Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This action is in response to the application filed on 06/30/2023, in which claims 1-20 are presented for the examination.
Information Disclosure Statement
The Information Disclosure Statement (IDS) submitted on 06/30/2023 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the IDS statement is being considered by the examiner.
Drawings
The drawings filed on 06/30/2023 are accepted by the examiner.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-6, 9, 13-14, 16, 18-19 are rejected under 35 U.S.C. 103 as being unpatentable over Broyles (US 7,752,013) in view of Bean et al. (US 2023/0068909, referred herein after Bean).
As per claim 1, 13, 18, Broyles discloses a computer-implemented method comprising: establishing a system behavior database based at least in part on behavior data received from a system, wherein the system behavior database comprises a set of historical observations of behavior of the system (Fig. 2, step 202, Col. 4, lines 30-45, automatically determining that the server exhibited aberrant characteristics during a time horizon, where those characteristics vary from some historical characteristics of a corresponding time horizon);
sampling current behavior data from the system (Col. 4, lines 46-56, current performance data is gathered from servers 112 and stored in database 116);
generating a current observation based on the current behavior data that was sampled (Col. 5, lines 1-16, performance data gathered from a server);
comparing the current observation to a subset of the set of historical observations of the set of historical observations to determine a divergence between the current observation and the subset of historical observation (Col. 5, lines 1-16, These comparison values are what can be compared to historical averages or benchmarks. The benchmark values are historical values that are associated with the server and with the corresponding time horizons);
comparing the divergence to a divergence threshold; and upon a determination that the divergence exceeds the divergence threshold: detecting an anomaly in the system (Fig. 2, step 206, Col. 4, lines 62- Col. 5, lines 1-16, a step 206, where each server with a relative performance-variance value that exceeds some given threshold value is automatically identified without user intervention, Col. 8, lines 12-19, Aberrant behavior (considered as an claimed anomaly) “refers to actions or patterns of conduct that deviate significantly from what is expected in a given context”);
updating the set of historical observations to include the current observation as a new historical observation; and (Fig. 5, Col. 7, lines 10-33, current performance data associated with server would be gathered for a certain time frame, and be included in the set of historical observations as shown in Fig. 5);
Broyles does not specifically disclose performing a responsive action within the system based on the anomaly that was detected;
However, Bean discloses performing a responsive action within the system based on the anomaly that was detected ([0054], [0055], System security policies 114 and corrective actions 310 in response to anomalous behavior may be defined by the event monitor 112 (e.g., responsive actions may be defined for specific errors, or may be based in template policies associated with the applied best-fit system template 202m) and may be further based on a variety of factors including, but not limited to, the degree of divergence from the optimal outcome set 216a);
Therefore it would have been obvious to the one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate teaching of Bean’s method for neural network based detection of a cyber intrusion into Broyles’ method for determining aberrant server variance because one of the ordinary skill in the art would have been motivated to provide real-time monitoring, intelligent correlation, and automated workflows to quickly address issues before they escalate.
As per claim 2, 16, 19, Broyles discloses the computer-implemented method of claim 1, further comprising detecting a correlation pattern between two or more monitored variables of the set of historical observations, and upon a determination that the current observation comprises the two or more variables out-of- correlation with respect to each other, detecting an anomaly in the system (Col. 4, lines 29-56, historical values of different characteristics are gathered and if threshold exceeds, fault is detected, Col. 6, lines 40-53, Col. 7, lines 10-22, CPU utilization and performance data).
As per claim 3, Broyles discloses the computer-implemented method of claim 1, wherein performing the responsive action comprises generating an anomaly detection report to display on an interface (Fig. 4, Col. 1, lines 53-60).
As per claim 4, Bean discloses the computer-implemented method of claim 1, wherein the system is a computer system, and wherein performing the responsive action comprises isolating a section of the computer system based on the anomaly that was detected ([0014], [0054], isolating an interface associated with abnormal or anomalous behavior from the protected system).
As per claim 5, Bean discloses the computer-implemented method of claim 1, wherein the system is a computer system, and wherein performing the responsive action comprises activating a redundant component to handle a portion of operations performed over the computer system ([0014], [0015], [0011]).
As per claim 6, Bean discloses the computer-implemented method of claim 1, wherein the system is a computer system, and wherein performing the responsive action comprises reconfiguring a component of the computer system to restore the computer system to normal operation ([0014], [0054], isolating performed as responsive action and considered as reconfiguration action).
As per claim 9, Broyles discloses the computer-implemented method of claim 1, wherein sampling the current behavior data from the system comprises collecting one or more samples of system behavior data over a period of time (Col. 5, lines 1-16, sample data are gathered within the specific time horizon).
As per claim 14, Broyles discloses the computer program product of claim 13, wherein the stored program instructions are stored in a computer readable storage device in a data processing system, and wherein the stored program instructions are transferred over a network from a remote data processing system (Fig. 1, network 114, Col. 3, lines 22-30).
Claims 7-8, 10-11, 17, 20 are rejected under 35 U.S.C. 103 as being unpatentable over Broyles and Bean further in view of Martin et al. (US 9,946,465, referred herein after Martin).
As per claim 7, neither Broyles nor Bean discloses the computer-implemented method of claim 1, wherein the system is a computer system, and wherein performing the responsive action comprises allocating computer resources to evenly distribute a workload across the computer system;
However, Martin discloses the system is a computer system, and wherein performing the responsive action comprises allocating computer resources to evenly distribute a workload across the computer system (Col. 13, lines 32-61, Col. 36, lines 56-67, evenly distributing workload);
Therefore it would have been obvious to the one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate teaching of Martin’s adaptive learning techniques for determining expected service levels into Bean’s method for neural network based detection of a cyber intrusion and Broyles’ method for determining aberrant server variance because one of the ordinary skill in the art would have been motivated to make their overall processing more efficient.
As per claim 8, neither Broyles nor Bean discloses the computer-implemented method of claim 1, wherein each historical observation and the current observation comprise a probability distribution of a value of a variable associated with system behavior;
However, Martin discloses each historical observation and the current observation comprise a probability distribution of a value of a variable associated with system behavior (Fig. 14, histogram, Col. 72, lines 9-62, probability distribution of a variable);
Therefore it would have been obvious to the one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate teaching of Martin’s adaptive learning techniques for determining expected service levels into Bean’s method for neural network based detection of a cyber intrusion and Broyles’ method for determining aberrant server variance because one of the ordinary skill in the art would have been motivated to make their overall processing more efficient.
As per claim 10, 17, 20, neither Broyles nor Bean discloses the computer-implemented method of claim 1, further comprising allocating a portion of memory to store the current observation and each historical observation and partitioning each portion of memory into a plurality of bins, wherein each bin of the plurality of bins corresponds to a percentage of data samples that fall within a particular range of values;
However, Martin discloses allocating a portion of memory to store the current observation and each historical observation and partitioning each portion of memory into a plurality of bins, wherein each bin of the plurality of bins corresponds to a percentage of data samples that fall within a particular range of values (Fig. 14, Col. 41, lines 61-67, Col. 42, lines 1-7, memory partitioned in plurality of bins which corresponds to a number (frequency) of data portions);
Therefore it would have been obvious to the one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate teaching of Martin’s adaptive learning techniques for determining expected service levels into Bean’s method for neural network based detection of a cyber intrusion and Broyles’ method for determining aberrant server variance because one of the ordinary skill in the art would have been motivated to make their overall processing more efficient.
As per claim 11, Martin discloses the computer-implemented method of claim 10, further comprising expanding each bin of the plurality of bins upon sampling data that is outside of the particular range of values (Col. 73, lines 25-33).
Claims 12 are rejected under 35 U.S.C. 103 as being unpatentable over Broyles and Bean further in view of Bize-Forest et al. (US 11,814,931, referred herein after Bize-Forest).
As per claim 12, neither Broyles nor Bean discloses the computer-implemented method of claim 10, further comprising constructing a missing data sample bin that corresponds to a percentage of missing data samples;
However, Bize-Forest discloses constructing a missing data sample bin that corresponds to a percentage of missing data samples (Col. 6, lines 46-61, Col. 11, lines 29-37, The missing data handling may comprise discarding absent values representing less than a predetermined percentage of the data);
Therefore it would have been obvious to the one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate teaching of Bize-Forest’s supervised leaning methods to predict depositional facies in cores into Martin’s adaptive learning techniques for determining expected service levels, Bean’s method for neural network based detection of a cyber intrusion and Broyles’ method for determining aberrant server variance because one of the ordinary skill in the art would have been motivated to make their overall processing more efficient.
Claims 12 are rejected under 35 U.S.C. 103 as being unpatentable over Broyles and Bean further in view of Cropper et al. (US 2017/0024257, referred herein after Cropper).
As per claim 15, neither Broyles nor Bean discloses the computer program product of claim 13, wherein the stored program instructions are stored in a computer readable storage device in a server data processing system, and wherein the stored program instructions are downloaded in response to a request over a network to a remote data processing system for use in a computer readable storage device associated with the remote data processing system, further comprising: program instructions to meter use of the program instructions associated with the request; and program instructions to generate an invoice based on the metered use;
However, Cropper discloses program instructions to meter use of the program instructions associated with the request; and program instructions to generate an invoice based on the metered use (Fig. 4, step 491, [0060], meter use for shred pool of resources usage);
Therefore it would have been obvious to the one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate teaching Cropper’s method of managing a shared pool of configured resources into Bean’s method for neural network based detection of a cyber intrusion and Broyles’ method for determining aberrant server variance because one of the ordinary skill in the art would have been motivated to capture revenue from high-usage customers without low-usage ones and automates entire billing cycle.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See form 892.
Heikkila teaches a method relates to analysis of measurement results and more particularly to performing measurement result analysis by using anomaly detection and identification of anomalous variables.
Altman teaches a method for dynamically and adaptively monitoring a system based on its running behavior adjusts monitoring levels of the monitored application in real-time.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KAMINI B PATEL whose telephone number is (571)270-3902. The examiner can normally be reached on M-F 8-4:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ashish Thomas can be reached on 571-272-0631. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KAMINI B PATEL/Primary Examiner, Art Unit 2114
Prosecution Insights