DETAILED ACTION
This Office Action is sent in response to Applicant’s Communication received 12/28/2023 for application number 18/399,161.
Claims 1-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 20 rejected under 35 U.S.C. 101 because the broadest reasonable interpretation of “machine-readable media” in light of the specification includes transitory signals. Applicant’s specification states a “machine-readable medium,” includes, “any medium that is capable of storing, encoding, or carrying instructions for execution,” which encompasses transitory signals. Transitory propagating signals are non-statutory subject matter. In re Nuijten, 500 F.3d 1346, 1356-57, 84 U.S.P.Q.2d 1495, 1502 (Fed. Cir. 2007) (transitory embodiments are not directed to statutory subject matter). See also Subject Matter Eligibility of Computer Readable Media, 1351 Off. Gaz. Pat. Office 212 (Feb. 23, 2010).
Claims 1-19 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.:
Independent claim 1 (the Examiner notes this analysis would also apply to claim 20 if that claim were directed to statutory subject matter) recites:
A method comprising: obtaining a first graph representation of a dynamically evolving graph at a first time; obtaining candidate second graph representations for the dynamically evolving graph at a second time; determining, with a graph neural network (GNN) of a statistical model for graph prediction, a first graph embedding of the first graph representation and second graph embeddings of the candidate second graph representations; determining, with a feedforward neural network (FNN) of the statistical model for graph prediction, a forward image of the first graph embedding; determining vector differences between a first vector comprising the forward image of the first graph embedding and second vectors comprising the second graph embeddings ; and determining, with a statistical distribution of the statistical model, relative probabilities of the candidate second graph representations based on the vector differences.
(2A, prong 1) The underlined portions of the claim recite an abstract idea, specifically mathematical calculations and equations. Applicant’s specification (para. 0021 as published) describes that determining embeddings of graphs uses GraphSAGE (see pages 3-6 of Hamilton et al. Inductive Representation Learning on Large Graphs, NPL [9] in IDS of 2/26/2024), which are a series of mathematical calculations. The specification further describes determining a forward image of the embedding, determining vector differences, and determining a statistical probability as a series of equations at paragraphs 25-28 (as published). Therefore, the broadest reasonable interpretation of the underlined portions of the claim are a series of mathematical calculations and equations.
(2A, prong 2) This judicial exception is not integrated into a practical application. The claims recite the additional limitation of [a] obtaining a first and second graph. This limitation is insignificant extra-solution activity because it acts as mere necessary data gathering for the abstract idea. Even when all of the additional elements are considered in ordered combination with the recited abstract idea, the claim as a whole does not integrate the abstract idea into a practical application because the additional elements only add insignificant extra-solution activity to the abstract idea.
(2B) The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception. Additional limitation [a] is well-understood, routine, and conventional, analogous to receiving or transmitting data over a network, e.g., using the Internet to gather data. See MPEP 2106.05(d) citing Intellectual Ventures v. Symantec, 838 F.3d 1307, 1321; 120 USPQ2d 1353, 1362 (Fed. Cir. 2016). Even when all of the additional elements are considered in ordered combination with the recited abstract idea, the claim as a whole does not amount to significantly more than the abstract idea itself because they only add insignificant extra-solution activity that is well-understood, routine, and conventional to the mathematical calculations and equations.
With respect to dependent claims 2-5, (2A, prong 1) these claims add additional mathematical calculations to the other mathematical calculations.
With respect to dependent claims 6-10, (2A, prong 2) these claims recite the additional elements of [b] the graph representing computer network assets and connections from security incident data, and selecting a mitigating action like sending warnings or notifying authorities, and monitoring the computer network for security data. These additional elements do not integrate the abstract idea into a practical application because they are field of use limitations: the limitations merely confine the use of the mathematical calculations and equations to the field of network security. Even when all of the additional elements are considered in ordered combination with the recited abstract idea, the claim as a whole does not integrate the abstract idea into a practical application because the additional elements only add insignificant extra-solution activity and field of use limitations to the abstract idea. (2A, prong 2) additional limitation [b] does not amount to significantly more than the abstract idea itself because it is a field of use limitation, as explained above. Even when all of the additional elements are considered in ordered combination with the recited abstract idea, the claim as a whole does not amount to significantly more than the abstract idea itself because they only add insignificant extra-solution activity that is well-understood, routine, and conventional and field of use limitations to the mathematical calculations and equations.
With respect to dependent claims 11-12, (2A, prong 1) these claims recite the additional elements of [c] the second graph representations are randomly changed graphs and [d] sampling graphs from historical data. These elements are additional abstract idea elements, particularly mental processes: a human can randomly change a graph (like delete or add nodes or edges, etc.), and sample a graph from historical data.
Independent claim 13 recites:
A system comprising: one or more computer processors; and one or more machine-readable media storing processor-readable instructions which, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising: obtaining training data pairs comprising a first graph representation and a second graph representation of a time series of graph representations of a dynamically evolving graph, the second graph representation following the first graph representation in the time series; creating a statistical model for dynamic graph prediction by jointly training, by backpropagation of gradients, a graph neural network (GNN) and a multi-layer perceptron (FNN) to maximize, based on a statistical distribution, a joint probability of vector differences, aggregated over the training data pairs, between a first vector comprising a forward image of a first graph embedding determined from the first graph representation and a second vector comprising a second graph embedding determined from the second graph representation of the respective training data pair, wherein the GNN is used to determine the first and second graph embeddings for the training data pairs and the FNN is used to determine the forward images of the first graph embeddings; and using the statistical model for dynamic graph representation to determine, for an observed graph representation of an observed dynamically evolving graph at a first observation time, relative probabilities of candidate graph representations for the observed dynamically evolving graph at a second observation time.
(2A, prong 1) The underlined portions of the claim recite an abstract idea, specifically mathematical calculations and equations. Applicant’s specification (para. 0021 as published) describes training and determining embeddings of graphs uses GraphSAGE (see pages 3-6 of Hamilton et al. Inductive Representation Learning on Large Graphs, NPL [9] in IDS of 2/26/2024), which are a series of mathematical calculations. The specification further describes determining a forward image of the embedding, determining vector differences, and determining a statistical probability as a series of equations at paragraphs 25-28 (as published).
(2A, prong 2) This judicial exception is not integrated into a practical application. The claims recite the additional elements of [a] obtaining a first and second graphs and [b] a processor. Element [a] limitation is insignificant extra-solution activity because it acts as mere necessary data gathering for the abstract idea. Element [b] is a mere instruction to apply the exception because it merely adds generic computer hardware to the abstract idea after-the-fact. Even when all of the additional elements are considered in ordered combination with the recited abstract idea, the claim as a whole does not integrate the abstract idea into a practical application because the additional elements only add insignificant extra-solution activity and mere instructions to apply the exception to the abstract idea.
(2B) The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception. Additional limitation [a] is well-understood, routine, and conventional, analogous to receiving or transmitting data over a network, e.g., using the Internet to gather data. See MPEP 2106.05(d) citing Intellectual Ventures v. Symantec, 838 F.3d 1307, 1321; 120 USPQ2d 1353, 1362 (Fed. Cir. 2016). Element [b] is a mere instruction to apply the exception, as explained above. Even when all of the additional elements are considered in ordered combination with the recited abstract idea, the claim as a whole does not amount to significantly more than the abstract idea itself because they only add insignificant extra-solution activity that is well-understood, routine, and conventional and mere instructions to apply the exception to the mathematical calculations and equations.
With respect to dependent claims 14-15, (2A, prong 1) these claims add additional mathematical calculations to the other mathematical calculations.
With respect to dependent claims 16-19, (2A, prong 2) these claims recite the additional elements of [c] the graph representing computer network assets and connections from security incident data, and selecting a mitigating action like sending warnings or notifying authorities, and monitoring the computer network for security data. These additional elements do not integrate the abstract idea into a practical application because they are field of use limitations: the limitations merely confine the use of the mathematical calculations and equations to the field of network security. Even when all of the additional elements are considered in ordered combination with the recited abstract idea, the claim as a whole does not integrate the abstract idea into a practical application because the additional elements only add insignificant extra-solution activity, mere instructions to apply the exception, and field of use limitations to the abstract idea. (2A, prong 2) additional limitation [c] does not amount to significantly more than the abstract idea itself because it is a field of use limitation, as explained above. Even when all of the additional elements are considered in ordered combination with the recited abstract idea, the claim as a whole does not amount to significantly more than the abstract idea itself because they only add insignificant extra-solution activity that is well-understood, routine, and conventional, mere instructions to apply the exception, and field of use limitations to the mathematical calculations and equations.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1-5, 12-15, and 20 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Deng et al. Graph Neural Network-Based Anomaly Detection in Multivariate Time Series (NPL [U], see Notice of References Cited).
In reference to claim 1, Deng discloses a method comprising: obtaining a first graph representation of a dynamically evolving graph at a first time; obtaining candidate second graph representations for the dynamically evolving graph at a second time (graph data over a plurality of times is obtained, 3.1 Problem Statement, page 4029); determining, with a graph neural network (GNN) of a statistical model for graph prediction, a first graph embedding of the first graph representation and second graph embeddings of the candidate second graph representations (embeddings of graphs are determined, 3.2 – 3.4, pages 4029-30); determining, with a feedforward neural network (FNN) of the statistical model for graph prediction, a forward image of the first graph embedding (first embedding is forecast to the future, 3.5 Graph Attention Based Forecasting, page 4030); determining vector differences between a first vector comprising the forward image of the first graph embedding and second vectors comprising the second graph embeddings; and determining, with a statistical distribution of the statistical model, relative probabilities of the candidate second graph representations based on the vector differences (differences between embedding vector of predicted graph and embedding vector of second graphs, i.e. graphs at plurality of times, is determined and scores deviation value, which is a relative probability, for each time, 3.6 Graph Deviation Scoring, page 4030-31).
In reference to claim 2, Deng discloses the method of claim 1, wherein the statistical model has been trained by maximum likelihood estimation on training data pairs of graph representations of a dynamically evolving graph at two respective times (training uses mean squared error, which is a type of maximum likelihood estimation, 3.5 Graph Attention Based Forecasting, page 4030).
In reference to claim 3, Deng discloses the method of claim 2, wherein the maximum likelihood estimation comprises jointly training the GNN and FNN to maximize, based on the statistical distribution, a joint probability of vector differences, aggregated over the training data pairs, between a vector comprising a forward image of a graph embedding of a first graph representation of the respective training data pair and a vector comprising a graph embedding of a second graph representation of the respective training data pair (see the training process under 3. Proposed Framework, pages 4029-31).
In reference to claim 4, Deng discloses the method of claim 1, wherein the statical distribution comprises a multivariate normal distribution (training data is normal, so the statistical distribution would be normal, 3.1 Problem Statement, 4029).
In reference to claim 5, Deng discloses the method of claim 4, wherein the multivariate normal distribution is a standard normal distribution (training data is normal, so the statistical distribution would be normal, 3.1 Problem Statement, 4029).
In reference to claim 12, Deng discloses the method of claim 1, wherein obtaining the candidate second graph representations comprises: sampling graphs from a set of graphs according to a distribution over the set derived from historical graph evolution data; and generating the candidate second graph representations from the sampled graphs (second graphs are historic graphs over time, 3.1 Problem Statement, page 4029).
In reference to claim 13, Deng discloses a system comprising: one or more computer processors; and one or more machine-readable media storing processor-readable instructions which, when executed by the one or more computer processors (4.4 Experimental Setup, pages 4031-32), cause the one or more computer processors to perform operations comprising: obtaining training data pairs comprising a first graph representation and a second graph representation of a time series of graph representations of a dynamically evolving graph, the second graph representation following the first graph representation in the time series (graph data over a plurality of times is obtained, 3.1 Problem Statement, page 4029); creating a statistical model for dynamic graph prediction by jointly training, by backpropagation of gradients, a graph neural network (GNN) and a multi-layer perceptron (FNN) to maximize, based on a statistical distribution, a joint probability of vector differences, aggregated over the training data pairs (training uses mean squared error, 3.5 Graph Attention Based Forecasting, page 4030), between a first vector comprising a forward image of a first graph embedding determined from the first graph representation and a second vector comprising a second graph embedding determined from the second graph representation of the respective training data pair (see the training process under 3. Proposed Framework, pages 4029-31), wherein the GNN is used to determine the first and second graph embeddings for the training data pairs and the FNN is used to determine the forward images of the first graph embeddings (GNN determines embeddings, 3.3-3.4, pages 4029-4030, and feedforward attention network forecasts, 3.5, page 4030); an using the statistical model for dynamic graph representation to determine, for an observed graph representation of an observed dynamically evolving graph at a first observation time, relative probabilities of candidate graph representations for the observed dynamically evolving graph at a second observation time (differences between embedding vector of predicted graph and embedding vector of second graphs, i.e. graphs at plurality of times, is determined and scores deviation value, which is a relative probability, for each time, 3.6 Graph Deviation Scoring, page 4030-31).
In reference to claim 14, Deng discloses the system of claim 13, wherein using the statistical model to determine the relative probabilities of the candidate graph representations comprises: determining, with the GNN, an observed graph embedding from the observed graph representation and candidate graph embeddings from the candidate graph representations; determining, with the FNN, a forward image of the observed graph embedding; determining vector differences between a vector comprising the forward image of the observed graph embedding and vectors comprising the candidate graph embeddings; and determining the relative probabilities of the candidate graph representations with the statistical distribution based on the vector differences (see the training process under 3. Proposed Framework, pages 4029-31).
In reference to claim 15, Deng discloses the system of claim 13, wherein the statical distribution comprises a multivariate normal distribution (training data is normal, so the statistical distribution would be normal, 3.1 Problem Statement, 4029).
In reference to claim 20, this claim is directed to a computer-readable medium associated with the method claimed in claim 1 and is therefore rejected under a similar rationale.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 6-10 and 16-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Deng et al. Graph Neural Network-Based Anomaly Detection in Multivariate Time Series (NPL [U], see Notice of References Cited) as applied to claims 1 and 13 above, and further in view of Cheng et al. (US 20210232918 A1).
In reference to claim 6, Deng does not explicitly teach the method of claim 1, wherein nodes of the dynamically evolving graph represent assets of a computer network, and wherein edges of the dynamically evolving graph represent connections and associations between the assets.
Chen teaches the method of claim 1, wherein nodes of the dynamically evolving graph represent assets of a computer network, and wherein edges of the dynamically evolving graph represent connections and associations between the assets (input graph is of computer network, with nodes as systems and edges as communications, para. 0022).
It would have been obvious to one of ordinary skill in art, having the teachings of Deng and Chen before the earliest effective filing date, to modify the graph of Deng to include the computer network graph of Chen.
One of ordinary skill in the art would have been motivated to modify the graph of Deng to include the computer network graph of Chen because it would allow the anomaly detection of Deng to extent to other types of anomalies, like computer networks.
In reference to claim 7, Chen further teaches the method of claim 6, wherein obtaining the graph representation comprises: receiving security data associated with a security incident in the computer network associated with the first time, the data comprising security alerts involved in the security incident (network security incident data can be received, para. 0059-61, 0022); constructing a graph dataset based on the data; and generating the first graph representation based on the graph dataset (graph is created from network data and input to GNN, para. 0022).
In reference to claim 8, Chen further teaches the method of claim 7, further comprising: selecting, based on the relative probabilities and on security risks associated with the candidate second graph representations, one of the second graph representations for mitigating action (identified anomaly can be used to mitigate action, para. 0020-25).
In reference to claim 9, Chen further teaches the method of claim 8, wherein the mitigating action comprises at least one of: suspending network accounts, sending warnings to network users, causing authentication credentials to be reset, isolating affected machines, preforming scans for malware, de-installing malware, removing a persistence mechanism associated with the security incident, backing up data, restoring destroyed data from back-up copies, identifying exfiltrated data, fixing security bugs, increasing a level of network traffic monitoring, and notifying authorities (sending warning, shutting down device, which is isolation of machine, etc., para. 0024).
In reference to claim 10, Chen further teaches the method of claim 7, further comprising: monitoring the computer network to receive the security data (network is monitored, para. 0059-62).
In reference to claim 16, this claim is directed to a system associated with the method claimed in claim 6 and is therefore rejected under a similar rationale.
In reference to claim 17, this claim is directed to a system associated with the method claimed in claim 7 and is therefore rejected under a similar rationale.
In reference to claim 18, this claim is directed to a system associated with the method claimed in claim 8 and is therefore rejected under a similar rationale.
In reference to claim 19, this claim is directed to a system associated with the method claimed in claim 9 and is therefore rejected under a similar rationale.
Claim(s) 11 is/are rejected under 35 U.S.C. 103 as being unpatentable over Deng et al. Graph Neural Network-Based Anomaly Detection in Multivariate Time Series (NPL [U], see Notice of References Cited) as applied to claim 13 above, and further in view of You et al. Graph Contrastive Learning with Augmentations (NPL [V], see Notice of References Cited).
In reference to claim 11, Deng does not explicitly teach the method of claim 1, wherein obtaining the plurality of candidate second graph representations comprises: creating random variations of the dynamically evolving graph at the first time, the random variations comprising at least one of: addition or deletion of a node, addition or deletion of an edge, or modification of an attribute of a node or edge; and generating the candidate second graph representations from the random variations.
You teaches the method of claim 1, wherein obtaining the plurality of candidate second graph representations comprises: creating random variations of the dynamically evolving graph at the first time, the random variations comprising at least one of: addition or deletion of a node, addition or deletion of an edge, or modification of an attribute of a node or edge; and generating the candidate second graph representations from the random variations (GNN training data can be augmented through deleting nodes, adding or deleting edges, modifying attributes, see 3.1 Data Augmentation for Graphs, pages 3-4).
t would have been obvious to one of ordinary skill in art, having the teachings of Deng and Chen before the earliest effective filing date, to modify the graph of Deng to include the augmentations of You.
One of ordinary skill in the art would have been motivated to modify the graph of Deng to include the augmentations of You because it helps speed training and boost robustness against adversarial attacks (You, 1. Introduction, pages 1-2).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Andrew T. Chiusano whose telephone number is (571)272-5231. The examiner can normally be reached M-F, 10am-6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Tamara Kyle can be reached at 571-272-4241. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ANDREW T CHIUSANO/ Primary Examiner, Art Unit 2144
Prosecution Insights