the time series signals; generating a gap statistic that indicates a difference between the first intra- cluster dispersions and second intra-cluster dispersions in additional clusters of random noise signals; and selecting a quantity for the plurality of the clusters at which the gap statistic is maximized.
Garvey, in the same field of endeavor, teaches identifying first intra-cluster dispersions in the plurality of clusters based on… generating a gap statistic that indicates a difference between the first intra- cluster dispersions and second intra-cluster dispersions in additional clusters of random noise signals; and selecting a quantity for the plurality of the clusters at which the gap statistic is maximized. (Paragraph 0094, “A gap statistic may then be used to select the optimal k…The number of clusters k is then selected to maximize the gap statistic, which is defined as:
PNG
media_image1.png
39
204
media_image1.png
Greyscale
where E.sub.n* denotes expectation under a sample size of n from the random distribution and W.sub.k is the pooled within-cluster sum of squares around the cluster mode or means.”, Paragraph 0095, “For example, if the optimal number for k is three, then three clusters are retained as generated through k-mode or k-means clustering.”
The computes a gap statistic by comparing the within-cluster dispersion of clustered input data (intra-cluster dispersion) with the expected within-cluster dispersion that is obtained by clustering randomly generated noise data into additional clusters (second intra-cluster dispersion). The gap statistic selects the number of clusters k that maximizes this difference between the first and second intra-cluster dispersions across additional clusters of random noise data.)
Therefore, it would have been obvious to one of ordinary skill in the art to combine Servajean’s teaching of automatically clustering time series signals for multiple machines with Garvey’s teaching of computing intra-cluster dispersions using a gap statistic based on comparing clustered input data in order to select the number of clusters that maximize the differences between dispersions to improve clustering quality and accuracy (Paragraphs 0054 and 0055 of Garvey).
Servajean and Garvey do not teach performing an inverse Fourier transform of a cross power spectral density of a pair of the time series signals to determine a distance between the pair of the time series signals.
Yoshitaka, in the same field of endeavor, teaches …performing an inverse Fourier transform of a cross power spectral density of a pair of the time series signals to determine a distance between the pair of the time series signals (Page 5 Section 3-4. Modification 4, “The specific method for calculating the correlation between the first time series data and the second time series data is not limited to that exemplified in the embodiment. In one example, the cross-correlation between the data D [1] and the data D [2] may be calculated by the following equation (2) instead of the equation (1). [2] Equation (2) means the inverse Fourier transform of the cross spectrum between the frequency spectrum Y1 (f) of the sound signal y1 (t) and the frequency spectrum Y2 (f) of the sound signal y2 (t). Y1 * (f) is a complex conjugate of Y1 (f). In step S3, the specifying unit 14 specified a part of the video included in the first time series data based on the correlation between the sound of the first time series data and the sound of the second time series data… For example, the specifying unit 14 may specify a part using other feature amounts such as MFCC (Mel-Frequency Cepstrum Coefficients) or PCP (Pitch Class Profile).”
The reference discloses calculating the cross-correlation between two time-series signals by taking the inverse Fourier transform of the cross spectrum formed from the frequency spectra of the two signals. Cross power spectral density (cross-PSD) is the cross spectrum of two signals and the resulting cross-correlation function quantifies similarity (and thus distance or dissimilarity) between the signals. A cross power spectral density is the cross spectrum of two signals. Further, the reference expressly states that correlation may be calculated using spectral feature quantities such as MFCCs or PCPs, which are derived from power spectral densities.);
Therefore, it would have been obvious to one of ordinary skill in the art to combine Servajean and Garvey’s teaching with Yoshitaka’s teaching of determining distances between time series using an inverse Fourier transform of CPSD in order to improve the quality of calculating the correlation between time series data (Page 5 Section 3-4. Modification 4 of Yoshitaka).
Claim 10 is a non-transitory computer-readable medium corresponding to method claim 3 and is rejected using the same rationale as claim 3.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MAJD MAHER HADDAD whose telephone number is (571)272-2265. The examiner can normally be reached Mon-Friday 8-5 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamran Afshar can be reached at (571) 272-7796. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/M.M.H./Examiner, Art Unit 2125
/KAMRAN AFSHAR/Supervisory Patent Examiner, Art Unit 2125