DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1 to 7, 13 to 14, 16 to 18, and 20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Moore et al. (U.S. Patent Publication 2021/0174253).
Regarding independent claims 1 and 16, Moore et al. discloses a method and computer program product for analysis of system log data using machine learning, comprising:
“extracting a first original numeric literal and a second original numeric literal from a log entry” – system 120 or device 101 may process multiple log messages (“a log entry”); a log message in a machine-generated log may include in addition to other data a message identifier, a timestamp, and text data describing the event that occurred (¶[0028]: Figure 1); anomaly detection system 200 may receive input log messages of a single machine-generated log that is generated by a single device/system (¶[0037]: Figure 2); machine-generated log messages are data-rich sources of information regarding system health; a log message may contain a timestamp, a prompt indicating the machine name, and a raw message content (¶[0038]: Figure 2); Table 2 illustrates a machine-generated log comprising Lines 1 to 5, with Line 1 including “a first original numeric literal” of ‘00000000’, ‘c0ab9bc0’, and ‘00000286’ and Line 2 including “a second original numeric literal” of ‘0x98’, and ‘0xb0’; here, “a numeric literal” can be integer, decimal, octal, hexadecimal, or binary; See, e.g., https://lean-lang.org/doc/reference/latest/Terms/Numeric-Literals/ or https://www.geeksforgeeks.org/c/literals-in-c-cpp-with-examples/;
“generating a first substitute numeric literal that represents the first original numeric literal and a second substitute numeric literal that represents the second original numeric literal” – context component 210 may extract all decimal and hexadecimal numbers for each message; because a format of each message may differ, a representation of numbers, and a count of numbers in messages may differ; to handle this inhomogeneity, context component 210 may use relational features to describe the numeric data in each message; context component 210 may include a count of the numeric values in the message, an average of the numeric values, and a standard deviation of the numerical value; the count of the numeric values in the message may represent the total number of decimal and hexadecimal values in the message; the average of the numerical values may be an average of the decimal and hexadecimal values; the standard deviation may be calculated based on the decimal and hexadecimal values in the message; Table 3 illustrates numerical features extracted from the log messages (¶[0044] - ¶]0046]: Table 3); Table 3 illustrates “a first substitute numeric literal” that represents “the first original numeric literal” of Table 2, e.g., Line 1 of Table 3 includes “a first substitute numeric literal” of ‘1’, ‘1,077,490,882’ and ‘1,866,268,393’, and Line 2 of Table 3 includes “a second substitute numeric literal” of ‘2’, ‘164’, and ’16,971’;
“wherein the first substitute numeric literal does not represent the second original numeric literal, and the log entry does not contain the first substitute numeric literal and the second substitute numeric literal” – here, “the first substitute numeric literal” of ‘1, ‘1,077,490,882’, and ‘1,866,268,393’ on Line 1 of Table 3 does not represent “the second original numeric literal” of ‘0x98’, and ‘0xb0’ of Line 2 of Table 2, but only represents “the first original numeric literal of ‘00000000’, ‘c0ab9bc0’, and ‘00000286’ on Line 1 of Table 2; Lines 1 and 2 of Table 2 can be construed as “the log entry”, and do not contain any of the “the first substitute numeric literal” of ‘1’, ‘1,077,490,882’, and ‘1,866,268,393’ on Line 1 of Table 3 or “the second substitute numeric literal” of ‘2’, ‘164’, and ’16,971’ on Line 2 of Table 3;
“generating a sequence of lexical tokens that represents the log entry and contains the first substitute numeric literal and the second substitute numeric literal, wherein the sequence of lexical tokens does not contain the first original numeric literal and the second original numeric literal” – context component 210 may store features/feature data corresponding to each input log message 205; feature data may include the determined numerical features; after extracting clusters on the textual data, and relational features on the numeric data, the two sets are combined to generate feature data for a message (¶[0047] - ¶[0048]: Figure 3A); here, “a sequence of lexical tokens that represents the log entry and contains the first substitute numeric literal and the second substitute numeric literal” is construed as some subset of the collection of Lines 1 to 5 of Table 3, e.g., Lines 1 and 2 of Table 3; that is, Table 3 presents “a sequence” of Lines 1 to 2 of Table 3; “the log entry does not contain the first original numeric literal and the second original numeric literal” because the entries Line 1 and Line 2 of Table 3 differ from the entries of Line 1 and Line 2 of Table 2; that is, “the sequence of lexical tokens does not contain the original numeric lexical tokens” because a count of tokens, an average of tokens, and a standard deviation of tokens replace original values of numeric tokens as illustrated in Figure 3A; ‘1’, ‘1,077,490,882’, and ‘1,866,268,393’ on Line 1 of Table 3 do not include any of the original numeric literals of ‘00000000 c0ab9bc0 00000286’ on Line 1 of Table 2, and ‘2’, ‘164’, and ’16,971’ on Line 2 of Table 3 do not include any of the original numeric literals of ‘0x98’ or ‘0xb0’ of Line 2 of Table 2;
“generating, by a machine learning model and based on the sequence of lexical tokens that represents the log entry and contains the first substitute numeric literal and the second substitute numeric literal, an inference that characterizes the log entry” – machine-generated logs are processed and analyzed using machine learning models to determine whether a log message is anomalous (Abstract); a machine-learning model may be configured to determine if a log message includes data (text and numbers) that appear to be an anomaly (¶[0021]); system 120 or device 101 may process a first log message using a selected machine learning model to determine model data; system 120 or device 101 may determine that the first log message is anomalous based at least in part on the model data (¶[0030] - ¶[0031]: Figure 1: Steps 134 and 136); here, determining by a machine learning model from an original message and features extracted from the message if a message is anomalous or not anomalous is “generating, by a machine learning model . . . an inference that characterizes the log entry.”
Regarding claims 2 and 17, Moore et al. discloses that Table 3 illustrates “generating the first a substitute numeric literal” of 1,077,480,882’ and “a third substitute numeric literal” of ‘1,866,268,393’ on Line 1 of Table 3 that together represent “the first original numeric literal” of Line 1 of Table 2 including original numeric literals of ‘00000000’, ‘c0ab9bc0’, ‘00000286’ (¶[0044] - ¶]0046]: Tables 2 and 3); here, ‘00000000 c0ab9bc0 00000286’ can be construed as “the first original numeric literal”, and ‘1’, ‘1,077,490,882’, and ‘1,866,268,393’ can be construed to comprise “the first substitute numeric literal” and “a third substitute numeric literal that together represent the first original numeric literal”; that is, a count of numerical values (‘1’), an average of numeric values (1,077,490,882’), and a standard deviation of numeric values (‘1,866,268,393’) are three ‘substitute numeric literals’ that represent an original numeric literal of ‘00000000 c0ab9bc0 00000286’.
Regarding claim 3, Moore et al. discloses “the first substitute numeric literal” of ‘1,077,490,882’, and “the third substitute numeric literal” of ‘1,866,268,393’ (¶[0044] - ¶]0046]: Tables 2 and 3); both ‘1,077,490,882’ and‘1,866,268,393’ are ten digit numeric literals that have “identical numeric ranges” between 1,000,000,000 and 2,000,000,000.
Regarding claim 4, Moore et al. discloses “the first substitute numeric literal” of ‘1,077,490,882’ is calculated as an average, and “the third substitute numeric literal” of ‘1,866,268,393’ is calculated as a standard deviation (¶[0044] - ¶]0046]: Tables 2 and 3); here, calculating an average and calculating a standard deviation are “distinct respective logics”; that is, an average and a standard deviation are calculated by different algorithms.
Regarding claim 5, Moore et al. discloses at least one embodiment of “only one of the first original numeric literal and the third substitute numeric literal exceeds one” in Tables 2 and 3; Line 5 includes “the first original numeric literal of 5 which exceeds one in Table 2, but “the third substitute numeric literal” of standard deviation is ‘0’ on Line 5 of Table 3 (¶[0044] - ¶]0046]: Tables 2 and 3).
Regarding claims 6 and 18, Moore et al. discloses “wherein the log entry contains a third original numeric literal that contains a concatenation of the first original numeric literal and a fourth original numeric literal” for an original numeric literal of ‘00000000 c0ab9bc0 00000286’ in Line 1 of Table 2 (¶[0044] - ¶]0046]: Tables 2 and 3); here, ‘00000000 c0ab9bc0 00000286’ can be construed as “a third original numeric literal that contains a concatenation of the first original numeric literal” of ‘00000000’ and “a fourth original numeric literal” of ‘00000286’.
Regarding claim 7, Moore et al. discloses an original numeric lexical token of ‘00000000’and ‘00000286’ in Line 1 of Table 2 (¶[0044] - ¶]0046]: Tables 2 and 3); this lexical token is a concatenation of sixteen individual lexical tokens; here, sixteen tokens is “at least six numeric lexical tokens”; broadly, a given line of an original message could include an arbitrary number of numeric lexical tokens including more than six numeric lexical tokens, and the five lines of code collectively include at least six numeric lexical tokens in Tables 2 and 3.
Regarding claims 13 and 20, Moore et al. discloses “wherein the sequence of lexical tokens contains more numeric lexical tokens than non-numeric lexical tokens” because all of the tokens are numeric in Table 3; here, “the sequence of lexical tokens” is defined by the independent claims to include “the first substitute literal and the second substitute literal”, and “the sequence” is all of the substitute literals in Lines 1 to 5 of Table 3; given that there are no non-numeric tokens in Table 3, then there are “more numeric lexical tokens than non-numeric lexical tokens.”
Regarding claim 14, Moore et al. discloses “the first original numeric literal” on Line 3 of Table 2 with a value ‘0.96’ having a numeric precision to two decimal places, but a corresponding “the first substitute numeric literal” of Line 3 of Table 3 can be ‘1’ or ‘0’ that does not include any decimal place precision. (¶[0044] - ¶]0046]: Tables 2 and 3) That is, ‘0.96’ and ‘1’ have “distinct respective numeric precisions.”
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 10 to 11, 19, and 22 are rejected under 35 U.S.C. 103 as being unpatentable over Moore et al. (U.S. Patent Publication 2021/0174253) in view of Pajak (U.S. Patent Publication 2021/0286947).
Concerning claims 10 and 19, Moore et al. discloses the limitation of “a count of in the sequence of lexical tokens depends on a count of values in the log entry” because counting more lines of a log entry of Table 2 implies that there more values that are counted in Table 3. (¶[0044] - ¶]0046]: Tables 2 to 3) Applicants’ “a count of lexical tokens in the sequence of lexical tokens” is a new limitation and can be construed as all of the numeric tokens in Lines 1 to 5 of Table 3. Here, “the sequence of lexical tokens” is defined by the independent claims to include at least “the first substitute numeric literal” and “the second substitute numeric literal”, so that “a count of the lexical tokens in the sequence of lexical tokens” is just a count of the number of tokens in “the first substitute numeric literal” and “the second substitute numeric literal”, which are “values in the log entry”.
Concerning claims 10 and 19, Moore et al. does not expressly disclose “the inference is a fixed-sized encoding that represents the log entry”. However, Pajak teaches that tokens are represented as embeddings of fixed length by passing text 74 through a word embedding model. Pre-processing circuit 64 represents each of the numerical values in array 76 as a respective fixed length vector 86. (¶[0051] - ¶[0057]: Figure 5) Neural network 114 is trained to determine whether a value for a parameter is normal or abnormal. (¶[0088] and ¶[0092]: Figure 8) Here, “the inference . . . that represents the log entry” is whether a value for a parameter is normal or abnormal. Pajak teaches text processing in machine learning with pre-processing of text data for inputting into a trained model including receiving a set of text data that includes numerical information, wherein a first subset of the plurality of tokens comprises tokens that do not comprise numerical information and a second subset of the plurality of tokens comprises tokens that comprise respective numerical information, and each token in the second subset is assigned a respective numerical vector in dependence on the numerical information in the token. (Abstract) Pre-processing circuitry 64 assigns a value of that number as the numerical value for the token for each token that comprises a number. Here, Figure 5 illustrates that a numerical value of ‘22’ is represented as a fixed length vector of ‘2.2’ and ‘1’ and a numerical value of ‘107’ is represented as a fixed length vector of ‘1.07’ and ‘2’. An objective is to deal with numbers when embedding for numbers that are not frequent enough to have a learned embedding. (¶[0018] - ¶[0020]) It would have been obvious to one having ordinary skill in the art to encode a log entry of Moore et al. with fixed size encodings as taught by Pajak for a purpose of representing numbers for machine learning embeddings that are not frequent enough to have a learned embedding.
Concerning claims 11 and 22, Moore et al. discloses machine-generated logs that include text data describing and/or relating to events that occur during processing by the computing system. A machine-generated log may include a process tag identifying a type of process/event that occurred. (¶[0023]) A log message may may contain a prompt indicating a machine name. (¶[0038]) Textual tokens clustered in a machine-readable log include ‘read’, ‘process’, ‘call’, ‘create’, ‘send’, etc. (¶[0043]: Table 1) Broadly, computer program processes to ‘read’, ‘call’, ‘create’, and ‘send’ are “an execution of a database statement” (“wherein the log entry represents an execution of a database statement”). Similarly, a prompt in machine learning represents “an execution of a database statement.”
Allowable Subject Matter
Claims 8 to 9, 12, 15, and 21 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Response to Arguments
Applicants’ arguments filed 26 January 2026 have been fully considered but they are not persuasive.
Applicants provide various claim amendments, and present arguments traversing the rejection of independent claims 1 and 16 as being anticipated under 35 U.S.C. §102(a)(1) by Moore et al. (U.S. Patent Publication 2021/0174253), and the rejection of claims 10 and 19 as being obvious under 35 U.S.C. §103 over Moore et al. (U.S. Patent Publication 2021/0174253) in view of Pajak (U.S. Patent Publication 2021/0286947). Applicants argue that Moore et al. does not anticipate the limitation of “the first substitute numeric literal does not represent the second original numeric literal”, and maintain that the reference is “a disavowal” of the claimed “represents the original numeric literal” because the reference states that the features are agnostic to the particular formatting of the message. Applicants cite “an express purpose” and “principle of operation”, and argue that the combination is improper because a proposed modification cannot render the prior art unsatisfactory for the intended purpose or change the principle of operation.
Applicants’ arguments are not persuasive and the rejection is being revised and maintained to address the amendments. Mainly, Applicants’ argument that Moore et al. fails to disclose the limitation of “the first substitute numeric literal does not represent the second original numeric literal” is not persuasive because a first substitute numeric literal represented by, e.g., Line 1 of Table 3 only represents a corresponding Line 1 of Table 2, and does not represent “the second original numeric literal” of Line 2 of Table 2. That is, given any of the ‘substitute’ numeric literals of a given line of Table 3, this ‘substitute’ numeric literal only represents a corresponding ‘original’ numeric literal of the same line of Table 2, and does not represent any of the remaining different lines of Table 2.
Moreover, Applicants’ citation of ¶[0044] of Moore et al., “This makes the features agnostic to the particular formatting of the message” is not relevant to the rejection. This statement only relates to the formatting of the original numeric values in the message and is not relevant to any of the claim limitations. Applicants simply appear to be citing a peripheral statement in the prior art out of context. Consequently, this statement about formatting of the message in Moore et al. does not amount to a ’disavowal’ of a substitute numeric value representing an original numeric value as argued by Applicants.
Generally, the examiner maintains that Tables 2 and 3 of Moore et al. disclose a variety of original numeric literals and substitute numeric literals in Lines 1 to 5, and any given pair of lines in Table 2 could be construed as “a first original numeric literal” and “a second original numeric literal”, and any corresponding pair of lines in Table 3 could be construed as “a first substitute numeric literal” and “a second substitute numeric literal”. Moore et al. can be construed to disclose at least one embodiment that meets the limitations of the claims from the various pairs of lines of Tables 2 and 3. Consequently, Applicants’ limitation of “wherein the sequence of lexical tokens that represents the log entry does not contain the first original numeric literal and the second original numeric literal” is met by Lines 1 and 2 of Tables 2 and 3 because none of ‘3’, ‘1,077,490,882’, ‘1,866,268,393’, ‘2’, ‘164’, and ’16,971’ of Lines 1 to 2 of Table 3 (“the sequence of lexical tokens that represents the log entry”) contains any of ‘0000000’, ‘c0ab9bc0’, ‘00000286’, ‘0x98’, and ‘0xb0’ (“the first original numeric literal and the second original numerical literal”) of Lines 1 to 2 of Table 2.
Correspondingly, Applicants’ limitations of their dependent claims could similarity be construed as disclosed by Moore et al. Applicants’ “third substitute numeric literal” could be construed as a standard deviation numeric literal in a third column of any line of Table 3, as there is nothing in the claim language that requires “a third substitute numeric literal” must correspond to its own line on Table 3. Applicants’ “fourth original numeric literal” could be construed as an additional numeric literal of a plurality of numeric literals on any line of Table 2, e.g., ‘00000286’ or ‘5’, and does not require correspondence to its own line.
Applicants’ traversal based on “ii) an express purpose and iii) a principle of operation does not appear to provide any relevant considerations for an anticipation rejection under 35 U.S.C. §102(a)(1). Nor does their cited case law of Richardson v. Suzuki Co., 868 F.2d 1226, appear to have any relevance to in the present circumstance of an anticipation rejection, as that case was directed to whether a jury instruction was correct to consider equivalents in a patent validity determination.
The obviousness rejection under 35 U.S.C. §103 over Moore et al. (U.S. Patent Publication 2021/0174253) in view of Pajak (U.S. Patent Publication 2021/0286947) is maintained to be proper under a rationale of KSR Int'l Co. v. Teleflex Inc., 550 U.S. 398, 415-421, 82 USPQ2d 1385, 1395-97 (2007): (C) Use of known technique to improve similar devices (methods, or products) in the same way. Here, Moore et al. and Pajak are both directed to performing machine learning on tokens that are numbers, and the only element omitted by Moore et al. is “a fixed length encoding” of these numbers. However, fixed length coding is a known technique in machine learning as taught by Pajak, and it could be used to improve a similar device of Moore et al. in the same way. Additionally, there is nothing that would render fixed length encoding unsatisfactory for its intended purpose of encoding tokens that are numbers or that would change the principle of operation because fixed length vector embedding is a common feature of machine learning so that the encoded tokens can be easily compared in a higher-dimensional space. Moore et al. is directed to analyzing log data by machine learning to determine if numerical values are anomalous, and Pajak similarly is directed to analyzing numeric values by machine learning to determine if they are abnormal.
Applicants’ arguments are not persuasive. There are no new grounds of rejection. This Office Action is NON-FINAL.
Conclusion
The prior art made of record and not relied upon is considered pertinent to Applicants’ disclosure.
Reddekopp et al., Bhatia et al., and Bang et al. disclose related prior art patent publications.
Moghaddam et al. (“Anomaly Detection . . .”) and Moghaddam et al. (“ExPAD: An Explainable . . .”) disclose related non-patent literature.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MARTIN LERNER whose telephone number is (571) 272-7608. The examiner can normally be reached Monday-Thursday 8:30 AM-6:00 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Richemond Dorvil can be reached at (571) 272-7602. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MARTIN LERNER/Primary Examiner
Art Unit 2658
March 13, 2026