Prosecution Insights
Last updated: April 19, 2026
Application No. 18/185,318

DETECTING ANOMALOUS ACTIVITY IN A SYSTEM-ON-CHIP

Final Rejection §103
Filed
Mar 16, 2023
Examiner
SHAUGHNESSY, AIDAN EDWARD
Art Unit
2432
Tech Center
2400 — Computer Networks
Assignee
International Business Machines Corporation
OA Round
3 (Final)
38%
Grant Probability
At Risk
4-5
OA Rounds
3y 7m
To Grant
99%
With Interview

Examiner Intelligence

Grants only 38% of cases
38%
Career Allow Rate
3 granted / 8 resolved
-20.5% vs TC avg
Strong +71% interview lift
Without
With
+71.4%
Interview Lift
resolved cases with interview
Typical timeline
3y 7m
Avg Prosecution
44 currently pending
Career history
52
Total Applications
across all art units

Statute-Specific Performance

§101
7.9%
-32.1% vs TC avg
§103
66.0%
+26.0% vs TC avg
§102
11.9%
-28.1% vs TC avg
§112
14.1%
-25.9% vs TC avg
Black line = Tech Center average estimate • Based on career data from 8 resolved cases

Office Action

§103
Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Response to Amendments / Arguments Regarding the rejection(s) of claims under 35 USC 103: Applicant’s arguments, field 01/26/2026, in view of the amended claims, have been fully considered and are not persuasive. Applicant argues that the Tamir reference does not teach "determining counter values from counters for processing elements in the system-on-chip during a test workload, wherein a counter for one of the processing elements indicates an amount of activity at the processing element during a measurement period, wherein the counters for at least two of the processing elements measure different types of processing activities." Applicant argues that "the processes in Tamir are not processing elements on a SOC and the counters in Tamir are not for processing elements, such that counters for at least two of the processing elements measure different types of processing activities;" that "the processes tracked in Tamir comprise code executing at an address that produces events" and "the counters are for events at memory addresses that correspond to processes;" and that "Tamir does not teach providing counters to detect anomalies for processing elements in a SOC as claimed." However, the cited portions of Tamir (Para [0024]-[0025], [0030], and [0078]) explicitly recite hardware-based performance monitoring using "INTEL® CPU and Chipset Performance Counters" and "Performance Monitoring Unit or PMU counters." Para [0030] of Tamir further recites specific examples including "Machine clear events," "Store forward miss rate instructions," "Misaligned memory references," "ITLB flushes," and "Distribution of Translation Lookaside Buffer (TLB) misses." Para [0078] additionally lists hardware counters corresponding to "machine clear, cache miss, branch miss, self-modifying code, debugging event, single step event, store forward miss, misaligned memory reference, ITLB flush, TLB miss, indirect call, conditional branch, trap, context switch, power management event, and explicit stack pointer change instruction." Therefore, Tamir teaches hardware counters that monitor different types of processing activities at the underlying processing elements (CPU cores, execution units, cache systems, memory management units) of the computer system. Applicant further argues that there is a fundamental distinction between monitoring "software processes" versus "hardware processing elements," suggesting that Tamir's process-based monitoring cannot teach counters for processing elements. In response, it is noted that software processes necessarily execute on and utilize specific hardware processing elements, and that Tamir's hardware performance counters inherently monitor the activity of these processing elements during process execution. At least paragraph [0030] of Tamir discusses "taking into account the memory address of the interrupt raised when a given counter reaches its threshold, it is possible to determine which process was responsible for the event" and "analyze a time series of specific counters for specific processes." This demonstrates that the hardware counters are monitoring processing element activity that occurs when processes utilize those processing elements. Therefore, Tamir is considered to teach "counters for processing elements" that "measure different types of processing activities" because the disclosed hardware performance counters monitor distinct processing activities (cache events, branch events, memory events, execution events) occurring at the processing elements of the system. Therefore, the identified claim language is considered to be taught by the combined references, and the rejection is maintained. Further, since Applicant has not presented additional persuasive arguments concerning the dependent claims, their rejections are likewise maintained. DETAILED ACTION This is a reply to the arguments filed on 01/26/2026, in which, claims 1-4, 6-13 and 15-23 are pending. Claims 1, 12, and 17 are independent. Claims 5 and 14 are cancelled. When making claim amendments, the applicant is encouraged to consider the references in their entireties, including those portions that have not been cited by the examiner and their equivalents as they may most broadly and appropriately apply to any particular anticipated claim amendments. Claim Rejections - 35 USC § 103 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claims 1-4, 12-13 and 17-18 are rejected under 35 U.S.C. 103 as being unpatentable over Amram et al. (US 20230359307 A1, referred to as Amram), in view of Tamir et al. (US 20160328561 A1, referred to as Tamir). In reference to claim 1, A computer program product for detecting an anomaly in system-on-chip, the computer program product comprising a computer readable storage medium having computer readable program code embodied therein that is executable to perform operations, the operations comprising (Amram: [0099]-[0102] Provides for a computer program embodied on computer-readable storage with code that performs anomaly detection methods.) Training an anomaly detector to classify determined values during measurement periods occurring during the test workload as non-anomalous activity (Amram: [0035]-[0041] Provides for training an anomaly detector through both supervised and unsupervised learning approaches. It explicitly mentions providing "desired input signals without anomalies" during a learning phase.) Deploying the trained anomaly detector within the system-on-chip to process values for the processing elements on the system-on-chip to classify the values as anomalous or non-anomalous (Amram: [0025]-[0032] Provides for deploying the trained AI anomaly detector within a processor/system to process signals and classify them as valid (non-anomalous) or anomalous.) Performing a mitigation action in response to the deployed trained anomaly detector detecting the anomalous activity within the system-on-chip (Amram: [0031] and [0044]-[0046] Provides for performing mitigation actions in response to detecting anomalies, including dropping bad signals, applying correction algorithms, and implementing estimation or interpolation processes.) Amran doesn't explicitly disclose that the determined values are counter values and determines counter values from counters for processing elements in the system-on-chip during a test workload, wherein a counter for one of the processing elements indicates an amount of activity at a processing element during a measurement period. However, Dally teaches: Determining counter values from counters for processing elements in the system-on-chip during a test workload, wherein a counter for one of the processing elements indicates an amount of activity at a processing element during a measurement period (Tamir: [0029]-[0030] Provides for determining counter values from hardware counters that indicate activity of processing elements during measurement periods. It details numerous counters that measure various activities at processing elements. For the sake of completeness Tamir also teaches [0050]-[0051] Provides for using machine learning to define normal or expected (non-anomalous) behavior based on counter values. Tamir [0053]-[0054] Provides for deploying a behavioral model (fingerprint) to detect anomalies by comparing runtime behavior with established patterns. Tamir [0071]-[0073] Provides for performing mitigation actions in response to detecting anomalous activity.) Wherein the counters for at least two of the processing elements measure different types of processing activities (Tamir: [0030] and [0078] Provides for multiple different types of hardware counters measuring different processing activities (cache events, branch events, memory events, etc.).) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram, which provides a method for anomaly detection in system-on-chip environments using trained anomaly detectors that classify signals and perform mitigation actions, with the teachings of Tamir, which introduces the use of hardware performance counters that measure processing element activity during measurement periods. One of ordinary skill in the art would recognize the ability to incorporate Tamir's counter-based measurement data into Amram's anomaly detection system to provide more concrete and quantifiable metrics for anomaly detection. One of ordinary skill in the art would be motivated to make this modification in order to enhance anomaly detection precision by using objective activity measurements from hardware counters. In reference to claim 2, The computer program product of claim 1, wherein the anomaly detector implements an unsupervised or semi-supervised machine learning model, wherein the operations further comprise: repeatedly retraining the anomaly detector while deployed within the system-on-chip to classify as non-anomalous counter values resulting from known non-anomalous activity and counter values whose classification by the anomaly detector as anomalous comprises a false positive classification (Amram: [0040]-[0043] Provides for using unsupervised learning for the anomaly detector. It also describes reinforcement learning with penalties for false positives (erroneously qualifying valid signals as anomalies) and active learning where the detector requests more data when experiencing excessive detections.) In reference to claim 3, The computer program product of claim 1, wherein the mitigation action comprises: determining a process, executing in the system-on-chip, producing activity in the system-on-chip that results in the counter values in the counters being classified as anomalous; determining whether the determined process is an authorized process; and quarantining the determined process in response to determining the determined process is not authorized (Amram: [0044]-[0051] and [0067]-[0070] Provides for determining the cause of an anomaly by analyzing patterns across devices and taking specific mitigation actions based on the type of anomaly detected.) In reference to claim 4, The computer program product of claim 1, wherein the operations further comprise: determining counter values classified as anomalous activity that is a false positive; and training the anomaly detector to classify the determined counter values as non-anomalous activity (Amram: [0040]-[0043] Provides for false positives and describes specific learning approaches to address them. The reinforcement learning method explicitly penalizes the anomaly detector when it "erroneously qualifies a valid position signal as an anomaly signal" (i.e., a false positive), which would train the detector not to make similar errors in the future.) In reference to claim 12, A system-on-chip for detecting an anomaly, comprising: a plurality of processing elements; an anomaly defense tile executing code to perform operations (Amram: [0099]-[0102] Provides for a computer program embodied on computer-readable storage with code that performs anomaly detection methods.) Training an anomaly detector to classify determined values during measurement periods occurring during the test workload as non-anomalous activity (Amram: [0035]-[0041] Provides for training an anomaly detector through both supervised and unsupervised learning approaches. It explicitly mentions providing "desired input signals without anomalies" during a learning phase.) Deploying the trained anomaly detector within the system-on-chip to process values for the processing elements on the system-on-chip to classify the values as anomalous or non-anomalous (Amram: [0025]-[0032] Provides for deploying the trained AI anomaly detector within a processor/system to process signals and classify them as valid (non-anomalous) or anomalous.) Performing a mitigation action in response to the deployed trained anomaly detector detecting the anomalous activity within the system-on-chip (Amram: [0031] and [0044]-[0046] Provides for performing mitigation actions in response to detecting anomalies, including dropping bad signals, applying correction algorithms, and implementing estimation or interpolation processes.) Amran doesn't explicitly disclose that the determined values are counter values and determines counter values from counters for processing elements in the system-on-chip during a test workload, wherein a counter for one of the processing elements indicates an amount of activity at a processing element during a measurement period. However, Dally teaches: Determining counter values from counters for processing elements in the system-on-chip during a test workload, wherein a counter for one of the processing elements indicates an amount of activity at a processing element during a measurement period (Tamir: [0029]-[0030] Provides for determining counter values from hardware counters that indicate activity of processing elements during measurement periods. It details numerous counters that measure various activities at processing elements. For the sake of completeness Tamir also teaches [0050]-[0051] Provides for using machine learning to define normal or expected (non-anomalous) behavior based on counter values. Tamir [0053]-[0054] Provides for deploying a behavioral model (fingerprint) to detect anomalies by comparing runtime behavior with established patterns. Tamir [0071]-[0073] Provides for performing mitigation actions in response to detecting anomalous activity.) Wherein the counters for at least two of the processing elements measure different types of processing activities (Tamir: [0030] and [0078] Provides for multiple different types of hardware counters measuring different processing activities (cache events, branch events, memory events, etc.).) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram, which provides a method for anomaly detection in system-on-chip environments using trained anomaly detectors that classify signals and perform mitigation actions, with the teachings of Tamir, which introduces the use of hardware performance counters that measure processing element activity during measurement periods. One of ordinary skill in the art would recognize the ability to incorporate Tamir's counter-based measurement data into Amram's anomaly detection system to provide more concrete and quantifiable metrics for anomaly detection. One of ordinary skill in the art would be motivated to make this modification in order to enhance anomaly detection precision by using objective activity measurements from hardware counters. In reference to claim 13, The system-on-chip of claim 12, wherein the operations further comprise: determining counter values classified as anomalous activity that is a false positive; and training the anomaly detector to classify the determined counter values as non-anomalous activity (Amram: [0040]-[0043] Provides for false positives and describes specific learning approaches to address them. The reinforcement learning method explicitly penalizes the anomaly detector when it "erroneously qualifies a valid position signal as an anomaly signal" (i.e., a false positive), which would train the detector not to make similar errors in the future.) In reference to claim 17, A method for detecting an anomaly in system-on-chip (Amram: [0099]-[0102] Provides for a computer program embodied on computer-readable storage with code that performs anomaly detection methods.) Training an anomaly detector to classify determined values during measurement periods occurring during the test workload as non-anomalous activity (Amram: [0035]-[0041] Provides for training an anomaly detector through both supervised and unsupervised learning approaches. It explicitly mentions providing "desired input signals without anomalies" during a learning phase.) Deploying the trained anomaly detector within the system-on-chip to process values for the processing elements on the system-on-chip to classify the values as anomalous or non-anomalous (Amram: [0025]-[0032] Provides for deploying the trained AI anomaly detector within a processor/system to process signals and classify them as valid (non-anomalous) or anomalous.) Performing a mitigation action in response to the deployed trained anomaly detector detecting the anomalous activity within the system-on-chip (Amram: [0031] and [0044]-[0046] Provides for performing mitigation actions in response to detecting anomalies, including dropping bad signals, applying correction algorithms, and implementing estimation or interpolation processes.) Amran doesn't explicitly disclose that the determined values are counter values and determines counter values from counters for processing elements in the system-on-chip during a test workload, wherein a counter for one of the processing elements indicates an amount of activity at a processing element during a measurement period. However, Dally teaches: Determining counter values from counters for processing elements in the system-on-chip during a test workload, wherein a counter for one of the processing elements indicates an amount of activity at a processing element during a measurement period (Tamir: [0029]-[0030] Provides for determining counter values from hardware counters that indicate activity of processing elements during measurement periods. It details numerous counters that measure various activities at processing elements. For the sake of completeness Tamir also teaches [0050]-[0051] Provides for using machine learning to define normal or expected (non-anomalous) behavior based on counter values. Tamir [0053]-[0054] Provides for deploying a behavioral model (fingerprint) to detect anomalies by comparing runtime behavior with established patterns. Tamir [0071]-[0073] Provides for performing mitigation actions in response to detecting anomalous activity.) Wherein the counters for at least two of the processing elements measure different types of processing activities (Tamir: [0030] and [0078] Provides for multiple different types of hardware counters measuring different processing activities (cache events, branch events, memory events, etc.).) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram, which provides a method for anomaly detection in system-on-chip environments using trained anomaly detectors that classify signals and perform mitigation actions, with the teachings of Tamir, which introduces the use of hardware performance counters that measure processing element activity during measurement periods. One of ordinary skill in the art would recognize the ability to incorporate Tamir's counter-based measurement data into Amram's anomaly detection system to provide more concrete and quantifiable metrics for anomaly detection. One of ordinary skill in the art would be motivated to make this modification in order to enhance anomaly detection precision by using objective activity measurements from hardware counters. In reference to claim 18, The method of claim 17, further comprising: determining counter values classified as anomalous activity that is a false positive; and training the anomaly detector to classify the determined counter values as non-anomalous activity (Amram: [0040]-[0043] Provides for false positives and describes specific learning approaches to address them. The reinforcement learning method explicitly penalizes the anomaly detector when it "erroneously qualifies a valid position signal as an anomaly signal" (i.e., a false positive), which would train the detector not to make similar errors in the future.) Claim Rejections - 35 USC § 103 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claims 6-11, 15-16, and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over Amram et al. (US 20230359307 A1, referred to as Amram), in view of Tamir et al. (US 20160328561 A1, referred to as Tamir) in further view of Hoover et al. (US 20090282227 A1, referred at Hoover). In reference to claim 6, The computer program product of claim 1, wherein the different counters comprise: a counter for an accelerator that measures processing cycles during a measurement period; a counter for a memory tile in the system-on-chip indicating a number of memory requests to the memory tile; a counter for an Input/Output tile that measures packets-in and packets-out of the Input/output tile; and a general purpose counter for tiles that measure network-on-chip packets-in and packets-out of the tiles (Hoover: [0075]-[0080] Provides for counters for various aspects of system operation, including processor activity, memory traffic, and packet transmission.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure processing element activity, with the teachings of Hoover, which introduces specialized counters for measuring different types of network-on-chip traffic activity at different processing elements. One of ordinary skill in the art would recognize the ability to incorporate Hoover's diverse counter types into the combined anomaly detection system to provide more granular and comprehensive monitoring of network-on-chip behavior. One of ordinary skill in the art would be motivated to make this modification in order to enable more sophisticated anomaly detection by monitoring multiple types of network traffic activity. In reference to claim 7, The computer program product of claim 1, wherein the system-on-chip includes a network-on-chip, wherein the network-on-chip includes routers comprising hardware on the network-on-chip to interconnect the processing elements, and wherein the counters are implemented in the routers for the processing elements (Hoover: [0026]-[0031], [0049] and [0077]-[0079] Provides for the NoC is implemented on a chip (system-on-chip), that the NoC includes routers as hardware interconnecting the processing elements (IP blocks), and that counters are specifically implemented in the routing logic of these routers.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure processing element activity, with the teachings of Hoover, which introduces implementing counters within network-on-chip routers that serve as hardware interconnects between processing elements. One of ordinary skill in the art would recognize the ability to incorporate Hoover's router-based counter implementation into the combined anomaly detection system to provide direct monitoring at the interconnection points. One of ordinary skill in the art would be motivated to make this modification in order to capture network traffic data at the optimal location where all communication between processing elements passes through In reference to claim 8, The computer program product of claim 7, wherein the operations further comprise: reading, by the anomaly detector, the counter values for the processing elements from the routers for the processing elements (Hoover: [0071]-[0081] Provides for the process of reading counter values from routers for processing elements.) In reference to claim 9, The computer program product of claim 7, wherein the routers form at least one first network plane and at least one second network plane separate from the at least one first network plane, wherein the processing elements use the at least one first network plane to communicate during workload operations, and wherein the at least one second network plane is used to read the counter values from the counters in the routers that are provided to the anomaly detector (Hoover: [0050]-[0053] and [0079] Provides for a network-on-chip with multiple virtual communication channels implemented by the routers, where each virtual channel is characterized by a communication type.) In reference to claim 10, The computer program product of claim 1, wherein the computer readable program code is executed by a processing core tile dedicated to implementing the anomaly detector, and wherein a dedicated anomaly tile stores the anomaly detector loaded into the processing core tile and the determined counter values (Hoover: [0035] and [0071]-[0073] Provides for a dedicated processor for monitoring and analysis functions.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure processing element activity, with the teachings of Hoover, which introduces dedicated processing tiles for monitoring and analysis functions. One of ordinary skill in the art would recognize the ability to incorporate Hoover's dedicated processor architecture into the combined anomaly detection system to isolate monitoring functions from operational processing elements. One of ordinary skill in the art would be motivated to make this modification in order to prevent anomaly detection overhead from impacting the performance of functional processing elements. In reference to claim 11, The computer program product of claim 1, wherein the computer readable program code and the anomaly detector are implemented in a hardware accelerator tile of the system-on-chip having a dedicated memory tile to store the determined counter values (Hoover: [0019]-[0021] and [0030]-[0035] Provides for NOC coprocessors that are "optimized to accelerate particular data processing tasks,".) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure processing element activity, with the teachings of Hoover, which introduces hardware accelerator tiles with dedicated memory for specialized data processing tasks. One of ordinary skill in the art would recognize the ability to incorporate Hoover's hardware accelerator architecture into the combined anomaly detection system to optimize the performance of anomaly detection operations. One of ordinary skill in the art would be motivated to make this modification in order to accelerate anomaly detection processing through specialized hardware optimized for the computational patterns of machine learning inference In reference to claim 15, The system-on-chip of claim 12, wherein the system-on-chip includes a network-on-chip, wherein the network-on-chip includes routers comprising hardware on the network-on-chip to interconnect the processing elements, and wherein the counters are implemented in the routers for the processing elements (Hoover: [0026]-[0031], [0049] and [0077]-[0079] Provides for the NoC is implemented on a chip (system-on-chip), that the NoC includes routers as hardware interconnecting the processing elements (IP blocks), and that counters are specifically implemented in the routing logic of these routers.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure processing element activity, with the teachings of Hoover, which introduces implementing counters within network-on-chip routers that serve as hardware interconnects between processing elements. One of ordinary skill in the art would recognize the ability to incorporate Hoover's router-based counter implementation into the combined anomaly detection system to provide direct monitoring at the interconnection points. One of ordinary skill in the art would be motivated to make this modification in order to capture network traffic data at the optimal location where all communication between processing elements passes through In reference to claim 16, The system-on-chip of claim 15, wherein the routers form at least one first network plane and at least one second network plane separate from the at least one first network plane, wherein the processing elements use the at least one first network plane to communicate during workload operations, and wherein the at least one second network plane is used to read the counter values from the counters in the routers that are provided to the anomaly detector (Hoover: [0050]-[0053] and [0079] Provides for a network-on-chip with multiple virtual communication channels implemented by the routers, where each virtual channel is characterized by a communication type.) In reference to claim 19, The method of claim 17, wherein the system-on-chip includes a network-on-chip, wherein the network-on-chip includes routers comprising hardware on the network-on-chip to interconnect the processing elements, and wherein the counters are implemented in the routers for the processing elements (Hoover: [0026]-[0031], [0049] and [0077]-[0079] Provides for the NoC is implemented on a chip (system-on-chip), that the NoC includes routers as hardware interconnecting the processing elements (IP blocks), and that counters are specifically implemented in the routing logic of these routers.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure processing element activity, with the teachings of Hoover, which introduces implementing counters within network-on-chip routers that serve as hardware interconnects between processing elements. One of ordinary skill in the art would recognize the ability to incorporate Hoover's router-based counter implementation into the combined anomaly detection system to provide direct monitoring at the interconnection points. One of ordinary skill in the art would be motivated to make this modification in order to capture network traffic data at the optimal location where all communication between processing elements passes through In reference to claim 20, The method of claim 19, wherein the routers form at least one first network plane and at least one second network plane separate from the at least one first network plane, wherein the processing elements use the at least one first network plane to communicate during workload operations, and wherein the at least one second network plane is used to read the counter values from the counters in the routers that are provided to the anomaly detector (Hoover: [0050]-[0053] and [0079] Provides for a network-on-chip with multiple virtual communication channels implemented by the routers, where each virtual channel is characterized by a communication type.) In reference to claim 21, The computer program product of claim 1, wherein the measured different types of processing activities measured by the counters are selected from the group consisting of processing cycles at one of the processing elements, number of memory requests to one of the processing elements, and packets-in and packets-out at one of the processing elements (Hoover: [0074]-[0080] Provides for three processing activity types: compute density measures processing cycles per processor cycle, cache miss monitoring provides for memory requests to processing elements, and packet transmission counters provide for packets-in and packets-out at processing elements.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure different types of processing element activities, with the teachings of Hoover, which introduces specific counter types for measuring processing cycles, memory requests, and packet transmission activities. One of ordinary skill in the art would recognize the ability to incorporate Hoover's specific counter implementations into the combined anomaly detection system to provide comprehensive monitoring of critical system-on-chip metrics. One of ordinary skill in the art would be motivated to make this modification in order to enable thorough anomaly detection by monitoring important performance indicators that reveal system behavior. In reference to claim 22, The system-on-chip of claim 12, wherein the measured different types of processing activities measured by the counters are selected from the group consisting of processing cycles at one of the processing elements, number of memory requests to one of the processing elements, and packets-in and packets-out at one of the processing elements (Hoover: [0074]-[0080] Provides for three processing activity types: compute density measures processing cycles per processor cycle, cache miss monitoring provides for memory requests to processing elements, and packet transmission counters provide for packets-in and packets-out at processing elements.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure different types of processing element activities, with the teachings of Hoover, which introduces specific counter types for measuring processing cycles, memory requests, and packet transmission activities. One of ordinary skill in the art would recognize the ability to incorporate Hoover's specific counter implementations into the combined anomaly detection system to provide comprehensive monitoring of critical system-on-chip metrics. One of ordinary skill in the art would be motivated to make this modification in order to enable thorough anomaly detection by monitoring important performance indicators that reveal system behavior. In reference to claim 23, The method of claim 17, wherein the measured different types of processing activities measured by the counters are selected from the group consisting of processing cycles at one of the processing elements, number of memory requests to one of the processing elements, and packets-in and packets-out at one of the processing elements (Hoover: [0074]-[0080] Provides for three processing activity types: compute density measures processing cycles per processor cycle, cache miss monitoring provides for memory requests to processing elements, and packet transmission counters provide for packets-in and packets-out at processing elements.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Amram in view of Tamir, which together provide a method for anomaly detection in system-on-chip environments using hardware performance counters to measure different types of processing element activities, with the teachings of Hoover, which introduces specific counter types for measuring processing cycles, memory requests, and packet transmission activities. One of ordinary skill in the art would recognize the ability to incorporate Hoover's specific counter implementations into the combined anomaly detection system to provide comprehensive monitoring of critical system-on-chip metrics. One of ordinary skill in the art would be motivated to make this modification in order to enable thorough anomaly detection by monitoring important performance indicators that reveal system behavior. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTO-892. Applicant’s amendment necessitated the new ground(s) of rejection presented in this office action. Accordingly, THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to AIDAN EDWARD SHAUGHNESSY whose telephone number is (703)756-1423. The examiner can normally be reached on Monday-Friday from 7:30am to 5pm. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson, can be reached at telephone number (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/usptoautomated-interview-request-air-form. /A.E.S./Examiner, Art Unit 2432 /Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
Read full office action

Prosecution Timeline

Mar 16, 2023
Application Filed
Apr 04, 2025
Non-Final Rejection — §103
Jul 09, 2025
Applicant Interview (Telephonic)
Jul 09, 2025
Examiner Interview Summary
Jul 16, 2025
Response Filed
Nov 03, 2025
Non-Final Rejection — §103
Jan 22, 2026
Applicant Interview (Telephonic)
Jan 22, 2026
Examiner Interview Summary
Jan 26, 2026
Response Filed
Feb 12, 2026
Final Rejection — §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12574412
METHOD AND SYSTEM FOR PROCESSING AUTHENTICATION REQUESTS
2y 5m to grant Granted Mar 10, 2026
Patent 12339956
ENDPOINT ISOLATION AND INCIDENT RESPONSE FROM A SECURE ENCLAVE
2y 5m to grant Granted Jun 24, 2025
Patent 12225029
AUTOMATIC IDENTIFICATION OF ALGORITHMICALLY GENERATED DOMAIN FAMILIES
2y 5m to grant Granted Feb 11, 2025
Study what changed to get past this examiner. Based on 3 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

4-5
Expected OA Rounds
38%
Grant Probability
99%
With Interview (+71.4%)
3y 7m
Median Time to Grant
High
PTA Risk
Based on 8 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month