DETAILED ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. In communications filed on 0 7 / 21 /201 3 . Claims 1-20 are pending in this examination. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. This examination is in response to US Patent Application No. 1 8 / 356 , 783 . Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. Claim Interpretation: Under the broadest reasonable interpretation, the terms of the claim are presumed to have their plain meaning consistent with the specification as it would be interpreted by one of ordinary skill in the art. See MPEP 2111. The claim(s) recite(s) accessing, by a server system, a machine learning model trained using a plurality of different features generated using two or more feature extraction procedures; determining, by the server system using the machine learning model, labels for one or more unlabeled nodes in a network graph whose nodes correspond to different entities and whose edges correspond to different electronic communications executed between the different entities, wherein the determining is performed based on output of the machine learning model for values of the plurality of different features corresponding to the one or more unlabeled nodes; updating, by the server system based on the determining, the network graph, wherein the updating includes assigning the determined labels to the one or more unlabeled nodes in the network graph; and performing, by the server system, one or more preventative actions for one or more entities corresponding to the one or more nodes with the assigned labels, wherein the one or more preventative actions are performed based on the assigned labels indicating that behavior of entities corresponding to the one or more nodes are anomalous. The claim does not put any limits on how the trained machine learning model determine values of the plurality of different features corresponding to the one or more unlabeled nodes. The steps recited above are performed by “ server system, and trained machine learning model ”. The server system and the recited machine learning is recited at a high level of generality, and specification does not explain how this ML model is trained to process the input and produce output. Step 1 : See MPEP 2106.03. The claim recites at least one step or act, including “ determining , by the server system using machine learning model… …” , and “ updating by the server ……”, and “ performing by the server... ”, Thus, the claim is to a process, which is one of the statutory categories of invention. (Step 1: YES). Step 2A, Prong One : As explained in MPEP 2106.04, subsection II, a claim “recites” judicial exception when the judicial exception is “set forth” or “described” in the claim. The broadest reasonable interpretation of steps is that those steps fall within the mental process groupings of abstract ideas because they cover concepts performed in the human mind, including observation, evaluation, judgment, and opinion. See MPEP 2106.04(a)(2), subsection III. Under its broadest reasonable interpretation when read in light of the specification, the “obtaining” and “producing” , and “providing” encompasses mental observations or evaluations that are practically performed in the human mind, for example, the claimed “ determining , by the server system using machine learning model… …” , and “ updating by the server ……”, and “ performing by the server... ” . Step 2A, Prong Two. See MPEP 2106.04(d). The claim recites the additional elements of “ a server system and m trained machine learning model ” . This judicial exception is not integrated into a practical application because the limitations accessing, by a server system, a machine learning model trained using a plurality of different features generated using two or more feature extraction procedures; determining, by the server system using the machine learning model, labels for one or more unlabeled nodes in a network graph whose nodes correspond to different entities and whose edges correspond to different electronic communications executed between the different entities, wherein the determining is performed based on output of the machine learning model for values of the plurality of different features corresponding to the one or more unlabeled nodes; updating, by the server system based on the determining, the network graph, wherein the updating includes assigning the determined labels to the one or more unlabeled nodes in the network graph; and performing, by the server system, one or more preventative actions for one or more entities corresponding to the one or more nodes with the assigned labels, wherein the one or more preventative actions are performed based on the assigned labels indicating that behavior of entities corresponding to the one or more nodes are anomalous , in this case a trained machine learning model, is recited at a high level of generality. The model is used as a tool to perform the generic developing algorithms of classifying the information. See MPEP 2106.05(f). The limitations, the machine learning model is used to perform an abstract idea, as discussed above in Step 2A, Prong One, such that it amounts to no more than mere instructions to apply the exception using a generic computer. See MPEP 2106.05(f). Even when viewed in combination, these additional elements do not integrate the recited judicial exception into a practical application (Step 2A, Prong Two: NO), and the claim is directed to the judicial exception. (Step 2A: YES). Step 2B: See MPEP 2106.05. As explained with respect to Step 2A, Prong Two, the additional elements. The additional element of “AI model” are at best mere instructions to “apply” the abstract ideas, which cannot provide an inventive concept. See MPEP 2106.05(f) The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because even when considered in combination, these additional elements represent mere instructions to implement an abstract idea or other exception on a computer and insignificant extra-solution activity, which do not provide an inventive concept. (Step 2B: NO). The claim is ineligible . Claims 2- 8 , all recites such as : feature extraction procedures , comparing new label with existing labels, network graph is a bi-partite transaction network graph , time interval, snapshot of the network graph, node behavioral features , neighbor nodes . The claim(s) does/do not include additional elements that are sufficient to amount to significantly more under step 2A and Sept 2B , similarly as above analyzed. Claim 9 and claims 10-15 , all recites : a non-transitory computer-readable medium , and trained machine learning mode . The claim(s) does/do not include additional elements that are sufficient to amount to significantly more under step 2A and Sept 2B , similarly as above analyzed. Claims 16 and 17-20 , the limitations “ a processor” and “non-transitory computer readable medium … and the trained machine learning model ”, the same steps, in this case a computer, are recited at a high level of generality, as above noted for claim 1 and claims 2-8 . In these limitations are used as a tool to perform the generic computer function of receiving data and creating data. See MPEP 2106.05(f). Double Patenting 3 . The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum , 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington , 418 F.2d 528, 163 USPQ 644 (CCPA 1969). A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the conflicting application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b). Claim s 1 -20 of Application number 18356783 are non- provisionally rejected on the grou nd of non - statutory anticipatory double patenting as being unpatentable over Claim s 1 -20 of co - pending Application number 18356725 . Although the conflicting claims are not identical, they are not patentably distinct from each other because the claims in the instant patent application relates to “ techniques are disclosed for maintaining a network graph by updating labels in the graph based on features generated using at least two different feature extraction procedures. A server system accesses a machine learning model trained using features generated using multiple feature extraction procedures. Using the model, the system determines labels for unlabeled nodes in a network graph whose nodes correspond to entities and whose edges correspond to electronic communications executed between the different entities, where the determining is performed based on output of the model for values of the features corresponding to the unlabeled nodes. Based on the determining, the system updates the graph by assigning the determined labels to the unlabeled nodes in the graph. The system performs, based on the assigned labels indicating that behavior of entities corresponding to the nodes are anomalous, preventative actions for entities corresponding to the nodes with assigned labels ” and co-pending application 18356725 relate generally to “t echniques are disclosed for generating multiple different types of new features from a network graph and training a machine learning model using the newly generated features. A server system generates, from electronic communications, a network graph that includes nodes and edges. The server captures snapshots of the network graph that include nodes and edges existing at different time intervals. The system generates, for nodes included in respective snapshots, different types of features that include a neighbor convolution feature for a given node in a given snapshot by compressing node behavior features for neighbor nodes of the given node that are one hop away from the given node within the given snapshot of the network graph. The system trains, using the plurality of different types of features, a machine learning model usable to predict whether unlabeled nodes in the network graph are anomalous ”. There is a comparison table in which the instant application is compared with an application filed by the same inventors: 18356725 . Co-pending Application 18356725 Instant Application 18356783 1. A method, comprising: generating, by a server system from a plurality of electronic communications, a network graph that includes a plurality of nodes and edges ; capturing, by the server system, a plurality of snapshots of the network graph, wherein the plurality of snapshots include nodes and edges existing at a plurality of diff erent time intervals ; generating, by the server system for nodes included in respective snapshots of the plurality of snapshots , a plurality of diff erent types of features, wherein generating the plurality of diff erent types of features includes generating a neighbor convolution feature for a given node in a given snapshot by: compressing a plurality of n ode behavior features for one or more neighbor nodes of the given node, wherein the one or more neighbor nodes are one hop away from the given node within the given snapshot of the network graph ; and training, by the server system using the plurality of diff erent types of features, a machine learning model , wherein the trained machine learning model is usable to predict whether one or more unlabeled nodes in the network graph are anomalous. 1. A method, comprising: accessing, by a server system, a machine learning model trained using a plurality of different features generated using two or more feature extraction procedures; determining, by the server system using the machine learning model , labels for one or more unlabeled nodes in a network graph whose nodes correspond to different entities and whose edges correspond to different electronic communications executed between the different entities, wherein the determining is performed based on output of the machine learning model for values of the plurality of different features corresponding to the one or more unlabeled nodes; updating, by the server system based on the determining, the network graph , wherein the updating includes assigning the determined labels to the one or more unlabeled nodes in the network graph ; and performing, by the server system, one or more preventative actions for one or more entities corresponding to the one or more nodes with the assigned labels, wherein the one or more preventative actions are performed based on the assigned labels indicating that behavior of entities corresponding to the one or more nodes are anomalous. The method of claim 1, wherein the network graph is a bi-partite transaction network graph , wherein the nodes of the bi-partite transaction network graph correspond to both user accounts and electronic transactions, and wherein one or more labels for nodes in the network graph specify that user accounts and electronic transactions corresponding to the nodes are known to be anomalous. 3. The method of claim 1, further comprising: determining, by the server system using the trained machine learning model, labels for one or more unlabeled nodes in the network graph, wherein the determining includes inputting features for the one or more unlabeled nodes into the trained machine learning model; and performing, by the server system based on the determined labels, one or more preventative actions for entities corresponding to one or more nodes based on the determined labels for the one or more unlabeled nodes indicating anomalous behavior for entities corresponding to the unlabeled one or more nodes. 4. The method of claim 1, wherein the compressing includes: generating an adjacency matrix that indicates, for different pairs of a first set of nodes that are a single hop away from the given node, whether the different pairs of nodes of the first set of nodes are connected to one another in the network graph via one or more edges, wherein values stored in the adjacency matrix indicate weights of edges between respective pairs of nodes in the first set of nodes; generating an identity matrix that indicates whether nodes in the network graph include one or more loop edges connected to themselves; generating a feature matrix that includes node behavior features for nodes in the first set of nodes; squaring the adjacency matrix; adding a result of the squaring to the identity matrix; multiplying a result of the adding with the feature matrix; and performing independent component analysis on a result of the multiplying. 5. The method of claim 4, further comprising: performing, by the server system, the compressing for a second set of nodes that are at least two hops away from the given node of the network graph. 6. The method of claim 1, wherein generating the plurality of different types of features includes generating one or more community diffusion features by: identifying, in a given snapshot of the network graph, whether nodes included in the given snapshot have anomalous labels; determining, using one or more distance procedures, distances between unlabeled nodes of the given snapshot and the one or more nodes identified to have anomalous labels; and determining a connectivity density for the unlabeled nodes, wherein determining the connectivity density for a given unlabeled node includes identifying a number of nodes connected to the given unlabeled node with anomalous labels. 7. The method of claim 1, wherein generating the plurality of different types of features includes generating a plurality of node behavior features, including determining one or more types of the following types of node behavior features: degree-related features, flow-related features, duration-related features, and interval-related features. 8. The method of claim 7, wherein the degree-related features, flow-related features, duration-related features, and interval-related features include the following: in-degree, out-degree, total degree, inflow, outflow, change of balance, input electronic communication duration, output transaction duration, input transaction interval, output transaction interval, and total transaction interval. 9. A non-transitory computer-readable medium having instructions stored thereon that are executable by a server system to perform operations comprising: generating, from a plurality of electronic communications, a bi-partite network graph that includes a plurality of nodes and edges, wherein the plurality of nodes correspond to one of electronic communications and entities participating in the electronic communications; capturing a plurality of snapshots of the bi-partite network graph, wherein the plurality of snapshots include nodes and edges existing at a plurality of different time intervals; generating, for nodes included in respective snapshots of the plurality of snapshots, a plurality of different types of features, wherein generating the plurality of different types of features includes generating a neighbor convolution feature for a given node in a given snapshot by: compressing a plurality of node behavior features for one or more neighbor nodes to the given node, wherein the one or more neighbor nodes are one hop away from the given node within the given snapshot of the bi-partite network graph; and training, using the plurality of different types of features, a machine learning model, wherein the trained machine learning model is usable to predict whether one or more unlabeled nodes in the bi-partite network graph are anomalous. 10. The non-transitory computer-readable medium of claim 9, wherein the bi-partite network graph is a transaction network graph, wherein the electronic communications are electronic transactions and the entities participating in the electronic transactions are users of the server system, and wherein one or more labels for nodes in the bi-partite network graph specify that user accounts and electronic transactions corresponding to the nodes are known to be anomalous. 11. The non-transitory computer-readable medium of claim 10, wherein the compressing includes: generating an adjacency matrix that indicates, for different pairs of a first set of nodes that are a single hop away from a center node of the bi-partite network graph, whether the different pairs of nodes of the first set of nodes are connected to one another in the bi-partite network graph via one or more edges, wherein values stored in the adjacency matrix indicate weights of edges between respective pairs of nodes in the first set of nodes; generating an identity matrix that indicates whether nodes in the bi-partite network graph include one or more loop edges connected to themselves; generating a feature matrix that includes node behavior features for nodes in the first set of nodes; combining the adjacency matrix, the identity matrix, and the feature matrix; and performing independent component analysis on the combination. 12. The non-transitory computer-readable medium of claim 9, wherein generating the plurality of different types of features includes generating one or more community diffusion features by: identifying, in a given snapshot of the bi-partite network graph, whether nodes included in the given snapshot have anomalous labels; determining, using one or more distance procedures, distances between unlabeled nodes of the given snapshot and the one or more nodes identified to have anomalous labels; and determining a connectivity density for the unlabeled nodes, wherein determining the connectivity density for a given unlabeled node includes identifying a number of nodes connected to the given unlabeled node with anomalous labels. 13. The non-transitory computer-readable medium of claim 9, wherein generating the plurality of different types of features includes generating one or more node behavior features, including one or more types of the following types of node behavior features: in-degree, out-degree, inflow, outflow, change of balance, input electronic communication duration, output electronic communication duration, input electronic communication interval, and output electronic communication interval. 14. The non-transitory computer-readable medium of claim 10, wherein the plurality of snapshots are generated for the bi-partite network graph at different twenty-four hour time intervals. 15. The non-transitory computer-readable medium of claim 14, wherein a given node is included in two or more of the plurality of snapshots of the bi-partite network graph. 16. A system comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that are executable by the processor to cause the system to perform operations comprising: generating, by a server system from a plurality of electronic communications, a network graph that includes a plurality of nodes and edges; capturing, by the server system, a plurality of snapshots of the network graph, wherein the plurality of snapshots include nodes and edges existing at a plurality of different time intervals ; generating, by the server system for nodes included in respective snapshots of the plurality of snapshots, a plurality of different types of features, wherein generating the plurality of different types of features includes generating community diffusion features for a plurality of nodes in a given snapshot by: determining, using one or more distance procedures, a distance between unlabeled nodes included in a given snapshot and one or more labeled nodes located near the center of the given snapshot; and determining a connectivity density for the unlabeled nodes, including determining a number of nodes that the unlabeled nodes are connected to that are known to be anomalous; and training, by the server system using the plurality of different types of features, a machine learning model, wherein the trained machine learning model is usable to predict whether one or more unlabeled nodes in the network graph are anomalous. 17. The system of claim 16, wherein the network graph is a bi-partite transaction network graph, wherein the nodes of the bi-partite transaction network graph correspond to both user accounts and electronic transactions, and wherein one or more labels for nodes in the network graph specify that user accounts and electronic transactions corresponding to the nodes are known to be anomalous. 18. The system of claim 16, wherein the instructions are further executable by the processor to cause the system to: determine, using the trained machine learning model, labels for one or more unlabeled nodes in the network graph, wherein the determining includes inputting features for the one or more unlabeled nodes into the trained machine learning model; and perform, based on the determined labels, one or more preventative actions for entities corresponding to one or more nodes based on the determined labels for the one or more unlabeled nodes indicating anomalous behavior for entities corresponding to the unlabeled one or more nodes. 19. The system of claim 16, wherein generating the plurality of different types of features includes generating a neighbor convolution feature for a given node in a given snapshot by: compressing a plurality of node behavior features for one or more neighbor nodes to the given node, wherein the one or more neighbor nodes are one hop away from the given node within the given snapshot of the network graph. 20. The system of claim 16, wherein generating the plurality of different types of features includes generating one or more community diffusion features by: identifying, in a given snapshot of the network graph, whether nodes included in the given snapshot have anomalous labels; determining, using one or more distance procedures, distances between unlabeled nodes of the given snapshot and the one or more nodes identified to have anomalous labels; and determining a connectivity density for the unlabeled nodes, wherein determining the connectivity density for a given unlabeled node includes identifying a number of nodes connected to the given unlabeled node with anomalous labels. 2. The method of claim 1, wherein the two or more feature extraction procedures include two or more of the following types of feature extraction procedures: node behavior feature extraction, neighbor convolution feature extraction, and community diffusion feature extraction. 3. The method of claim 1, further comprising: determining, by the server system using the machine learning model, new labels for one or more labeled nodes in the network graph; comparing, by the server system, the new labels with existing labels currently assigned to the one or more labeled nodes of the network graph; and in response to identifying that a new label and an existing label corresponding to a given node in the network graph do not match, updating, by the server system, the given node by replacing the existing label for the given node with the new label. 4. The method of claim 1, wherein the network graph is a bi-partite transaction network graph , wherein the nodes of the bi-partite transaction network graph correspond to both electronic wallets and electronic transactions, and wherein the labels for one or more unlabeled nodes in the network graph indicate whether electronic wallets and electronic transactions corresponding to the one or more unlabeled nodes are anomalous. 5. The method of claim 1, further comprising, prior to the accessing: retrieving, by the server system, a plurality of electronic communications; dividing, by the server system based on a time interval , the plurality of electronic communications into different sets of electronic communications; and generating, by the server system for the different sets of electronic communications, a plurality of snapshots of the network graph. 6. The method of claim 5, wherein the time interval is a twelve-hour time window, and wherein a first set of electronic communications generated during the dividing includes electronic communications initiated within a first twelve-hour time window. 7. The method of claim 1, wherein generating the plurality of different features using two or more feature extraction procedures includes using a first feature extraction procedure to generate neighbor convolution features , and wherein generating a given neighbor convolution feature for a given node in the network graph includes: compressing a plurality of node behavioral features for one or more neighbor nodes to the given node, wherein the one or more neighbor nodes are one hop away from the given node within the network graph. 8. The method of claim 7, further comprising: updating, by the server system using the neighbor convolution features, the trained machine learning model. 9. A non-transitory computer-readable medium having instructions stored thereon that are executable by a server system to perform operations comprising: accessing a machine learning model trained using a plurality of different features generated using two or more feature extraction procedures; determining, using the machine learning model, labels for one or more unlabeled nodes in a bi-partite network graph whose nodes correspond to different entities and electronic communications and whose edges correspond to different interactions between the nodes, wherein the determining is performed based on output of the machine learning model for values of the plurality of different features corresponding to the one or more unlabeled nodes; updating, based on the determining, the bi-partite network graph, wherein the updating includes assigning the determined labels to the one or more unlabeled nodes in the bi-partite network graph; and performing one or more preventative actions for one or more entities corresponding to the one or more nodes with the assigned labels, wherein the one or more preventative actions are performed based on the assigned labels indicating that behavior of entities corresponding to the one or more nodes are anomalous. 10. The non-transitory computer-readable medium of claim 9, wherein the plurality of different features that are generated using the two or more feature extraction procedures include two or more of the following types of features: node behavior features, neighbor convolution features, and community diffusion features. 11. The non-transitory computer-readable medium of claim 10, wherein the node behavior features include one or more of the following types of features: in-degree, out- degree, inflow, outflow, change of balance, input electronic communication duration, output transaction duration, input transaction interval, and output transaction interval. 12. The non-transitory computer-readable medium of claim 10, wherein the community diffusion features are generated by: identifying whether one or more nodes in the bi-partite network graph have anomalous labels; determining distances between unlabeled nodes of the bi-partite network graph and the one or more nodes identified to have anomalous labels; and determining a connectivity density for the unlabeled nodes, wherein determining the connectivity density for a given unlabeled node includes identifying a number of nodes connected to the given unlabeled node with anomalous labels. 13. The non-transitory computer-readable medium of claim 9, wherein the operations further comprise: determining, using the machine learning model, new labels for one or more labeled nodes in the bi-partite network graph; comparing the new labels with existing labels currently assigned to the one or more labeled nodes of the bi-partite network graph; and in response to identifying that a new label and an existing label corresponding to a given node in the bi-partite network graph do not match, updating the given node by replacing the existing label for the given node with the new label. 14. The non-transitory computer-readable medium of claim 9, wherein the bi-partite network graph is a bi-partite transaction network graph, wherein the nodes of the bi-partite transaction network graph correspond to both electronic wallets and electronic transactions, and wherein the labels for one or more unlabeled nodes in the bi-partite transaction network graph indicate whether electronic wallets and electronic transactions corresponding to the one or more unlabeled nodes are anomalous. 15. The non-transitory computer-readable medium of claim 9, wherein the two or more feature extraction procedures include a neighbor convolution feature extraction procedure, wherein execution of the neighbor convolution feature extraction procedure includes: generating an adjacency matrix that indicates, for different pairs of nodes of a first set of nodes that are a single hop away from a labeled node of the bi-partite network graph, whether the pairs of nodes of the first set of nodes are connected to one another in the bi-partite network graph via one or more edges, wherein values stored in the adjacency matrix indicate weights of the connections between respective pairs of nodes in the first set of nodes; generating an identity matrix that indicates whether nodes in the bi-partite network graph include one or more loop edges connected to themselves; generating a feature matrix that includes node behavior features for nodes in the first set of nodes; combining the adjacency matrix, the identity matrix, and the feature matrix; and performing independent component analysis on the combination. 16. A system comprising: a processor; and a non-transitory computer-readable medium having stored thereon instructions that are executable by the processor to cause the system to perform operations comprising: determining, using a trained machine learning model, labels for one or more unlabeled nodes in a network graph whose nodes correspond to different entities and whose edges correspond to different electronic communications executed between the different entities, wherein the determining is performed based on output of the machine learning model for values of a plurality of different features corresponding to the one or more unlabeled nodes, wherein the trained machine learning model is trained using a plurality of different features generated using one or more feature extraction procedures; updating, based on the determining, the network graph, wherein the updating includes assigning the determined labels to the one or more unlabeled nodes in the network graph; and performing one or more preventative actions for one or more entities corresponding to the one or more nodes with the assigned labels, wherein the one or more preventative actions are performed based on the assigned labels indicating that behavior of entities corresponding to the one or more nodes are anomalous. 17. The system of claim 16, wherein the instructions are further executable by the processor to cause the system to: determine, using the trained machine learning model, new labels for one or more labeled nodes in the network graph; and replacing one or more existing labels assigned to the one or more labeled nodes in the network graph with the new labels. 18. The system of claim 16, wherein the instructions are further executable by the processor to cause the system to: retrieve a plurality of electronic communications; divide, based on a time interval , the plurality of electronic communications into different sets of electronic communications; and generate, for the different sets of electronic communications, a plurality of snapshots of the network graph. 19. The system of claim 16, wherein the plurality of different features are generating using two or more feature extraction procedures include two or more of the following types of features: node behavior features, neighbor convolution features, and community diffusion features. 20. The system of claim 19, wherein the community diffusion features are generated by: determining, using one or more distance procedures, a distance between unlabeled nodes included in a given snapshot and one or more labeled nodes located near the center of the given snapshot; and determining a connectivity density for the unlabeled nodes, including determining a number of nodes that the unlabeled nodes are connected to that are known to be anomalous. Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. The factual inquiries set forth in Graham v. John Deere Co. , 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows: 1. Determining the scope and contents of the prior art. 2. Ascertaining the differences between the prior art and the claims at issue. 3. Resolving the level of ordinary skill in the pertinent art. 4. Considering objective evidence present in the application indicating obviousness or nonobviousness. Claims 1-3, 5-6, and 16-20 are rejected under 35 U.S.C. 103 as being unpatentable over US Patent No. (US2023/0106416) issued to Gupte and in view of US Patent No. ( US 2021/0194907 ) issued to Bertiger . Regarding claim s 1 , and 16 , Gupte discloses a method, comprising: accessing, by a server system, a machine learning model trained using a plurality of different features generated using two or more feature extraction procedures [0001] The present disclosure generally relates to labeling of digital content items using machine learning models, and more specifically relates to graph-based labeling of heterogenous digital content items using machine learning models to detect spam and/or content moderation policy triggers. [0041] Broadly speaking, aspects of this disclosure include a graph-based labeling model that is able to label digital content items across content types, modalities, languages, and tasks/policies. In doing so, aspects of this disclosure provide a graph-based model architecture that can generate multiple different types of label predictions for unlabeled content items of multiple different types, modalities, and languages. Embodiments of the graph-based model are responsive to inputs that have been extract ed from a content graph in which nodes of the content graph correspond to digital content items in an application system. These inputs can include node attribute data, which reflect characteristics of a corresponding digital content item such as modality, content type, language, and pre-existing semantic labels (if any), and edge data , which reflect relationships between digital content items represented by the nodes in the content graph. [0108] Alternatively, in some implementations, content item data is stored in a non-graph data structure such as a key-value store or relational database of, e.g., content item data 210 . In these implementations, grapher 254 can issue a query to extract relationship data for the digital content item from the data structure, where the relationship data may be determined based on key values, for example. Using, e.g., graph primitives, grapher 254 converts the non-graph node relationship data for the digital content item into a content graph in which the digital content item is represented as a node, related digital content items are represented as adjacent nodes, and edges between the digital content item node and the adjacent nodes are labeled with relationship type data. Gupte discloses : determining, by the server system using the machine learning model, labels for one or more unlabeled nodes in a network graph whose nodes correspond to different entities and whose edges correspond to different electronic communications executed between the different entities, wherein the determining is performed based on output of the machine learning model for values of the plurality of different features corresponding to the one or more unlabeled nodes [ Abstract, Technologies for graph-based labeling of digital content items include, in some embodiments, for digital content items received from user systems by an application system, generating and storing a content graph. The content graph can include labeled nodes that correspond to digital content items that have labels, unlabeled nodes that correspond to digital content items that do not have labels, and edges that indicate relationships between content items . Edge data for an edge between an unlabeled node and an adjacent node can be retrieved from the content graph. Responsive to a set of inputs that includes the retrieved edge data and embedding data associated with the unlabeled node, a machine learning model trained on labeled nodes and edges of the content graph can assign a label to the unlabeled node ]. [0108] Alternatively, in some implementations, content item data is stored in a non-graph data structure such as a key-value store or relational database of, e.g., content item data 210 . In these implementations, grapher 254 can issue a query to extract relationship data for the digital content item from the data structure, where the relationship data may be determined based on key values, for example. Using, e.g., graph primitives, grapher 254 converts the non-graph node relationship data for the digital content item into a content graph in which the digital content item is represented as a node, related digital content items are represented as adjacent nodes, and edges between the digital content item node and the adjacent nodes are labeled with relationship type data ], and [0219-0220]. Gupte discloses updating, by the server system based on the determining, the network graph, wherein the updating includes assigning the determined labels to the one or more unlabeled nodes in the network graph [Abstract, Technologies for graph-based labeling of digital content items include, in some embodiments, for digital content items received from user systems by an application system, generating and storing a content graph. The content graph can include labeled nodes that correspond to digital content items that have labels, unlabeled nodes that correspond to digital content items that do not have labels, and edges that indicate relationships between content items. Edge data for an edge between an unlabeled node and an adjacent node can be retrieved from the content graph. Responsive to a set of inputs that includes the retrieved edge data and embedding data associated with the unlabeled node, a machine learning model trained on labeled nodes and edges of the content graph can assign a label to the unlabeled node. [0041] Broadly speaking, aspects of this disclosure include a graph-based labeling model that is able to label digital content items across content types, modalities, languages, and tasks/policies. In doing so, aspects of this disclosure provide a graph-based model architecture that can generate multiple different types of label predictions for unlabeled content items of multiple different types, modalities, and languages. [0126] Label prediction model 260 is a machine learning model having a training mode and a prediction mode. In a training mode, training data is applied to an untrained or partially trained label prediction model 260 by model trainer 258 as described above. Partially trained can refer to a model that has been trained with only a small set of training data, or to a model that has been trained with training data that is now out of date or otherwise needs to be refreshed or updat ed. [0144] At operation 318, the processing device uses output of the labeling model to generate label data for the digital content item. Operation 318 can include providing the label data to the application system. Operation 318 can include generating a label for the content item, assign ing a label to the content item, and/or labeling the content item with a label of a set of predefined labels, such as a set of spam labels, based on output produced by the labeling model in response to the set of inputs. Operation 318 can include providing the label to the application system. ], and [ 0050] . Gupte does not explicitly disclose, however, Bertiger discloses and performing, by the server system, one or more preventative actions for one or more entities corresponding to the one or more nodes with the assigned labels, wherein the one or more preventative actions are performed based on the assigned labels indicating that behavior of entities corresponding to the one or more nodes are anomalous. [0012]… , communication data indicating network communication of network components of an enterprise network is collected. Network communication can occur between two devices within an enterprise network or, alternatively, between a device within the enterprise network and another, external device. The term “network communication” is herein understood broadly to refer to any kind of messages or packets sent between devices across a network… The communication data can be represented as a network graph, with nodes of the network graph representing devices or network components participating in the communication, and edges of the graph representing communication between the network components. In some embodiments, the network graph is a directed graph, with edges representing traffic between devices in one direction. The temporal behavior of the network is tracked with multiple network graphs providing “snapshots” of network communication occurring within different time periods. Collectively, these multiple network graphs can also be viewed as a “time-dependent network graph.” The time-dependent network graph represents a time series of recorded network activity involving network devices (e.g., computers), from which subsequent network activity can be predicted . A comparison of the predicted network activity with the actually observed subsequent network activity allows for anomaly detection.] It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teaching of Gupte by incorporating “ The temporal behavior of the network is tracked with multiple network graphs ”, as taught by Bertiger . One could have been motivated to do so by providing “snapshots” of network communication occurring within different time periods. To record network activity involving network devices (e.g., computers), from which subsequent network activity can be predicted. A comparison of the predicted network activity with the actually observed subsequent network activity allows for anomaly detection. [ Bertiger , [0012 ] ] . Regarding claim s 2 , and 19, Gupte discloses wherein the two or more feature extraction procedures include two or more of the following types of feature extraction procedures: node behavior feature extraction, neighbor convolution feature extraction, and community diffusion feature extraction [0041] Broadly speaking, aspects of this disclosure include a graph-based labeling model that is able to label digital content items across content types, modalities, languages, and tasks/policies. In doing so, aspects of this disclosure provide a graph-based model architecture that can generate multiple different types of label predictions for unlabeled content items of multiple different types, modalities, and languages. Embodiments of the graph-based model are responsive to inputs that have been extract ed from a content graph in which nodes of the content graph correspond to digital content items in an application system. These inputs can include node attribute data, which reflect characteristics of a corresponding digital content item such as modality, content type, language, and pre-existing semantic labels (if any), and edge data, which reflect relationships between digital content items represented by the nodes in the content graph. [0108] Alternatively, in some implementations, content item data is stored in a non-graph data structure such as a key-value store or relational database of, e.g., content item data 210 . In these implementations, grapher 254 can issue a query to extract relationship data for the digital content item from the data structure, where the relationship data may be determined based on key values, for example. Using, e.g., graph primitives, grapher 254 converts the non-graph node relationship data for the digital content item into a content graph in which the digital content item is represented as a node, related digital content items are represented as adjacent nodes, and edges between the digital content item node and the adjacent nodes are labeled with relationship type data. [0156] In operation, to model architecture 404 is applied to inputs X, A, and Y{circumflex over ( )} for a starting node K, and one or more Q neighbor (or adjacent) nodes. In querying the content graph, the starting (or source) node K is designated as the key and a neighbor node Q becomes the value. A neighbor vector can be generated for all neighbor nodes Q (e.g., all n-degree connections of K, where n can be any positive integer). Nodes K and Q can be referred to source and destination nodes, respectively, or collectively as an edge pair. [0157] An additional input V is an aggregation of edge relation data between node K and each neigh bor node Q over all of the Q neighbor nodes. The aggregation can be computed as, e.g., a mean or average o