Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Election/Restrictions
Applicant's election with traverse of claims 2-11 in the reply filed on 08/17/2026 is acknowledged.
Applicant’s amendments altered the scope of the claims to obviate the restriction requirement. It is withdrawn.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Claim 1
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 1 is drawn to a system.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 1 recites the following abstract ideas:
“generate, for each pair of a set of pairs of the event sequence and a respective query token of the set of query tokens, a set of probabilities of future events” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
“based on the first query token being associated with the first probability of the target event that satisfies the threshold probability, marking a first event associated with the first query token for monitoring” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 1 recites the following additional elements:
“a system for determining events for monitoring for cyber security incidents by using a language model to simulate future events and identifying alert-worthy events based on the simulations” This constitutes adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp.,573 U.S. at 225-26, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)).
“one or more processors programmed with instructions that, when executed by the one or more processors, cause operations” This constitutes adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp.,573 U.S. at 225-26, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)).
“obtaining a large language model trained to predict an event performed by a user, the large language model having been trained on a dataset comprising event sequences, wherein a second event of the event sequences indicates a probability that an earlier first event comprised a cybersecurity incident” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
“obtaining a set of query tokens, wherein each query token of the set of query tokens is usable as a seed event for the large language model, and wherein each query token of the set of query tokens is of the same query token type” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
“inputting an event sequence and the set of query tokens into the large language model” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
“inputting the event sequence comprises inputting the event sequence into the large language model multiple times such that a different query token of the set of query tokens is inputted into the large language model each time of the multiple times” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
“obtaining a first query token, of the set of query tokens associated with a first probability of a target event that (i) satisfies a threshold probability and (ii) is derived for the first query token from the set of probabilities of future events” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 1 recites the following additional elements:
“a system for determining events for monitoring for cyber security incidents by using a language model to simulate future events and identifying alert-worthy events based on the simulations” This constitutes adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp.,573 U.S. at 225-26, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)).
“one or more processors programmed with instructions that, when executed by the one or more processors, cause operations” This constitutes adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp.,573 U.S. at 225-26, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)).
“obtaining a large language model trained to predict an event performed by a user, the large language model having been trained on a dataset comprising event sequences, wherein a second event of the event sequences indicates a probability that an earlier first event comprised a cybersecurity incident” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
“obtaining a set of query tokens, wherein each query token of the set of query tokens is usable as a seed event for the large language model, and wherein each query token of the set of query tokens is of the same query token type” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
“inputting an event sequence and the set of query tokens into the large language model” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
“inputting the event sequence comprises inputting the event sequence into the large language model multiple times such that a different query token of the set of query tokens is inputted into the large language model each time of the multiple times” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
“obtaining a first query token, of the set of query tokens associated with a first probability of a target event that (i) satisfies a threshold probability and (ii) is derived for the first query token from the set of probabilities of future events” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
Claim 2
Claim 2 is ineligible for the same reasons as claim 1, mutatis mutandis.
Claim 3
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 3 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 3 recites the following abstract ideas:
The abstract ideas of claim 2.
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 3 recites the following additional elements:
“inputting the event sequence and the set of query tokens into the machine learning model comprises inputting the event sequence into the machine learning model multiple times, the event sequence being inputted into the machine learning model with a different query token of the set of query tokens each time of the multiple times” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 3 recites the following additional elements:
“inputting the event sequence and the set of query tokens into the machine learning model comprises inputting the event sequence into the machine learning model multiple times, the event sequence being inputted into the machine learning model with a different query token of the set of query tokens each time of the multiple times” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data
Claim 4
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 4 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 4 recites the following abstract ideas:
The abstract ideas of claim 2.
“sorting the set of query tokens based on corresponding probabilities of the target event, wherein the first query token in the sorted set of query tokens is associated with a higher probability of the target event occurring than a second query token” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 4 recites the following additional elements:
“based on the sorting, obtaining the first query token” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 4 recites the following additional elements:
“based on the sorting, obtaining the first query token” - This amounts to insignificant extra solution activity in the form of mere data gathering, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (i), regarding receiving or transmitting data.
Claim 5
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 5 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 5 recites the following abstract ideas:
The abstract ideas of claim 2.
“generating, based on the set of probabilities and the set of query tokens, monitoring rules for events” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 5 recites the following additional elements:
“causing a computing system to monitor based on the monitoring rules” - This constitutes adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp.,573 U.S. at 225-26, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)).
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 5 recites the following additional elements:
“causing a computing system to monitor based on the monitoring rules” - This constitutes adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp.,573 U.S. at 225-26, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)).
Claim 6
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 6 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 6 recites the following abstract ideas:
The abstract ideas of claim 2.
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 6 recites the following additional elements:
“generating a user interface comprising an indication of the first query token and the event sequence; and causing display of the user interface” - This constitutes adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp.,573 U.S. at 225-26, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)).
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 6 recites the following additional elements:
“generating a user interface comprising an indication of the first query token and the event sequence; and causing display of the user interface” - This constitutes adding the words "apply it" (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, e.g., a limitation indicating that a particular function such as creating and maintaining electronic records is performed by a computer, as discussed in Alice Corp.,573 U.S. at 225-26, 110 USPQ2d at 1984 (see MPEP § 2106.05(f)).
Claim 7
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 7 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 7 recites the following abstract ideas:
The abstract ideas of claim 2.
“determining, based on the set of probabilities of future events, that the target event has greater than a given threshold probability of occurring; and based on the target event having greater than the given threshold probability of occurring, generating a first classification for a historical event in the event sequence” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 7 does not recite additional elements.
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 7 does not recite additional elements.
Claim 8
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 8 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 8 recites the following abstract ideas:
The abstract ideas of claim 7.
“based on the second user performing an event that matches the historical event, generating an alert message” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 8 recites the following additional elements:
“based on identifying a second user having a second event sequence that matches a portion of the event sequence, storing an indication of the historical event, wherein the portion of the event sequence does not include the historical event” - This amounts to insignificant extra solution activity in the form of mere data storage, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (iv), regarding storing and retrieving information in memory.
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 8 recites the following additional elements:
“based on identifying a second user having a second event sequence that matches a portion of the event sequence, storing an indication of the historical event, wherein the portion of the event sequence does not include the historical event” - This amounts to insignificant extra solution activity in the form of mere data storage, see MPEP 2106.05(g) and MPEP 2106.05(d), II, (iv), regarding storing and retrieving information in memory.
Claim 9
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 9 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 9 recites the following abstract ideas:
The abstract ideas of claim 2.
“generating the set of probabilities of future events comprises generating, for each combination of the event sequence and the respective query token, a plurality of probability vectors, each probability vector corresponding to a different future time step; obtaining the first query token comprises extracting, from the plurality of probability vectors generated for the first query token, probability values corresponding to the target event across a threshold number of future time steps; and the first probability of the target event comprises an average of the probability values corresponding to the target event across the threshold number of future time steps.” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 9 does not recite additional elements.
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 9 does not recite additional elements.
Claim 10
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 10 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 10 recites the following abstract ideas:
The abstract ideas of claim 2.
“wherein a second event of the event sequences in the dataset indicates a probability that an earlier first event of the event sequences comprised a cybersecurity incident” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 10 does not recite additional elements.
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 10 does not recite additional elements.
Claim 11
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
Yes. Claim 11 is drawn to a process.
Step 2A, Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes. Claim 11 recites the following abstract ideas:
The abstract ideas of claim 2.
“determining, for each query token in the set of query tokens and based on the set of probabilities of future events, a given probability of the target event” - This constitutes a concept performed in the human mind, such as an observation, evaluation, judgement, and/or opinion. Furthermore, the courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011). See MPEP 2106.04(a)(2).
Step 2A, Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. Claim 11 does not recite additional elements.
Step 2B: Does the claim recite additional elements that amount ot significantly more than the judicial exception?
No. Claim 11 does not recite additional elements.
Claims 12-20
Claims 12-20 are ineligible for the same reasons as claims 1-11, mutatis mutandis.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 1 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claim 1, “a large language model” renders the claim indefinite because it is unclear what constitutes a language model as “large”, i.e. what threshold the language model must pass in order to be considered “large” rather than “not large”.
Regarding claim 1, “a large language model” renders the claim indefinite because it is unclear if it claims antecedence to or is related to the language model claimed in the preamble.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 2-7 and 10-11 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Guo (Guo, Haixuan, Shuhan Yuan, and Xintao Wu. "Logbert: Log anomaly detection via bert." 2021 international joint conference on neural networks (IJCNN). IEEE, 2021., arXiv:2103.04475v1).
Regarding claim 2, Guo teaches a method comprising:
obtaining a machine learning model trained to predict an event, the machine learning model having been trained on a dataset comprising event sequences (§3.3, “After training, we can deploy LogBERT [obtaining a machine learning model] for anomalous log sequence detection [trained to predict an event]. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences [the machine learning model having been trained on a dataset comprising event sequences], it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”);
obtaining a set of query tokens, wherein each query token of the set of query tokens is usable as a seed event for the machine learning model (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens [obtaining a set of query tokens] and use the randomly-masked log sequence as an input to LogBERT [each query token of the set of query tokens is usable as a seed event for the machine learning model]. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”);
inputting an event sequence and the set of query tokens into the machine learning model to generate, for each combination of a set of combinations of the event sequence and a respective query token of the set of query tokens, a set of probabilities of future events (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token [inputting an event sequence and the set of query tokens into the machine learning model to generate, for each combination of a set of combinations of the event sequence and a respective query token of the set of query tokens]. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi] [a set of probabilities of future events]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”);
obtaining a first query token, of the set of query tokens, associated with a first probability of a target event that satisfies a threshold probability (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT [obtaining a first query token, of the set of query tokens, associated with a first probability of a target event that satisfies a threshold probability], we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”); and
based on the first query token being associated with the first probability of the target event that satisfies the threshold probability, marking a first event associated with the first query token for monitoring (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous [based on the first query token being associated with the first probability of the target event that satisfies the threshold probability, marking a first event associated with the first query token for monitoring]. Both g and r are hyper-parameters and will be tuned based on a validation set.”).
Regarding claim 3, Guo teaches all of the limitations of claim 2, wherein inputting the event sequence and the set of query tokens into the machine learning model comprises
inputting the event sequence into the machine learning model multiple times, the event sequence being inputted into the machine learning model with a different query token of the set of query tokens each time of the multiple times (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi] [inputting the event sequence into the machine learning model multiple times, the event sequence being inputted into the machine learning model with a different query token of the set of query tokens each time of the multiple times]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”).
Regarding claim 4, Guo teaches the method of claim 2, wherein obtaining the first query token comprises:
sorting the set of query tokens based on corresponding probabilities of the target event, wherein the first query token in the sorted set of query tokens is associated with a higher probability of the target event occurring than a second query token; and, based on the sorting, obtaining the first query token (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi] [sorting the set of query tokens based on corresponding probabilities of the target event]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous [wherein the first query token in the sorted set of query tokens is associated with a higher probability of the target event occurring than a second query token; and, based on the sorting, obtaining the first query token]. Both g and r are hyper-parameters and will be tuned based on a validation set.”)
Regarding claim 5, Guo teaches the method of claim 2, further comprising:
generating, based on the set of probabilities and the set of query tokens, monitoring rules for events; and causing a computing system to monitor based on the monitoring rules (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi] . If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous [generating, based on the set of probabilities and the set of query tokens, monitoring rules for events; and causing a computing system to monitor based on the monitoring rules]. Both g and r are hyper-parameters and will be tuned based on a validation set.” – The rules are based on the probabilities for the query tokens and decisions are made based on the rules by a system which can be considered a computing system)
Regarding claim 6, Guo teaches the method of claim 2, further comprising:
generating a user interface comprising an indication of the first query token and the event sequence; and causing display of the user interface (Figure 3(b), reproduced below).
PNG
media_image1.png
524
1072
media_image1.png
Greyscale
Regarding claim 7, Guo teaches the method of claim 2, further comprising:
determining, based on the set of probabilities of future events, that the target event has greater than a given threshold probability of occurring; and based on the target event having greater than the given threshold probability of occurring, generating a first classification for a historical event in the event sequence (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key [determining, based on the set of probabilities of future events, that the target event has greater than a given threshold probability of occurring]. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous [based on the target event having greater than the given threshold probability of occurring, generating a first classification for a historical event in the event sequence]. Both g and r are hyper-parameters and will be tuned based on a validation set.”)
Regarding claim 10, Guo teaches the method of claim 2, wherein
a second event of the event sequences in the dataset indicates a probability that an earlier first event of the event sequences comprised a cybersecurity incident (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token [a second event of the event sequences in the dataset indicates a probability that an earlier first event of the event sequences comprised a cybersecurity incident]. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key [a cybersecurity incident]. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”)
Regarding claim 11, Guo teaches the method of claim 2, further comprising:
determining, for each query token in the set of query tokens and based on the set of probabilities of future events, a given probability of the target event (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token [determining, for each query token in the set of query tokens and based on the set of probabilities of future events, a given probability of the target event]. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”)
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim(s) 1, 12-13 and 15-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Guo (Guo, Haixuan, Shuhan Yuan, and Xintao Wu. "Logbert: Log anomaly detection via bert." 2021 international joint conference on neural networks (IJCNN). IEEE, 2021., arXiv:2103.04475v1) in view of Dichiu (US 20210326438 A1)
Regarding claim 1, Guo teaches a system for determining events for monitoring for cyber security incidents by using a language model to simulate future events and identifying alert-worthy events based on the simulations, the system comprising:
obtaining a large language model trained to predict an event performed by a user, the large language model having been trained on a dataset comprising event sequences, wherein a second event of the event sequences indicates a probability that an earlier first event comprised a cybersecurity incident (§3.3, “After training, we can deploy LogBERT [obtaining a large language model] for anomalous log sequence detection [trained to predict an event performed by a user]. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences [the large language model having been trained on a dataset comprising event sequences], it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi] [wherein a second event of the event sequences indicates a probability that an earlier first event comprised a cybersecurity incident] . If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”);
obtaining a set of query tokens, wherein each query token of the set of query tokens is usable as a seed event for the large language model, and wherein each query token of the set of query tokens is of the same query token type (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens [obtaining a set of query tokens] and use the randomly-masked log sequence as an input to LogBERT [each query token of the set of query tokens is usable as a seed event for the large language model]. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi] [each query token of the set of query tokens is of the same query token type]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”);
inputting an event sequence and the set of query tokens into the large language model, to generate, for each pair of a set of pairs of the event sequence and a respective query token of the set of query tokens, a set of probabilities of future events, wherein inputting the event sequence comprises inputting the event sequence into the large language model multiple times such that a different query token of the set of query tokens is inputted into the large language model each time of the multiple times (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token [inputting an event sequence and the set of query tokens into the large language model to generate, for each pair of a set of pairs of the event sequence and a respective query token of the set of query tokens]. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi] [a set of probabilities of future events] [inputting the event sequence comprises inputting the event sequence into the large language model multiple times such that a different query token of the set of query tokens is inputted into the large language model each time of the multiple times]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”);
obtaining a first query token, of the set of query tokens, associated with a first probability of a target event that (i) satisfies a threshold probability and (ii) is derived for the first query token from the set of probabilities of future events (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT [obtaining a first query token, of the set of query tokens, associated with a first probability of a target event that (i) satisfies a threshold probability and (ii) is derived for the first query token from the set of probabilities of future events], we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.”); and
based on the first query token being associated with the first probability of the target event that satisfies the threshold probability, marking a first event associated with the first query token for monitoring (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous [based on the first query token being associated with the first probability of the target event that satisfies the threshold probability, marking a first event associated with the first query token for monitoring]. Both g and r are hyper-parameters and will be tuned based on a validation set.”).
Guo does not teach one or more processors programmed with instructions that, when executed by the one or more processors, cause the operations.
Dichiu teaches one or more processors programmed with instructions that, when executed by the one or more processors, cause the operations (Figure 2, element 24 and element 22, see below).
PNG
media_image2.png
354
686
media_image2.png
Greyscale
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Guo to utilize one or more processors programmed with instructions that, when executed by the one or more processors, cause the operations of claim 1 in order to efficiently realize the methodology of Guo.
Regarding claim 12, Guo according to claim 1 teaches the operations of claim 12 (see rejection of claim 1) but does not teach one or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors, perform the operations.
Dichiu teaches one or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors, perform operations (Figure 2, element 24 and element 22, see below).
PNG
media_image2.png
354
686
media_image2.png
Greyscale
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Guo to utilize one or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors, perform the operations of claim 2 in order to efficiently realize the methodology of Guo.
Regarding claim 13, Guo as modified teaches all of the limitations of claim 12, the operations further comprising:
identifying, based on a first classification for the first event, a second user having a second event sequence that matches the first event sequence; and classifying, based on the first event sequence matching the second event sequence, a portion of the second event sequence with the first classification (§3.3, “After training, we can deploy LogBERT for anomalous log sequence detection. The idea of applying LogBERT for log anomaly detection is that since LogBERT is trained on normal log sequences, it can achieve high prediction accuracy on predicting the masked log keys if a testing log sequence is normal. Hence, we can derive the anomalous score of a log sequence based on the prediction results on the MASK tokens. To this end, given a testing log sequence, similar to the training process, we first randomly replace a ratio log keys with MASK tokens and use the randomly-masked log sequence as an input to LogBERT [identifying, based on a first classification for the first event, a second user having a second event sequence that matches the first event sequence]. Then, given a MASK token, the probability distribution calculated based on Equation 4 indicates the likelihood of a log key appeared in the position of the MASK token. Similar to the strategy in DeepLog [2], we build a candidate set consisting of g normal log keys with the top g highest likelihoods computed by
y
^
[MASKi]. If the real log key is in the candidate set, we treat the key as normal. In other words, if the observed log key is not in the top-g candidate set predicted by LogBERT, we consider the log key as an anomalous log key [classifying, based on the first event sequence matching the second event sequence, a portion of the second event sequence with the first classification]. Then, when a log sequence consists of more than r anomalous log keys, we will label this log sequence as anomalous. Both g and r are hyper-parameters and will be tuned based on a validation set.” – If an inference log sequence (a second) is the same as a training log sequence (the first) the it will be classified the same based on the training log sequence)
Regarding claims 15, Guo according to claims 6, 1, 4, 1, 10, and 1, and as modified according to claim 12, covers the limitations of claims 15, 16, 17, 18, 19, and 20, respectively.
Allowable Subject Matter
Claims 8-9 and 14 are objected to as being dependent upon a rejected base claim but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
The prior art does not anticipate or render obvious the matching of sequences without the historical event claim in claims 8 and 14.
The prior art does not anticipate or render obvious the probability vector generation of claim 9.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Nguyen (US11314945B1) teaches sequential features in conjunction with natural language models.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SCHYLER S SANKS whose telephone number is (571)272-6125. The examiner can normally be reached 06:30 - 15:30 Central Time, M-F.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Michael Huntley can be reached at (303) 297-4307. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SCHYLER S SANKS/ Primary Examiner, Art Unit 2129
Prosecution Insights