Prosecution Insights
Last updated: August 17, 2026
Application No. 18/418,581

MACHINE-LEARNING BASED SYSTEM LOG ANOMALY DETECTION AND REMEDIATION

Non-Final OA §101
Filed
Jan 22, 2024
Examiner
WILSON, YOLANDA L
Art Unit
2113
Tech Center
2100 — Computer Architecture & Software
Assignee
Dell Products L.P.
OA Round
3 (Non-Final)
84%
Grant Probability
Favorable
3-4
OA Rounds
0m
Est. Remaining
90%
With Interview

Examiner Intelligence

Grants 84% — above average
84%
Career Allowance Rate
890 granted / 1063 resolved
+28.7% vs TC avg
Moderate +7% lift
Without
With
+6.6%
Interview Lift
resolved cases with interview
Typical timeline
2y 6m
Avg Prosecution
21 currently pending
Career history
1104
Total Applications
across all art units

Statute-Specific Performance

§101
20.3%
-19.7% vs TC avg
§103
28.2%
-11.8% vs TC avg
§102
32.0%
-8.0% vs TC avg
§112
9.7%
-30.3% vs TC avg
Black line = Tech Center average estimate • Based on career data from 1063 resolved cases

Office Action

§101
Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-12,14-21 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The claim(s) recite(s) mental processes – concepts performed in the human mind and mathematical concepts. Regarding claim 1, with the exception of the limitations ‘at least one processing device comprising a processor coupled to a memory’, the claim is directed to mental processes. The limitations ‘to generate a first data structure, the first data structure comprising a numerical representation of content of a given system log associated with at least one information technology asset’ – mental process of organizing data. The limitations ‘to determine, utilizing the first data structure, a given one of a plurality of system log clusters to which the given system log belongs, each of the plurality of system log clusters comprising a set of non-anomalous system logs; to select, from the given system log cluster, a subset of a given set of non-anomalous system logs which are part of the given system log cluster’ are mental processes – concepts performed in the human mind by observation evaluation, judgment, and/or opinion. Step 2A: Prong two This judicial exception is not integrated into a practical application because the additional elements ‘at least one processing device comprising a processor coupled to a memory; to perform contextual contrastive tuning of at least one machine learning model utilizing the selected subset of non-anomalous system logs, wherein performing the contextual contrastive tuning of the at least one machine learning model comprises performing a first training process comprising syntactical tuning to adapt the at least one machine learning model to domain-specific message code terminology of message codes used in system logs produced by the at least one information technology asset, the syntactical tuning being based at least in part on analysis of one or more unique message code combinations in the system logs produced by the at least one information technology asset and performing a second training process comprising contextual contrastive learning of the at least one machine learning model, the contextual contrastive learning being based at least in part on sequential patterns of message codes of one or more non-anomalous ones of the system logs produced by the at least one information technology asset; to generate a second data structure utilizing the tuned at least one machine learning model, the tuned at least one machine learning model taking as input the first data structure, the second data structure characterizing (i) one or more anomalies detected in the given system log and (ii) one or more causes of at least one of the one or more anomalies detected in the given system log’ are directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). Step 2B The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘to perform one or more remediation actions for the at least one information technology asset, the one or more remediation actions being selected based at least in part on the second data structure’ are directed to adding insignificant extra-solution activity to the judicial exception (MPEP 2106.05(g)). Regarding claim 2, the limitation ‘wherein the first data structure comprises a vectorized representation of a sequence of message codes of the given system log’ is a mental process of organizing data. Regarding claim 3, the limitation ‘apply pre-processing to the given system log to remove duplicate consecutive message codes in the sequence of message codes’ are mental processes – concepts performed in the human mind by observation evaluation, judgment, and/or opinion. Regarding claim 4, the limitation ‘apply pre-processing to the given system log by removing one or more stop message codes from the sequence of message codes’ are mental processes – concepts performed in the human mind by observation evaluation, judgment, and/or opinion. Regarding claim 5, the limitation ‘wherein the one or more stop message codes are identified utilizing term frequency-inverse document frequency (TF-IDF) of message codes in a plurality of system logs’ is a mathematical concept. Regarding claim 6, the limitation ‘wherein determining the given system log cluster comprises computing a Euclidean distance between the numerical representation of the content of the given system log and cluster centroids of the plurality of system log clusters’ is mathematical concept. Regarding claim 7, the limitation ‘wherein the plurality of system log clusters is generated based at least in part on applying a clustering algorithm to numerical representations of the sets of non-anomalous system logs’ is a mathematical concept. Regarding claim 8, the limitation ‘wherein the clustering algorithm comprises a Balanced Iterative Reducing and Clustering Using Hierarchies (BIRCH) clustering algorithm’ is a mathematic concept. Regarding claim 9, the limitation ‘wherein selecting the subset of the given set of non-anomalous system logs which are part of the given system log cluster comprises selecting a designated threshold number of the given set of non-anomalous system logs closest to a cluster centroid of the given system log cluster’ are mental processes – concepts performed in the human mind by observation evaluation, judgment, and/or opinion. Regarding claim 10, the limitation ‘the second training process further comprises anomaly detection tuning of the at least one machine learning model utilizing anomaly reasons for one or more anomalous sequences of message code sequences learned from historical anomalous system logs’ are directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). Regarding claim 11, the limitation ‘wherein the at least one machine learning model comprises a large language model’ are directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). Regarding claim 12, the limitation ‘the at least one machine learning model comprises a base machine learning model not possessing domain knowledge about a given domain associated with the at least one information technology asset, and wherein first training process adapts the base machine learning model to the given domain associated with the at least one information technology asset’ are directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). Regarding claim 14, the limitation ‘wherein the given domain comprises the message code terminology used in the system logs produced by the at least one information technology asset’ are mental processes – concepts performed in the human mind by observation evaluation, judgment, and/or opinion. Regarding claim 15, with the exception of the limitations ‘A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device’, the claims are directed to mental processes. The limitations ‘to generate a first data structure, the first data structure comprising a numerical representation of content of a given system log associated with at least one information technology asset’ – mental process of organizing data. The limitations ‘to determine, utilizing the first data structure, a given one of a plurality of system log clusters to which the given system log belongs, each of the plurality of system log clusters comprising a set of non-anomalous system logs; to select, from the given system log cluster, a subset of a given set of non-anomalous system logs which are part of the given system log cluster’ are mental processes – concepts performed in the human mind by observation evaluation, judgment, and/or opinion. Step 2A: Prong two This judicial exception is not integrated into a practical application because the additional elements ‘A computer program product comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device; to perform contextual contrastive tuning of at least one machine learning model utilizing the selected subset of non-anomalous system logs, wherein performing the contextual contrastive tuning of the at least one machine learning model comprises performing a first training process comprising syntactical tuning to adapt the at least one machine learning model to domain-specific message code terminology of message codes used in system logs produced by the at least one information technology asset, the syntactical tuning being based at least in part on analysis of one or more unique message code combinations in the system logs produced by the at least one information technology asset and performing a second training process comprising contextual contrastive learning of the at least one machine learning model, the contextual contrastive learning being based at least in part on sequential patterns of message codes of one or more non-anomalous ones of the system logs produced by the at least one information technology asset; to generate a second data structure utilizing the tuned at least one machine learning model, the tuned at least one machine learning model taking as input the first data structure, the second data structure characterizing (i) one or more anomalies detected in the given system log and (ii) one or more causes of at least one of the one or more anomalies detected in the given system log’ are directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). Step 2B The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘to perform one or more remediation actions for the at least one information technology asset, the one or more remediation actions being selected based at least in part on the second data structure’ are directed to adding insignificant extra-solution activity to the judicial exception (MPEP 2106.05(g)). Regarding claim 16, the limitation ‘wherein the first data structure comprises a vectorized representation of a sequence of message codes of the given system log’ is a mental process of organizing data. Regarding claim 17, the limitation ‘the at least one machine learning model comprises a base machine learning model not possessing domain knowledge about a given domain associated with the at least one information technology asset, and wherein first training process adapts the base machine learning model to the given domain associated with the at least one information technology asset’ are directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). Regarding claim 18, with the exception of the limitation ‘wherein the method is performed by at least one processing device comprising a processor coupled to a memory’, the claims are directed to mental processes. The limitation ‘generating a first data structure, the first data structure comprising a numerical representation of content of a given system log associated with at least one information technology asset’ – mental process of organizing data. The limitations ‘determining, utilizing the first data structure, a given one of a plurality of system log clusters to which the given system log belongs, each of the plurality of system log clusters comprising a set of non-anomalous system logs; selecting, from the given system log cluster, a subset of a given set of non-anomalous system logs which are part of the given system log cluster’ are mental processes – concepts performed in the human mind by observation evaluation, judgment, and/or opinion. Step 2A: Prong two This judicial exception is not integrated into a practical application because the additional elements ‘wherein the method is performed by at least one processing device comprising a processor coupled to a memory; performing contextual contrastive tuning of at least one machine learning model utilizing the selected subset of non-anomalous system logs, wherein performing the contextual contrastive tuning of the at least one machine learning model comprises performing a first training process comprising syntactical tuning to adapt the at least one machine learning model to domain-specific message code terminology of message codes used in system logs produced by the at least one information technology asset, the syntactical tuning being based at least in part on analysis of one or more unique message code combinations in the system logs produced by the at least one information technology asset and performing a second training process comprising contextual contrastive learning of the at least one machine learning model, the contextual contrastive learning being based at least in part on sequential patterns of message codes of one or more non-anomalous ones of the system logs produced by the at least one information technology asset; generating a second data structure utilizing the tuned at least one machine learning model, the tuned at least one machine learning model taking as input the first data structure, the second data structure characterizing (i) one or more anomalies detected in the given system log and (ii) one or more causes of at least one of the one or more anomalies detected in the given system log’ are directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). Step 2B The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements ‘performing one or more remediation actions for the at least one information technology asset, the one or more remediation actions being selected based at least in part on the second data structure’ are directed to adding insignificant extra-solution activity to the judicial exception (MPEP 2106.05(g)). Regarding claim 19, the limitation ‘wherein the first data structure comprises a vectorized representation of a sequence of message codes of the given system log’ is a mental process of organizing data. Regarding claim 20, the limitation ‘the at least one machine learning model comprises a base machine learning model not possessing domain knowledge about a given domain associated with the at least one information technology asset, and wherein first training process adapts the base machine learning model to the given domain associated with the at least one information technology asset’ are directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). Regarding claim 21, the limitation ‘wherein the at least one machine learning model comprises a large language model’ is directed to generic computer components recited at a high-level of generality such that they amount to nothing more than mere instructions to apply the exception using generic computer components (MPEP 2106.05(f)). There is no prior art rejection for claims 1-21 because of the inclusion of the following limitations: ‘to select, from the given system log cluster, a subset of a given set of non-anomalous system logs which are part of the given system log cluster; to perform contextual contrastive tuning of at least one machine learning model utilizing the selected subset of non-anomalous system logs; to generate a second data structure utilizing the tuned at least one machine learning model, the tuned at least one machine learning model taking as input the first data structure, the second data structure characterizing (i) one or more anomalies detected in the given system log and (ii) one or more causes of at least one of the one or more anomalies detected in the given system log’. Response to Arguments Applicant's arguments and amendments filed 05/11/2026 have been fully considered but they are not persuasive. Concerning the rejection of the 101 rejection, the Examiner does not see an improvement to the function of computer. The newly added limitations recite the use of a trained machine learning environment without any specification of details pertaining to how the associated machine learning environment is trained and/or how the actual machine learning is performed. Such details would include description of specific algorithms used in training the machine learning model. As currently written, the limitations in the claims describe merely certain data inputted to the machine learning environment and received. There is no indication that the combination of elements solves a technological problem other than merely taking advantage of the inherent advantages of using existing artificial intelligence technology (i.e., machine learning) in its ordinary, off-the-shelf capacity to apply the identified judicial exception. Simply implementing the abstract idea(s) on a general purpose processor or other generic computer component is not a practical application of the abstract idea(s). The Desjardins decision only being directed to training a machine learning model was stated because the current application includes using the information in the machine learning model is used to determine remediation actions. The Desjardins does not disclose remediation actions in the claims. Only in the specification that you cited that it could be used for. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. The closest prior art: USPN 20250130884 - abstract - A set of incident records are received for a computing system. The incident records are analyzed to identify similar incident records which are then linked. Incident clusters are generated based upon the links and incident records in each cluster are ranked. A prompt is generated to an artificial intelligence (AI) model based on the ranked, related incidents and the AI model returns a response that identifies a root cause and mitigation steps corresponding to the ranked incidents.; paragraph 0031 - Model training system 116 may obtain a pre-trained AI model and fine tune that AI model based upon information in the historical incident/root cause record store 118. For instance, record store 118 may include a set of historical incident records where the root cause has already been identified, and where the mitigation steps have been identified as well. That information can be used as training data by model training system 116 to fine tune the AI model or models used in root cause processing system 108.; USPN 20240345911 – paragraph 0070 discloses In an advanced example of an AI assisted prognostics module 140, a Large Language Models such as GPT-4 can be leveraged to provide multiple levels of necessary troubleshooting and engineering support.; CN113344134 - S4, clustering and analyzing the cleaning data set based on the pre-trained DBSCAN clustering model so as to divide the abnormal data sample and the normal data sample. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Yolanda L Wilson whose telephone number is (571)272-3653. The examiner can normally be reached M-F (7:30 am - 4 pm). Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bryce Bonzo can be reached at 571-272-3655. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /Yolanda L Wilson/Primary Examiner, Art Unit 2113
Read full office action

Prosecution Timeline

Show 1 earlier event
Aug 13, 2025
Non-Final Rejection mailed — §101
Oct 27, 2025
Interview Requested
Nov 07, 2025
Response Filed
Feb 25, 2026
Final Rejection mailed — §101
Apr 27, 2026
Response after Non-Final Action
May 11, 2026
Request for Continued Examination
May 15, 2026
Response after Non-Final Action
Jun 17, 2026
Non-Final Rejection mailed — §101 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12699631
HIGH AVAILABILITY SYSTEM OUTAGE RECOVERY
2y 6m to grant Granted Aug 04, 2026
Patent 12699615
DISTRIBUTED JOURNAL FOR HIGH PERFORMANCE CONTINUOUS DATA PROTECTION
1y 11m to grant Granted Aug 04, 2026
Patent 12693925
REAL-TIME FAULT MANAGEMENT (RFM)
1y 9m to grant Granted Jul 28, 2026
Patent 12688090
Firmware Failure Remediation Operation to Facilitate a Successful Information Handling System Boot Process
2y 5m to grant Granted Jul 21, 2026
Patent 12681812
GRAPHICS SYSTEM OPERATION FAILURE DECTECTION
1y 8m to grant Granted Jul 14, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

3-4
Expected OA Rounds
84%
Grant Probability
90%
With Interview (+6.6%)
2y 6m (~0m remaining)
Median Time to Grant
High
PTA Risk
Based on 1063 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month