DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on August 19, 2026 has been entered.
Information Disclosure Statement
Acknowledgment is made of the information disclosure statements filed March 28, 2023, which comply with 37 CFR 1.97. As such, the information disclosure statements have been placed in the application file and the information referred to therein has been considered by the examiner.
Response to Amendment
This non-final office action is responsive to the amendment filed with an RCE on August 4, 2026, which was in response to the final office action mailed June 23, 2026.
Claims 1, 8, and 15 have been amended. Claims 1-20 are pending and have been examined. Claims 1-20 are rejected.
Claim Rejections - 35 USC § 101
35 U.S.C. § 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
According to the USPTO guidelines, a claim is directed to non-statutory subject matter if:
Step 1: The claim does not fall within one of the four statutory categories of invention (process, machine, manufacture, or composition of matter), or,
Step 2: The claim recites a judicial exception, e.g. an abstract idea, without reciting additional elements that amount to significantly more than the judicial exception, as determined using the following analysis:
Step 2A, Prong 1: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Step 2A, Prong 2: Does the claim recite additional elements that integrate the judicial exception into a practical application?
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
MPEP 2106.04(a)(2)(I) states: “The mathematical concepts grouping is defined as mathematical relationships, mathematical formulas or equations, and mathematical calculations.”
MPEP 2106.04(a)(2)(III) states: “Accordingly, the “mental processes” abstract idea grouping is defined as concepts performed in the human mind, and examples of mental processes include observations, evaluations, judgements, and opinions.
Further, the MPEP states: “The courts do not distinguish between mental processes that are performed entirely in the human mind and mental processes that require a human to use a physical aid (e.g. pen and paper or a slide run) to perform the claim limitation.
Using the two-step inquiry, it is clear that Claims 1-20 are each directed to an abstract idea as shown below:
Please note the following:
Claims 1-6 recite identical limitations as Claims 8-14 and Claims 15-20. Additionally, Claim 7 recites identical limitations as Claim 14. Each group is expressed in a different statutory category.
Claims 1-7 are directed to a computer-implemented method for grouping two or more associated alerts comprised of a machine learning method.
Claims 8-14 are directed to a computer program embodied on a non-transitory computer readable medium, with the computer program being configured to cause at least one processor to execute a machine learning method.
Claims 15-20 are directed to an apparatus configured to group two or more associated alerts comprising: memory comprising a set of instructions; and at least one processor wherein the set of instructions are configured to cause at least one processor to execute a machine learning method.
With respect to Claims 1, 8, and 15:
Step 1: Claim 1 is directed to a method, also known as a process, which is one of the four statutory categories of patentable subject matter. Claim 8 is directed to a non-transitory computer readable medium on which a computer program is stored, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Claim 15 is directed to an apparatus comprised of memory with a set of instructions and at least one processer wherein the set of instructions are configured to cause at least one processor to execute a machine learning method, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter.
Step 2A, Prong 1: A judicial exception is recited in the claim(s) as they recite mathematical calculations and mental processes, which are abstract ideas:
“A computer-implemented method for grouping two or more associated alerts into a single incident, comprising: dividing alert data received from one or more monitoring tools into a plurality of temporal buckets each corresponding to a configurable time window, (Covers mental concepts that could be practically performed in the human mind or through the use of a pencil and paper, including observation, evaluation, and judgement - see MPEP 2106.04.)
and, within each configurable time window, selecting a context alert and a target alert;” (Covers mental concepts that could be practically performed in the human mind or through the use of a pencil and paper, including observation, evaluation, and judgement - see MPEP 2106.04.)
“the learning comprising generating the alert-vectors using an alert-frequency-based negative sampling in which positive samples are alert pairs that co-occur within a same context window and negative samples are alert pairs that do not co-occur within the same context window, the negative samples being selected based on a frequency of occurrence;” (Covers mental concepts that could be practically performed in the human mind or through the use of a pencil and paper, including observation, evaluation, and judgement - see MPEP 2106.04.)
“applying, by the ML model, a cosine-similarity or vector similarity metrics to determine the frequency of the occurrence and co-occurrence patterns in the repeat data;” (Covers mental concepts that could be practically performed in the human mind or through the use of a pencil and paper, including observation, evaluation, and judgement - see MPEP 2106.04.)
“and grouping, by the ML model, the repeated data in real time into the single incident based on the learning of the alert-vectors and the n-dimensional representation and the applying of the cosine-similar or vector similarity metrics,” (Covers mental concepts that could be practically performed in the human mind or through the use of a pencil and paper, including observation, evaluation, and judgement - see MPEP 2106.04.)
“wherein an alert is attached to the single incident based on a similarity-score threshold, thereby reducing a volume of incidents generated from the alert data and improving accuracy and performance of the ML model on new data” (An alert attached to a single incident based on a similarity-score threshold covers mental concepts that could be practically performed in the human mind or through the use of a pencil and paper, including observation, evaluation, and judgement - see MPEP 2106.04. Additionally, the result of reducing a volume of incidents generated from the alert data and improving accuracy and performance of the ML model on new data merely states the result of performing the grouping operation identified above, which means it is part of the recited abstract idea which covers mental concepts that could be practically performed in the human mind or through the use of a pencil and paper, including observation, evaluation, and judgement - see MPEP 2106.04.)
Step 2A, Prong 2: No, the abstract ideas in the limitations are not integrated into a practical application:
“learning, by a machine learning (ML) model, alert-vectors and a n-dimensional representation in a vector space to determine a frequency of occurrence and cooccurrence patterns of repeat data,” (Recites the training of an ML model in order to determine the patterns within repeated data, which only amounts to “apply it” and is using a computer as a tool to perform an abstract idea – see MPEP 2106.05(f)(1). Determining a frequency of occurrence or cooccurrence patterns of repeat data means data is being repeatedly counted and analyzed for patterns (relationships between the data), which is well-understood, routine, and conventional activity of observing patterns within data – see MPEP 2106.05(d).)
Step 2B: No, the additional elements of Claims 1, 8, and 15 do not provide significantly more than the abstract idea itself:
Training an ML model in order to determine the patterns within repeated data only amounts to
“apply it” and is using a computer as a tool to perform an abstract idea. Determining a frequency of occurrence or cooccurrence patterns of repeat data means data is being repeatedly counted and analyzed for patterns (relationships between the data), which is well-understood, routine, and conventional activity of observing patterns within data.
With respect to Claims 2, 9, and 16:
Step 1: Claim 2 is directed to a method, also known as a process, which is one of the four statutory categories of patentable subject matter. Claim 9 is directed to a non-transitory computer readable medium on which a computer program is stored, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Claim 16 is directed to an apparatus comprised of memory with a set of instructions and at least one processer wherein the set of instructions are configured to cause at least one processor to execute a machine learning method, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Step 2A, Prong 1: A judicial exception is not recited in the claims as they do not recite an abstract idea (mathematical concepts, certain methods of organizing human activity, or mental processes), law of nature, or natural phenomenon.
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into a practical application:
“wherein the learning of the alert-vectors and the n-dimensional representation comprising learning, by the ML model, using co-occurrence patterns of the two or more associated alerts”; Recites the training of an ML model on alert-vectors and n-dimensional representation through the use of co-occurrence patterns of the two or more associated alerts, which only amounts to “apply it” and is using a computer as a tool to perform an abstract idea – see MPEP 2106.05(f)(1).
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception. The training of an ML model on alert-vectors and n-dimensional representation through the use of co-occurrence patterns of two or more associated alerts involves mere instructions that are implemented by a computer – see MPEP 2106.05(f).
With respect to Claims 3, 10, and 17:
Step 1: Claim 3 is directed to a method, also known as a process, which is one of the four statutory categories of patentable subject matter. Claim 10 is directed to a non-transitory computer readable medium on which a computer program is stored, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Claim 17 is directed to an apparatus comprised of memory with a set of instructions and at least one processer wherein the set of instructions are configured to cause at least one processor to execute a machine learning method, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Step 2A, Prong 1: The claims recite an abstract idea. A judicial exception is recited in the claims as they recite mental processes:
“wherein the two or more associated alerts are characterized by repeated, simultaneous appearances, indicating a significant correlation between the two or more associated alerts”; Observing the repetition of two or more associated alerts and figuring out if there is a relationship between them is a mental process that can be performed in the human mind (this includes an observation, evaluation, judgement, or opinion).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into a practical application.
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
With respect to Claims 4, 11, and 18:
Step 1: Claim 4 is directed to a method, also known as a process, which is one of the four statutory categories of patentable subject matter. Claim 11 is directed to a non-transitory computer readable medium on which a computer program is stored, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Claim 18 is directed to an apparatus comprised of memory with a set of instructions and at least one processer wherein the set of instructions are configured to cause at least one processor to execute a machine learning method, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Step 2A, Prong 1: The claims recite an abstract idea. A judicial exception is recited in the claims as they recite mathematical calculations:
“wherein the alert-vectors are numerical representations of the two or more associated alerts, where n numerical values to represent the two or more associated alerts”; Alerts represented as numerical representations (alert-vectors) involve a mathematical calculation where words from alert messages are converted into a set of numbers arranged as vectors with n-dimensions.
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into a practical application.
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
With respect to Claims 5, 12, and 19:
Step 1: Claim 5 is directed to a method, also known as a process, which is one of the four statutory categories of patentable subject matter. Claim 12 is directed to a non-transitory computer readable medium on which a computer program is stored, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Claim 19 is directed to an apparatus comprised of memory with a set of instructions and at least one processer wherein the set of instructions are configured to cause at least one processor to execute a machine learning method, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Step 2A, Prong 1: The claims recite an abstract idea. A judicial exception is recited in the claims as they recite a mathematical calculation:
“selecting the n numerical values by computing a cosine similarity of the two or more associated alerts to produce a large value when the two or more associated alerts are related”; Recites the computing of a cosine similarity of the two or more associate alerts, which is a mathematical calculation.
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into a practical application.
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
With respect to Claims 6, 13, and 20:
Step 1: Claim 6 is directed to a method, also known as a process, which is one of the four statutory categories of patentable subject matter. Claim 13 is directed to a non-transitory computer readable medium on which a computer program is stored, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Claim 20 is directed to an apparatus comprised of memory with a set of instructions and at least one processer wherein the set of instructions are configured to cause at least one processor to execute a machine learning method, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter. Step 2A, Prong 1: The claims recite an abstract idea. A judicial exception is recited in the claims as they recite mathematical calculations:
“wherein the n-dimensional vector space comprises a vector in the space having n components and n axes representing the space”; An “n-dimensional vector space” is a mathematical calculation where a vector in the space having n components and n axes is representing data through a mathematical model. Data is represented through abstract, mathematical calculations.
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into a practical application.
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
With respect to Claims 7 and 14:
Step 1: Claim 7 is directed to a method, also known as a process, which is one of the four statutory categories of patentable subject matter. Claim 14 is directed to a non-transitory computer readable medium on which a computer program is stored, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter.
Step 2A, Prong 1: The claims recite an abstract idea. A judicial exception is recited in the claims as they recite mental processes and data classification:
“refreshing, by the ML model, the grouping of the repeated data when one or more associated alerts are detached from one or more incidents”; An ML model refreshing a grouping of repeated data triggered by the detachment of one or more associated alerts from one or more incidents is a mental process. Observing a list of alerts, making a judgement of which alerts are no longer associated with an incident, and then regrouping the updated data is a manual and mental process that can be performed in the human mind. Regrouping repeated data can also be considered data classification.
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into a practical application.
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e. changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
The following is a quotation of 35 U.S.C. § 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or non-obviousness.
Claims 1-6, 8-13, and 15-20 are rejected under 35 U.S.C. 103 as being unpatentable over Li, (U.S. Patent Application Publication No. US20240256951A1 filed on January 27, 2023), in view of Tang et al. (U.S. Patent Application Publication No. US10291483B2 filed on February 8, 2017, hereinafter “Tang”).
With respect to Claims 1, 8, and 15:
Li teaches:
“A computer-implemented method for grouping two or more associated alerts into a single incident, comprising: (Paragraph 0030 recites implementations where similarities, associations, and correlations between multiple events or alerts are identified and grouped together.)
“dividing alert data received from one or more monitoring tools into a plurality of temporal buckets each corresponding to a configurable time window, (Paragraph 0104 recites one or more monitoring systems (monitoring tools) configured to transmit events to a system for processing (alert data received). Paragraph 0189 recites time-window-based grouping in which groupable data, like alerts, are grouped by time windows of a predefined width, where examples can include time windows that are overlapping or non-overlapping (plurality of temporal buckets each corresponding to a configurable time window). Paragraphs 0185 and 0186 further clarify a groupable object may be associated with an active window that can be defined by a start time and end time, where the end time can be extendable (configurable).)
and, within each configurable time window, selecting a context alert and a target alert;” (Paragraph 0182 recites the invention disclosure uses a model that is an extension of the Word2Vec algorithm that can be trained to understand an alert context by defining sentence equivalents. It is understood that the Word2Vec algorithm works by sliding across a sequence of words, and at each position, designating one element as the target (target alert) and the surrounding elements within the window as context (context alert).)
“applying, by the ML model, a cosine-similarity or vector similarity metrics to determine the frequency of the occurrence and co-occurrence patterns in the repeat data;” (Paragraph 0214 teaches the application of an ML model to determine whether an embedding corresponding to the alert meets a similarity threshold. Paragraph 0138 further clarifies “Any number of techniques can be used to vectorize the word vector, such as count vectorization…or other techniques…cosine similarities or cosine similarity is a metric used to measure the similarity between features of two items, documents, or the like, represented as feature vectors. The technique of cosine similarities measures the cosine of an angle between two vectors of data projected in multi-dimensional space. This measurement allows a measure the similarity of a document of any type, such as of the alerts disclosed herein.”)
“and grouping, by the ML model, the repeated data in real time into the single incident based on the learning of the alert-vectors and the n-dimensional representation and the applying of the cosine-similar or vector similarity metrics, (Paragraph 0183 teaches using a neural network (a type of ML model) to generating embeddings (vectors in a dimensional space) through the application of vector similarity techniques. Paragraph 0032 further teaches using ML to identify related alerts (groupable objects) and group alerts, reducing the number of incidents triggered by alerts. It is understood an embedding is an alert-vector representation and cosine similarity occurs in a continuous, multidimensional vector space (akin to an n-dimensional representation in a vector space). Paragraph 0204 further recites how an incoming alert is grouped under an incident. Under broadest reasonable interpretation, grouping data in real time could be akin to an incoming alert being grouped as a singular event through live or streaming processing.)
wherein an alert is attached to the single incident based on a similarity-score threshold, thereby reducing a volume of incidents generated from the alert data” (Paragraph 0204 recites a neural network is used to obtain an embedding for the incoming alert and the embedding is compared to the embeddings of the open incidents. The embedding of the incoming alert is matched (such as using cosine similarities) to the embeddings of the open incidents to obtain respective match scores. The maximum match score is selected and compared to a threshold match score. If the maximum match score exceeds the threshold match score, then the incoming alert is considered to match the incident corresponding to the maximum match score before grouping. Paragraph 0030 further recites by grouping alerts, the number of triggered incidents can be reduced.)
and improving accuracy and performance of the ML model on new data” (Recites the intended result of the grouping process already addressed above, rather than a further independently acting step. Under MPEP 2111.04(II), a claim limitation that merely expresses the intended result of process steps already positively recited elsewhere in the claim is not accorded separate patentable weight, and need not be independently taught by the prior art beyond what has already been shown for those earlier steps. Because Li and Tang combined (see Tang’s teachings below) teach the grouping and vector-learning steps from which this result necessarily flows, this limitation is satisfied by the combination of teachings already relied upon above.)
Li does not appear to explicitly disclose:
“learning, by a machine learning (ML) model, alert-vectors and a n-dimensional representation in a vector space to determine a frequency of occurrence and co-occurrence patterns of repeat data,
the learning comprising generating the alert-vectors using an alert-frequency-based negative sampling in which positive samples are alert pairs that co-occur within a same context window and negative samples are alert pairs that do not co-occur within the same context window,
the negative samples being selected based on a frequency of occurrence;”
However, Tang teaches:
“learning, by a machine learning (ML) model, alert-vectors and a n-dimensional representation in a vector space to determine a frequency of occurrence and co-occurrence patterns of repeat data, (Column 4, Lines 12-15 recite each entity, such as a user, or a process in computer systems, is represented as a d-dimensional vector and will be automatically learned from the data. Column 2, Lines 59-61 recite entities are embed into a common latent space using their observed co-occurrence in different events.)
the learning comprising generating the alert-vectors using an alert-frequency-based negative sampling in which positive samples are alert pairs that co-occur within a same context window and negative samples are alert pairs that do not co-occur within the same context window, (Column 4, Lines 23-29 recite in order to alleviate the large event space issue and enable efficient model learning, the invention uses a first scenario where at the model level, instead of modeling all possible interactions among the entities, it only considers pairwise interaction that reflects the strength of co-occurrences of the entities, and a second scenario at the learning level, where it uses noise-contrastive estimation with context-dependent noise distribution (learning comprising generating alert-vectors using an alert-frequency-based negative sampling). Column 5, Lines 15-20 recite an equation to optimize the maximum likelihood objective over events in the training data “D”. Under broadest reasonable interpretation, an event acts as a boundary within which items are treated as jointly occurring, akin to a same context window. Column 5, Lines 33-35 recite the samples fed to the model can come from real training data set (positive samples are alert pairs that co-occur) or from data being generated artificially (negative samples), where the model is trained to classify them a posteriori. Column 6, Lines 50-57 recite negative sampling is dependent on its context (i.e., the observed event), where the procedure is, for each observed event e, an embodiment of the present invention first uniformly samples an entity type Ai, and then sample a new entity to replace ai and form a new negative sample e’ (negative samples are alert pirs that do not co-occur within the same context window).)
the negative samples being selected based on a frequency of occurrence;” (Column 6, Lines 35-45 recite one straight-forward choice of noise distribution is “context-independent” noise distribution, where a negative event is drawn independently and does not depend on the observed event. One can sample a negative event according to some factorized distribution on event space, where pAi(ai) is the probability of choosing entity ai of the type Ai (the negative samples being selected), which can be specified uniformly or computed by counting unigram in data (frequency of occurrence).)
It would have been obvious to a person having ordinary skill in the art (PHOSITA) before the effective filing date of the present application to implement the claims that utilized the teachings of Li and the teachings of Tang, which are both in the same field of invention. A PHOSITA would have been motivated to combine the alert grouping pipeline from Li with the frequency-based negative sampling technique from Tang in order to improve the embeddings from Li by producing more selective alert-vectors and more accurate similarity-based groupings through the frequency-weighted negative sampling technique.
With respect to Claims 2, 9, and 16:
Li and Tang combined teach:
“wherein the learning of the alert-vectors and the n-dimensional representation comprising learning, by the ML model, using co-occurrence patterns of the two or more associated alerts” (Paragraph 0032 from Li teaches the training of an ML model using historical alerts (repeated data) and the generation of embeddings that can be compared to each other in order to identify related alerts. Paragraph 0209 from Li teaches the existence of training datum that includes a series of alert texts obtained from historical alerts, meaning the ML model is trained on repeated data and embeddings, inherently capturing occurrence and co-occurrence patterns of the repeated data. Further, Paragraph 0141 from Li describes the ML model as being trained on historical correlations and co-occurrence of alerts to determine whether two alerts are related. It is inherently understood an embedding is an alert-vector representation and cosine similarity occurs in a continuous, multidimensional vector space (akin to an n-dimensional representation in a vector space).)
With respect to Claims 3, 10, and 17:
Li and Tang combined teach:
“wherein the two or more associated alerts are characterized by repeated, simultaneous appearance, indicating a significant correlation between the two or more associated alerts” (Paragraph 0027 from Li teaches a high number of alerts or incidents received within a period of time (time window) having related causes or symptoms. In this case, these repeated events appearing may be similar or correlated, in which case it would be beneficial to identify and group the related events.)
With respect to Claims 4, 11, and 18:
Li and Tang combined teach:
“wherein the alert-vectors are numerical representation of the two or more associated alerts, where n numerical values to represent the two or more associated alerts” (Paragraph 0141 from Li teaches a graph-based neural network, which is an ML model, trained to build a model that can obtain a numerical representation of each alert.)
With respect to Claims 5, 12, and 19:
Li and Tang combined teach:
“selecting the n numerical values by computing a cosine similarity of the two or more associated alerts to produce a large value when the two or more associated alerts are related” (Paragraph 0214 from Li teaches the application of an ML model to determine whether an embedding corresponding to the alert meets a similarity threshold. Paragraph 0138 from Li further clarifies “Any number of techniques can be used to vectorize the word vector, such as count vectorization…or other techniques… cosine similarities or cosine similarity is a metric used to measure the similarity between features of two items, documents, or the like, represented as feature vectors. The technique of cosine similarities measures the cosine of an angle between two vectors of data projected in multi-dimensional space. This measurement allows a measure the similarity of a document of any type, such as of the alerts disclosed herein.” A cosine similarity can be computed to measure the similarity between two or more alerts to produce a measurement value signaling similarity strength.)
With respect to Claims 6, 13, and 20:
Li and Tang combined teach:
“wherein the n-dimensional vector space comprises a vector in the space having n components and n axes representing the space” (Paragraph 0197 from Li teaches an example of a graph-based learning method that can learn latent representations of vertices in a graph that encode relations in a continuous vector space. Having n components and n axes representing the space is standard in describing a vector. “n” is just a symbol for describing a set number and the number of features (dimensions) in the vector.)
Claims 7 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Li, (U.S. Patent Application Publication No. US20240256951A1 filed on January 27, 2023), in view of Tang et al. (U.S. Patent Application Publication No. US10291483B2 filed on February 8, 2017, hereinafter “Tang”), in further view of Israel et al., (WO Patent Application Publication No. WO2021211212A1 with an earliest priority date of 4/17/2020, hereinafter “Israel”).
With respect to Claims 7 and 14:
Li and Tang combined do not appear to explicitly disclose:
“refreshing, by the ML model, the grouping of the repeated data when one or more associated alerts are detached from one or more incidents”
However, Israel teaches:
“refreshing, by the ML model, the grouping of the repeated data when one or more associated alerts are detached from one or more incidents” (Paragraph 0054 teaches the ability of an analyst (user) to perform at least one alert-incident grouping action, such as removing (detaching) an alert from an incident. Paragraph 0071 teaches an example of training the ML model based on data that explicitly groups alerts with incidents. Explicit grouping means an analyst (user) performed a custom action that identifies both an alert and an incident, such as detachment of the alert from the incident or “remove alert 456 from incident”. This means the ML model can be refreshed (trained) with updated groupings of repeated data when an analyst detaches one or more associated alerts from one or more incidents.)
It would have been obvious to a person having ordinary skill in the art (PHOSITA) before the effective filing date of the present application to implement Claims 7 and 14 that utilized the teachings of Li and Tang and the teachings of Israel, which are all in the same field of invention. A PHOSITA would have been motivated to modify the associated alert grouping system taught by Li with the frequency-based negative sampling technique from Tang, and additionally, the introduction of choice tuples from Israel in order to improve the trained model’s alert-vectors by teaching it to distinguish actual related alerts from alerts that resemble each other, which would produce more accurate incident grouping decisions.
Response to Arguments
Applicant’s arguments filed on August 4, 2026 have been fully considered, but the examiner believes that not all are fully persuasive.
Claim Rejections - 35 USC § 101
Applicant argues that the claims do not recite mathematical calculations or mental
processes under Step 2A, Prong 1.
In light of amended independent Claims 1, 8, and 15, a new 101 rejection has been established. Please see above. Regarding mathematical calculations, Applicant’s arguments have been considered, but are moot because the new ground of rejection does not recite the abstract idea as falling under mathematical calculations applied in the prior 101 rejection of record for any matter specifically challenged in the argument. Regarding mental processes, Examiner respectfully disagrees. Applicant relies on the specification’s description of the size and complexity of the training set from Paragraph 0023 to justify their reasoning instead of the size and complexity that is actually recited in the claim itself. Regarding the USPTO memorandum of August 4, 2025, the citation “[c]laim limitations that encompass AI in a way that cannot be practically performed in the human mind do not fall within [the mental process] grouping,” is directed to claim limitations that recite a specifical technical implementation or scale/size precluding mental processes, not to limitations that can be interpreted broadly and do not recite the particular scale/size.
B. Applicant argues that amended Claims 1, 8, and 15 reflects a technical improvement for Step 2A, Prong 2, reflecting a specific improvement to alert-management and incident-management technology.
Examiner respectfully disagrees and maintains the 101 rejection. See above. Firstly, examiner would like to point out that “It is important to note, the judicial exception alone cannot provide the improvement. The improvement can be provided by one or more additional elements. (MPEP 2106.05(a))”. In this case, applicant argues that the improvement lies in the amended claim, where the improved accuracy and performance of the ML model on new is a result of “the temporal-bucketing and negative-sampling training regime and the real-time grouping of alerts into a single incident—rather than by the cosine-similarity metric itself”. This limitation has been analyzed above as an abstract idea, therefore the improvement is currently being claimed as part of the judicial exception. It is important to keep in mind that an improvement in the abstract idea itself is not an improvement in technology and that the improvement needs to be provided by the one or additional elements.
C. Applicant argues that the claimed invention under Step 2B amounts to more than well-understood, routine, and conventional activity since the claimed approach is a specific form of grouping data that is not known in the art.
Examiner respectfully disagrees. The claimed combination of “temporal bucketing, alert-frequency-based negative sampling defining positive and negative samples, application of vector-similarity metrics, and real-time grouping into a single incident with threshold-based attachment” is known in the art, as taught by the detailed 103 rejections for Claims 1, 8, and 15 (see above). Therefore, the claimed invention under Step 2B does not amount to more than well-understood, routine, and conventional activity.
Claim Rejections - 35 USC § 103
Applicant argues that Li does not disclose the features of independent Claims 1, 8, and
15 and respectfully submits that independent Claims 1, 8, and 15 are patentably distinguishable over Li.
Applicant’s arguments have been considered, but are moot because the new ground of rejection does not rely solely on Li applied in the prior 103 rejection of record for any teaching or matter specifically challenged in the argument.
Applicant argues that the feature “ “grouping ... thereby ... improving accuracy and performance
of the ML model on new data,” and relied on assertion that a person of ordinary skill in the art would find it obvious because vector-embedding and cosine-similarity techniques are “commonly used to improve similarity detection within ML models across new data” is a conclusory statement that does not satisfy the requirement under KSR Int'l Co. v. Teleflex Inc. and MPEP 2143.
Applicant’s arguments have been considered, but are moot because the rejection has been revised to no longer rely on the assertion that vector-embedding and cosine-similarity techniques are "commonly used to improve similarity detection within ML models across new data." As set forth in the new rejection, the limitation is now treated under MPEP 2111.04(II) as reciting the intended result of process steps already taught by the combination of Li and Tang.
Applicant argues that neither Li nor Israel, whether taken alone or in combination, teaches or
suggests alert-frequency-based negative sampling recited in the independent claims from which Claims 7 and 14 depend on, therefore failing to render Claims 7 and 14 obvious.
Applicant’s arguments have been considered, but are moot because the new ground of rejection for independent Claims 1, 8, and 15 do not rely solely on Li nor Israel, taken alone or in combination, applied in the prior 103 rejection of record for any teaching or matter specifically challenged in the argument. Therefore, Claims 7 and 14 are rendered obvious.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Vibha Bhat whose telephone number is (571)-272-7091. The examiner can normally be reached on Monday – Thursday from 8:00 AM to 5:00 PM EST and every other Friday from 8:00 AM to 4:00 PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. See MPEP § 713.01. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at https://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Mariela Reyes, can be reached at telephone number (571)-270-1006. The fax phone number for the organization where this application or proceeding is assigned is (571)-273-8300. Information regarding the status of an application may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or (572)-272-1000.
/Vibha Bhat/Examiner
Art Unit 2142
/Mariela Reyes/Supervisory Patent Examiner, Art Unit 2142
