Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 21,23-25,27,29,31-33,35,37-43 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) mental processes – concepts performed in the human mind.
Regarding claim 21, with the exception of the recitation of the limitation ‘a computing platform communicatively coupled to a plurality of network nodes; the computing platform including a hardware processor and a system memory storing a software code; the hardware processor configured to execute the software code’, the claim recites mental processes concepts performed in the human mind. The limitations ‘detect a plurality of anomalous performance indicators originating from one or more of the plurality of network nodes; determine a signature of the incident; compare the signature to at least one of a plurality of entries in an incident signature database; perform, when comparing determines that the signature corresponds to one or more of the plurality of entries, a root cause analysis of the incident using the corresponding one or more of the plurality of entries’ are mental processes concepts performed in the human mind by observation, evaluation, judgment, and/or opinion.
Step 2A: Prong two
This judicial exception is not integrated into a practical application because the additional elements ‘generate an incident alert including at least one of a result of the root cause analysis or a description of the incident; and display the incident alert using an incident identification pane, and a root cause analysis pane showing similarities between the incident and a plurality of root causes, the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators’ are merely adding insignificant extra-solution activity to the judicial exception (MPEP 2105.05(g)).
Step 2B
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘a computing platform communicatively coupled to a plurality of network nodes; the computing platform including a hardware processor and a system memory storing a software code; the hardware processor configured to execute the software code; determine, using the plurality of anomalous performance indicators in an automated process, an occurrence of an incident, wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each anomalous indicator based on a deviation of each anomalous indicator from a respective behavior defined as being normal for that anomalous indicator; infer, using a machine learning predictive model and based on the result of the root cause analysis, a solution for performing at least one of a mitigation or a resolution of the incident; via a communication network; via the communication network to at least one of the one or more of the plurality of network nodes’ is directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). The machine learning predictive model is described at a high level such that it amounts to using a computer with a generic machine learning predictive model with only stating that the machine learning predictive model is used to detect anomalies.
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘execute, during the incident, the inferred solution to mitigate or resolve the incident’ is simply appending well-understood, routine, conventional activities previously known to the industry, specified at a high-level of generality to the judicial exception (MPEP 2106.05(d)). The USPN 7120633 discloses in column 1, lines 56-59 - As one skilled in the art will recognize, various well-known methods and systems exist for executing such corrective actions and USPN 8620921 discloses in column 2, lines 48 -52 - As known in the art, the MAPE procedure will constantly monitor (M) each SLO and workload to determine any SLO violations, and if so, will analyze (A) and plan (P) multiple proposed solutions to help in selecting a particular solution, and then execute (E) the selected solution.
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘wherein executing the inferred solution includes outputting one or more instructions for mitigating or resolving the incident’ is simply appending well-understood, routine, conventional activities previously known to the industry, specified at a high-level of generality to the judicial exception (MPEP 2106.05(d)). USPN 20070220303A1 – discloses in a conventional network management, a countermeasure method in the case where a failure has occurred in a network has been such that a highly skilled operator directly deals with each failure, or that operating methods for recovering the network from simple failures are prepared as a script on a computer beforehand, whereupon an operator selects the corresponding operating method., in paragraph 0004. USPN 20190258948A1 – discloses conventional automated help programs provide the same instructions for troubleshooting to every user, making no differentiation based on experience, skill level, and other profile attributes. These conventional programs also do not differentiate based on what has worked or not worked for users with different experience, skill levels, and other profile attributes., in paragraph 0027.
Regarding claim 23, the limitation ‘the plurality of anomalous performance indicators are detected during a time interval, and wherein the plurality of anomalous performance indicators are identified as anomalous based on a comparison of respectively corresponding performance indicators during a previous time interval’ is a mental process - concept performed in the human mind by observation, evaluation, judgment, and/or opinion.
Regarding claim 24, the limitation ‘the time interval extends from a first time of day to a second time of day, and wherein the previous time interval extends from the first time of day to the second time of day on a previous day’ is a mental process - concept performed in the human mind by observation, evaluation, judgment, and/or opinion.
Regarding claim 25, the limitation ‘the comparison is performed based on a Holt-Winters method’ is a mathematical concept per the specification.
Regarding claim 27, the limitation ‘the occurrence of the incident is determined using a principal component analysis’ is a mathematical concept per the specification.
Regarding claim 29, with the exception of the recitation of the limitation ‘a computing platform communicatively coupled to a plurality of network nodes; the computing platform including a hardware processor and a system memory storing a software code; the hardware processor configured to execute the software code’, the claim recites mental processes concepts performed in the human mind. The limitations ‘detecting a plurality of anomalous performance indicators originating from one or more of the plurality of network nodes; determining a signature of the incident; comparing the signature to at least one of a plurality of entries in an incident signature database; performing, when comparing determines that the signature corresponds to one or more of the plurality of entries, a root cause analysis of the incident using the corresponding one or more of the plurality of entries’ are mental processes concepts performed in the human mind by observation, evaluation, judgment, and/or opinion.
Step 2A: Prong two
This judicial exception is not integrated into a practical application because the additional elements ‘generating an incident alert including at least one of a result of the root cause analysis or a description of the incident; and displaying the incident alert using an incident identification pane, and a root cause analysis pane showing similarities between the incident and a plurality of root causes, the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators’ are merely adding insignificant extra-solution activity to the judicial exception (MPEP 2105.05(g)).
Step 2B
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘a computing platform communicatively coupled to a plurality of network nodes; the computing platform including a hardware processor and a system memory storing a software code; the hardware processor configured to execute the software code; determining, using the plurality of anomalous performance indicators in an automated process, an occurrence of an incident, wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each anomalous indicator based on a deviation of each anomalous indicator from a respective behavior defined as being normal for that anomalous indicator;; inferring, using a machine learning predictive model and based on the result of the root cause analysis, a solution for performing at least one of a mitigation or a resolution of the incident; via a communication network; via the communication network to at least one of the one or more of the plurality of network nodes’ is directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). The machine learning predictive model is described at a high level such that it amounts to using a computer with a generic machine learning predictive model with only stating that the machine learning predictive model is used to detect anomalies.
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘executing, during the incident, the inferred solution to mitigate or resolve the incident’ is simply appending well-understood, routine, conventional activities previously known to the industry, specified at a high-level of generality to the judicial exception (MPEP 2106.05(d)). The USPN 7120633 discloses in column 1, lines 56-59 - As one skilled in the art will recognize, various well-known methods and systems exist for executing such corrective actions and USPN 8620921 discloses in column 2, lines 48 -52 - As known in the art, the MAPE procedure will constantly monitor (M) each SLO and workload to determine any SLO violations, and if so, will analyze (A) and plan (P) multiple proposed solutions to help in selecting a particular solution, and then execute (E) the selected solution.
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘wherein executing the inferred solution includes outputting one or more instructions for mitigating or resolving the incident’ is simply appending well-understood, routine, conventional activities previously known to the industry, specified at a high-level of generality to the judicial exception (MPEP 2106.05(d)). USPN 20070220303A1 – discloses in a conventional network management, a countermeasure method in the case where a failure has occurred in a network has been such that a highly skilled operator directly deals with each failure, or that operating methods for recovering the network from simple failures are prepared as a script on a computer beforehand, whereupon an operator selects the corresponding operating method., in paragraph 0004. USPN 20190258948A1 – discloses conventional automated help programs provide the same instructions for troubleshooting to every user, making no differentiation based on experience, skill level, and other profile attributes. These conventional programs also do not differentiate based on what has worked or not worked for users with different experience, skill levels, and other profile attributes., in paragraph 0027.
Regarding claim 31, the limitation ‘wherein the plurality of anomalous performance indicators are detected during a time interval, and wherein the plurality of anomalous performance indicators are identified as anomalous based on a comparison of respectively corresponding performance indicators during a previous time interval’ is a mental process - concept performed in the human mind by observation, evaluation, judgment, and/or opinion.
Regarding claim 32, the limitation ‘wherein the time interval extends from a first time of day to a second time of day, and wherein the previous time interval extends from the first time of day to the second time of day on a previous day’ is a mental process - concept performed in the human mind by observation, evaluation, judgment, and/or opinion.
Regarding claim 33, the limitation ‘the comparison is performed based on a Holt-Winters method’ is a mathematical concept per the specification.
Regarding claim 35, the limitation ‘the occurrence of the incident is determined using a principal component analysis’ is a mathematical concept per the specification.
Regarding claim 37, the limitations ‘the machine learning predictive model includes a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model, wherein detecting the plurality of anomalous performance indicators is performed using the machine learning predictive model, the plurality of anomalous performance indicators being included in performance data originating from the one or more of the plurality of network nodes, and wherein the hardware processor is further configured to execute the software code to: retrain the machine learning predictive model using the performance data including the plurality of anomalous performance indicators to update the plurality of parameters; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes’ is directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). The machine learning predictive model is described at a high level such that it amounts to using a computer with a generic machine learning predictive model with only stating that the machine learning predictive model is used to detect anomalies and also mathematical concepts are involved in the parameter being calculated per the specification.
The limitation ‘receive additional performance data originating from the one or more of the plurality of network nodes’ is are merely adding insignificant extra-solution activity to the judicial exception (MPEP 2105.05(g)), in this case data gathering.
Regarding claim 38, the limitations ‘the machine learning predictive model includes a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model, wherein detecting the plurality of anomalous performance indicators is performed using the machine learning predictive model, the plurality of anomalous performance indicators being included in performance data originating from the one or more of the plurality of network nodes, and wherein the hardware processor is further configured to execute the software code to: retrain the machine learning predictive model using the performance data including the plurality of anomalous performance indicators to update the plurality of parameters; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes’ is directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). The machine learning predictive model is described at a high level such that it amounts to using a computer with a generic machine learning predictive model with only stating that the machine learning predictive model is used to detect anomalies and also mathematical concepts are involved in the parameter being calculated per the specification.
The limitation ‘receive additional performance data originating from the one or more of the plurality of network nodes’ is are merely adding insignificant extra-solution activity to the judicial exception (MPEP 2105.05(g)), in this case data gathering.
Regarding claim 39, with the exception of the recitation of the limitation ‘a computing platform communicatively coupled to a plurality of network nodes; the computing platform including a hardware processor and a system memory storing a software code and a machine learning predictive model having a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model; the hardware processor configured to execute the software code to’ are mental processes concepts performed in the human mind by observation, evaluation, judgment, and/or opinion. The limitations ‘ determine a signature of the incident; compare the signature to at least one of a plurality of entries in an incident signature database; perform, when comparing determines that the signature corresponds to one or more of the plurality of entries, a root cause analysis of the incident using the corresponding one or more of the plurality of entries;
Step 2A: Prong two
This judicial exception is not integrated into a practical application because the additional elements ‘receive performance data originating from one or more of the plurality of network nodes; generate an incident alert including at least one of a result of the root cause analysis or a description of the incident; display the incident alert using an incident identification pane, and a root cause analysis pane showing similarities between the incident and a plurality of root causes, the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators; receive additional performance data originating from the one or more of the plurality of network nodes’ are merely adding insignificant extra-solution activity to the judicial exception (MPEP 2105.05(g)).
Step 2B
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘a computing platform communicatively coupled to a plurality of network nodes; the computing platform including a hardware processor and a system memory storing a software code and a machine learning predictive model having a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model; the hardware processor configured to execute the software code to; detect, using the machine learning predictive model having the plurality of parameters, a plurality of anomalous performance indicators in the performance data originating from the one or more of the plurality of network nodes; determine, using the plurality of anomalous performance indicators in an automated process, an occurrence of an incident, wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each anomalous indicator based on a deviation of each anomalous indicator from a respective behavior defined as being normal for that anomalous indicator; update, using the performance data including the plurality of anomalous performance indicators the plurality of parameters defining the shape of the machine learning predictive model; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes’ is directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). The machine learning predictive model is described at a high level such that it amounts to using a computer with a generic machine learning predictive model with only stating that the machine learning predictive model is used to detect anomalies and also mathematical concepts are involved in the parameter being calculated per the specification.
Regarding claim 40, the limitation ‘the root cause analysis pane further displays a dominant root cause of the plurality of root causes that influences the other ones of the plurality of root causes’ is merely adding insignificant extra-solution activity to the judicial exception (MPEP 2105.05(g)). In this case, displaying information.
Regarding claim 41, the limitation ‘the plurality of anomalous performance indicators are detected during a time interval, and wherein the plurality of anomalous performance indicators are identified as anomalous based on a comparison of respectively corresponding performance indicators during a previous time interval’ .
Regarding claim 42, the limitation ‘the time interval extends from a first time of day to a second time of day, and wherein the previous time interval extends from the first time of day to the second time of day on a previous day’ is a mental process - concept performed in the human mind by observation, evaluation, judgment, and/or opinion.
Regarding claim 43, the limitation ‘the machine learning predictive model uses a Holt-Winters method’ is a mathematical concept per the specification.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) are rejected under 35 U.S.C. 103 as being unpatentable over Palla et al. (USPN 20180321997A1) in view of Wang et al. (USPN 20190165988A1) in further view of Tanaka et al. (USPN 20190108082A1).
As per claim 21, Palla et al. discloses a system comprising: a computing platform communicatively coupled to a plurality of network nodes via a communication network (paragraph 0028 – a plurality of service computing systems connected to a plurality of different client computing systems through a network); the computing platform including a hardware processor and a system memory storing a software code (paragraphs 0142-0143 – discloses processors, computer readable media storing computer readable instructions); the hardware processor configured to execute the software code to: detect a plurality of anomalous performance indicators originating from one or more of the plurality of network nodes (paragraph 0051 – identifies any number of problems a computing system is experiencing in diagnostic data); determine, using the plurality of anomalous performance indicators in an automated process, an occurrence of an incident in real-time during the occurrence of the incident (paragraphs 0077-0078 – gathering/generating additional data regarding the problem or problem scenario); determine a signature of the incident (paragraphs 0092-0096,0102 – signature generation logic is generated based on the problem and other information); compare the signature to at least one of a plurality of entries in an incident signature database (paragraph 0103 – compares signatures with other signatures stored in a data store 465); perform, when comparing determines that the signature corresponds to one or more of the plurality of entries, a root cause analysis of the incident using the corresponding one or more of the plurality of entries (paragraphs 0110-0111 – signature shows the cause of the problem); generate an incident alert including at least one of a result of the root cause analysis or a description of the incident (paragraph 0116 – issue has been identified and suggested recovery action is displayed in a user interface, as shown in Fig 13D and paragraph 0113); display the incident alert using an incident identification pane (paragraph 0116 – FIG. 13D is similar to FIG. 13C, and similar items are similarly numbered. However, it can be seen in FIG. 13D that an issue 482 has been identified, along with a suggested recovery action 484. This can be done either locally on client computing system 106 (as described above) or it can be done by accessing one of the service computing systems (such as service computing system 102 described above) – Fig. 13D displays the issue and an recommended action); infer, using a machine learning predictive model and based on the result of the root cause analysis, a solution for performing at least one of a mitigation or a resolution of the incident (paragraph 0116 – issue has been identified and suggested recovery action and 0080 – discloses Identifying a root cause and recovery action can be done by accessing mappings or rules 359 that map between various items or combinations of diagnostic data and a root cause, or by accessing a dynamic model or machine learning system 337); execute, during the incident, the inferred solution to mitigate or resolve the incident; wherein executing the inferred solution includes outputting, via the communication network to at least one of the one or more of the plurality of network nodes, one or more instructions for mitigating or resolving the incident (paragraphs 0081,0110,0116 – issue has been identified and suggested recovery action executed automatically or semi-automatically and if successful; The recovery action may be performed automatically or semi-automatically, as indicated by block 413, or in other ways, as indicated by block 415, as disclosed in paragraph 0081).
Palla et al. fails to explicitly state a root cause analysis pane showing similarities between the incident and a plurality of root causes.
Palla et al. does disclose issue has been identified and suggested recovery action is displayed in a user interface in paragraphs 0113,0116.
Wang et al. discloses a root cause analysis pane showing similarities between the incident and a plurality of root causes in paragraph 0067 – the user interface 600a provides correlated root cause data in tabular format for display to a user. The user interface 600a includes a menu 605. The menu 605 may be similar to commonly used application menus and provides functionality for a variety of tasks to be performed in the application configures on a computing device. For example, the menu 605 includes a file sub-menu, a filter sub-menu, a sort sub-menu, a topology view sub-menu, an import/export sub-menu and a help sub-menu. Each sub-menu may further include a number of sub-menu selections that, when executed, perform various tasks related to the sub-menu functionality. For example, the filter sub-menu may allow users to filter the root cause data by network entity, failure probability, failure types, severity or root cause event. Upon selecting a filter condition, only the root cause data corresponding to the filter selections may be presented to the user. Similarly, upon selecting the topology view sub-menu, the user interface may display to the user a view of the root cause data in a network topology view instead of a view including root cause data formatted in a tabular view; paragraph 0070 - As further shown in FIG. 6A, the user interface 600a includes severity data 620. The severity data 620 may include data indicating the severity of the network entities failure due to the root cause failure. For example, as shown in FIG. 6A, the severity data 620 that is associated with the network entity “router_a:port0” port down failure indicates that the failure is a “High” severity failure. The severity settings and logic used to assign a particular severity setting to a failure event may be a user-configurable attribute of a root cause correlation system 110 and/or the user interface 600a. For example, severity levels may be associated with historic traffic levels through the network entity…
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include a user interface having a filter sub-menu to filter root cause and severity of the issue of Wang in an issue has been identified and suggested recovery action is displayed in a user interface of Palla. A person of ordinary skill in the art would have been motivated to make the modification because the displayed information provides the administrator with convenience for dealing with a root cause, as disclosed in paragraph 0360.
Palla et al. and Wang et al. fail to explicitly state wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each of the plurality of anomalous performance indicators based on a deviation of each anomalous performance indicator from a respective behavior defined as being normal for that anomalous performance indicator; the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators.
Palla et al. does disclose an issue has been identified is displayed in a user interface in paragraph 0116.
Tanaka et al. discloses wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each of the plurality of anomalous performance indicators based on a deviation of each anomalous performance indicator from a respective behavior defined as being normal for that anomalous performance indicator (paragraph 0087 - The management server 100 counts the number of event occurrences for each application (the number of pieces of the event information 114), sets a higher score to an application regarding which the number of event occurrences is smaller, and calculates the number-of-occurrences score used to display the application.; paragraph 0081 - Subsequently, the management server 100 increases the weighting of an application regarding which an event of high severity has occurred (step S40). More specifically, the management server 100 calculates a severity score used to display the application and a severity score used to display the event on the basis of the event information 114 of the application(s) extracted in step S10.); the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators; the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators in (paragraph 0093 - The management server 100 determines the sequential order to display applications based on the relevance score, the severity score, and the number-of-occurrences score. More specifically, the management server 100 determines the sequential order to display applications by: sorting the applications extracted in step S10 in the order of the relevance score; further sorting them in the order of the severity score if there are applications with the same relevance score; and further sorting them in the order of the number-of-occurrences score if there are applications with the same severity score).
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the ability to calculate and sort the severity score for each event of Tanaka in the an issue has been identified is displayed in a user interface of Palla. A person of ordinary skill in the art would have been motivated to make the modification because the severity score and the number-of-occurrences score are displayed and sorted/prioritized for analysis, as disclosed in paragraph 0104.
As per claims 23,31, Palla et al. discloses wherein the plurality of anomalous performance indicators are detected during a time interval, and wherein the plurality of anomalous performance indicators are identified as anomalous based on a comparison of respectively corresponding performance indicators during a previous time interval (paragraphs 0089-0091, 0112 – determine problems occurring at different times based on a comparison).
As per claims 24,32, Palla et al. discloses wherein the time interval extends from a first time of day to a second time of day, and wherein the previous time interval extends from the first time of day to the second time of day on a previous day (paragraphs 0089-0091,0112 – determine problems occurring at different times/dates).
As per claim 29, Palla et al. discloses a method for use by a system including a computing platform communicatively coupled to a plurality of network nodes via a communication network, the computing platform having a hardware processor and a system memory storing a software code, the method comprising: detecting a plurality of anomalous performance indicators originating from one or more of the plurality of network nodes (paragraph 0051 – identifies any number of problems a computing system is experiencing in diagnostic data); determining, using the plurality of anomalous performance indicators in an automated process, an occurrence of an incident in real-time during the occurrence of the incident (paragraphs 0077-0078 – gathering/generating additional data regarding the problem or problem scenario); determining a signature of the incident (paragraphs 0092-0096,0102 – signature generation logic is generated based on the problem and other information); comparing the signature to at least one of a plurality of entries in an incident signature database (paragraph 0103 – compares signatures with other signatures stored in a data store 465); performing, when comparing determines that the signature corresponds to one or more of the plurality of entries, a root cause analysis of the incident using the corresponding one or more of the plurality of entries (paragraphs 0110-0111 – signature shows the cause of the problem); generating an incident alert including at least one of a result of the root cause analysis or a description of the incident (paragraph 0116 – issue has been identified and suggested recovery action is displayed in a user interface, as shown in Fig 13D and paragraph 0113); displaying the incident alert using an incident identification pane (paragraph 0116 – FIG. 13D is similar to FIG. 13C, and similar items are similarly numbered. However, it can be seen in FIG. 13D that an issue 482 has been identified, along with a suggested recovery action 484. This can be done either locally on client computing system 106 (as described above) or it can be done by accessing one of the service computing systems (such as service computing system 102 described above) – Fig. 13D displays the issue and an recommended action); inferring, using a machine learning predictive model and based on the result of the root cause analysis, a solution for performing at least one of a mitigation or a resolution of the incident (paragraph 0116 – issue has been identified and suggested recovery action and 0080 – discloses Identifying a root cause and recovery action can be done by accessing mappings or rules 359 that map between various items or combinations of diagnostic data and a root cause, or by accessing a dynamic model or machine learning system 337); executing, during the incident, the solution to perform the at least one of the mitigation or the resolution; wherein executing the inferred solution includes outputting, via the communication network to at least one of the one or more of the plurality of network nodes, one or more instructions for mitigating or resolving the incident (paragraphs 0081,0110,0116 – issue has been identified and suggested recovery action executed automatically or semi-automatically and if successful; The recovery action may be performed automatically or semi-automatically, as indicated by block 413, or in other ways, as indicated by block 415, as disclosed in paragraph 0081).
Palla et al. fails to explicitly state a root cause analysis pane showing similarities between the incident and a plurality of root causes.
Palla et al. does disclose issue has been identified and suggested recovery action is displayed in a user interface in paragraphs 0113,0116.
Wang et al. discloses a root cause analysis pane showing similarities between the incident and a plurality of root causes in paragraph 0067 – the user interface 600a provides correlated root cause data in tabular format for display to a user. The user interface 600a includes a menu 605. The menu 605 may be similar to commonly used application menus and provides functionality for a variety of tasks to be performed in the application configures on a computing device. For example, the menu 605 includes a file sub-menu, a filter sub-menu, a sort sub-menu, a topology view sub-menu, an import/export sub-menu and a help sub-menu. Each sub-menu may further include a number of sub-menu selections that, when executed, perform various tasks related to the sub-menu functionality. For example, the filter sub-menu may allow users to filter the root cause data by network entity, failure probability, failure types, severity or root cause event. Upon selecting a filter condition, only the root cause data corresponding to the filter selections may be presented to the user. Similarly, upon selecting the topology view sub-menu, the user interface may display to the user a view of the root cause data in a network topology view instead of a view including root cause data formatted in a tabular view; paragraph 0070 - As further shown in FIG. 6A, the user interface 600a includes severity data 620. The severity data 620 may include data indicating the severity of the network entities failure due to the root cause failure. For example, as shown in FIG. 6A, the severity data 620 that is associated with the network entity “router_a:port0” port down failure indicates that the failure is a “High” severity failure. The severity settings and logic used to assign a particular severity setting to a failure event may be a user-configurable attribute of a root cause correlation system 110 and/or the user interface 600a. For example, severity levels may be associated with historic traffic levels through the network entity…- the severity data is inclusive of the score based on deviation from normal.
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include a user interface having a filter sub-menu to filter root cause and severity of the issue of Wang in an issue has been identified and suggested recovery action is displayed in a user interface of Palla. A person of ordinary skill in the art would have been motivated to make the modification because the displayed information provides the administrator with convenience for dealing with a root cause, as disclosed in paragraph 0360.
Palla et al. and Wang et al. fail to explicitly state wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each of the plurality of anomalous performance indicators based on a deviation of each anomalous performance indicator from a respective behavior defined as being normal for that anomalous performance indicator; the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators.
Palla et al. does disclose an issue has been identified is displayed in a user interface in paragraph 0116.
Tanaka et al. discloses wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each of the plurality of anomalous performance indicators based on a deviation of each anomalous performance indicator from a respective behavior defined as being normal for that anomalous performance indicator (paragraph 0087 - The management server 100 counts the number of event occurrences for each application (the number of pieces of the event information 114), sets a higher score to an application regarding which the number of event occurrences is smaller, and calculates the number-of-occurrences score used to display the application.; paragraph 0081 - Subsequently, the management server 100 increases the weighting of an application regarding which an event of high severity has occurred (step S40). More specifically, the management server 100 calculates a severity score used to display the application and a severity score used to display the event on the basis of the event information 114 of the application(s) extracted in step S10.); the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators; the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators in (paragraph 0093 - The management server 100 determines the sequential order to display applications based on the relevance score, the severity score, and the number-of-occurrences score. More specifically, the management server 100 determines the sequential order to display applications by: sorting the applications extracted in step S10 in the order of the relevance score; further sorting them in the order of the severity score if there are applications with the same relevance score; and further sorting them in the order of the number-of-occurrences score if there are applications with the same severity score).
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the ability to calculate and sort the severity score for each event of Tanaka in the an issue has been identified is displayed in a user interface of Palla. A person of ordinary skill in the art would have been motivated to make the modification because the severity score and the number-of-occurrences score are displayed and sorted/prioritized for analysis, as disclosed in paragraph 0104.
Claim(s) 25,33 are rejected under 35 U.S.C. 103 as being unpatentable over Palla et al. in view of Wang et al. in view of Tanaka et al. (USPN 20190108082A1) in further view of Doyle et al. (USPN 20100031156A1)
As per claims 25,33, Palla et al., Wang et al., and Tanaka et al. fail to explicitly state wherein the comparison is performed based on a Holt-Winters method.
Palla et al. does a machine learning system that identifies different problem-specific data given an identified problem or problem scenario in paragraph 0057.
Doyle et al. discloses wherein the comparison is performed based on a Holt-Winters method in paragraphs 0071-0074,0079-0085,0088,0089 – Holt winter is used to detect anomalies by comparing observed data of a particular time to data of a previous time.
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the holt-winters method for anomaly detection in Doyle in the machine learning system that identifies different problem-specific data of Palla. A person of ordinary skill in the art would have been motivated to make the modification because Holt-winters method is used for anomaly detection as disclosed in paragraph 0071.
Claim(s) 27,35 are rejected under 35 U.S.C. 103 as being unpatentable over Palla et al. in view of Wang et al. in view of Tanaka et al. (USPN 20190108082A1) in further view of Marwah et al. (USPN 20200134175A1)
As per claims 27,35, Palla et al., Wang et al., and Tanaka et al. fail to explicitly state wherein the occurrence of the incident is determined using a principal component analysis.
Palla et al. does disclose a machine learning system that identifies different problem-specific data given an identified problem or problem scenario in paragraph 0057.
Marwah et al. discloses the occurrence of the incident is determined using a principal component analysis in paragraph 0058 – a principal component analysis is used to determine abnormal behavior.
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the principal component analysis being used to determine abnormal behavior in Marwah in the machine learning system that identifies different problem-specific data of Palla. A person of ordinary skill in the art would have been motivated to make the modification because principal component analysis is a type of machine learning technique that determines abnormal behavior as disclosed in paragraph 0058.
Claim(s) 37-38 are rejected under 35 U.S.C. 103 as being unpatentable over Palla et al. in view of Wang et al. in view of Tanaka et al. (USPN 20190108082A1) in further view of Vasseur et al. (USPN 20190213504A1).
As per claim 37, Palla et al., Wang et al., and Tanaka et al. fail to explicitly state wherein the machine learning predictive model includes a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model, wherein detecting the plurality of anomalous performance indicators is performed using the machine learning predictive model, the plurality of anomalous performance indicators being included in performance data originating from the one or more of the plurality of network nodes, and wherein the hardware processor is further configured to execute the software code to: retrain the machine learning predictive model using the performance data including the plurality of anomalous performance indicators to update the plurality of parameters; receive additional performance data originating from the one or more of the plurality of network nodes; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes.
Palla et al. does disclose a machine learning system that identifies different problem-specific data given an identified problem or problem scenario in paragraph 0057.
Vasseur et al. discloses the machine learning predictive model includes a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model, wherein detecting the plurality of anomalous performance indicators is performed using the machine learning predictive model, the plurality of anomalous performance indicators being included in performance data originating from the one or more of the plurality of network nodes, and wherein the hardware processor is further configured to execute the software code to: retrain the machine learning predictive model using the performance data including the plurality of anomalous performance indicators to update the plurality of parameters; receive additional performance data originating from the one or more of the plurality of network nodes; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes in paragraphs 0040,0062,0063,0068,0074,0079 - In various embodiments, network assurance process 248 may employ one or more supervised, unsupervised, or semi-supervised machine learning models. Generally, supervised learning entails the use of a training set of data, as noted above, that is used to train the model to apply labels to the input data. For example, the training data may include sample network observations that do, or do not, violate a given network health status rule and are labeled as such.; The techniques herein allow for the training of machine learning-based, predictive failure models in a cloud-based environment using gathered telemetry regarding wireless AP radio failures (e.g., time, type of failure, etc.) that is augmented with network and AP state information.; In order to train the machine learning model with appropriate data, AP failure collector 406 may use complex logic to select the actual failures, that is, software failures leading to a reset, from these events and filter out all other resets (e.g., resets triggered by configuration changes, etc.). Then, for each failure event, AP failure collector 406 may gather the set of required input data from various sources such as logs, and other JSON fields reporting the actual states of the AP before the failure took place, such parameters being used as input feature candidate in the predictive engine.; In another embodiment, re-training of a failure prediction model 410 can be triggered on-the-fly by cloud service 302 upon detecting new failures in the network. For example, a custom signal can then be sent by the failing network entity 404 (e.g., AP, or the WLC with which the AP is associated), so as to signal the failure, accompanied with the required logs and other files reporting the status of the AP before the failure. In one embodiment, such notification is systematic., , the retrained model is used for the next iteration of failure data)
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the failure prediction model that is trained and retrained in Vasseur in the machine learning system that identifies different problem-specific data of Palla. A person of ordinary skill in the art would have been motivated to make the modification because machine learning system/model are constructed by training the model as disclosed in paragraphs 0040,0062.
As per claim 38, Palla et al., Wang et al., and Tanaka et al. fail to explicitly state wherein the machine learning predictive model includes a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model, wherein detecting the plurality of anomalous performance indicators is performed using the machine learning predictive model, the plurality of anomalous performance indicators being included in performance data originating from the one or more of the plurality of network nodes, and wherein the hardware processor is further configured to execute the software code to: retrain the machine learning predictive model using the performance data including the plurality of anomalous performance indicators to update the plurality of parameters; receive additional performance data originating from the one or more of the plurality of network nodes; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes.
Palla et al. does disclose a machine learning system that identifies different problem-specific data given an identified problem or problem scenario in paragraph 0057.
Vasseur et al. discloses the machine learning predictive model includes a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model, wherein detecting the plurality of anomalous performance indicators is performed using the machine learning predictive model, the plurality of anomalous performance indicators being included in performance data originating from the one or more of the plurality of network nodes, and wherein the hardware processor is further configured to execute the software code to: retrain the machine learning predictive model using the performance data including the plurality of anomalous performance indicators to update the plurality of parameters; receive additional performance data originating from the one or more of the plurality of network nodes; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes in paragraphs 0040,0062,0063,0068,0074,0079 - In various embodiments, network assurance process 248 may employ one or more supervised, unsupervised, or semi-supervised machine learning models. Generally, supervised learning entails the use of a training set of data, as noted above, that is used to train the model to apply labels to the input data. For example, the training data may include sample network observations that do, or do not, violate a given network health status rule and are labeled as such.; The techniques herein allow for the training of machine learning-based, predictive failure models in a cloud-based environment using gathered telemetry regarding wireless AP radio failures (e.g., time, type of failure, etc.) that is augmented with network and AP state information.; In order to train the machine learning model with appropriate data, AP failure collector 406 may use complex logic to select the actual failures, that is, software failures leading to a reset, from these events and filter out all other resets (e.g., resets triggered by configuration changes, etc.). Then, for each failure event, AP failure collector 406 may gather the set of required input data from various sources such as logs, and other JSON fields reporting the actual states of the AP before the failure took place, such parameters being used as input feature candidate in the predictive engine.; In another embodiment, re-training of a failure prediction model 410 can be triggered on-the-fly by cloud service 302 upon detecting new failures in the network. For example, a custom signal can then be sent by the failing network entity 404 (e.g., AP, or the WLC with which the AP is associated), so as to signal the failure, accompanied with the required logs and other files reporting the status of the AP before the failure. In one embodiment, such notification is systematic., the retrained model is used for the next iteration of failure data)
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the failure prediction model that is trained and retrained in Vasseur in the machine learning system that identifies different problem-specific data of Palla. A person of ordinary skill in the art would have been motivated to make the modification because machine learning system/model are constructed by training the model as disclosed in paragraphs 0040,0062.
Claim(s) 39,41,42 are rejected under 35 U.S.C. 103 as being unpatentable over Palla et al. in view of Wang et al. in view of Vasseur et al. (USPN 20190213504A1) in further view of Tanaka et al. (USPN 20190108082A1).
As per claim 39, Palla et al. discloses a system comprising: a computing platform communicatively coupled to a plurality of network nodes (paragraph 0028 – a plurality of service computing systems connected to a plurality of different client computing systems through a network); the computing platform including a hardware processor and a system memory storing a software code (paragraphs 0142-0143 – discloses processors, computer readable media storing computer readable instructions); the hardware processor configured to execute the software code to: receive performance data originating from one or more of the plurality of network nodes (paragraph 0051 – identifies any number of problems a computing system is experiencing in diagnostic data); detect, using the machine learning predictive model having the plurality of parameters, a plurality of anomalous performance indicators in the performance data originating from the one or more of the plurality of network nodes (paragraph 0057 - Accessing mappings or rules is indicated by block 254. It can also access a dynamic model or machine learning system that identifies different problem-specific data, given an identified problem or problem scenario.); determine, using the plurality of anomalous performance indicators in an automated process, an occurrence of an incident in real-time during the occurrence of the incident (paragraphs 0077-0078 – gathering/generating additional data regarding the problem or problem scenario); determine a signature of the incident (paragraphs 0092-0096,0102 – signature generation logic is generated based on the problem and other information); compare the signature to at least one of a plurality of entries in an incident signature database (paragraph 0103 – compares signatures with other signatures stored in a data store 465); perform, when comparing determines that the signature corresponds to one or more of the plurality of entries, a root cause analysis of the incident using the corresponding one or more of the plurality of entries (paragraphs 0110-0111 – signature shows the cause of the problem); generate an incident alert including at least one of a result of the root cause analysis or a description of the incident (paragraph 0116 – issue has been identified and suggested recovery action is displayed in a user interface, as shown in Fig 13D and paragraph 0113); display the incident alert using an incident identification pane (paragraph 0116 – FIG. 13D is similar to FIG. 13C, and similar items are similarly numbered. However, it can be seen in FIG. 13D that an issue 482 has been identified, along with a suggested recovery action 484. This can be done either locally on client computing system 106 (as described above) or it can be done by accessing one of the service computing systems (such as service computing system 102 described above) – Fig. 13D displays the issue and an recommended action);.
Palla et al. fails to explicitly state a root cause analysis pane showing similarities between the incident and a plurality of root causes.
Palla et al. does disclose issue has been identified and suggested recovery action is displayed in a user interface in paragraphs 0113,0116.
Wang et al. discloses a root cause analysis pane showing similarities between the incident and a plurality of root causes in paragraph 0067 – the user interface 600a provides correlated root cause data in tabular format for display to a user. The user interface 600a includes a menu 605. The menu 605 may be similar to commonly used application menus and provides functionality for a variety of tasks to be performed in the application configures on a computing device. For example, the menu 605 includes a file sub-menu, a filter sub-menu, a sort sub-menu, a topology view sub-menu, an import/export sub-menu and a help sub-menu. Each sub-menu may further include a number of sub-menu selections that, when executed, perform various tasks related to the sub-menu functionality. For example, the filter sub-menu may allow users to filter the root cause data by network entity, failure probability, failure types, severity or root cause event. Upon selecting a filter condition, only the root cause data corresponding to the filter selections may be presented to the user. Similarly, upon selecting the topology view sub-menu, the user interface may display to the user a view of the root cause data in a network topology view instead of a view including root cause data formatted in a tabular view; paragraph 0070 - As further shown in FIG. 6A, the user interface 600a includes severity data 620. The severity data 620 may include data indicating the severity of the network entities failure due to the root cause failure. For example, as shown in FIG. 6A, the severity data 620 that is associated with the network entity “router_a:port0” port down failure indicates that the failure is a “High” severity failure. The severity settings and logic used to assign a particular severity setting to a failure event may be a user-configurable attribute of a root cause correlation system 110 and/or the user interface 600a. For example, severity levels may be associated with historic traffic levels through the network entity…- the severity data is inclusive of the score based on deviation from normal.
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include a user interface having a filter sub-menu to filter root cause and severity of the issue of Wang in an issue has been identified and suggested recovery action is displayed in a user interface of Palla. A person of ordinary skill in the art would have been motivated to make the modification because the displayed information provides the administrator with convenience for dealing with a root cause, as disclosed in paragraph 0360.
Palla et al., and Wang et al. fail to explicitly state a machine learning predictive model having a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model; update using the performance data including the plurality of anomalous performance indicators, the plurality of parameters defining the shape of the machine learning predictive model; receive additional performance data originating from the one or more of the plurality of network nodes; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes.
Palla et al. does disclose a machine learning system that identifies different problem-specific data given an identified problem or problem scenario in paragraph 0057.
Vasseur et al. discloses a machine learning predictive model having a plurality of parameters calculated using training data, the plurality of parameters defining a shape of the machine learning predictive model; update using the performance data including the plurality of anomalous performance indicators, the plurality of parameters defining the shape of the machine learning predictive model; receive additional performance data originating from the one or more of the plurality of network nodes; and detect, using the machine learning predictive model having the updated plurality of parameters, additional plurality of anomalous performance indicators in the additional performance data originating from the one or more of the plurality of network nodes in paragraphs 0040,0062,0063,0068,0074,0079 - In various embodiments, network assurance process 248 may employ one or more supervised, unsupervised, or semi-supervised machine learning models. Generally, supervised learning entails the use of a training set of data, as noted above, that is used to train the model to apply labels to the input data. For example, the training data may include sample network observations that do, or do not, violate a given network health status rule and are labeled as such.; The techniques herein allow for the training of machine learning-based, predictive failure models in a cloud-based environment using gathered telemetry regarding wireless AP radio failures (e.g., time, type of failure, etc.) that is augmented with network and AP state information.; In order to train the machine learning model with appropriate data, AP failure collector 406 may use complex logic to select the actual failures, that is, software failures leading to a reset, from these events and filter out all other resets (e.g., resets triggered by configuration changes, etc.). Then, for each failure event, AP failure collector 406 may gather the set of required input data from various sources such as logs, and other JSON fields reporting the actual states of the AP before the failure took place, such parameters being used as input feature candidate in the predictive engine.; In another embodiment, re-training of a failure prediction model 410 can be triggered on-the-fly by cloud service 302 upon detecting new failures in the network. For example, a custom signal can then be sent by the failing network entity 404 (e.g., AP, or the WLC with which the AP is associated), so as to signal the failure, accompanied with the required logs and other files reporting the status of the AP before the failure. In one embodiment, such notification is systematic., the retrained model is used for the next iteration of failure data)
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the failure prediction model that is trained and retrained in Vasseur in the machine learning system that identifies different problem-specific data of Palla. A person of ordinary skill in the art would have been motivated to make the modification because machine learning system/model are constructed by training the model as disclosed in paragraphs 0040,0062.
Palla et al., Wang et al., and Vasseur et al. fail to explicitly state wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each of the plurality of anomalous performance indicators based on a deviation of each anomalous performance indicator from a respective behavior defined as being normal for that anomalous performance indicator; the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators.
Palla et al. does disclose an issue has been identified is displayed in a user interface in paragraph 0116.
Tanaka et al. discloses wherein the occurrence of the incident is determined based on how many anomalous performance indicators are detected and a respective score assigned to each of the plurality of anomalous performance indicators based on a deviation of each anomalous performance indicator from a respective behavior defined as being normal for that anomalous performance indicator (paragraph 0087 - The management server 100 counts the number of event occurrences for each application (the number of pieces of the event information 114), sets a higher score to an application regarding which the number of event occurrences is smaller, and calculates the number-of-occurrences score used to display the application.; paragraph 0081 - Subsequently, the management server 100 increases the weighting of an application regarding which an event of high severity has occurred (step S40). More specifically, the management server 100 calculates a severity score used to display the application and a severity score used to display the event on the basis of the event information 114 of the application(s) extracted in step S10.); the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators; the incident identification pane configured to enable a system user to select filtering criteria for displaying anomalous performance indicators based on the respective score assigned to each of the plurality of anomalous performance indicators in (paragraph 0093 - The management server 100 determines the sequential order to display applications based on the relevance score, the severity score, and the number-of-occurrences score. More specifically, the management server 100 determines the sequential order to display applications by: sorting the applications extracted in step S10 in the order of the relevance score; further sorting them in the order of the severity score if there are applications with the same relevance score; and further sorting them in the order of the number-of-occurrences score if there are applications with the same severity score).
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the ability to calculate and sort the severity score for each event of Tanaka in the an issue has been identified is displayed in a user interface of Palla. A person of ordinary skill in the art would have been motivated to make the modification because the severity score and the number-of-occurrences score are displayed and sorted/prioritized for analysis, as disclosed in paragraph 0104.
As per claim 41, Palla et al. discloses wherein the plurality of anomalous performance indicators are detected during a time interval, and wherein the plurality of anomalous performance indicators are identified as anomalous based on a comparison of respectively corresponding performance indicators during a previous time interval (paragraphs 0089-0091, 0112 – determine problems occurring at different times based on a comparison).
As per claim 42, Palla et al. discloses wherein the time interval extends from a first time of day to a second time of day, and wherein the previous time interval extends from the first time of day to the second time of day on a previous day (paragraphs 0089-0091,0112 – determine problems occurring at different times/dates).
Claim(s) 40 is rejected under 35 U.S.C. 103 as being unpatentable over Palla et al. (USPN 20180321997A1) in view of Wang et al. (USPN 20190165988A1) in view of Vasseur et al. (USPN 20190213504A1) in view of Tanaka et al. (USPN 20190108082A1) in further view of Onitsuka et al. (USPN 20120102362A1).
As per claim 40, Palla et al., Wang et al., Vasseur et al., and Tanaka et al. fail to explicitly state wherein the root cause analysis pane further displays a dominant root cause of the plurality of root causes that influences the other ones of the plurality of root causes.
Palla et al. does disclose issue has been identified and suggested recovery action is displayed in a user interface in paragraphs 0113,0116.
Onitsuka et al. discloses wherein the root cause analysis pane further displays a dominant root cause of the plurality of root causes that influences the other ones of the plurality of root causes in paragraphs 0351-0355 and Figure 45 – root cause analysis result screen displaying rank, root cause node, root cause component and certainty factor, the list is sorted based on the certainty factor which is displayed as a percentage and as a rank of 1-3, paragraph 0353 states this; also Fig 46 and paragraph 0356 discloses Detailed content of a selected root cause is displayed in the RCA result detailed display plane. For example, when one root cause is selected from the list display of the root causes of the RCA result type plane 461, detailed content of the root cause is displayed in the RCA result detailed display plane 462. In the example shown in FIG. 46, a root cause 4612 is selected and details of the root cause 4612 are displayed.
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include root cause analysis result screen displaying rank, root cause node, root cause component, certainty factor, and present analysis result of Onitsuka in issue has been identified and suggested recovery action is displayed in a user interface of Palla. A person of ordinary skill in the art would have been motivated to make the modification because the displayed information provides the administrator with convenience for finding the best root cause based on rank compared to the other root causes, as disclosed in paragraph 0360.
Claim(s) 43 is rejected under 35 U.S.C. 103 as being unpatentable over Palla et al. in view of Wang et al. in view of Vasseur et al. in view of Tanaka et al. (USPN 20190108082A1) in further view of Doyle et al. (USPN 20100031156A1).
As per claim 43, Palla et al., Wang et al., Vasseur et al., and Tanaka et al. fail to explicitly state the machine learning predictive model uses a Holt-Winters method.
Palla et al. does a machine learning system that identifies different problem-specific data given an identified problem or problem scenario in paragraph 0057.
Doyle et al. discloses wherein the comparison is performed based on a Holt-Winters method in paragraphs 0071-0074,0079-0085,0088,0089 – Holt winter is used to detect anomalies by comparing observed data of a particular time to data of a previous time.
Accordingly, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the holt-winters method for anomaly detection in Doyle in the machine learning system that identifies different problem-specific data of Palla. A person of ordinary skill in the art would have been motivated to make the modification because Holt-winters method is used for anomaly detection as disclosed in paragraph 0071.
Response to Arguments
Applicant's amendments and arguments filed 10/01/2025 have been fully considered. The newly added limitations have been rejected. Please see the above rejection. The 101 rejection still stands. Concerning Applicant’s argument of the 101 rejection, the amended independent claims are still directed to an abstract and have not overcome the 101 rejection. The ‘determining…the occurrence of the incident in real-time during the occurrence of the incident’ is able to performed in the human mind. The ‘machine learning predictive model to infer’ is considered to be mere instructions to apply an exception 2106.05(f) because a computer is being used to run a machine learning predictive model in order to help determine a solution for the incident and the machine learning predictive model as well as the updating is considered to be generic. The reference to Enfish, LLC v. Microsoft Corp. et al. has been considered; however, there is no indication of a specific improvement to computer capabilities. The computer is being used as a tool. The reference to McRo, Inc. v. Bandai Namco Games Am., Inc. has been considered; however, there is no improvement to the relevant technology viewed by the Examiner indicated in the claims and specification. The reference to example 39 has been considered; however, for claim 21 the information received by the machine learning predictive model is used by a computer system to execute a solution to mitigate or resolve the incident. Example 39 is only dealing the training of a neural network. As previously stated the present application is closer to example 47. The references to the PTAB Appeals and Examiner 47 have been considered; however, they are not persuasive. There are no additional elements viewed to overcome the 101 rejection.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Yolanda L Wilson whose telephone number is (571)272-3653. The examiner can normally be reached M-F (7:30 am - 4 pm).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bryce Bonzo can be reached on 571-272-3655. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Yolanda L Wilson/Primary Examiner, Art Unit 2113
Prosecution Insights