DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendments:
The Amendment filed April 7th, 2026 has been entered. Claims 1, 3-11, 12-13, 16-17, 18, 20, and 21-24 remain pending in the application.
Response to Arguments:
Applicant’s arguments filed on April 7, 2026 have been fully considered.
In reference to Applicant’s arguments:
-Claim rejections under 35 U.S.C. 101.
Examiner’s response:
Regarding the applicant’s arguments to 35 U.S.C. 101 with
The applicant stating on page 9 of the remarks that “Application discloses improvements to the operation of an Event Management Bus ("EMB"), which is a class of computer system that monitors, manages, and responds to alerts from distributed IT infrastructure. ( [0023]-[0025])” and citing of specification paragraphs [0027-0029],
From applicant’s arguments, the examiner respectfully disagrees and did not find the applicant’s arguments to be persuasive since the triggering a separate incident for each incoming alert is able to be performed by any generic computer, and is seen as a generic computer being used a tool.
In regards to the applicant further stating on page 9 of remarks that “the claimed features address these problems by training a graph-based neural network on co-occurrence patterns among alert texts and using the resulting embeddings to group incoming alerts under existing incidents in real time, thereby directly reducing the computational burden on the EMB, causing notifications that would otherwise be transmitted to responders based on those alerts to not be transmitted, and reducing the number of new incidents triggered. ([0031], [0033]).”
The examiner also respectfully disagrees and did not find the applicant’s arguments to be persuasive since these citations, although improvement was stated, especially the reducing the computational burden and reducing the number of new incidents triggered, were not directly recited in claims or reflected by the limitations in the claims.
Further, regarding the applicant’s remarks on page 10 paragraph 1 that “requires training the machine-learning model by (1) grouping historical alerts into (e.g., time-windowed) samples, (2) generating a clique graph (i.e., a sample graph) for each sample in which every alert node is connected to every other, (3) combining the per-sample graphs into a combined graph with edge weights, and (4) probabilistically traversing the combined graph based on those edge weights to generate ordered sequences of alert texts as training data. No person can perform this pipeline mentally. The combined graph described in the Application aggregates "100s, 1000s, or more of time windows" into "massive graphs" whose connections are "repeated many number of times." ( [0194]). Probabilistic traversal of a massive, weighted graph to generate statistically representative training corpora is a computational process, not a mental one,”
The examiner also respectfully disagrees and did not find the applicant’s arguments to be persuasive since training a model is considered an additional element for a 1) generic computer to apply instructions to run an abstract idea, 2) grouping alerts is able to be performed mentally (since time-windowed samples was not recited in the claims, this phrase is not viewed as part of a practical application), 3) combining the graphs is considered another mental process since the word combining is not described with any functioning of a computer, 4) probabilistically traversing a combined graph based on edge weights to generate ordered sequences of alert texts as training data is viewed as a step that is able to be performed by any generic computer, 5) regarding the specification [0194] where aggregating 100s, 1000s, or more of time windows" into "massive graphs" whose connections are "repeated many number of times," this element was not recited in the amended claims, the claims did not incorporate this information to be considered.
Regarding the applicant’s remarks on page 10 in paragraph 2 stating “normalizing, tokenizing into n-grams, and vectorizing alert texts into vector representations based on words identified in a training dataset, followed by computing a cosine-style similarity score between the vectorized representations. These are defined computational algorithms, not steps performable in the human mind.”
The examiner also respectfully disagrees and did not find the applicant’s arguments to be persuasive since although performed as computational algorithms, normalizing is a concept that involves mentally converting words to lowercase, removing punctuation and special characters for words, and tokenizing into n-grams involves mentally grouping a sequence of n items from a given text into n part phrases such as one or two word phrases, calculating similarity score involves a calculation that is able to be evaluated mentally with pen and paper.
Regarding the applicant’s remarks on page 10 in paragraph 3 stating for claim 2 “A random walk through a massive weighted graph requires hardware-based computation; no person can perform it mentally.”
The examiner also respectfully disagrees and did not find the applicant’s arguments to be persuasive since a random walk is random and the claim did not recite any instances of the random walk to be computer generated with random number generator or recite additional information regarding how ‘random’ the walk needs to be, thus the human mind can also randomly perform a random walk.
Regarding the applicant’s remarks on page 10 in paragraphs 4 -5, and continued in page 11, paragraphs 1-2, the examiner acknowledges the examples used, however, these examples did not connect to the invention of the instant application, and will not be evaluated since the context for these examples cover different topics and elements.
Regarding the applicant’s remarks on page 11 last paragraph and first few paragraphs in page 12, stating “claims now expressly recite that the alert is added to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert… and expressly identifies a specific technical outcome: the alert is handled under the existing open incident, causing the notification that would otherwise be transmitted to a responder based on the alert to not be transmitted…this is not an abstract organizing concept. It is a specific operation on a specific data structure (an open incident object) maintained by the EMB that directly reduces notification traffic, conserves computational resources, and preserves responder availability.”
The examiner also respectfully disagrees and did not find the applicant’s arguments to be persuasive since the reducing notification traffic, conserving resources, and preserving responder availability were not recited in the claims or reflected by the limitations in the claims.
Regarding the applicant’s remarks on page 13, second paragraph, stating “(1) constructing per-sample clique graphs from co-occurring alert texts, (2) combining those graphs into a weighted combined graph, (3) probabilistically traversing the combined graph based on edge weights to generate an ordered-sequence training corpus of alert texts, and (4) training a graph-based neural network on that corpus to produce alert embeddings for real-time incremental grouping within an EMB is not a well-understood, routine, or conventional activity.”
The examiner also respectfully disagrees and did not find the applicant’s arguments to be persuasive since these steps are able to be performed in a generic computer, and did not connect to a practical application.
Please see examiner’s rejections under 35 U.S.C. 101.
In reference to Applicant’s arguments:
-Claim rejections under 35 U.S.C. 103.
Examiner’s response:
Regarding the applicant’s arguments to 35 U.S.C. 103 with the reference of Chen Z.
From this, the applicant’s arguments have been considered, but are moot in view of new grounds of rejection because the arguments do not apply to the combination of references used in the current rejection.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, 3-11, 12-13, 16-17, 18, 20-24 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea (mental process) without significantly more.
Claim 1:
Regarding claim 1, in step 1 of the 101-analysis set forth in MPEP 2106, the claim recites
“A method, comprising: receiving an alert; obtaining, using a machine-learning model, an embedding for the alert, wherein the machine-learning model is trained by steps comprising: obtaining training data, wherein each training datum comprises a series of alert texts obtained from historical alerts and wherein obtaining the training data comprises:
grouping the historical alerts into samples of alerts; generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts;
combining the respective graphs into a combined graph; and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
and training the machine-learning model using the training data to output embedding for alert texts; identifying, based on the embedding, a group of alerts; and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert,” and a method is one of the four statutory categories of invention. In step 2A prong 1 of the 101-analysis set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process but for recitation of generic computer components:
wherein obtaining the training data comprises: grouping the historical alerts into samples of alerts; (This is considered a mental process, since a person can mentally evaluate and group the data of historical alerts into samples of alerts, see MPEP 2106.04(a)(2)(III)),
generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts; (This is considered a mental process, since a person can mentally evaluate samples of alert to generate respective graphs connecting an alert of a sample of alerts to every other historical alert of the sample of alerts, see MPEP 2106.04(a)(2)(III)),
combining the respective graphs into a combined graph, (this is considered a mental process, since a person can mentally evaluate to combine graphs into a combined graph, see MPEP 2106.04(a)(2)(III)),
“identifying, based on the embedding, a group of alerts;” (mental process, a person can mentally evaluate an alert based on an embedding and sort into a group, see MPEP 2106.04(a)(2)(III))
“and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, (this is considered a mental process, since a person can mentally evaluate and add and then group an alert that is under an existing open incident, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
In step 2A prong 2 of the 101-analysis set forth in MPEP 2106, the examiner has determined that the following additional elements do not integrate this judicial exception into a practical application:
receiving an alert; (In step 2A, prong 2, receiving an alert recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g))
obtaining, using a machine-learning model, an embedding for the alert, (In step 2A, prong 2, obtaining an embedding for alert recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g))
wherein the machine-learning model is trained by steps comprising: obtaining training data, wherein each training datum comprises a series of alert texts obtained from historical alerts; (In step 2A, prong 2, obtaining training data recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g))
and training the machine-learning model using the training data to output embedding for alert texts; (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes; (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert, (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
Since the claim as a whole, looking at the additional elements individually and in combination, does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea.
In step 2B of the 101-analysis set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
As discussed above, additional elements ix, x, and xi recite mere instructions to apply the judicial exception, which are not indicative of significantly more. The additional elements vi, vii, and viii recite mere data gathering, and are considered insignificant extra-solution activities. In step 2B, these insignificant extra-solution activities are well understood routine and conventional activities which includes receiving or transmitting data over a network from court case Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016), – see MPEP 2106.05(d) (II)(i)),
Considering the additional elements individually and in combination, and the claim as a whole, the additional elements do not provide significantly more than the abstract idea. Therefore, the claim is not patent eligible.
Claim 3:
Regarding claim 3, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 3 recites the following abstract idea:
“The method of claim 1, wherein grouping the historical alerts into the samples of alerts comprises: grouping the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts.” (This is considered a mental process, since a person can mentally evaluate and group the historical alerts into the samples of alerts based on an overlapping time window, and the time window is a predefined time interval as mentioned in specification paragraphs [0185, 0190], also see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 4:
Regarding claim 4, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 4 recites the following abstract idea:
“The method of claim 1, wherein grouping the historical alerts into the samples of alerts comprises: grouping one or more of the historical alerts into a sample associated with a historical alert of the historical alerts based on an active window associated with the historical alert.” (this is considered a mental process, since a person can mentally evaluate and group the historical alerts into the samples of alerts based on an active time window, and the time window is a predefined time interval as mentioned in specification paragraphs [0185, 0190-0191], also see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea. Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 5:
Regarding claim 5, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1.
Further, claim 5 recites the following abstract ideas in:
“determining that the second alert cannot be grouped into any other group of alerts by comparing an embedding of the second alert obtained using the machine-learning model to respective embeddings of the group of alerts,” (this is considered a mental process, since a person can mentally evaluate to determine that a second alert cannot be sorted into any group, by mentally comparing the embedding or vector value of the second alert to the embedding values of the group, see MPEP 2106.04(a)(2)(III)),
“and in response to determining that the second alert cannot be grouped into any other group of alerts, adding the second alert to a new group” (this is considered a mental process, since a person can mentally evaluate to determine that a second alert cannot be sorted into any group, and subsequently mentally add that ungrouped second alert to a new group, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Further, claim 5 recites the following additional element:
“The method of claim 1, wherein the alert is a first alert, further comprising: receiving a second alert,” (In step 2A, prong 2, this recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g),). In step 2B, this insignificant extra-solution activity is well understood routine and conventional activity which includes receiving or transmitting data over a network from court case Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) – see MPEP 2106.05(d) (II)(i),
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 6:
Regarding claim 6, it is dependent upon claim 5, and thereby incorporates the limitations of, and corresponding analysis applied to claim 5. Further, claim 6 recites the following additional elements:
“The method of claim 5, wherein adding the second alert to the new group comprises: triggering a new incident from the alert,” (In step 2A, prong 2, this is considered mere instructions to apply an exception using generic computer with the triggering a new incident operation performed by any generic computer, see MPEP 2106.05(f)). (In step 2B, this is also considered mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)).
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 7:
Regarding claim 7, it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 1 recites the following additional elements:
“The method of claim 1, wherein the alert is a first alert, further comprising: receiving a second alert;” (In step 2A, prong 2, this recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g),). In step 2B, this insignificant extra-solution activity is well understood routine and conventional activity which includes receiving or transmitting data over a network from court case Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) – see MPEP 2106.05(d) (II)(i),
“and determining whether the second alert matches any group of alerts ” (this is considered a mental process, since a person can mentally evaluate each alert and determine if a second or additional incoming alert matches any group of alerts, see MPEP 2106.04(a)(2)(III)),
“using a text similarity tool,” (In step 2A, prong 2, this is considered mere instructions to apply an exception using generic computer, see MPEP 2106.05(f)). (In step 2B, this is also considered mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)).
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 8:
Regarding claim 8, it is dependent upon claim 7, and thereby incorporates the limitations of, and corresponding analysis applied to claim 7. Further, claim 8 recites the following additional elements:
“The method of claim 7, further comprising: responsive to determining, using the text similarity tool, that the second alert does not match any group of alerts, using the machine-learning model,” (In step 2A, prong 2, this is considered mere instructions to apply an exception using generic computer with the triggering a new incident operation performed by any generic computer, see MPEP 2106.05(f)). (In step 2B, this is also considered mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
“to determine whether the second alert matches any of the group of alerts,” (this is considered a mental process, since a person can mentally evaluate each alert and determine if a second or additional incoming alert matches any group of alerts, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 9:
Regarding claim 9, it is dependent upon claim 8, and thereby incorporates the limitations of, and corresponding analysis applied to claim 8. Further, claim 9 recites the following abstract idea:
“The method of claim 8, further comprising: responsive to determining that the second alert does not match any group of alerts, adding the second alert to a new group of alerts.” (this is considered a mental process, since a person can mentally evaluate to determine that a second alert cannot be sorted into any group, and subsequently mentally add that ungrouped second alert to a new group, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 10:
Regarding claim 10, it is dependent upon claim 8, and thereby incorporates the limitations of, and corresponding analysis applied to claim 8. Further, claim 10 recites the following abstract idea:
“The method of claim 8, further comprising: responsive to determining that the second alert matches a group of alerts, adding the second alert to the group of alerts.” (this is considered a mental process, since a person can mentally evaluate to determine that a second alert is sorted into a group, and subsequently mentally add that second alert to that group, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 11:
Regarding claim 11, it is dependent upon claim 10, and thereby incorporates the limitations of, and corresponding analysis applied to claim 10. Further, claim 11 recites the following abstract idea:
“The method of claim 10, wherein an incident corresponds to the group of alerts, and wherein adding the second alert to the group of alerts comprises: grouping the second alert under the incident,” (this is considered a mental process, since a person can mentally evaluate to determine that a second alert is sorted into a group or incident, and subsequently mentally group that second alert under the incident, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea. Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 12:
Regarding claim 12, in step 1 of the 101-analysis set forth in MPEP 2106, the claim recites “ A method, comprising: receiving an alert; determining, using a text similarly tool and based on a text of the alert, whether the alert matches a group of alerts of groups of alerts, wherein determining whether the alert matches a group of alerts comprises: normalizing the text of the alert; tokenizing the normalized text into n-grams; vectorizing the n-grams into vector representations based on words identified in a training dataset; and computing a similarity score between the vectorized n-grams of the alert and vectorized texts associated with the groups of alerts; responsive to determining that the alert does not match any of the groups of alerts, determining, using a machine-learning model, whether an embedding corresponding to the alert meets a similarity threshold to a respective embedding of any of the groups of alerts, wherein the machine-learning model is trained by steps comprising:
obtaining training data, wherein each training datum comprises a series of alert texts obtained from historical alerts, and wherein obtaining the training data comprises:
grouping the historical alerts into samples of alerts;
generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts; combining the respective graphs into a combined graph;
and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
and training the machine-learning model using the training data to output an embedding for alert texts;
and responsive to the embedding meeting the similarity threshold with an embedding of a group of alerts, adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert,” which is considered a method and is one of the four statutory categories of invention.
In step 2A prong 1 of the 101-analysis set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process but for recitation of generic computer components:
“determine … based on a text of the alert, whether the alert matches a group of alerts of groups of alerts,” (this is considered a mental process, since a person can mentally evaluate if an alert matches a group of alerts, see MPEP 2106.04(a)(2)(III)),
“determine…whether an embedding corresponding to the alert meets a similarity threshold to a respective embedding of any of the groups of alerts”, (this is considered a mental process, since a person can mentally evaluate if an alert meets a threshold to a respective embedding of any groups of alerts, see MPEP 2106.04(a)(2)(III)),
wherein obtaining the training data comprises: grouping the historical alerts into samples of alerts; (This is considered a mental process, since a person can mentally evaluate and group the data of historical alerts into samples of alerts, see MPEP 2106.04(a)(2)(III)),
generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts, (this is considered a mental process, since a person can mentally evaluate samples of alert to generate respective graphs, see MPEP 2106.04(a)(2)(III)),
combining the respective graphs into a combined graph, (this is considered a mental process, since a person can mentally evaluate to combine graphs into a combined graph, see MPEP 2106.04(a)(2)(III)),
wherein determining whether the alert matches a group of alerts comprises: normalizing the text of the alert; (this recites a mental process, since a person can mentally evaluate and normalize text of the alert, see MPEP 2106.04(a)(2)(III)),
tokenizing the normalized text into n-grams; (this recites a mental process, since a person can mentally evaluate and tokenize text to n-grams, see MPEP 2106.04(a)(2)(III)),
vectorizing the n-grams into vector representations based on words identified in a training dataset; and computing a similarity score between the vectorized n-grams of the alert and vectorized texts associated with the groups of alerts; (this recites a mental process, since a person can mentally evaluate and vectorize n-grams and calculate similarity between vectors, see MPEP 2106.04(a)(2)(III)),
“responsive to the embedding meeting the similarity threshold with an embedding of a group of alerts, adding the alert to the group of alerts, by grouping the alert under an existing open incident in an event management system, (this is considered a mental process, since a person can mentally see if an embedding meets a similarity threshold, add the alert to the group of alerts, and then group an alert under an existing open incident, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
In step 2A prong 2 of the 101-analysis set forth in MPEP 2106, the examiner has determined that the following additional elements do not integrate this judicial exception into a practical application:
“A method, comprising: receiving an alert,” (In step 2A, prong 2, receiving an alert recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g)),
“determine, using a text similarly tool”, (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
“responsive to determining that the alert does not match any of the groups of alerts, determining, using a machine-learning model,” (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
wherein the machine-learning model is trained by steps comprising: obtaining training data, wherein each training datum comprises a series of alert texts obtained from historical alerts, (In step 2A, prong 2, obtaining training data recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g),).
and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes; (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
and training the machine-learning model using the training data to output an embedding for alert texts; (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert, (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
In step 2B of the 101-analysis set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
As discussed above, additional elements xi, xii, xiv, xv, and xvi recite mere instructions to apply the judicial exception, which is not indicative of significantly more. The additional element x and xiii recite mere data gathering, and are considered insignificant extra-solution activities. In step 2B, this insignificant extra-solution activities are well understood routine and conventional activities which include receiving or transmitting data over a network from court case Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016), – see MPEP 2106.05(d) (II)(i)).
Considering the additional elements individually and in combination, and the claim as a whole, the additional elements did not provide significantly more than the abstract idea. Therefore, the claim is not patent eligible.
Claim 13:
Regarding claim 13, it is dependent upon claim 12, and thereby incorporates the limitations of, and corresponding analysis applied to claim 12. Further, claim 13 recites the following abstract idea:
“The method of claim 12, further comprising: responsive to the embedding not meeting the similarity threshold with any respective embedding of the groups of alerts, adding the alert to a new group of alerts,” (this is considered a mental process, since a person can mentally evaluate and then judge to determine that an alert does not meet the similarity threshold value with any respective embedding of the groups of alerts, and subsequently add that alert to a new group, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 16:
Regarding claim 16, it is dependent upon claim 12, and thereby incorporates the limitations of, and corresponding analysis applied to claim 12. Further, claim 16 recites the following abstract idea:
“The method of claim 12, wherein grouping the historical alerts into the samples of alerts comprises: grouping the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts.” (this is considered a mental process, since a person can mentally evaluate and group the historical alerts into the samples of alerts based on an overlapping time window, and the time window is a predefined time interval as mentioned in specification paragraphs [0185, 0190], also see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 17:
Regarding claim 17, it is dependent upon claim 12, and thereby incorporates the limitations of, and corresponding analysis applied to claim 12. Further, claim 17 recites the following additional elements:
“The method of claim 12, wherein grouping the historical alerts into the samples of alerts comprises: grouping one or more of the historical alerts into a sample associated with a historical alert of the historical alerts based on an active window associated with the historical alert.” (this is considered a mental process, since a person can mentally evaluate and group the historical alerts into the samples of alerts based on an active time window, and the time window is a predefined time interval as mentioned in specification paragraphs [0185, 0190-0191], also see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea. Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 18:
Regarding claim 18, in step 1 of the 101-analysis set forth in MPEP 2106, the claim recites “a device, comprising: a memory; and a processor, the processor configured to execute instructions stored in the memory to: receive an alert; obtain, using a machine-learning model, an embedding for the alert, wherein the machine-learning model is trained to: obtain training data, wherein each training datum comprises a series of alert texts obtained from historical alerts, and wherein to obtain the training data comprises to:
group the historical alerts into samples of alerts;
generate respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts;
combine the respective graphs into a combined graph;
and obtain random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes; and output embedding for alert texts; identify, based on the embedding, a group of alerts; and add the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert,” and a device is a machine, which is one of the four statutory categories of invention. In step 2A prong 1 of the 101-analysis set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process but for recitation of generic computer components:
wherein to obtain the training data comprises to: group the historical alerts into samples of alerts; (This is considered a mental process, since a person can mentally evaluate and group the data of historical alerts into samples of alerts, see MPEP 2106.04(a)(2)(III)),
“generate respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts,” (This is considered a mental process, since a person can mentally evaluate samples of alert to generate respective graphs connecting an alert of a sample of alerts to every other historical alert of the sample of alerts, see MPEP 2106.04(a)(2)(III)),
“combine the respective graphs into a combined graph,” (This is considered a mental process, since a person can mentally evaluate to combine graphs into a combined graph, see MPEP 2106.04(a)(2)(III)),
“identify, based on the embedding, a group of alerts;” (mental process, a person can mentally evaluate an alert based on an embedding and sort into a group, see MPEP 2106.04(a)(2)(III))
“and add the alert to the group of alerts by grouping the alert under an existing open incident in an event management system,” (This is considered a mental process, since a person can mentally add the alert to a group, then group an alert under an existing open incident, see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
In step 2A prong 2 of the 101-analysis set forth in MPEP 2106, the examiner has determined that the following additional elements do not integrate this judicial exception into a practical application:
a device, comprising: a memory; and a processor, the processor configured to execute instructions stored in the memory, (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f))
receive an alert; (In step 2A, prong 2, receiving an alert recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g))
obtain, using a machine-learning model, an embedding for the alert, (In step 2A, prong 2, obtaining an embedding for alert recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g))
wherein the machine-learning model is trained to: obtain training data, wherein each training datum comprises a series of alert texts obtained from historical alerts; (In step 2A, prong 2, obtaining training data recites mere data gathering, which is considered insignificant extra-solution activity – see MPEP 2106.05(g))
and output embedding for alert texts; (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
and obtain random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes; (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert, (Mere instructions to apply an exception using generic computer – see MPEP 2106.05(f)),
Since the claim as a whole, looking at the additional elements individually and in combination, does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea.
In step 2B of the 101-analysis set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
As discussed above, additional elements vi, x, xi, and xii recite mere instructions to apply the judicial exception, which are not indicative of significantly more. The additional elements vii, viii, and ix, recites mere data gathering, and are considered insignificant extra-solution activities. In step 2B, these insignificant extra-solution activities are well understood routine and conventional activities which includes receiving or transmitting data over a network from court case Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016), – see MPEP 2106.05(d) (II)(i)), Considering the additional elements individually and in combination, and the claim as a whole, the additional element does not provide significantly more than the abstract idea. Therefore, the claim is not patent eligible.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claim 20:
Regarding claim 20, it is dependent upon claim 18, and thereby incorporates the limitations of, and corresponding analysis applied to claim 18. Further, claim 20 recites the following additional elements:
“The device of claim 18, wherein to group the historical alerts into the samples of alerts comprises to: group the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts.” (This is considered a mental process, since a person can mentally evaluate and group the historical alerts into the samples of alerts based on an overlapping time window, and the time window is a predefined time interval as mentioned in specification paragraphs [0185, 0190], also see MPEP 2106.04(a)(2)(III)),
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mathematical concept but for the recitation of generic computer components, then it falls within the mathematical concept grouping of abstract ideas. Accordingly, the claim “recites” an abstract idea.
Since the claim does not recite additional elements that either integrate the judicial exception into a practical application, nor provide significantly more than the judicial exception, the claim is not patent eligible.
Claims 21 – 24:
All of claim 18’s dependent claims follow the deficiencies of their parent claim. Since claims 21-24 recite similar limitations as corresponding claims 4-7 listed above, and are rejected for similar reasons under 35 U.S.C. 101.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1, 5, 18, and 22 are rejected under 35 U.S.C. 103 over Turgeman L. et al. "Context-aware incremental clustering of alerts in monitoring systems", available at https://doi.org/10.1016/j.eswa.2022.118489 in December 30, 2022), (hereafter, Turgeman), in view of Shetty M., et al., in "SoftNER: Mining Knowledge Graphs From Cloud Incidents", published on April 28, 2022, available at https://link.springer.com/article/10.1007/s10664-022-10159-w , (hereafter, SHETTY), further in view of Jiang, S. et al., in "Random walks on adjacency graphs for mining lexical relations from big text data," published on October 27-30, 2014 for a conference, available at https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=7004272 , (hereafter, Jiang), and further in view of Menon L. et al., in “Leveraging AI to Optimize Oracle EM Ops Center Operations” , published on May-June 2022, available at https://www.researchgate.net/profile/Prabhu-Prasad/publication/393545078_Leveraging_AI_to_Optimize_Oracle_EM_Ops_Center_Operations/links/686f5c04e9b6c13c89e7f17b/Leveraging-AI-to-Optimize-Oracle-EM-Ops-Center-Operations.pdf , (hereafter Menon).
Claim 1:
Regarding claim 1, Turgeman teaches “A method, comprising: receiving an alert,”
See Turgeman describe in page 5, section 4.1.4 in Incremental alerts clustering, "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman talks about receiving a record of an alert related to an information technology incident.
Further, Turgeman also teaches “obtaining, using a machine-learning model, an embedding for the alert, wherein the machine-learning model is trained by steps …”
See Turgeman in page 4, section 4.1.1 Contextualized metric embedding-based model (‘liberal’) mentions " the model is trained using historical data and is applied to incoming alerts…The input to the model is a history of n recent alerts corresponding metric IDs, within a time window w, e.g. {m1, m2, ..., mn}. Using the extracted metrics correlation matrix and an anomaly counter module, the suggested algorithm generates a sparse matrix containing the number of times every two alerts had co-occurred within a pre-defined time window. We train a Word2Vec model (Mikolov et al., 2013) using a 1-hidden-layer neural network based on the synthetic task of given an input metric. The network is trained by feeding the extracted metric pairs co-occurrence data, to learn statistics from the number of times each pairing occurs. The output is the conditional probability distribution, Pr[mt|w], describing the probability for each metric ID to appear nearby a given one from w. A virtual one-hot encoding of metrics goes through a ‘projection layer’ to the hidden layer; these projection weights are later interpreted as a distributed representation of the metrics (e.g., “embeddings”), which are then utilized by a tailored incremental clustering algorithm to dynamically cluster incoming alerts in real time." Here, Turgeman describes using a machine learning model to obtain embeddings for incoming alerts.
Further, Turgeman describes in page 6, section 5.2. Experimental setup "in what follows, we describe the experimental setup that is used to evaluate the performance and effectiveness of the suggested approach. We perform the experiments by using the system described in section 3.1.1. The data set is split into train and test sets; The train set spans the date range of between 22/1/2020 to 21/3/2020 and is composed of 27,109 alerts,” Here, Turgeman in section 5.2 talks about creating pair-wise proximity models (i.e. machine learning model) as well as a contextualized metric embedding (i.e. embedding for the alert).
Further, Turgeman also teaches “obtaining training data, wherein each training datum comprises a series of alert texts obtained from historical alerts,”
See Turgeman in page 4, section 4.1.1. Contextualized metric embedding-based model (‘liberal’) teaches “the model is trained using historical data and is applied to incoming alerts. The suggested modeling approach is influenced by several recent advances in Natural Language Processing (NLP).” Here, Turgeman teaches that the model is using training data, where the data comprises of historical alert data records.
Further, Turgeman also teaches “training the machine-learning model using the training data to output embedding for alert texts,”
See Turgeman in section 5.2 Experimental setup, page 6, where Turgeman describes that training the model involves "4. Based on alert history, the algorithm generates pair-wise proximity models, by using both the contextualized metric embedding-based model (section 4.1.1), and the frequency-based model (section 4.1.2). 5. The post-processing algorithm is applied to metric embedding outcomes (section 4.1.3). 6. The incremental clustering algorithm is then applied to the testing set alerts, yielding a set of cluster outcomes. 7. The parameters used for training and testing are shown in Table 1." Here, Turgeman illustrates that the outputs are the metric embedding outcomes or embeddings from the model.
Further, Turgeman also teaches “identifying, based on the embedding, a group of alerts”
See Turgeman in section 4.1.4 on page 5 describing that "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert." Here, Turgeman describes that based on the average of the corresponding alerts' embeddings (i.e. embedding), Turgeman was able to identify cluster centroid which correspond to a group of alerts.
Further, Turgeman also teaches “adding the alert to the group of alerts,”
See Turgeman in section 4.1.4 on page 5 describing that "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." See Turgeman in page 3, section 2.2, where Turgeman describes that "as a new alert enters the system, it is identified in real-time and placed under the right cluster. The results are then presented to end users, thus helping them immediately surface useful information from large volumes of alerts." Here, Turgeman shows that as a new alert enters the system, the alert is immediately identified and placed under the right cluster, which relates to adding the alert to the group of alerts.
However, Turgeman did not teach the limitations:
“and wherein obtaining the training data comprises: grouping the historical alerts into samples of alerts;
generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts;
combining the respective graphs into a combined graph;
and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous field, Shetty teaches “grouping the historical alerts into samples of alerts”
See Shetty in page 8 second paragraph, section 4, describe "SoftNER uses pattern extractors which leverage the key-value and tabular structural patterns in the incident descriptions to bootstrap the training data." Later, see Shetty in page 25, section 9.2.1 Clustering Incident Titles, describe " we first aim to group incidents by clustering their titles, which are generally a representative summary of the incident." This shows that Shetty describes creating groups of incidents (related to alerts) by patterns according to text descriptions.
See Shetty in page 23, section 9.1 Auto-triaging of incidents, describe "We sample 20% of resolved incidents for the 10 most common teams from the initial incident set…" Here, Shetty mentions organizing the incidents into samples.
Further, see Shetty in page 3, second paragraph mention "address the key problem of extracting structured knowledge from service incidents. This structured knowledge would reduce the effort spent by on call engineers by opening up avenues for automating processes like log extraction and health checks on resources (VMs, Databases, etc.) identified within these descriptions". Here, Shetty shows using log extraction which relates to historical log records of incidents and alerts. See Shetty in page 8, last paragraph of section 4 and figure 1 for more details.
PNG
media_image1.png
395
1627
media_image1.png
Greyscale
Further, Shetty teaches “generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts,”
See Shetty in page 8, last paragraph of section 4. SoftNER Overview, describe "Service incidents can be created by external customers or even automated monitoring systems. They contain unstructured information in various forms, like statements, conversations, stack traces, etc. As stated before, this makes incident descriptions rich in information that are identifiable as entities. Although extracting all entities is useful, certain entities are more important for the investigation and mitigation of an incident. To capture complete knowledge that can be used for other aspects, such as entity relevance, it is important to mine interactions and relations between entities... Having identified related entities, SoftNER automatically constructs an undirected incident knowledge graph. As shown in Fig. 3, the knowledge graph nodes represent cloud services, incidents, and entities extracted from incidents, and edges represent relatedness." Here, Shetty shows creating graphs to organize interactions and relations of entities from monitoring systems of incidents (i.e. alerts), stack traces (historical record of systems), or other information.
Further, see Shetty in page 26 in first paragraph, describe " use the primary entity as the source node to find the shortest paths to every other reachable entity. We hypothesize that every entity (ex) reachable from the primary entity (ep) of a cluster is related to the incidents of that cluster. Then, the relatedness between any reachable entity (ex)and a cluster(C) is scored as the average of the edge weights." Here, Shetty shows walking from node of one incident and see if that incident is related to another similar incident, which helps detect if two or more incidents are related. Figure 3 also shows the organization where every incident is connected to related incidents.
PNG
media_image2.png
863
1653
media_image2.png
Greyscale
Further, Shetty teaches “combining the respective graphs into a combined graph,”
See Shetty in page 8, last paragraph of section 4. SoftNER Overview, describe "Service incidents can be created by external customers or even automated monitoring systems. They contain unstructured information in various forms, like statements, conversations, stack traces, etc. As stated before, this makes incident descriptions rich in information that are identifiable as entities. Although extracting all entities is useful, certain entities are more important for the investigation and mitigation of an incident. To capture complete knowledge that can be used for other aspects, such as entity relevance, it is important to mine interactions and relations between entities... Having identified related entities, SoftNER automatically constructs an undirected incident knowledge graph. As shown in Fig. 3, the knowledge graph nodes represent cloud services, incidents, and entities extracted from incidents, and edges represent relatedness." Here, Shetty shows creating graphs that helps combine interactions and relations of entities from monitoring systems of incidents (i.e. alerts), stack traces (historical record of systems), or other information, constructing combined graphs. See figures 3 and 7 for details.
PNG
media_image3.png
565
977
media_image3.png
Greyscale
Further, Shetty teaches “and obtaining random walks of nodes of the combined graph … wherein each … walk corresponds to a training datum … of alert texts of the traversed nodes;”
See Shetty in page 3, last paragraph of Introduction section, describe the study first "use Named-entity recognition (NER) for extraction of factual and structured information from the incidents. We leverage syntactic pattern extractors for bootstrapping the training data. Further, we incorporate a novel multi-task BiLSTM-CRF deep learning model with an attention mechanism. Next, we enrich these entities by mining binary relations between the entities. Lastly, we automatically construct knowledge graphs using the entities and relations extracted". Here, Shetty describes using each record of training data that relates to each incident's entity, which the method takes unstructured text from incidents and transforms into structured text with meaningful patterns. Further, see Shetty in page 6, Information retrieval paragraph, describe "Named-Entity Recognition (NER) (Nadeau and Sekine 2007), specifically, is a well explored task of parsing unstructured text to detect entities and classify them into specific categories," a definition for classifying unstructured text of incidents into organized groups.
Additionally, see Shetty in page 26, first paragraph, note " use the primary entity as the source node to find the shortest paths to every other reachable entity. We hypothesize that every entity (ex) reachable from the primary entity (ep) of a cluster is related to the incidents of that cluster. Then, the relatedness between any reachable entity (ex) and a cluster(C) is scored as the average of the edge weights in the path taken from the primary entity to the entity of interest (ex)." The term path is construed to be synonyms with the term walk, since a path needs to be walked or traversed to arrive from one node to another within a graph. Here, Shetty describes obtaining paths of the graph to identify related incidents.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman of grouping alert texts using models that organize text data, and incorporate into the teachings of Shetty of using a combined graph to organize alert texts.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, into the framework of Shetty, this would achieve a goal for “the service to be cost efficient since majority of the incidents are created during the day,” (see Shetty in page 18, section 7.2 Model deployment), and “entities extracted by SoftNER can be utilized to improve simple machine learning models for incident triaging. Next, we show that the knowledge graph can be used to build entity recommenders that can improve tooling in incident management platforms and in turn reduce customer impact,” (see Shetty in page 23, section 9 Applications).
However, Turgeman in view of Shetty did not teach
“and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous art, Jiang teaches “and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes,”
See Jiang in pages 551, section V. Mining Paradigmatic and syntagmatic relations, part A. Mining paradigmatic relation, last paragraph, describes " Combining different adjacency graphs induced from the same data together, we finally use Pr(vi; vj) to measure the paradigmatic relation, which is defined as:
PNG
media_image4.png
148
741
media_image4.png
Greyscale
" , where Jiang shows combing different graphs into a combined graph to take a random walk. Further, see Jiang in page 552, section V, part B. Mining Syntagmatic Relation, for more details.
See Jiang in page 550, section III. Adjacency graph, definition 1, describe “Text data can be considered as a special case of the family of sequence data, where a sequence is a series of ordered elements. In text data, we can treat each sentence, paragraph or even document as an individual sequence, and construct the sequence-based adjacency graph from the sequences.” Here, Jiang mentions creating the graph from ordered elements of text data.
Later, see Jiang in page 550, section IV Random Walks on Adjacency Graph describe “Given an adjacency graph G, two basic types of random walks can be defined, namely forward walking and backward walking…The weights on edges can be normalized in various ways to allow for interpreting the graph as a transition matrix with the nodes of the graph as states. Such a probabilistic interpretation enables us to compute probabilities of different random walks on the graph, which we can then use to mine interesting paths, relations between words”. Here, Jiang describes using weights on edges in random walks of nodes of a graph along with probabilistic method of the walks on the graph (i.e. probabilistically traversing the combined graph from edge weights).
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman and Shetty of grouping alert texts using models that organize text data, and incorporate into the teachings of Jiang of random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman and Shetty, into the framework of Jiang, this would achieve “evaluation results show that the proposed algorithms are effective for discovering meaningful paradigmatic and syntagmatic relations of words from text data, and that for both relations, the algorithms respond well to the growth of big data and are able to generate higher quality of knowledge,” (See Jiang in page 553, section VII. Conclusion).
However, Turgeman in view of Shetty, further in view of Jiang, did not teach “adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous field, Menon teaches “and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
See Menon in page 8, section XI. Conclusion, describe “From predicting patch risks and automating optimal schedules, to classifying unstructured event logs and suppressing alert noise, AI is transforming OEMOC from a reactive administrative interface into a proactive, intelligent platform.” Menon here describes suppressing alert noise.
Further, see Menon in pages 5-6, section VII. Patch management optimization using AI, part 3. Anomaly Detection in post-patch performance, describe " Techniques such as Isolation Forests, autoencoders, or one-class SVMs can detect subtle deviations in system behavior such as increased I/O latency, memory leaks, or service response lags that may not trigger explicit alerts.” When Menon mentions may not trigger explicit alerts, Menon describes not triggering a notification, and enhances suppressing alert noise from being transmitted to a responder.
Further, see Menon in page 6, section VIII. Event Correlation and Noise Suppression, part 1. AI-Driven Deduplication of alerts from multiple layers, describe "Oracle EM Ops Center environments often produce overlapping alerts from system agents, operating systems, hardware enclosures, and third-party components. This results in redundant messages that clutter dashboards and overwhelm operators. AI can reduce this noise through intelligent
deduplication techniques. By using clustering and similarity detection algorithms such as cosine similarity or hierarchical clustering AI systems can identify alerts with semantically equivalent content and group them into unified incidents. These models can evaluate historical co-occurrence, source proximity, and temporal alignment to consolidate events that stem from the same root cause. This not only reduces the alert count but also streamlines operator attention toward actionable issues, improving mean time to acknowledgment (MTTA). " Menon here mentions ‘alerts with semantically equivalent content’ relates to existing open incident. Menon also describes a method using machine learning methods in grouping similar alerts by root cause, reducing redundant messages that overwhelm operators. See Menon in page 3, section III, part 1, describe “The system’s reactive model generates a high frequency of notifications…” showing an event management system.
Later, see Menon in page 6, part VII part 4. Automating Patch Scheduling with Reinforcement Learning, describes "this intelligent automation relieves administrators from manually juggling multiple dependencies, while improving patch efficacy and reducing operational overhead. " Menon here describes this helps improve handling of information technology (IT) related incidents by relieve administrators (i.e. responder) from viewing redundant IT tickets under a common root cause.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, and Jiang of grouping alert texts using models that organize text data, and incorporate into the teachings of Menon of an alert handled under the existing open incident without a notification being transmitted to a responder.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, Shetty, and Jiang, into the framework of Menon, this would achieve “this intelligent automation relieves administrators from manually juggling multiple dependencies, while improving patch efficacy and reducing operational overhead,” (see Menon in page 6, part VII part 4. Automating Patch Scheduling with Reinforcement Learning).
Claim 5:
Regarding claim 5, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, teach the elements of claim 1 as outlined above.
Further, Turgeman also teaches: “the method of claim 1, wherein the alert is a first alert, further comprising: receiving a second alert;”
See page 3, section 2.1. Related work and challenges, where Turgeman describes “as a new alert enters the system, it is identified in real-time and placed under the right cluster. The results are then presented to end users, thus helping them immediately surface useful information from large volumes of alerts, use those findings to effectively remove noise from the alerts being managed, and focus on actual production issues.” Here, Turgeman teaches receiving a second alert, where the second alert include new alerts or incoming alerts. Note here, the examiner construes that a second alert to mean an additional or new incoming alert. For more information, see Turgeman in page 5, section 4.1.4 Incremental alerts clustering.
Turgeman further teaches “determining that the second alert cannot be grouped into any other group of alerts by comparing an embedding of the second alert obtained using the machine-learning model to respective embeddings of the group of alerts; and in response to determining that the second alert cannot be grouped into any other group of alerts, adding the second alert to a new group,”
See Turgeman in page 5, section 4.1.4 Incremental alerts clustering, where Turgeman describes " as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman mentions that if a new alert (i.e. second alert), after comparing to an embedding of that new alert with embeddings of the groups of alerts, did not match the embeddings with the groups. Then, that new alert is not classified into a group of the existing group of alerts from the model, and subsequently add the new alert (i.e. second alert) into a new cluster (i.e. new group). For more information, See Turgeman also in page 4, section 4.1., Metric ID definition.
Claim 18:
Regarding claim 18,
Turgeman teaches “ receiving an alert,”
See Turgeman describe in page 5, section 4.1.4 in Incremental alerts clustering, "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman talks about receiving a record of an alert related to an information technology incident.
Further, Turgeman also teaches “obtaining, using a machine-learning model, an embedding for the alert, wherein the machine-learning model is trained by steps …”
See Turgeman in page 4, section 4.1.1 Contextualized metric embedding-based model (‘liberal’) mentions " the model is trained using historical data and is applied to incoming alerts…The input to the model is a history of n recent alerts corresponding metric IDs, within a time window w, e.g. {m1, m2, ..., mn}. Using the extracted metrics correlation matrix and an anomaly counter module, the suggested algorithm generates a sparse matrix containing the number of times every two alerts had co-occurred within a pre-defined time window. We train a Word2Vec model (Mikolov et al., 2013) using a 1-hidden-layer neural network based on the synthetic task of given an input metric. The network is trained by feeding the extracted metric pairs co-occurrence data, to learn statistics from the number of times each pairing occurs. The output is the conditional probability distribution, Pr[mt|w], describing the probability for each metric ID to appear nearby a given one from w. A virtual one-hot encoding of metrics goes through a ‘projection layer’ to the hidden layer; these projection weights are later interpreted as a distributed representation of the metrics (e.g., “embeddings”), which are then utilized by a tailored incremental clustering algorithm to dynamically cluster incoming alerts in real time." Here, Turgeman describes using a machine learning model to obtain embeddings for incoming alerts.
Further, Turgeman describes in page 6, section 5.2. Experimental setup "in what follows, we describe the experimental setup that is used to evaluate the performance and effectiveness of the suggested approach. We perform the experiments by using the system described in section 3.1.1. The data set is split into train and test sets; The train set spans the date range of between 22/1/2020 to 21/3/2020 and is composed of 27,109 alerts,” Here, Turgeman in section 5.2 talks about creating pair-wise proximity models (i.e. machine learning model) as well as a contextualized metric embedding (i.e. embedding for the alert).
Further, Turgeman also teaches “obtaining training data, wherein each training datum comprises a series of alert texts obtained from historical alerts,”
See Turgeman in page 4, section 4.1.1. Contextualized metric embedding-based model (‘liberal’) teaches “the model is trained using historical data and is applied to incoming alerts. The suggested modeling approach is influenced by several recent advances in Natural Language Processing (NLP).” Here, Turgeman teaches that the model is using training data, where the data comprises of historical alert data records.
Further, Turgeman also teaches “training the machine-learning model using the training data to output embedding for alert texts,”
See Turgeman in section 5.2 Experimental setup, page 6, where Turgeman describes that training the model involves "4. Based on alert history, the algorithm generates pair-wise proximity models, by using both the contextualized metric embedding-based model (section 4.1.1), and the frequency-based model (section 4.1.2). 5. The post-processing algorithm is applied to metric embedding outcomes (section 4.1.3). 6. The incremental clustering algorithm is then applied to the testing set alerts, yielding a set of cluster outcomes. 7. The parameters used for training and testing are shown in Table 1." Here, Turgeman illustrates that the outputs are the metric embedding outcomes or embeddings from the model.
Further, Turgeman also teaches “identifying, based on the embedding, a group of alerts”
See Turgeman in section 4.1.4 on page 5 describing that "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert." Here, Turgeman describes that based on the average of the corresponding alerts' embeddings (i.e. embedding), Turgeman was able to identify cluster centroid which correspond to a group of alerts.
Further, Turgeman also teaches “adding the alert to the group of alerts,”
See Turgeman in section 4.1.4 on page 5 describing that "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." See Turgeman in page 3, section 2.2, where Turgeman describes that "as a new alert enters the system, it is identified in real-time and placed under the right cluster. The results are then presented to end users, thus helping them immediately surface useful information from large volumes of alerts." Here, Turgeman shows that as a new alert enters the system, the alert is immediately identified and placed under the right cluster, which relates to adding the alert to the group of alerts.
However, Turgeman did not teach the limitations:
“and wherein obtaining the training data comprises: grouping the historical alerts into samples of alerts;
generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts;
combining the respective graphs into a combined graph;
and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous field, Shetty teaches “grouping the historical alerts into samples of alerts”
See Shetty in page 8 second paragraph, section 4, describe "SoftNER uses pattern extractors which leverage the key-value and tabular structural patterns in the incident descriptions to bootstrap the training data." Later, see Shetty in page 25, section 9.2.1 Clustering Incident Titles, describe " we first aim to group incidents by clustering their titles, which are generally a representative summary of the incident." This shows that Shetty describes creating groups of incidents (related to alerts) by patterns according to text descriptions.
See Shetty in page 23, section 9.1 Auto-triaging of incidents, describe "We sample 20% of resolved incidents for the 10 most common teams from the initial incident set…" Here, Shetty mentions organizing the incidents into samples.
Further, see Shetty in page 3, second paragraph mention "address the key problem of extracting structured knowledge from service incidents. This structured knowledge would reduce the effort spent by on call engineers by opening up avenues for automating processes like log extraction and health checks on resources (VMs, Databases, etc.) identified within these descriptions". Here, Shetty shows using log extraction which relates to historical log records of incidents and alerts. See Shetty in page 8, last paragraph of section 4 and figure 1 for more details.
PNG
media_image1.png
395
1627
media_image1.png
Greyscale
Further, Shetty teaches “generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts,”
See Shetty in page 8, last paragraph of section 4. SoftNER Overview, describe "Service incidents can be created by external customers or even automated monitoring systems. They contain unstructured information in various forms, like statements, conversations, stack traces, etc. As stated before, this makes incident descriptions rich in information that are identifiable as entities. Although extracting all entities is useful, certain entities are more important for the investigation and mitigation of an incident. To capture complete knowledge that can be used for other aspects, such as entity relevance, it is important to mine interactions and relations between entities... Having identified related entities, SoftNER automatically constructs an undirected incident knowledge graph. As shown in Fig. 3, the knowledge graph nodes represent cloud services, incidents, and entities extracted from incidents, and edges represent relatedness." Here, Shetty shows creating graphs to organize interactions and relations of entities from monitoring systems of incidents (i.e. alerts), stack traces (historical record of systems), or other information.
Further, see Shetty in page 26 in first paragraph, describe " use the primary entity as the source node to find the shortest paths to every other reachable entity. We hypothesize that every entity (ex) reachable from the primary entity (ep) of a cluster is related to the incidents of that cluster. Then, the relatedness between any reachable entity (ex)and a cluster(C) is scored as the average of the edge weights." Here, Shetty shows walking from node of one incident and see if that incident is related to another similar incident, which helps detect if two or more incidents are related. Figure 3 also shows the organization where every incident is connected to related incidents.
PNG
media_image2.png
863
1653
media_image2.png
Greyscale
Further, Shetty teaches “combining the respective graphs into a combined graph,”
See Shetty in page 8, last paragraph of section 4. SoftNER Overview, describe "Service incidents can be created by external customers or even automated monitoring systems. They contain unstructured information in various forms, like statements, conversations, stack traces, etc. As stated before, this makes incident descriptions rich in information that are identifiable as entities. Although extracting all entities is useful, certain entities are more important for the investigation and mitigation of an incident. To capture complete knowledge that can be used for other aspects, such as entity relevance, it is important to mine interactions and relations between entities... Having identified related entities, SoftNER automatically constructs an undirected incident knowledge graph. As shown in Fig. 3, the knowledge graph nodes represent cloud services, incidents, and entities extracted from incidents, and edges represent relatedness." Here, Shetty shows creating graphs that helps combine interactions and relations of entities from monitoring systems of incidents (i.e. alerts), stack traces (historical record of systems), or other information, constructing combined graphs. See figures 3 and 7 for details.
PNG
media_image3.png
565
977
media_image3.png
Greyscale
Further, Shetty teaches “and obtaining random walks of nodes of the combined graph … wherein each … walk corresponds to a training datum … of alert texts of the traversed nodes;”
See Shetty in page 3, last paragraph of Introduction section, describe the study first "use Named-entity recognition (NER) for extraction of factual and structured information from the incidents. We leverage syntactic pattern extractors for bootstrapping the training data. Further, we incorporate a novel multi-task BiLSTM-CRF deep learning model with an attention mechanism. Next, we enrich these entities by mining binary relations between the entities. Lastly, we automatically construct knowledge graphs using the entities and relations extracted". Here, Shetty describes using each record of training data that relates to each incident's entity, which the method takes unstructured text from incidents and transforms into structured text with meaningful patterns. Further, see Shetty in page 6, Information retrieval paragraph, describe "Named-Entity Recognition (NER) (Nadeau and Sekine 2007), specifically, is a well explored task of parsing unstructured text to detect entities and classify them into specific categories," a definition for classifying unstructured text of incidents into organized groups.
Additionally, see Shetty in page 26, first paragraph, note " use the primary entity as the source node to find the shortest paths to every other reachable entity. We hypothesize that every entity (ex) reachable from the primary entity (ep) of a cluster is related to the incidents of that cluster. Then, the relatedness between any reachable entity (ex) and a cluster(C) is scored as the average of the edge weights in the path taken from the primary entity to the entity of interest (ex)." The term path is construed to be synonyms with the term walk, since a path needs to be walked or traversed to arrive from one node to another within a graph. Here, Shetty describes obtaining paths of the graph to identify related incidents.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman of grouping alert texts using models that organize text data, and incorporate into the teachings of Shetty of using a combined graph to organize alert texts.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, into the framework of Shetty, this would achieve a goal for “the service to be cost efficient since majority of the incidents are created during the day,” (see Shetty in page 18, section 7.2 Model deployment), and “entities extracted by SoftNER can be utilized to improve simple machine learning models for incident triaging. Next, we show that the knowledge graph can be used to build entity recommenders that can improve tooling in incident management platforms and in turn reduce customer impact,” (see Shetty in page 23, section 9 Applications).
However, Turgeman in view of Shetty did not teach
“and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous art, Jiang teaches “and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes,”
See Jiang in pages 551, section V. Mining Paradigmatic and syntagmatic relations, part A. Mining paradigmatic relation, last paragraph, describes " Combining different adjacency graphs induced from the same data together, we finally use Pr(vi; vj) to measure the paradigmatic relation, which is defined as:
PNG
media_image4.png
148
741
media_image4.png
Greyscale
" , where Jiang shows combing different graphs into a combined graph to take a random walk. Further, see Jiang in page 552, section V, part B. Mining Syntagmatic Relation, for more details.
See Jiang in page 550, section III. Adjacency graph, definition 1, describe “Text data can be considered as a special case of the family of sequence data, where a sequence is a series of ordered elements. In text data, we can treat each sentence, paragraph or even document as an individual sequence, and construct the sequence-based adjacency graph from the sequences.” Here, Jiang mentions creating the graph from ordered elements of text data.
Later, see Jiang in page 550, section IV Random Walks on Adjacency Graph describe “Given an adjacency graph G, two basic types of random walks can be defined, namely forward walking and backward walking…The weights on edges can be normalized in various ways to allow for interpreting the graph as a transition matrix with the nodes of the graph as states. Such a probabilistic interpretation enables us to compute probabilities of different random walks on the graph, which we can then use to mine interesting paths, relations between words”. Here, Jiang describes using weights on edges in random walks of nodes of a graph along with probabilistic method of the walks on the graph (i.e. probabilistically traversing the combined graph from edge weights).
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman and Shetty of grouping alert texts using models that organize text data, and incorporate into the teachings of Jiang of random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman and Shetty, into the framework of Jiang, this would achieve “evaluation results show that the proposed algorithms are effective for discovering meaningful paradigmatic and syntagmatic relations of words from text data, and that for both relations, the algorithms respond well to the growth of big data and are able to generate higher quality of knowledge,” (See Jiang in page 553, section VII. Conclusion).
However, Turgeman in view of Shetty, further in view of Jiang, did not teach “and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous field, Menon teaches “and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
See Menon in page 8, section XI. Conclusion, describe “From predicting patch risks and automating optimal schedules, to classifying unstructured event logs and suppressing alert noise, AI is transforming OEMOC from a reactive administrative interface into a proactive, intelligent platform.” Menon here describes suppressing alert noise.
See Menon in page 3, section III, part 1, describe “The system’s reactive model generates a high frequency of notifications…” showing an event management system.
Further, see Menon in pages 5-6, section VII. Patch management optimization using AI, part 3. Anomaly Detection in post-patch performance, describe " Techniques such as Isolation Forests, autoencoders, or one-class SVMs can detect subtle deviations in system behavior such as increased I/O latency, memory leaks, or service response lags that may not trigger explicit alerts.” When Menon mentions may not trigger explicit alerts, Menon describes not triggering a notification, and enhances suppressing alert noise from being transmitted to a responder.
Further, see Menon in page 6, section VIII. Event Correlation and Noise Suppression, part 1. AI-Driven Deduplication of alerts from multiple layers, describe "Oracle EM Ops Center environments often produce overlapping alerts from system agents, operating systems, hardware enclosures, and third-party components. This results in redundant messages that clutter dashboards and overwhelm operators. AI can reduce this noise through intelligent
deduplication techniques. By using clustering and similarity detection algorithms such as cosine similarity or hierarchical clustering AI systems can identify alerts with semantically equivalent content and group them into unified incidents. These models can evaluate historical co-occurrence, source proximity, and temporal alignment to consolidate events that stem from the same root cause. This not only reduces the alert count but also streamlines operator attention toward actionable issues, improving mean time to acknowledgment (MTTA). " Menon here mentions ‘alerts with semantically equivalent content’ relates to existing open incident. Menon also describes a method using machine learning methods in grouping similar alerts by root cause, reducing redundant messages that overwhelm operators.
Later, see Menon in page 6, part VII part 4. Automating Patch Scheduling with Reinforcement Learning, describes "this intelligent automation relieves administrators from manually juggling multiple dependencies, while improving patch efficacy and reducing operational overhead. " Menon here describes this helps improve handling of information technology (IT) related incidents by relieve administrators (i.e. responder) from viewing redundant IT tickets under a common root cause.
Further, Menon teaches a “a device, comprising: a memory; and a processor, the processor configured to execute instructions stored in the memory…”
See Menon in abstract page 1, noting “Oracle Enterprise Manager Ops Center (OEMOC) has long served as a unified platform for provisioning, patching, asset discovery, and monitoring in Oracle Solaris and Linux-based data centers.”, and see in page 3 where Menon mentions in section 4 Limited Predictive Capabilities in Resource Forecasting “OEMOC excels at monitoring current utilization levels of CPU, memory, and storage, but its ability to forecast future resource demand is minimal.”
Further, see Menon in section IV. in section 4. Time Series Forecasting for Utilization and Capacity on page 4, describe "By analyzing historical performance metrics CPU utilization, memory consumption, storage usage, and I/O patterns forecasting algorithms can predict future trends and help avoid capacity shortfalls." Here, Menon shows monitoring usage of CPU, memory, storage, which are all part of the Oracle enterprise manager OPS center, a system that visualizes and monitors the exact physical hardware components of a system.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, Jiang, and incorporate into the teachings of Menon since the references teach grouping information technology alerts into groups called incidents using models that organize text data.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, Shetty, Jiang, of comparing text embeddings of incoming alerts to existing groups of alerts with a device of Menon to achieve a method that " ensures that limited maintenance windows are used efficiently and that risk is minimized. Additionally, AI can learn temporal trends, such as which days or time windows correlate with lower patching success, and recommend optimal schedules accordingly," (See Menon in page 5, section VII. Patch Management Optimization Using AI, section 1. Prioritizing Patches Based on Historical Failure Likelihood ).
Claim 22:
Regarding claim 22, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, teach the limitations in claim 18. Referring to claim 22, the claim recites similar limitations as corresponding claim 5 and is rejected for similar reasons as claim 5 using similar teachings and rationale.
Claims 3, 4, 20, and 21 are rejected under 35 U.S.C. 103 over Turgeman in view of Shetty, and further in view of Jiang, further in view of Menon, and further in view of Sun J. et al. “An Efficient Alert Aggregation Method Based on Conditional Rough Entropy and Knowledge Granularity”, available at https://doi.org/10.3390/e22030324 in March 12, 2020), (hereafter, Sun).
Claim 3:
Regarding claim 3, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, teach the limitations in claim 1.
Turgeman in view of Shetty, further in view of Jiang, further in view of Menon, did not teach “The method of claim 1, wherein grouping the historical alerts into the samples of alerts comprises: grouping the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts,”
In an analogous system of organizing information technology incidents, Sun teaches
“the method of claim 1, wherein grouping the historical alerts into the samples of alerts comprises: grouping the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts”,
See Sun in page 15, section 4.4: Alert Similarity Calculation, where the researchers "calculated the corresponding important attributes and their weights according to different attack classifications. In order to aggregate similar alerts, we also need to calculate the similarity value of each important attribute between the two alerts and weight the total similarity. The two alerts are aggregated if the total similarity of the two alerts is greater than the set threshold. It should be noted that we only need to forcibly reduce the alerts whose total similarity is greater than the threshold for a certain period of time, so the setting of the time threshold is necessary. Therefore, we use sliding time windows to slice alert sequences and aggregate alerts within the same time window." Here, Sun describes using a sliding time window interval to group alerts to classify them.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, Jiang, and Menon, and incorporate into the teachings of Sun because all references teach using grouping methods on text data for information management alerts.
One of ordinary skill in the art would be motivated to do so because using the grouping methods on text alert data from the teachings of Turgeman, Shetty, Jiang, and Menon, and combine with sorting the groups of text alert data by sliding time windows from the teachings of Sun since using “a suitable similarity threshold can effectively eliminate duplicate alerts and provide higher quality data for the next data fusion layer” (Sun, page 18, section 5.3. Experimental Results), and Sun’s method “can effectively reduce redundant alerts and help network security administrators to find real attacks” (page 21, section 6. Discussion and Conclusions).
Claim 4:
Regarding claim 4, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, teach the limitations in claim 1.
However, Turgeman in view of Shetty, further in view of Jiang, further in view of Menon, did not teach “the method of claim 1, wherein grouping the historical alerts into the samples of alerts comprises: grouping one or more of the historical alerts into a sample associated with a historical alert of the historical alerts based on an active window associated with the historical alert.”
In an analogous system, Sun teaches “the method of claim 1, wherein grouping the historical alerts into the samples of alerts comprises: grouping one or more of the historical alerts into a sample associated with a historical alert of the historical alerts based on an active window associated with the historical alert,”
See Sun in page 15, section 4.4: Alert Similarity Calculation that the researchers "calculated the corresponding important attributes and their weights according to different attack classifications. In order to aggregate similar alerts, we also need to calculate the similarity value of each important attribute between the two alerts and weight the total similarity. The two alerts are aggregated if the total similarity of the two alerts is greater than the set threshold. It should be noted that we only need to forcibly reduce the alerts whose total similarity is greater than the threshold for a certain period of time, so the setting of the time threshold is necessary. Therefore, we use sliding time windows to slice alert sequences and aggregate alerts within the same time window." Here, Sun describes a certain period of time to mean any interval of time that contains an alert or incident and this corresponds to an active time window.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, Jiang, and Menon, and incorporate into the teachings of Sun because all references teach using grouping methods on text data for information management alerts.
One of ordinary skill in the art would be motivated to do so because using the grouping methods on text alert data from the teachings of Turgeman, Shetty, Jiang, and Menon, and combine with sorting the groups of text alert data by active windows from the teachings of Sun since using “a suitable similarity threshold can effectively eliminate duplicate alerts and provide higher quality data for the next data fusion layer” (Sun, page 18, section 5.3. Experimental Results), and Sun’s method “can effectively reduce redundant alerts and help network security administrators to find real attacks” (page 21, section 6. Discussion and Conclusions).
Claim 20:
Regarding claim 20, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, teach the limitations in claim 18. Referring to claim 20, the claim recites similar limitations as corresponding claim 3 and is rejected for similar reasons as claim 3 using similar teachings and rationale.
However, Turgeman in view of Shetty, further in view of Jiang, further in view of Menon, did not teach “ wherein grouping the historical alerts into the samples of alerts comprises: grouping the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts,”
In an analogous system of organizing information technology incidents, Sun teaches
“ wherein grouping the historical alerts into the samples of alerts comprises: grouping the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts”,
See Sun in page 15, section 4.4: Alert Similarity Calculation, where the researchers "calculated the corresponding important attributes and their weights according to different attack classifications. In order to aggregate similar alerts, we also need to calculate the similarity value of each important attribute between the two alerts and weight the total similarity. The two alerts are aggregated if the total similarity of the two alerts is greater than the set threshold. It should be noted that we only need to forcibly reduce the alerts whose total similarity is greater than the threshold for a certain period of time, so the setting of the time threshold is necessary. Therefore, we use sliding time windows to slice alert sequences and aggregate alerts within the same time window." Here, Sun describes using a sliding time window interval to group alerts to classify them.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, Jiang, and Menon, and incorporate into the teachings of Sun because all references teach using grouping methods on text data for information management alerts.
One of ordinary skill in the art would be motivated to do so because using the grouping methods on text alert data from the teachings of Turgeman, Shetty, Jiang, and Menon, and combine with sorting the groups of text alert data by sliding time windows from the teachings of Sun since using “a suitable similarity threshold can effectively eliminate duplicate alerts and provide higher quality data for the next data fusion layer” (Sun, page 18, section 5.3. Experimental Results), and Sun’s method “can effectively reduce redundant alerts and help network security administrators to find real attacks” (page 21, section 6. Discussion and Conclusions).
Claim 21:
Regarding claim 21, Turgeman in view of Shetty, further in view of Jiang, further in view of Menon, teach the limitations in claim 18. Referring to claim 21, the claim recites similar limitations as corresponding claim 4 and is rejected for similar reasons as claim 4 using similar teachings and rationale.
However, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, did not teach “ wherein grouping the historical alerts into the samples of alerts comprises: grouping one or more of the historical alerts into a sample associated with a historical alert of the historical alerts based on an active window associated with the historical alert.”
In an analogous system, Sun teaches “ wherein grouping the historical alerts into the samples of alerts comprises: grouping one or more of the historical alerts into a sample associated with a historical alert of the historical alerts based on an active window associated with the historical alert,”
See Sun in page 15, section 4.4: Alert Similarity Calculation that the researchers "calculated the corresponding important attributes and their weights according to different attack classifications. In order to aggregate similar alerts, we also need to calculate the similarity value of each important attribute between the two alerts and weight the total similarity. The two alerts are aggregated if the total similarity of the two alerts is greater than the set threshold. It should be noted that we only need to forcibly reduce the alerts whose total similarity is greater than the threshold for a certain period of time, so the setting of the time threshold is necessary. Therefore, we use sliding time windows to slice alert sequences and aggregate alerts within the same time window." Here, Sun describes a certain period of time to mean any interval of time that contains an alert or incident and this corresponds to an active time window.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, Jiang, Menon, and incorporate into the teachings of Sun because all references teach using grouping methods on text data for information management alerts.
One of ordinary skill in the art would be motivated to do so because using the grouping methods on text alert data from the teachings of Turgeman, Shetty, Jiang, Menon, and combine with sorting the groups of text alert data by active windows from the teachings of Sun since using “a suitable similarity threshold can effectively eliminate duplicate alerts and provide higher quality data for the next data fusion layer” (Sun, page 18, section 5.3. Experimental Results), and Sun’s method “can effectively reduce redundant alerts and help network security administrators to find real attacks” (page 21, section 6. Discussion and Conclusions).
Claims 6 and 23 are rejected under 35 U.S.C. 103 over Turgeman in view of Shetty, and further in view of Jiang, further in view of Menon, and further in view of Chen J. et al. “Online summarizing alerts through semantic and behavior information”, available at https://dl.acm.org/doi/pdf/10.1145/3510003.3510055, published on May 21, 2022), (hereafter, Chen J.).
Claim 6:
Regarding claim 6, Turgeman, in view of Shetty, further in view of Jiang, and further in view of Menon, teach the limitations in claim 6.
However, Turgeman, in view of Shetty, further in view of Jiang, and further in view of Menon, did not teach “the method of claim 5, wherein adding the second alert to the new group comprises: triggering a new incident from the alert.”
In an analogous system, Chen J. teaches “The method of claim 5, wherein adding the second alert to the new group comprises: triggering a new incident from the alert,”
See Chen J. in page 1652, section 7: Online summarizing, where Chen describes that " for the newly reported alert, 𝑒𝑖, and the previously reported alert, 𝑒𝑗, in the time window, [𝑡𝑖 − 𝑤,𝑡𝑖], we can easily represent their semantic information and behavior information by ASR and ABR, respectively. Then, according to ACT, we can obtain the correlation degree between the two alerts straightforwardly, which is defined as 𝑃ˆ 𝑖,𝑗 = [𝑝ˆ 𝑖,𝑗 1 , 𝑝ˆ 𝑖,𝑗 2 ]. Specifically, 𝑝ˆ 𝑖,𝑗 1 indicates the probability that the alerts are correlated, and 𝑝ˆ 𝑖,𝑗 2 indicates the probability that the alerts are uncorrelated. If 𝑝ˆ 𝑖,𝑗 1 > 𝑝ˆ 𝑖,𝑗 2 , 𝑒𝑖 and 𝑒𝑗 may belong to the same system failure." Later, Chen mentions "Then, as shown in Figure 6, if 𝑞𝑖 exists, we add 𝑒𝑖 into the incident of 𝑒𝑞𝑖. Otherwise, we form a new incident for 𝑒𝑖" Here, Chen shows that if qi, or the alert most correlated to the newly reported alert ei, exists, then the process involves adding the newly reported alert to the alert log record. However, if qi does not exist, then a new incident is created. This corresponds with the claim language adding a newly reported alert that this not matched with any of the previous groups of alerts (i.e. second alert) comprises of triggering a new incident from the alert.
See Chen J. also in figure 6, and in page 1652, section 7: Online Summarizing, where here the figure that Chen J. mentions in the study shows if a newly reported alert did not match any of the previous groups of alerts, then a new incident is triggered.
PNG
media_image5.png
318
624
media_image5.png
Greyscale
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the base reference of Turgeman, Shetty, Jiang, and Menon, and incorporate into the teachings of Chen J. because both references teach grouping information technology alerts into groups called incidents using models that organize text data.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, Shetty, Jiang, and Menon, of comparing text embeddings of incoming alerts to existing groups of alerts with the method of Chen J. would bring an approach to “efficiently summarize alerts online” (Chen J., page 1656, section 8, Conclusion), and with designing “three deep learning approaches, [the models] ASR, ABR and ACT … automatically summarize alerts, and experimental results show that our approaches can achieve the best effectiveness” (Chen J., page 1647, section 1, Introduction).
Claim 23:
Regarding claim 23, Turgeman in view of Shetty, further in view of Jiang, further in view of Menon, teach the limitations in claim 18. Referring to claim 23, the claim recites similar limitations as corresponding claim 6 and is rejected for similar reasons as claim 6 using similar teachings and rationale.
Claims 7 and 24 are rejected under 35 U.S.C. 103 over Turgeman in view of Shetty, and further in view of Jiang, and further in view of Menon, and further in view of Alikiaamiri, S. et al. (US PG Pub. No. US-20220067295-A1), published on March 3, 2022, (hereafter, Alikiaamiri).
Claim 7:
Regarding claim 7, Turgeman, in view of Shetty, further in view of Jiang, further in view of Menon, teach the limitations in claim 1.
Further, Turgeman teaches “the method of claim 1, wherein the alert is a first alert, further comprising: receiving a second alert,”
See Turgeman in page 5, section 4.1.4 Incremental alerts clustering, describe "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman mentions that if a new alert (i.e. second alert) is not classified into a group of the existing group of alerts from the model,
However, Turgeman, in view of Shetty, further in view of Jiang, and further in view of Menon, did not teach “and determining whether the second alert matches any group of alerts using a text similarity tool,”
In an analogous system, Alikiaamiri teaches “determining whether the second alert matches any group of alerts using a text similarity tool”
See in paragraph [0115], where Alikiaamiri describes "a correlation microservice may be configured to pull two weeks (or another duration) of Moogsoft™ Alert data and may correlate with the incoming incident (ticket) data. The correlation microservice then sends the incident data with Moogsoft™ alert identification tags or other identification (identifiers), appended as fields, to the back-end to be written into the database." Here, Alikiaamiri teaches that the alert data includes incoming incident data and is considered additional or new alerts.
Further, Alikiaamiri talks about in paragraph [0132] that "in reference to FIGS. 15 and 16, in some embodiments, the correlation engine may correlate descriptions using natural language processing. For example, this may include extracting top 10 keywords using a Rapid Automatic Keyword Extraction (RAKE) process, taking out stop words for alerts & incidents, removing words not in a GloVe (Global Vectors for Word Representation) word embedding vocabulary, measuring cosine similarities between alert & incident descriptions, and ranking correlated alerts based on description cosine similarities and time differences for each incident. GloVe is an unsupervised learning algorithm for obtaining vector representations for words, by mapping words into a vector space where the metric distance between words is related to semantic similarity. Other machine learning algorithms may be utilized as well for natural language processing." See Alikiaamiri in paragraph [0135] describes "the correlation of the description is carried out by associating an alert-specific description with a ticket-specific description if a cosine similarity between the alert-specific description and the ticket-specific description is below a description-correlation threshold."
Further, Alikiaamiri elaborates in paragraph [0151] "in some embodiments, the correlation engine may rank correlations. For example, correlation based on app codes may have the highest priority, followed by correlation based on descriptions, followed by correlation based on time (time-stamp). In various embodiments, the app codes may be correlated if they match exactly, the descriptions may be correlated based on GloVe embedding (cosine) similarity (being above a predefined threshold), and the time may be correlated based on differences in time (being below a predefined threshold." Here, Alikiaamiri provides examples of how to use the correlation engine tool in paragraph [0132] that uses word embeddings and the cosine similarity measurements (i.e. text similarity tool) for evaluating alerts in information technology tickets. This information along with the information Alikiaamiri discusses from paragraph [0115] shows determining if an incoming alert (i.e. second alert) matches any group of alerts using a text similarity tool. In paragraph [0151], Alikiaamiri explains that there may be a matching of the incoming alert if the embedding cosine similarity is above a predefined threshold, then using the correlation engine (i.e. text similarity tool) that new alert matches a group of alerts. See Alikiaamiri in paragraph [0237] for more information.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, Jiang, and Menon, and incorporate into the teachings of Alikiaamiri since the references teach grouping information technology alerts into groups called incidents using models that organize text data.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, Shetty, Jiang, and Menon, of comparing text embeddings of incoming alerts to existing groups of alerts with a text similarity tool of Alikiaamiri, “is cohesive and coherent to allow rapid association of incident tickets and alerts and to glean insights into broader topics or categories of issues being faced by the technology infrastructure” (paragraph [0015], Alikiaamiri), and “these solutions issue service alerts accessible to one or more levels of the IT support system and may often be associated with incident tickets logged by a customer or a device in the IT support system… such solutions may monitor IT incident tickets and their historical patterns” (paragraph [0079], Alikiaamiri).
Claim 24:
Regarding claim 24, Turgeman in view of Shetty, further in view of Jiang, further in view of Menon, and further in view of Alikiaamiri, teach the limitations in claim 18.
Referring to claim 24, the claim recites similar limitations as corresponding claim 7 and is rejected for similar reasons as claim 7 using similar teachings and rationale.
Claims 8, 9, 10, and 11 are rejected under 35 U.S.C. 103 over Turgeman in view of Shetty, and further in view of Jiang, and further in view of Menon, further in view of Alikiaamiri, and further in view of Chen J.
Claim 8:
Regarding claim 8, Turgeman in view of Shetty, further in view of Jiang, further in view of Menon, further in view of Alikiaamiri, teach the limitations in claim 7.
Referring to claim 8, however, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, and further in view of Alikiaamiri, did not teach “the method of claim 7, further comprising: responsive to determining, using the text similarity tool, that the second alert does not match any group of alerts, using the machine-learning model to determine whether the second alert matches any of the group of alerts,”
In an analogous field, Chen J. teaches “the method of claim 7, further comprising: responsive to determining, using the text similarity tool, that the second alert does not match any group of alerts, using the machine-learning model to determine whether the second alert matches any of the group of alerts,”
See in page 1648, Chen J. in section 3 Motivation describes "our study aims to automatically summarize such alerts into a group, named as incident, thereby reducing the number of alerts analyzed by maintenance engineers. To mine the correlation between alerts, in this paper, we leverage two types of alert information, semantic information and behavior information." In page 1647, Chen describes "Two deep learning models, ASR and ABR, are proposed to extract these information respectively. ASR (Alert Semantics Representation) extracts the semantics of alerts, which aggregates the contextual information of alert words according their importance. Meanwhile, ABR (Alert Behavior Representation) mines the common behavior pattern between alerts from the alert occurrence series. Then, to deal with the complexity of the alert correlation, instead of determining the correlation by simply setting a fixed threshold, we design a deep learning model, ACT (Alert CorrelaTion), to combine above two types of alert information and determine the correlation between alerts automatically." Here, Chen J. describes using a machine learning models ASR (Alert Semantics Representation) and ABR (Alert Behavior Representation) to understand the types of alert information and group them by similar text content.
Additionally, see page 1649, section 3,3 Combining Semantic and Behavior Information, where Chen J. also talks about “given two alerts, computing the similarity between their semantic information or behavior information, as long as one similarity exceeds the threshold, these two alerts are considered as correlated.” Chen J. here teaches using a similarity tool that incorporates the above machine learning models ASR and ABR to match a second or incoming alert to any of the existing groups of alerts. See Chen J. in figure 6 on page 1652 for more information.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, Jiang, Menon, and Alikiaamiri, and incorporate into the teachings of Chen J. because all references teach grouping information technology alerts into groups called incidents using models that organize text data.
One of ordinary skill in the art would be motivated to do so because incorporating the methods of Turgeman, Shetty, Jiang, Menon, and Alikiaamiri, of comparing text data of incoming alerts to existing groups of alerts with the method of Chen J. would bring an approach to “efficiently summarize alerts online” (Chen J., page 1656, section 8, Conclusion), and with designing “three deep learning approaches, [the models] ASR, ABR and ACT … automatically summarize alerts, and experimental results show that our approaches can achieve the best effectiveness” (Chen J., page 1647, section 1, Introduction).
Claim 9:
Regarding claim 9, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, further in view of Alikiaamiri, and further in view of Chen J. teaches the limitations in claim 8.
Referring to claim 9, Turgeman further teaches the limitation “the method of claim 8, further comprising: responsive to determining that the second alert does not match any group of alerts, adding the second alert to a new group of alerts”,
See Turgeman in page 5, section 4.1.4, Incremental alerts clustering, where Turgeman describes "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman teaches that if the incoming new alert (i.e. second alert) does not match any of the group of alerts, then the second alert is added to a new cluster (i.e. new group of alerts). Turgeman also teaches that the matching process here is comparing an alert’s embedding with a predefined threshold.
Claim 10:
Regarding claim 10, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, further in view of Alikiaamiri, and further in view of Chen J. teaches the limitations in claim 8.
Referring to claim 10, Turgeman further teaches “the method of claim 8, further comprising: responsive to determining that the second alert matches a group of alerts, adding the second alert to the group of alerts,”
See Turgeman in page 5, section 4.1.4, Incremental alerts clustering, where Turgeman describes "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman teaches that if the incoming new alert (i.e. second alert) matches any of the group of alerts, then the second alert is added to that group. Turgeman teaches that the matching process here is comparing an alert’s embedding with a predefined threshold.
Claim 11:
Regarding claim 11, Turgeman in view of Shetty, further in view of Jiang, and further in view of Menon, further in view of Alikiaamiri, and further in view of Chen J. teaches the limitations in claim 10.
Further, Chen J. teaches “the method of claim 10, wherein an incident corresponds to the group of alerts, and wherein adding the second alert to the group of alerts comprises: grouping the second alert under the incident.”
See Chen J. in page 1653, section 8.2 describes "since Jaccard [13, 31],Word2Vec[19], and LDA [2, 33] are widely used to measure the semantic relevance of alerts, we thus compare our approaches with such three approaches. In addition, we also individually evaluate the ability of ASR and ABR, respectively. Specifically, to summarize alerts online by ASR, we adopt the online summarizing strategy in Section 7. For the newly generated alert, 𝑒𝑖 , instead of ACT, we find its most relevant alert during [𝑡𝑖 −𝑤, 𝑡𝑖 ] by the cosine similarity between semantic representations. Then, if the maximum cosine similarity is larger than a fixed threshold, we then add 𝑒𝑖 into the incident of the most relevant alert. Otherwise, we form a new incident for 𝑒𝑖 ."
Additionally, Chen J. in section 3 Motivation, page 1648, explicitly mentions "our study aims to automatically summarize such alerts into a group, named as incident, thereby reducing the number of alerts analyzed by maintenance engineers. To mine the correlation between alerts, in this paper, we leverage two types of alert information, semantic information and behavior information." Here, Chen J. in page 1653 teaches that adding a new alert 𝑒𝑖 (i.e. second alert) into the incident of the most relevant alert (i.e. add second alert to the group of alerts). Further, Chen J. in page 1648 that a new alert (i.e. second alert) will be grouped under the incident. Here, Chen states that the new alert will be sorted into a group called an incident, therefore, corresponds to the grouping the second alert under the incident.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Shetty, Jiang, Menon, and Alikiaamiri, and incorporate into the teachings of Chen J. because these references teach grouping information technology alerts into groups called incidents using models that organize text data.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, Shetty, Jiang, Menon, and Alikiaamiri, of comparing text embeddings of incoming alerts to existing groups of alerts with the method of Chen J. would bring an approach to “efficiently summarize alerts online” (Chen J., page 1656, section 8, Conclusion), and with designing “three deep learning approaches, [the models] ASR, ABR and ACT … automatically summarize alerts, and experimental results show that our approaches can achieve the best effectiveness” (Chen J., page 1647, section 1, Introduction).
Claims 12 and 13 are rejected under 35 U.S.C. 103 over Turgeman in view of Alikiaamiri, further in view of Dupont, L. et al., (US PG Pub. No. US20120137367A1), published on May 31, 2012, (hereafter, Dupont), further in view of Shetty, further in view of Jiang, and further in view of Menon.
Claim 12:
Regarding claim 12, Turgeman teaches “A method, comprising: receiving an alert,”
See Turgeman describe in page 5, section 4.1.4 in Incremental alerts clustering, "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman talks about receiving a record of an alert related to an information technology incident.
Further, Turgeman teaches “responsive to determining that the alert does not match any of the groups of alerts, determining, using a machine-learning model, whether an embedding corresponding to the alert meets a similarity threshold to a respective embedding of any of the groups of alerts,”
See Turgeman on page 5, section 4.1.4 in section Incremental alerts clustering, that "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman describes sorting a new alert to a group of alerts using a threshold to evaluate an alert to see if an embedding that relates to the alert matches the threshold or not. Additionally, Turgeman teaches using a cosine similarity threshold value, either thp or thc on table 1, page 6.
PNG
media_image6.png
506
750
media_image6.png
Greyscale
Here, Turgeman further specifies of using the model to see if an embedding that corresponds to the alert meets a similarity threshold to a respective embedding of any of the groups of alerts.
Further, Turgeman also teaches “wherein the machine-learning model is trained by steps comprising: obtaining training data, wherein each training datum comprises a series of alert texts obtained from historical alerts,”
See Turgeman in page 4, section 4.1.1. Contextualized metric embedding-based model (‘liberal’) teaches “the model is trained using historical data and is applied to incoming alerts. The suggested modeling approach is influenced by several recent advances in Natural Language Processing (NLP).” Here, Turgeman teaches that the model is using training data, where the data comprises of historical alert data records.
Further, Turgeman also teaches “training the machine-learning model using the training data to output embedding for alert texts,”
See Turgeman in section 5.2 Experimental setup, page 6, where Turgeman describes that training the model involves "4. Based on alert history, the algorithm generates pair-wise proximity models, by using both the contextualized metric embedding-based model (section 4.1.1), and the frequency-based model (section 4.1.2). 5. The post-processing algorithm is applied to metric embedding outcomes (section 4.1.3). 6. The incremental clustering algorithm is then applied to the testing set alerts, yielding a set of cluster outcomes. 7. The parameters used for training and testing are shown in Table 1." Here, Turgeman illustrates that the outputs are the metric embedding outcomes or embeddings from the model.
Further, Turgeman teaches “responsive to the embedding meeting the similarity threshold with an embedding of a group of alerts, adding the alert to the group of alerts.”
See Turgeman in section 4.1.4 on page 5 describing that "as a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Further, see Turgeman in page 3, section 2.2, where Turgeman describes that "as a new alert enters the system, it is identified in real-time and placed under the right cluster. The results are then presented to end users, thus helping them immediately surface useful information from large volumes of alerts." See Turgeman on page 2, section 2. Objective & motivation, where Turgeman describes “alerts are typically composed of two components: a metric-based condition or threshold, and an action to perform when the values fall outside of the acceptable conditions”, and table 1, page 6, and the algorithms 1 and 3 on page 5 for more information. Here, Turgeman shows that as a new alert enters the system, the alert is immediately identified by comparing with a similarity threshold and placed under the right cluster, which relates to adding the alert to the group of alerts.
However, Turgeman did not explicitly teach
“determining, using a text similarly tool and based on a text of the alert, whether the alert matches a group of alerts of groups of alerts;”
wherein determining whether the alert matches a group of alerts comprises: normalizing the text of the alert;
tokenizing the normalized text into n-grams;
vectorizing the n-grams into vector representations based on words identified in a training dataset; and computing a similarity score between the vectorized n-grams of the alert and vectorized texts associated with the groups of alerts;
and wherein obtaining the training data comprises: grouping the historical alerts into samples of alerts;
generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts;
combining the respective graphs into a combined graph;
and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph,
wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous system, Alikiaamiri teaches “determining, using a text similarly tool and based on a text of the alert, whether the alert matches a group of alerts of groups of alerts;”
See Alikiaamiri describe in in paragraph [0015] that "aspects disclosed herein are directed to approaches to have alerts generated by analytics solutions automatically integrated with incident tickets, and delivered to a remote user (IT staff) as support information. The support information is cohesive and coherent to allow rapid association of incident tickets and alerts and to glean insights into broader topics or categories of issues being faced by the technology infrastructure." Here, Alikiaamiri teaches the use of clustering methods for text data especially for organizing alert incidents. Additionally, Alikiaamiri describes in paragraph [0132] “the correlation engine may correlate descriptions using natural language processing. For example, this may include extracting top 10 keywords using a Rapid Automatic Keyword Extraction (RAKE) process, taking out stop words for alerts & incidents, removing words not in a GloVe (Global Vectors for Word Representation) word embedding vocabulary, measuring cosine similarities between alert & incident descriptions, and ranking correlated alerts based on description cosine similarities and time differences for each incident. GloVe is an unsupervised learning algorithm for obtaining vector representations for words, by mapping words into a vector space where the metric distance between words is related to semantic similarity. Other machine learning algorithms may be utilized as well for natural language processing. Some embodiments may include converting Gensim Keyed Vectors and Word2Vec word embeddings to GloVe word embeddings." Here, Alikiaamiri teaches the use of similarity tools, such as semantic similarity or cosine similarity, for organizing text data. This corresponds with using a text similarly tool to determine if an alert matches a group of alerts. See Alikiaamiri in paragraph [0151] for more information.
Further, Alikiaamiri teaches “wherein determining whether the alert matches a group of alerts comprises: normalizing the text of the alert;”
See Alikiaamiri in [0145] describe “In some embodiments, to measure the cosine similarities of word vectors from incident and alert descriptions: once the similarity passes the threshold of 0.7 (Cosine similarity is normalized from 0-1), it will not be filtered out as irrelevant. The higher the cosine similarity between the incident and the alert, the closer to the top the alert will rank for the incident.” Here, Alikiaamiri describes the alert word vectors along with its calculated similarities are normalized from 0 to 1.
Further, Alikiaamiri teaches “vectorizing the n-grams into vector representations based on words identified in a training dataset;,”
See Alikiaamiri mention in [0132] “GloVe is an unsupervised learning algorithm for obtaining vector representations for words, by mapping words into a vector space where the metric distance between words is related to semantic similarity.” Alikiaamiri describes using an algorithm called GloVe to map words into a vector space or vectorizing words. Since an n-grams from the specification is defined in [0138] that “Tokenizing can split the normalized title into words and/or groups of groups (collectively, n-grams),” here, the term n-grams is construed to include words.
Further, see Alikiaamiri describe in [0233] “All the similarity values and distances in each step are stored in the matrix. This matrix can be saved in training data.” Alikiaamiri shows the information can be found within training data.
Further, Alikiaamiri teaches “and computing a similarity score between the vectorized n-grams of the alert and vectorized texts associated with the groups of alerts;”
See Alikiaamiri in [0228-0229] describe “Similarity can be defined based on cosine similarity between sentences which are converted to vectors.
PNG
media_image7.png
183
575
media_image7.png
Greyscale
… Where A and B are vectors that are obtained from TFIDF or word embedding for each sentence.” Here, Alikiaamiri describes calculating a similarity score between two items, where the vectors correspond to sentences that are related to the tickets.
Further, see Alikiaamiri in [0011] describe “A technical solution for automatic categorizing the input data to cluster and/or classify related tickets is described in various embodiments herein through performing separate natural language processing and machine learning steps. First, the tickets are grouped together using clustering to generate an issue, and then the issues are associated with alerts.” Here, Alikiaamiri shows the clustering of related tickets relates to groups of alerts. See Alikiaamiri in [0231-0232] for details.
Later, see Alikiaamiri in [0237] describe “As the number of clusters changes, (e.g., from 3, 5, 10), the system automatically regenerates the second level of clusters as the incidents in a level-1 cluster (with similar short descriptions) could be actually 3 or 5 or 10 (or even more) different types of incidents that happened to have similar short descriptions. Accordingly, the user can determine the number of level-2 clusters for each level-1 clusters (such as, but not limited to, a number between 3 to 10). The output of the model overall are some labels for each individual incident to specify their first and second group name and also their topic (3 words).”Alikiaamiri shows applying the similarity calculation to compare any two word vectors, to compare a word vector of a topic of the individual incident or alert (i.e. vectorized n-grams of the alert) and their respective cluster level ( i.e. vectorized texts associated with the groups of alerts). Since an n-grams from the specification is defined in [0138] that “Tokenizing can split the normalized title into words and/or groups of groups (collectively, n-grams),” here, the term n-grams is construed to include words. See ALIKIAAMIRI in [0028] for details.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the base reference of Turgeman and incorporate into the teachings of Alikiaamiri because both references teach grouping information technology alerts into groups called incidents using models that organize text data.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman of comparing text embeddings of incoming alerts to existing groups of alerts with a text similarity tool of Alikiaamiri “is cohesive and coherent to allow rapid association of incident tickets and alerts and to glean insights into broader topics or categories of issues being faced by the technology infrastructure” (paragraph [0015], Alikiaamiri), and “these solutions issue service alerts accessible to one or more levels of the IT support system and may often be associated with incident tickets logged by a customer or a device in the IT support system… such solutions may monitor IT incident tickets and their historical patterns” (paragraph [0079], Alikiaamiri).
However, Turgeman in view of Alikiaamiri did not teach
tokenizing the normalized text into n-grams;
and wherein obtaining the training data comprises: grouping the historical alerts into samples of alerts;
generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts;
combining the respective graphs into a combined graph;
and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph,
wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous art, Dupont teaches “tokenizing the normalized text into n-grams;”
See Dupont in [0154] describe “Token [116]: The smallest unit of analysis of the disclosure. In one embodiment, this atomic unit of analysis is a linguistic term. In another embodiment, it is a single character. N-grams [118] are continuous sequences of tokens [116] of length n, where n is a fixed, pre-determined integer.”
Further, see Dupont in [0760] describe “We begin by constructing a graph of n-gram [118] transitions within the universe of items [122] (see FIG. 20), also called a textblock graph [160]. For each item [122], examine its text one token [116] at a time.” Here, Dupont shows the process of tokenization of n-grams.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman and Alikiaamiri into the teachings of Dupont, since the references teach grouping text alerts into groups using models that organize text data.
One of ordinary skill in the art would be motivated to do so because incorporating the methods of Turgeman and Alikiaamiri, into the framework of Dupont, this would achieve “From here the system only operates within a specific time resolution at a time, meaning the time axis is slotted into time bins of constant width. This helps reduce upfront a set of small variances and errors in time interval measurement,” (see Dupont in [0375]).
However, Turgeman in view of Alikiaamiri, further in view of Dupont did not teach
“grouping the historical alerts into samples of alerts;
generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts;
combining the respective graphs into a combined graph;
and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph,
wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous field, Shetty teaches “grouping the historical alerts into samples of alerts
See Shetty in page 8 second paragraph, section 4, describe "SoftNER uses pattern extractors which leverage the key-value and tabular structural patterns in the incident descriptions to bootstrap the training data." Later, see Shetty in page 25, section 9.2.1 Clustering Incident Titles, describe " we first aim to group incidents by clustering their titles, which are generally a representative summary of the incident." This shows that Shetty describes creating groups of incidents (related to alerts) by patterns according to text descriptions. Further, see Shetty in page 23, section 9.1 Auto-triaging of incidents, describe "We sample 20% of resolved incidents for the 10 most common teams from the initial incident set…" Here, Shetty mentions organizing the incidents into samples.
Further, see Shetty in page 3, second paragraph mention "address the key problem of extracting structured knowledge from service incidents. This structured knowledge would reduce the effort spent by on call engineers by opening up avenues for automating processes like log extraction and health checks on resources (VMs, Databases, etc.) identified within these descriptions". Here, Shetty shows using log extraction which relates to historical log records of incidents and alerts. See Shetty in page 8, last paragraph of section 4 and figure 1 for more details.
PNG
media_image1.png
395
1627
media_image1.png
Greyscale
Further, Shetty teaches “generating respective graphs for the samples of alerts, wherein each historical alert of a sample of alerts is connected to every other historical alert of the sample of alerts,”
See Shetty in page 8, last paragraph of section 4. SoftNER Overview, describe "Service incidents can be created by external customers or even automated monitoring systems. They contain unstructured information in various forms, like statements, conversations, stack traces, etc. As stated before, this makes incident descriptions rich in information that are identifiable as entities. Although extracting all entities is useful, certain entities are more important for the investigation and mitigation of an incident. To capture complete knowledge that can be used for other aspects, such as entity relevance, it is important to mine interactions and relations between entities... Having identified related entities, SoftNER automatically constructs an undirected incident knowledge graph. As shown in Fig. 3, the knowledge graph nodes represent cloud services, incidents, and entities extracted from incidents, and edges represent relatedness." Here, Shetty shows creating graphs to organize interactions and relations of entities from monitoring systems of incidents (i.e. alerts), stack traces (historical record of systems), or other information.
Further, see Shetty in page 26 in first paragraph, describe " use the primary entity as the source node to find the shortest paths to every other reachable entity. We hypothesize that every entity (ex) reachable from the primary entity (ep) of a cluster is related to the incidents of that cluster. Then, the relatedness between any reachable entity (ex)and a cluster(C) is scored as the average of the edge weights." Here, Shetty shows walking from node of one incident and see if that incident is related to another similar incident, which helps detect if two or more incidents are related. Figure 3 also shows the organization where every incident is connected to related incidents.
PNG
media_image2.png
863
1653
media_image2.png
Greyscale
Further, Shetty teaches “combining the respective graphs into a combined graph,”
See Shetty in page 8, last paragraph of section 4. SoftNER Overview, describe "Service incidents can be created by external customers or even automated monitoring systems. They contain unstructured information in various forms, like statements, conversations, stack traces, etc. As stated before, this makes incident descriptions rich in information that are identifiable as entities. Although extracting all entities is useful, certain entities are more important for the investigation and mitigation of an incident. To capture complete knowledge that can be used for other aspects, such as entity relevance, it is important to mine interactions and relations between entities... Having identified related entities, SoftNER automatically constructs an undirected incident knowledge graph. As shown in Fig. 3, the knowledge graph nodes represent cloud services, incidents, and entities extracted from incidents, and edges represent relatedness." Here, Shetty shows creating graphs that helps combine interactions and relations of entities from monitoring systems of incidents (i.e. alerts), stack traces (historical record of systems), or other information, constructing combined graphs. See figures 3 and 7 for details.
PNG
media_image3.png
565
977
media_image3.png
Greyscale
Further, Shetty teaches “and obtaining random walks of nodes of the combined graph … wherein each … walk corresponds to a training datum … of alert texts of the traversed nodes;”
See Shetty in page 3, last paragraph of Introduction section, describe the study first "use Named-entity recognition (NER) for extraction of factual and structured information from the incidents. We leverage syntactic pattern extractors for bootstrapping the training data. Further, we incorporate a novel multi-task BiLSTM-CRF deep learning model with an attention mechanism. Next, we enrich these entities by mining binary relations between the entities. Lastly, we automatically construct knowledge graphs using the entities and relations extracted". Here, Shetty describes using each record of training data that relates to each incident's entity, which the method takes unstructured text from incidents and transforms into structured text with meaningful patterns. Further, see Shetty in page 6, Information retrieval paragraph, describe "Named-Entity Recognition (NER) (Nadeau and Sekine 2007), specifically, is a well explored task of parsing unstructured text to detect entities and classify them into specific categories," a definition for classifying unstructured text of incidents into organized groups.
Additionally, see Shetty in page 26, first paragraph, note " use the primary entity as the source node to find the shortest paths to every other reachable entity. We hypothesize that every entity (ex) reachable from the primary entity (ep) of a cluster is related to the incidents of that cluster. Then, the relatedness between any reachable entity (ex) and a cluster(C) is scored as the average of the edge weights in the path taken from the primary entity to the entity of interest (ex)." The term path is construed to be synonyms with the term walk, since a path needs to be walked or traversed to arrive from one node to another within a graph. Here, Shetty describes obtaining paths of the graph to identify related incidents.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Alikiaamiri, and Dupont of grouping alert texts using models that organize text data, and incorporate into the teachings of Shetty of using a combined graph to organize alert texts.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, Alikiaamiri, and Dupont, into the framework of Shetty, this would achieve a goal for “the service to be cost efficient since majority of the incidents are created during the day,” (see Shetty in page 18, section 7.2 Model deployment), and “entities extracted by SoftNER can be utilized to improve simple machine learning models for incident triaging. Next, we show that the knowledge graph can be used to build entity recommenders that can improve tooling in incident management platforms and in turn reduce customer impact,” (see Shetty in page 23, section 9 Applications).
However, Turgeman in view of Alikiaamiri, further in view of Dupont, further in view of Shetty, did not teach
“and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes;
and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous field, Jiang teaches “and obtaining random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights of the combined graph, wherein each random walk corresponds to a training datum comprising an ordered sequence of alert texts of the traversed nodes,”
See Jiang in pages 551, section V. Mining Paradigmatic and syntagmatic relations, part A. Mining paradigmatic relation, last paragraph, describes " Combining different adjacency graphs induced from the same data together, we finally use Pr(vi; vj) to measure the paradigmatic relation, which is defined as:
PNG
media_image4.png
148
741
media_image4.png
Greyscale
" , where Jiang shows combing different graphs into a combined graph to take a random walk. Further, see Jiang in page 552, section V, part B. Mining Syntagmatic Relation, for more details.
See Jiang in page 550, section III. Adjacency graph, definition 1, describe “Text data can be considered as a special case of the family of sequence data, where a sequence is a series of ordered elements. In text data, we can treat each sentence, paragraph or even document as an individual sequence, and construct the sequence-based adjacency graph from the sequences.” Here, Jiang mentions creating the graph from ordered elements of text data.
Later, see Jiang in page 550, section IV Random Walks on Adjacency Graph describe “Given an adjacency graph G, two basic types of random walks can be defined, namely forward walking and backward walking…The weights on edges can be normalized in various ways to allow for interpreting the graph as a transition matrix with the nodes of the graph as states. Such a probabilistic interpretation enables us to compute probabilities of different random walks on the graph, which we can then use to mine interesting paths, relations between words”. Here, Jiang describes using weights on edges in random walks of nodes of a graph along with probabilistic method of the walks on the graph (i.e. probabilistically traversing the combined graph from edge weights).
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Alikiaamiri, Dupont and Shetty of grouping alert texts using models that organize text data, and incorporate into the teachings of Jiang of random walks of nodes of the combined graph by probabilistically traversing the combined graph based on edge weights.
One of ordinary skill in the art would be motivated to do so because incorporating the method of Turgeman, Alikiaamiri, Dupont, and Shetty, into the framework of Jiang, this would achieve “evaluation results show that the proposed algorithms are effective for discovering meaningful paradigmatic and syntagmatic relations of words from text data, and that for both relations, the algorithms respond well to the growth of big data and are able to generate higher quality of knowledge,” (See Jiang in page 553, section VII. Conclusion).
However, Turgeman in view of Alikiaamiri, further in view of Dupont, further in view of Shetty, and further in view of Jiang, did not teach “and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
In an analogous field, Menon teaches “and adding the alert to the group of alerts by grouping the alert under an existing open incident in an event management system, wherein the grouping causes the alert to be handled under the existing open incident without a notification being transmitted to a responder based on the alert.”
See Menon in page 8, section XI. Conclusion, describe “From predicting patch risks and automating optimal schedules, to classifying unstructured event logs and suppressing alert noise, AI is transforming OEMOC from a reactive administrative interface into a proactive, intelligent platform.” Menon here describes suppressing alert noise. See Menon in page 3, section III, part 1, describe “The system’s reactive model generates a high frequency of notifications…” showing an event management system.
Further, see Menon in pages 5-6, section VII. Patch management optimization using AI, part 3. Anomaly Detection in post-patch performance, describe " Techniques such as Isolation Forests, autoencoders, or one-class SVMs can detect subtle deviations in system behavior such as increased I/O latency, memory leaks, or service response lags that may not trigger explicit alerts.” When Menon mentions may not trigger explicit alerts, Menon describes not triggering a notification, and enhances suppressing alert noise from being transmitted to a responder.
Further, see Menon in page 6, section VIII. Event Correlation and Noise Suppression, part 1. AI-Driven Deduplication of alerts from multiple layers, describe "Oracle EM Ops Center environments often produce overlapping alerts from system agents, operating systems, hardware enclosures, and third-party components. This results in redundant messages that clutter dashboards and overwhelm operators. AI can reduce this noise through intelligent
deduplication techniques. By using clustering and similarity detection algorithms such as cosine similarity or hierarchical clustering AI systems can identify alerts with semantically equivalent content and group them into unified incidents. These models can evaluate historical co-occurrence, source proximity, and temporal alignment to consolidate events that stem from the same root cause. This not only reduces the alert count but also streamlines operator attention toward actionable issues, improving mean time to acknowledgment (MTTA). " Menon here mentions ‘alerts with semantically equivalent content’ relates to existing open incident. Menon also describes a method using machine learning methods in grouping similar alerts by root cause, reducing redundant messages that overwhelm operators.
Later, see Menon in page 6, part VII part 4. Automating Patch Scheduling with Reinforcement Learning, describes "this intelligent automation relieves administrators from manually juggling multiple dependencies, while improving patch efficacy and reducing operational overhead. " Menon here describes this helps improve handling of information technology (IT) related incidents by relieve administrators (i.e. responder) from viewing redundant IT tickets under a common root cause.
Claim 13:
Regarding claim 13, Turgeman in view of Alikiaamiri, further in view of Dupont, further in view of Shetty, further in view of Jiang, further in view of Menon, teach the limitations in claim 12.
Further, Turgeman teaches “The method of claim 12, further comprising: responsive to the embedding not meeting the similarity threshold with any respective embedding of the groups of alerts, adding the alert to a new group of alerts,”
See Turgeman in page 9, section 6.22 Trade-off control, Turgeman talks about "Fig. 5 (a) shows the resulted clusters number and mean size, as a function of thdist. Clearly, the number of clusters decreases as thdist increases, and, on the other hand, the mean cluster size increases, as the algorithm tends to merge new alerts to existing clusters. For very low thdist values, the algorithm yields similar clusters to those obtained by the ‘conservative’ model (Fig. 5 (b)), indicating that a lower threshold based clustering mechanism yields results that are similar to those obtained by the pair-wise similarity-based mechanism (section 4.1.2)."
See Turgeman in page 5, section 4.1.4. Incremental alerts clustering describing "The process starts by initializing a set of cluster representatives, where incoming alerts are processed sequentially. As a new alert appears, it is compared to all existing clusters representatives by analyzing the Euclidian distance between its corresponding metric ID embedding to all existing clusters centroids, where the cluster centroid is calculated by averaging over its corresponding alerts’ embeddings, or is equal to alert’s embedding, in case of a cluster that is composed of a single alert. If this distance is smaller than a predefined threshold, it is added to that cluster, otherwise, a new cluster holding it is created." Here, Turgeman shows that if the text embedding of the alert did not meet a similarity threshold value, thdist in this case, from those of the other embeddings in the existing groups of alerts, then the algorithm initially attempts to find a place for the new alert in the existing groups of alerts. However, if the algorithm cannot, then Turgeman mentions in page 5, section 4.1.4, " a new cluster holding it is created", which corresponds to the new alert gets added to a new group.
Claims 16 and 17 are rejected under 35 U.S.C. 103 over Turgeman in view of Alikiaamiri, further in view of Dupont, further in view of Shetty, further in view of Jiang, further in view of Menon, and further in view of Sun.
Claim 16:
Referring to claim 16, Turgeman in view of Alikiaamiri, further in view of Dupont, further in view of Shetty, further in view of Jiang, and further in view of Menon, teach the limitations in claim 12.
However, regarding claim 16, Turgeman in view of Alikiaamiri, further in view of Dupont, further in view of Shetty, further in view of Jiang, and further in view of Menon, did not teach the limitation, “the method of claim 12, wherein grouping the historical alerts into the samples of alerts comprises: grouping the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts.”
In an analogous system, Sun teaches “the method of claim 12, wherein grouping the historical alerts into the samples of alerts comprises: grouping the historical alerts into the samples of alerts based on overlapping sliding windows over the historical alerts,”
See Sun in page 15, section 4.4: Alert Similarity Calculation, that the researchers "calculated the corresponding important attributes and their weights according to different attack classifications. In order to aggregate similar alerts, we also need to calculate the similarity value of each important attribute between the two alerts and weight the total similarity. The two alerts are aggregated if the total similarity of the two alerts is greater than the set threshold. It should be noted that we only need to forcibly reduce the alerts whose total similarity is greater than the threshold for a certain period of time, so the setting of the time threshold is necessary. Therefore, we use sliding time windows to slice alert sequences and aggregate alerts within the same time window." Here, Sun describes using a sliding time window interval to group alerts to classify them.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Alikiaamiri, Dupont, Shetty, Jiang, and Menon, and incorporate into the teachings of Sun because all references teach using grouping methods on text data for information management alerts.
One of ordinary skill in the art would be motivated to do so because using the grouping methods on text alert data from the teachings of Turgeman, Alikiaamiri, Dupont, Shetty, Jiang, and Menon, and combine with sorting the groups of text alert data by sliding time windows from the teachings of Sun since using “a suitable similarity threshold can effectively eliminate duplicate alerts and provide higher quality data for the next data fusion layer” (Sun, page 18, section 5.3. Experimental Results), and Sun’s method “can effectively reduce redundant alerts and help network security administrators to find real attacks” (page 21, section 6. Discussion and Conclusions).
Claim 17:
Regarding claim 17, Turgeman in view of Alikiaamiri, further in view of Dupont, further in view of Shetty, further in view of Jiang, and further in view of Menon, teach the limitations in claim 12.
However, regarding claim 17, Turgeman in view of Alikiaamiri, further in view of Dupont, further in view of Shetty, further in view of Jiang, and further in view of Menon, did not teach the limitation, “the method of claim 12, wherein grouping the historical alerts into the samples of alerts comprises: grouping at least some of the historical alerts into a sample associated with a historical alert of the historical alerts based on an active window associated with the historical alert.”
In an analogous system, Sun teaches “the method of claim 15, wherein grouping the historical alerts into the samples of alerts comprises: grouping at least some of the historical alerts into a sample associated with a historical alert of the historical alerts based on an active window associated with the historical alert,”
See Sun in page 15, section 4.4: Alert Similarity Calculation, where the researchers "calculated the corresponding important attributes and their weights according to different attack classifications. In order to aggregate similar alerts, we also need to calculate the similarity value of each important attribute between the two alerts and weight the total similarity. The two alerts are aggregated if the total similarity of the two alerts is greater than the set threshold. It should be noted that we only need to forcibly reduce the alerts whose total similarity is greater than the threshold for a certain period of time, so the setting of the time threshold is necessary. Therefore, we use sliding time windows to slice alert sequences and aggregate alerts within the same time window." Here, Sun describes a certain period of time to mean any interval of time that contains an alert or incident and this corresponds to an active time window.
It would have been obvious for one of ordinary skill in the art before the effective filing date of the claimed invention to combine the references of Turgeman, Alikiaamiri, Dupont, Shetty, Jiang, and Menon, and incorporate into the teachings of Sun because all references teach using grouping methods on text data for information management alerts.
One of ordinary skill in the art would be motivated to do so because using the grouping methods on text alert data from the teachings of Turgeman, Alikiaamiri, Dupont, Shetty, Jiang, and Menon, and combine with sorting the groups of text alert data by active windows from the teachings of Sun since using “a suitable similarity threshold can effectively eliminate duplicate alerts and provide higher quality data for the next data fusion layer” (Sun, page 18, section 5.3. Experimental Results), and Sun’s method “can effectively reduce redundant alerts and help network security administrators to find real attacks” (page 21, section 6. Discussion and Conclusions).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WENWEI ZENG whose telephone number is (571)272-7111. The examiner can normally be reached Monday-Friday, 8am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Usmaan Saeed can be reached at (571) 272-4046. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/WenWei Zeng/Examiner, Art Unit 2146
/USMAAN SAEED/Supervisory Patent Examiner, Art Unit 2146
Prosecution Insights