DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
This action is in response to applicant’s arguments and amendments filed 3/20/2026, which are in response to USPTO Office Action mailed 2/24/2026. Applicant’s arguments have been considered with the results that follow: THIS ACTION IS MADE NON-FINAL.
Status of Claims
Claims 1-21 are pending in the present Application.
Allowable Subject Matter
The following is a statement of reasons for the indication of allowable subject matter:
Regarding independent claim 15,
Applicant’s remarks filed in Response After Final Action received 3/20/2026 are persuasive. Upon further consideration, the currently presented prior art is considered to be the most relevant to the claimed invention but does not disclose every limitation of claim 15 as currently presented. For example, the combination of FANG et al. (Publication Number: CN 110991508A; Published on April 10, 2020) and Azam et al. (US Patent No. 11,726,982; Date of Patent: Aug. 15, 2023) does not disclose the following limitation(s):
accessing historical configurations stored with respect to past instances of an anomaly monitor, the historical configurations including historical time-series data and a description stored in association with each of the historical configurations;
based on the inputs and the historical configurations stored with respect to past instances of the anomaly monitor, generate a recommendation that includes: a recommended backend anomaly detector to be executed by the anomaly monitor;
Therefore, claim 15 is allowable over the prior art.
Regarding dependent claims 16-21,
Claims 16-21 depend upon independent claim 15 and are allowable under similar rationale.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 6, 8 and 12 is/are rejected under 35 U.S.C. 103 as being unpatentable over Dong et al. (US PGPUB No. 2022/0150590; Pub. Date: May 12, 2022) in view of Wang et al. (US PGPUB No. 2022/0303288; Pub. Date: Sep. 22, 2022).
Regarding independent claim 1,
Dong discloses a system comprising:an anomaly monitor customization tool stored in memory and executable to:execute an instance of an anomaly monitor, the instance defining a selected subset of backend anomaly detectors to process a time-series dataset for a performance metric; See FIG. 2C & Paragraph [0040], (Disclosing a method for receiving and processing viewership data and identifying anomalous events from said viewership data. System 210 comprises short-time behavior correlator 214 configured to propose a shape of viewership based on metadata and incorporate human feedback to mitigate false alarms, i.e. a system comprising: an anomaly monitor customization tool stored in memory and executable to: execute an instance of an anomaly monitor (e.g. Note [0044] wherein system 210 provides a user interface for exploring anomaly data).) See Paragraph [0041], (Anomaly detector 215 performs time-series viewership analysis for detecting anomalies using an initial model if no historical data is available, real-time or historical analysis may also be performed.) See Paragraph [0030], (The system may build and3 train an expected behavioral model for detection of objectable content for particular audiences and predict anomalous tune out events, i.e. the instance defining a selected subset of backend anomaly detectors (e.g. the anomaly detector may determine which mode to use based on the presence of historical information) to process a time-series dataset for a performance metric (e.g. the anomaly detector analyzes viewing metrics over time for video content).)
receive, as output from the instance of the anomaly monitor, anomaly report data identifying a first set of events included in the time-series dataset and flagged as anomalies; See Paragraph [0017], (System 100 facilitates analyzing aggregated viewership data to determine anomalous events associated with an aggregated viewership of media content or reporting of detected anomalous events.) See Paragraph [0043], (The system comprises report generator 216 configured to provide time-series reporting of events for providing an analysis of signal anomalies, i.e. receive, as output from the instance of the anomaly monitor, anomaly report data (e.g. system 210 comprises report generator 216 configured to create reports including identified anomaly data) identifying a first set of events included in the time-series dataset (e.g. Note [0041] anomaly detector 215 performs a time-series viewership analysis for anomalies applied to incoming content) and flagged as anomalies (e.g. Note FIG. 2D illustrating method 220 comprising step 222 of identifying an anomalous event from received viewership data) ;)
characterize, responsive to receiving the anomaly report data, the anomalies flagged by the anomaly monitor by assigning anomaly type classifiers, at least some of the anomaly type classifiers describing different anomaly shapes, the anomaly shapes determined based on one or more spatial features of the time-series dataset appearing that appear within a visualization of the time-series dataset; See Paragraph [0034], (System 210 employs pattern recognition and anomaly detection of instantaneous observations to typical shape to detect unexpected tune away behavior. System 210 creates a hierarchical construction of viewership behavior shapes correlated to content metadata to build a typical viewership behavior for content or advertisements with a shape with timed metadata.) See Paragraph [0043], (Report generator 216 creates reports and analysis for signal anomalies including comparing and contrasting an expected shape versus a reported shape of viewership behavior, i.e. characterize, responsive to receiving the anomaly report data, the anomalies flagged by the anomaly monitor by assigning anomaly type classifiers, at least some of the anomaly type classifiers describing different anomaly shapes (e.g. by creating the hierarchical construction of viewership behavior shapes), the anomaly shapes determined based on one or more spatial features of the time-series dataset appearing that appear within a visualization of the time-series dataset (e.g. the hierarchical construction of viewership behavior is based on content metadata including timed metadata and relate to behavior shapes of time-series data. Note [0041] wherein anomaly detector 215 performs time-series viewership analysis to detect anomalies in incoming content);
and a rule enforcement action to be performed with respect to events within the time-series dataset characterized by the at least one anomaly classifier of the anomaly type classifiers; See Paragraph [0042], (Anomaly detector 215 proposes actions for detected anomalies and may automatically learn mitigation strategies, i.e. a rule enforcement action to be performed with respect to events within the time-series dataset characterized by the at least one anomaly classifier of the anomaly type classifiers (e.g. the anomaly detector may apply mitigation strategies for a detected anomaly based on the analysis of input data).)
Dong does not disclose the step wherein the system may define an alert rule based on user feedback pertaining to discrepancies between the first set of events flagged as anomalies and a second set of events in the time-series dataset that are of interest to a user, the alert rule identifying: at least one anomaly classifier of the anomaly type classifiers describing one or more of the different anomaly shapes assigned to the characterized anomalies;
in response to defining the alert rule, iteratively update detector configuration data to identify modified configuration data for the anomaly monitor that performs better with respect to enforcement of the alert rule on the time-series dataset;
and provision a customized anomaly monitor based on the modified configuration data.
Wang discloses the step wherein the system may define an alert rule based on user feedback pertaining to discrepancies between the first set of events flagged as anomalies and a second set of events in the time-series dataset that are of interest to a user, See Paragraph [0036], (Disclosing an anomaly detector for detecting anomalies in input data. The system comprises a network manager 110 for determining anomaly detection parameters for configuring one or more anomaly detection mechanisms in one or more network nodes of network 100 based on receiving first values of network parameters identified as anomalies.) See Paragraph [0038], (Network manager 110 may receive feedback information regarding first values that are not identified as anomalies as well as normal first values to determine and set anomaly detection parameters, i.e. define an alert rule based on user feedback (e.g. by determining the anomaly determination parameters based on user feedback) pertaining to discrepancies between the first set of events flagged as anomalies and a second set of events in the time-series dataset that are of interest to a user (e.g. Note [0020] wherein feedback may indicate false alarms and missed detections. Note [0028] wherein user feedback is provided to address discrepancies).)
the alert rule identifying: at least one anomaly classifier of the anomaly type classifiers describing one or more of the different anomaly shapes assigned to the characterized anomalies; See Paragraph [0048], (A user may provide feedback including providing a label for misclassified input data indicating whether the input data is anomalous or non-anomalous, i.e. the alert rule identifying: at least one anomaly classifier of the anomaly type classifiers describing one or more of the different anomaly shapes assigned to the characterized anomalies;)
The examiner notes that the labels of Wang do not refer to "one or more of the different anomaly shapes assigned to the characterized anomalies" however, the system of Dong discloses determining and classifying anomalous data based on shapes as described in Paragraph [0034], System 210 creates a hierarchical construction of viewership behavior shapes correlated to content metadata to build a typical viewership behavior for content or advertisements with a shape with timed metadata.
One of ordinary skill in the art would recognize that user feedback comprising labels would not necessarily only be limited to "anomalous" or "non-anomalous" for a system that may determine a plurality of classifications for anomalies based on shapes such as the system of Dong. Therefore, one of ordinary skill in the art may combine the teachings of Dong and Wang wherein a user may provide a label for misclassified input data wherein the label indicates a particular shape which would allow the system to modify the anomaly detection to be aligned with the label provided by the user.
in response to defining the alert rule, iteratively update detector configuration data to identify modified configuration data for the anomaly monitor that performs better with respect to enforcement of the alert rule on the time-series dataset; See Paragraph [0049], (Tuner module 209 may update characteristics of the anomaly detection function based on user feedback. The adjustments may occur automatically during training of anomaly detector 101 or during execution based on the user feedback. Note [0019] wherein an autoencoder may be trained offline to detect anomalous data and further tuned online based on user feedback, i.e. in response to defining the alert rule, iteratively update detector configuration data to identify modified configuration data (e.g. the tuner module may update at least one of a threshold and weights for at least one loss function of a plurality of loss functions in a weighted combination of loss functions to adjust the reconstruction loss such that that the results of the anomaly detection are aligned with the user feedback) for the anomaly monitor that performs better with respect to enforcement of the alert rule on the time-series dataset;)
and provision a customized anomaly monitor based on the modified configuration data. See Paragraph [0055], (The gradient descent allows for the adjustment and fine tuning of the performance of anomaly detector 101 using labelled data, including online adjustments provided as a result of user feedback. Note [0111] wherein an output interface 727 is configured to render the result of anomaly detection of a display device 709, i.e. provision a customized anomaly monitor based on the modified configuration data (e.g. user feedback may be used to update the anomaly detector wherein the updated detector is provided for display at a display device).)
Dong and Wang are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong to include the method of turning an anomaly detection model based on feedback as disclosed by Wang. Paragraph [0008] of Wang discloses that the process of tuning anomaly detection thresholds and analyzing features of input data which may jointly improve the accuracy of anomaly detection.
Regarding dependent claim 6,
As discussed above with claim 1, WANG-Cawley-Lavrentyev discloses all of the limitations.
Dong further discloses the step wherein the anomaly type classifiers identify at least one of a shape, scope, and recurrency of an anomaly. See Paragraph [0034], (The system may create a hierarchical construction of viewership behavior shapes correlated to content metadata, i.e. wherein the anomaly type classifiers identify at least one of a shape.)
Regarding independent claim 8,
Dong discloses a method comprising: executing a first instance of an anomaly monitor, the first instance defining a selected subset of backend anomaly detectors to process a dataset including a time-series dataset for a performance metric sampled within a cloud provider network; See FIG. 2C & Paragraph [0040], (Disclosing a method for receiving and processing viewership data and identifying anomalous events from said viewership data. System 210 comprises short-time behavior correlator 214 configured to propose a shape of viewership based on metadata and incorporate human feedback to mitigate false alarms, i.e. a system comprising:an anomaly monitor customization tool stored in memory and executable to:execute an instance of an anomaly monitor (e.g. Note [0044] wherein system 210 provides a user interface for exploring anomaly data).) See Paragraph [0041], (Anomaly detector 215 performs time-series viewership analysis for detecting anomalies using an initial model if no historical data is available, real-time or historical analysis may also be performed.) See Paragraph [0030], (The system may build and train an expected behavioral model for detection of objectable content for particular audiences and predict anomalous tune out events, i.e. the instance defining a selected subset of backend anomaly detectors (e.g. the anomaly detector may determine which mode to use based on the presence of historical information) to process a time-series dataset for a performance metric (e.g. the anomaly detector analyzes viewing metrics over time for video content).) Note [0051] wherein the system may be embodied a cloud networking architecture.
receiving, as output from the selected subset of backend anomaly detectors, anomaly report data identifying a first set of events included in the time-series dataset and flagged as anomalous; See Paragraph [0017], (System 100 facilitates analyzing aggregated viewership data to determine anomalous events associated with an aggregated viewership of media content or reporting of detected anomalous events.) See Paragraph [0043], (The system comprises report generator 216 configured to provide time-series reporting of events for providing an analysis of signal anomalies, i.e. receive, as output from the instance of the anomaly monitor, anomaly report data (e.g. system 210 comprises report generator 216 configured to create reports including identified anomaly data) identifying a first set of events included in the time-series dataset (e.g. Note [0041] anomaly detector 215 performs a time-series viewership analysis for anomalies applied to incoming content) and flagged as anomalies (e.g. Note FIG. 2D illustrating method 220 comprising step 222 of identifying an anomalous event from received viewership data) ;)
characterize, responsive receiving the anomaly report data, physical characteristics of the time-series dataset to assign anomaly type classifiers to events of the first set of events flagged as anomalies by the anomaly monitor, at least some of the anomaly type classifiers describing different anomaly shapes, the anomaly shapes determined based on one or more spatial features of the time-series dataset appearing within a visualization of the time-series dataset; See Paragraph [0034], (System 210 employs pattern recognition and anomaly detection of instantaneous observations to typical shape to detect unexpected tune away behavior. System 210 creates a hierarchical construction of viewership behavior shapes correlated to content metadata to build a typical viewership behavior for content or advertisements with a shape with timed metadata.) See Paragraph [0043], (Report generator 216 creates reports and analysis for signal anomalies including comparing and contrasting an expected shape versus a reported shape of viewership behavior, i.e. characterize, responsive to receiving the anomaly report data, the anomalies flagged by the anomaly monitor by assigning anomaly type classifiers, at least some of the anomaly type classifiers describing different anomaly shapes (e.g. by creating the hierarchical construction of viewership behavior shapes), the anomaly shapes determined based on one or more spatial features of the time-series dataset appearing that appear within a visualization of the time-series dataset (e.g. the hierarchical construction of viewership behavior is based on content metadata including timed metadata and relate to behavior shapes of time-series data. Note [0041] wherein anomaly detector 215 performs time-series viewership analysis to detect anomalies in incoming content);
and a rule enforcement action to be performed with respect to events within the time- series dataset characterized by the at least one of the anomaly type classifiers; See Paragraph [0042], (Anomaly detector 215 proposes actions for detected anomalies and may automatically learn mitigation strategies, i.e. a rule enforcement action to be performed with respect to events within the time-series dataset characterized by the at least one anomaly classifier of the anomaly type classifiers (e.g. the anomaly detector may apply mitigation strategies for a detected anomaly based on the analysis of input data).
Dong does not disclose the step wherein the system may defining an alert rule based on user feedback pertaining to discrepancies between the first set of events flagged as anomalies and a second set of events in the time-series dataset that are of interest to a user, the alert rule identifying: at least one anomaly classifier of the anomaly type classifiers describing one or more of the different anomaly shapes assigned to the characterized anomalies;
in response to defining the alert rule, iteratively update detector configuration data to identify modified configuration data for the anomaly monitor that performs better with respect to enforcement of the alert rule on the time-series dataset;
and provision a customized anomaly monitor for use within the cloud provider network and in accordance with the modified configuration data.
Wang discloses the step wherein the system may define an alert rule based on user feedback pertaining to discrepancies between the first set of events flagged as anomalies and a second set of events in the time-series dataset that are of interest to a user, See Paragraph [0036], (Disclosing an anomaly detector for detecting anomalies in input data. The system comprises a network manager 110 for determining anomaly detection parameters for configuring one or more anomaly detection mechanisms in one or more network nodes of network 100 based on receiving first values of network parameters identified as anomalies.) See Paragraph [0038], (Network manager 110 may receive feedback information regarding first values that are not identified as anomalies as well as normal first values to determine and set anomaly detection parameters, i.e. define an alert rule based on user feedback (e.g. by determining the anomaly determination parameters based on user feedback) pertaining to discrepancies between the first set of events flagged as anomalies and a second set of events in the time-series dataset that are of interest to a user (e.g. Note [0020] wherein feedback may indicate false alarms and missed detections. Note [0028] wherein user feedback is provided to address discrepancies).)
the alert rule identifying: at least one anomaly classifier of the anomaly type classifiers describing one or more of the different anomaly shapes assigned to the characterized anomalies; See Paragraph [0048], (A user may provide feedback including providing a label for misclassified input data indicating whether the input data is anomalous or non-anomalous, i.e. the alert rule identifying: at least one anomaly classifier of the anomaly type classifiers describing one or more of the different anomaly shapes assigned to the characterized anomalies;)
The examiner notes that the labels of Wang do not refer to "one or more of the different anomaly shapes assigned to the characterized anomalies" however, the system of Dong discloses determining and classifying anomalous data based on shapes as described in Paragraph [0034], System 210 creates a hierarchical construction of viewership behavior shapes correlated to content metadata to build a typical viewership behavior for content or advertisements with a shape with timed metadata.
One of ordinary skill in the art would recognize that user feedback comprising labels would not necessarily only be limited to "anomalous" or "non-anomalous" for a system that may determine a plurality of classifications for anomalies based on shapes such as the system of Dong. Therefore, one of ordinary skill in the art may combine the teachings of Dong and Wang wherein a user may provide a label for misclassified input data wherein the label indicates a particular shape which would allow the system to modify the anomaly detection to be aligned with the label provided by the user.
in response to defining the alert rule, iteratively update detector configuration data to identify modified configuration data for the anomaly monitor that performs better with respect to enforcement of the alert rule on the time-series dataset; See Paragraph [0049], (Tuner module 209 may update characteristics of the anomaly detection function based on user feedback. The adjustments may occur automatically during training of anomaly detector 101 or during execution based on the user feedback. Note [0019] wherein an autoencoder may be trained offline to detect anomalous data and further tuned online based on user feedback, i.e. in response to defining the alert rule, iteratively update detector configuration data to identify modified configuration data (e.g. the tuner module may update at least one of a threshold and weights for at least one loss function of a plurality of loss functions in a weighted combination of loss functions to adjust the reconstruction loss such that that the results of the anomaly detection are aligned with the user feedback) for the anomaly monitor that performs better with respect to enforcement of the alert rule on the time-series dataset;)
and provision a customized anomaly monitor for use within the cloud provider network and in accordance with the modified configuration data. See Paragraph [0055], (The gradient descent allows for the adjustment and fine tuning of the performance of anomaly detector 101 using labelled data, including online adjustments provided as a result of user feedback. Note [0111] wherein an output interface 727 is configured to render the result of anomaly detection of a display device 709, i.e. provision a customized anomaly monitor based on the modified configuration data (e.g. user feedback may be used to update the anomaly detector wherein the updated detector is provided for display at a display device).) Note [0010] wherein the system may perform anomaly detection in internet proxy log data to detect malicious activity in a computer network.
While Wang describes a network generally, Dong explicitly mentions a cloud-based architecture configured to execute the method of anomaly detection (See [0051]). One of ordinary skill in the art would recognize that a cloud architecture is a type of network and would therefore be able to apply the process of providing an anomaly detection application to a user display device in communication with the anomaly detection system via a network such as a cloud network as in Dong.
Dong and Wang are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong to include the method of turning an anomaly detection model based on feedback as disclosed by Wang. Paragraph [0008] of Wang discloses that the process of tuning anomaly detection thresholds and analyzing features of input data which may jointly improve the accuracy of anomaly detection.
Regarding dependent claim 12,
As discussed above with claim 8, Dong-Wang discloses all of the limitations.
Dong further discloses the step wherein the at least one of the anomaly type classifiers classify at least one of a shape, scope, and recurrency of an anomaly. See Paragraph [0034], (The system may create a hierarchical construction of viewership behavior shapes correlated to content metadata, i.e. wherein the anomaly type classifiers identify at least one of a shape.)
Claim(s) 2, 9, 11 is/are rejected under 35 U.S.C. 103 as being unpatentable over Dong in view of Wang as applied to claim 1 above, and further in view of Lavrentyev et al. (US PGPUB No. 2023/0205193; Pub. Date: Jun. 29, 2023).
Regarding dependent claim 2,
As discussed above with claim 1, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein the anomaly monitor executes the selected subset of backend anomaly detectors based on a selected configuration of detector parameters and detection thresholds;
and wherein generating the modified configuration data includes altering at least one of: the selected subset of backend anomaly detectors; the detector parameters; or the detection thresholds.
Lavrentyev further discloses the step wherein the anomaly monitor executes the selected subset of backend anomaly detectors based on a selected configuration of detector parameters and detection thresholds; See Paragraph [0100], (Monitoring of anomalies of each class includes performing at least one of, with a given frequency: retrospective analysis, predictive analysis and stream analysis based on the characteristics of each class of anomalies. The monitoring frequency may be predetermined or indicated by an operator of the CPS, i.e. wherein the anomaly monitor executes the selected subset of backend anomaly detectors based on a selected configuration of detector parameters (e.g. the monitoring frequency).) Note [0013] wherein the monitoring process includes identifying an anomaly if a determined forecast error exceeds a predefined threshold value, i.e. execution of a backend anomaly detector is based on detection thresholds.
and wherein generating the modified configuration data includes altering at least one of: the selected subset of backend anomaly detectors; the detector parameters; or the detection thresholds. See Paragraph [0090], (System 300 includes a teaching module 305 configured to adjust classification rules for classifying anomalies. Classification rules may include supervised machine learning models, or unsupervised machine learning models (e.g., clustering models). The adjustment of rules may involve the formation of a learning sample, including the values of the classifying features for a historical period of time containing the time interval for the observation of the anomalies, i.e. wherein generating the modified configuration data includes altering at least the detector parameters.)
Dong, Wang and Lavrentyev are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of modifying classification rules over time for optimizing anomaly detection as disclosed by Lavrentyev. Paragraph [0105] of Lavrentyev discloses that the use of filtering rules and diagnostic processes allows the system to provide a user with additional information about anomalies of interest while also allowing for both manual and automatic removal of anomalies that are not of interest.
Regarding dependent claim 9,
As discussed above with claim 8, Dong-Wang-Lavrentyev discloses all of the limitations.
Dong-Wang does not disclose the step wherein executing the selected subset of backend anomaly detectors is based on a selected configuration of detector parameters and detection thresholds.
and wherein generating the modified configuration data includes altering at least one of: the selected subset of backend anomaly detectors; the detector parameters; or the detection thresholds.
Lavrentyev discloses the step wherein executing the selected subset of backend anomaly detectors is based on a selected configuration of detector parameters and detection thresholds. See Paragraph [0100], (Monitoring of anomalies of each class includes performing at least one of, with a given frequency: retrospective analysis, predictive analysis and stream analysis based on the characteristics of each class of anomalies. The monitoring frequency may be predetermined or indicated by an operator of the CPS, i.e. wherein the anomaly monitor executes the selected subset of backend anomaly detectors based on a selected configuration of detector parameters (e.g. the monitoring frequency).) Note [0013] wherein the monitoring process includes identifying an anomaly if a determined forecast error exceeds a predefined threshold value, i.e. execution of a backend anomaly detector is based on detection thresholds.
and wherein generating the modified configuration data includes altering at least one of: the selected subset of backend anomaly detectors; the detector parameters; or the detection thresholds. See Paragraph [0090], (System 300 includes a teaching module 305 configured to adjust classification rules for classifying anomalies. Classification rules may include supervised machine learning models, or unsupervised machine learning models (e.g., clustering models). The adjustment of rules may involve the formation of a learning sample, including the values of the classifying features for a historical period of time containing the time interval for the observation of the anomalies, i.e. wherein generating the modified configuration data includes altering at least the detector parameters.)
Dong, Wang and Lavrentyev are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of modifying classification rules over time for optimizing anomaly detection as disclosed by Lavrentyev. Paragraph [0105] of Lavrentyev discloses that the use of filtering rules and diagnostic processes allows the system to provide a user with additional information about anomalies of interest while also allowing for both manual and automatic removal of anomalies that are not of interest.
Regarding dependent claim 11,
As discussed above with claim 8, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein the alert rule provides for identifying an event as an anomaly if the event is characterized by the at least one of the anomaly type classifiers.
Lavrentyev discloses the step wherein the alert rule provides for identifying an event as an anomaly if the event is characterized by the at least one of the anomaly type classifiers. See Paragraphs [0078] & [0088], (An example is provided wherein in the case of diagnostics and monitoring of anomalies of a wall of a petroleum pipeline, a shape of an echo signal of the wall of a petroleum pipeline may be considered a classifying feature, i.e. wherein the alert rule provides for identifying an event as an anomaly if the event is characterized by the select anomaly classifier of the anomaly type classifiers (e.g. the classifying features of the dataset are used to classify an anomaly).)
Dong, Wang and Lavrentyev are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of modifying classification rules over time for optimizing anomaly detection as disclosed by Lavrentyev. Paragraph [0105] of Lavrentyev discloses that the use of filtering rules and diagnostic processes allows the system to provide a user with additional information about anomalies of interest while also allowing for both manual and automatic removal of anomalies that are not of interest.
Claim(s) 4 is/are rejected under 35 U.S.C. 103 as being unpatentable over Dong in view of Wang as applied to claim 1 above, and further in view of WANG et al. (US PGPUB No. 2023/0341832; Pub. Date: Oct. 26, 2023), hereinafter WANG’832.
Regarding dependent claim 4,
As discussed above with claim 1, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein the alert rule provides for identifying an event as an anomaly if the event is characterized by a select anomaly classifier of the at least one anomaly classifier.
WANG’832 discloses the step wherein the alert rule provides for identifying an event as an anomaly if the event is characterized by a select anomaly classifier of the at least one anomaly classifier. See Paragraph [0039], (An automatic rule is used to determine whether first module 304 is suitable for a given set of time-series data. If the first module is not suitable, a second module 308 may then be utilized to identify shape-based anomalies.) See Paragraph [0043], (Second module 308 may identify a data window exhibiting a most different shape compared to other data windows to detect a shape-based anomaly. FIG. 1 illustrates different types of shape-based anomalies, i.e. wherein the alert rule provides for identifying an event as an anomaly if the event is characterized by a select anomaly classifier of the at least one anomaly classifier (e.g. second module 308 may output information relating to identified shape-based anomalies).)
Dong, Wang and WANG’832 are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of identifying a data window based on anomaly detection rules as disclosed by WANG’832. Paragraph [0031] of WANG’832 discloses that the system may manage determinations of noisy data and unusual cycle shapes for time-series data in order to accurately identify anomalous behavior so that proper intervention or remedial actions may be taken.
Claim(s) 3 and 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Dong in view of Wang as applied to claim 1 above, and further in view of Dang et al. (US PGPUB No. 2022/0385529; Pub. Date: Dec. 1, 2022).
Regarding dependent claim 3,
As discussed above with claim 1, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein the anomaly monitor customization tool is further configured to: based on the user feedback, determine that the first set of events excludes a particular event of interest;
in response to the user feedback, execute multiple instances of the anomaly monitor to identify a detector configuration for the anomaly monitor that successfully identifies the particular event as an anomaly, each of the multiple instances being executed in response to a modification to the detector configuration;
identify a select detector configuration corresponding to one of multiple instances of the anomaly monitor that identifies the particular event as an anomaly;
and solicit additional user feedback pertaining to a version of the anomaly report data generated based on the select detector configuration.
Dang discloses the step wherein the anomaly monitor customization tool is further configured to: based on the user feedback, determine that the first set of events excludes a particular event of interest; See Paragraph [0096], (Disclosing a system for dynamic selection of anomaly detection options for metric data. FIG. 6 illustrates a process 640 comprising determining whether derived patterns indicate an anomaly action option that may be desirable for target metric data. The pattern may not indicate whether a desirable anomaly action option exists, i.e. based on the feedback (e.g. Note [0095] wherein a user may opt-in to machine learning-based anomaly detection option suggestions), determine that the first set of events excludes a particular event that a user is interested in (e.g. if the system determines that an anomaly action option exists outside of the default anomaly detection action).)
in response to the user feedback, execute multiple instances of the anomaly monitor to identify a detector configuration for the anomaly monitor that successfully identifies the particular event as an anomaly, each of the multiple instances being executed in response to a modification to the detector configuration; See Paragraph [0096], (When the patterns indicate a desirable anomaly action option for the target metric data, the system may automatically select and apply the indicated anomaly detection action, i.e. execute multiple instances of the anomaly monitor to identify a detector configuration for the anomaly monitor (e.g. process 640 determines machine learning patterns for a plurality of anomaly detection action option selections, i.e. multiple instances) that successfully identifies the particular event as an anomaly (e.g. the determined desirable anomaly action option).) See Paragraph [0097], (The assignment of anomaly detection action options is based on an indication of a model quality. Statistical models are associated with a qualitative prediction score that may be compared to a quality threshold in order to select a model having a highest quality, i.e. each of the multiple instances being executed in response to a modification to the detector configuration (e.g. the different models applied in order to determine a highest quality model that may indicate desirable anomaly action options).
identify a select detector configuration corresponding to one of multiple instances of the anomaly monitor that identifies the particular event as an anomaly; See Paragraphs [0072]-[0073], (The method may determine whether special metrics configuration rules exist for received metric data. The method may provide machine machine-automated provision of specialized metrics configuration rules relating to adjustment of anomaly detection action options. When no specialized rules are present, default anomaly detection actions are used. When specialized rules are present, the system may apply specialized anomaly detection actions specified for the particular metric data, i.e. entity a select detector configuration corresponding to one of multiple instances of the anomaly monitor that identifies the particular event as an anomaly.)
and solicit additional user feedback pertaining to a version of the anomaly report data generated based on the select detector configuration. See Paragraph [0085], (The system may provide alerts via a higher-priority user interface that may generate an incident such as an investigation and/or mitigation task assigned for completion by IT personnel based on the IT alert. This process of proactively providing alerts may facilitate IT personnel attention to detected anomalies, i.e. solicit additional feedback pertaining to a version of the anomaly report data generated based on the select detector configuration.)
Dong, Wang and Dang are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of dynamic selection of anomaly detection options as disclosed by Dang. Paragraph [0085] of Dang discloses that the method of generating anomaly alerts for metric data via a high-priority user interface allows the system to effectively direct the user's attention to a detected anomaly such that users may take further remedial action to either be made aware of or resolve potential system issues.
Regarding dependent claim 10,
As discussed above with claim 8, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein based on the user feedback, determine that the first set of events excludes a particular event that a user is interested in;
in response to the user feedback, execute multiple instances of the anomaly monitor to identify a detector configuration for the anomaly monitor that successfully identifies the particular event as an anomaly, each of the multiple instances being executed in response to a modification to the detector configuration;
identify a select detector configuration corresponding to one of multiple instances of the anomaly monitor that identifies the particular event as an anomaly;
and solicit additional user feedback pertaining to a version of the anomaly report data generated based on the select detector configuration.
Dang discloses the step based on the user feedback, determine that the first set of events excludes a particular event that a user is interested in; See Paragraph [0096], (Disclosing a system for dynamic selection of anomaly detection options for metric data. FIG. 6 illustrates a process 640 comprising determining whether derived patterns indicate an anomaly action option that may be desirable for target metric data. The pattern may not indicate whether a desirable anomaly action option exists, i.e. based on the feedback (e.g. Note [0095] wherein a user may opt-in to machine learning-based anomaly detection option suggestions), determine that the first set of events excludes a particular event that a user is interested in (e.g. if the system determines that an anomaly action option exists outside of the default anomaly detection action).)
in response to the user feedback, execute multiple instances of the anomaly monitor to identify a detector configuration for the anomaly monitor that successfully identifies the particular event as an anomaly, each of the multiple instances being executed in response to a modification to the detector configuration; See Paragraph [0096], (When the patterns indicate a desirable anomaly action option for the target metric data, the system may automatically select and apply the indicated anomaly detection action, i.e. execute multiple instances of the anomaly monitor to identify a detector configuration for the anomaly monitor (e.g. process 640 determines machine learning patterns for a plurality of anomaly detection action option selections, i.e. multiple instances) that successfully identifies the particular event as an anomaly (e.g. the determined desirable anomaly action option).) See Paragraph [0097], (The assignment of anomaly detection action options is based on an indication of a model quality. Statistical models are associated with a qualitative prediction score that may be compared to a quality threshold in order to select a model having a highest quality, i.e. each of the multiple instances being executed in response to a modification to the detector configuration (e.g. the different models applied in order to determine a highest quality model that may indicate desirable anomaly action options).
identify a select detector configuration corresponding to one of multiple instances of the anomaly monitor that identifies the particular event as an anomaly; See Paragraphs [0072]-[0073], (The method may determine whether special metrics configuration rules exist for received metric data. The method may provide machine machine-automated provision of specialized metrics configuration rules relating to adjustment of anomaly detection action options. When no specialized rules are present, default anomaly detection actions are used. When specialized rules are present, the system may apply specialized anomaly detection actions specified for the particular metric data, i.e. entity a select detector configuration corresponding to one of multiple instances of the anomaly monitor that identifies the particular event as an anomaly.)
and solicit additional user feedback pertaining to a version of the anomaly report data generated based on the select detector configuration. See Paragraph [0085], (The system may provide alerts via a higher-priority user interface that may generate an incident such as an investigation and/or mitigation task assigned for completion by IT personnel based on the IT alert. This process of proactively providing alerts may facilitate IT personnel attention to detected anomalies, i.e. solicit additional feedback pertaining to a version of the anomaly report data generated based on the select detector configuration.)
Dong, Wang and Dang are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of dynamic selection of anomaly detection options as disclosed by Dang. Paragraph [0085] of Dang discloses that the method of generating anomaly alerts for metric data via a high-priority user interface allows the system to effectively direct the user's attention to a detected anomaly such that users may take further remedial action to either be made aware of or resolve potential system issues.
Claim(s) 5 and 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Dong in view of Wang as applied to claim 1 above, and further in view of Beers et al. (US PGPUB No. 2023/0143734; Pub. Date: May 11, 2023).
Regarding dependent claim 5,
As discussed above with claim 1, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein the alert rule provides for not flagging an event as an anomaly if the event is characterized by the select anomaly classifier of the anomaly type classifiers.
Beers discloses the step wherein the alert rule provides for not flagging an event as an anomaly if the event is characterized by the select anomaly classifier of the anomaly type classifiers. See FIG. 5, (FIG. 5 illustrates method 500 comprising step 512 of determining if a mark information is anomalous. If the mark information is determined to not be anomalous, the method returns to step 504 of sampling mark information from monitored visualizations, i.e. wherein the alert rule provides for not flagging an event as an anomaly if the event is characterized by the select anomaly classifier of the anomaly type classifiers (e.g. Note [0088] wherein the determination of anomalous mark information is performed by a corresponding mark model).)
Dong, Wang and Beers are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of processing anomalies according to a plurality of mark models as disclosed by Beers. Paragraph [0055] of Beers discloses that the system may determine a subset of monitored dashboards such that the most useful visualizations or dashboards may be monitored based on metrics associated with visualizations that have been favorited, subscript and general popularity of the visualizations.
Regarding dependent claim 13,
As discussed above with claim 8, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein the alert rule provides for not flagging an event as an anomaly if the event is characterized by the subset of the anomaly type classifiers.
Beers further discloses the step wherein the alert rule provides for not flagging an event as an anomaly if the event is characterized by the subset of the anomaly type classifiers. See FIG. 5, (FIG. 5 illustrates method 500 comprising step 512 of determining if a mark information s anomalous. If the mark information is determined to not be anomalous, the method returns to step 504 of sampling mark information from monitored visualizations, i.e. wherein the alert rule provides for not flagging an event as an anomaly if the event is characterized by the select anomaly classifier of the anomaly type classifiers (e.g. Note [0088] wherein the determination of anomalous mark information is performed by a corresponding mark model).)
Dong, Wang and Beers are analogous art because they are in the same field of endeavor, anomaly detection. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of processing anomalies according to a plurality of mark models as disclosed by Beers. Paragraph [0055] of Beers discloses that the system may determine a subset of monitored dashboards such that the most useful visualizations or dashboards may be monitored based on metrics associated with visualizations that have been favorited, subscript and general popularity of the visualizations.
Claim(s) 7 and 14 is/are rejected under 35 U.S.C. 103 as being unpatentable over Dong in view of Wang as applied to claim 1 above, and further in view of ADAMSON et al. (US PGPUB No. 2022/0318118; Pub. Date: Oct. 6, 2022).
Regarding dependent claim 7,
As discussed above with claim 1, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein the user feedback is natural language feedback and the anomaly monitor customization tool is further configured to: utilize a trained natural language processing (NLP) model to infer intent from the user feedback;
and define the alert rule based on the intent.
ADAMSON further discloses the step wherein the user feedback is natural language feedback and the anomaly monitor customization tool is further configured to: utilize a trained natural language processing (NLP) model to infer intent from the user feedback; See Paragraph [0052], (Users may provide feedback via various widgets displayed on the user interface in which a narrative description 1100 is presented. The selectable widgets allow the user to indicate at least any of the following: indicate that the end user did not understand the significance of the narrative, a widget to indicate that the end user understood the narrative and found it to be useful, and a widget to indicate that the end user understood the narrative but did not find it to be useful. Users may also provide freeform text input via the user interface, i.e. wherein the user feedback is natural language feedback.) See Paragraph [0053], (The ML classifier may utilize the feedback data, including the freeform text input, to train an ML classifier to determine predicted causes for anomalous events as well as classifying the importance of an anomalous event to a user, i.e. the anomaly monitor customization tool is further configured to: utilize a trained natural language processing (NLP) model to infer intent from the user feedback (e.g. the ML classifier uses the user feedback to refine/augment the classifier functionality).)
and define the alert rule based on the intent. See Paragraph [0053], (The ML classifier may utilize the feedback data, including the freeform text input, to train an ML classifier to determine predicted causes for anomalous events as well as classifying the importance of an anomalous event to a user such that only anomalous events that are of sufficient importance to the end user are reported as elements of the actionable narrative. Note [0026] wherein messaging rules are applied to construct a narrative description of an anomaly, i.e. define the alert rule based on the intent (e.g. the ML classifier may refine the narratives being generated according to user feedback including freeform text entered by a user).)
Dong, Wang and ADAMSON are analogous art because they are in the same field of endeavor, anomaly detection and remediation. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of training a machine learning model to classify anomalous event data as disclosed by ADAMSON. Paragraph [0025] of ADAMSON discloses that the process of classifying anomalous events allows for specific messaging to be provided to an end user regarding specific interventions and remediation actions that can be pursued in order to mitigate the impact of an anomalous event on the computing environment.
Regarding dependent claim 14,
As discussed above with claim 8, Dong-Wang discloses all of the limitations.
Dong-Wang does not disclose the step wherein the user feedback is natural language feedback and the method further comprises: utilizing a natural language model to infer intent from the user feedback and to define the alert rule based on the intent.
and define the alert rule based on the intent.
ADAMSON further discloses the step wherein the feedback is natural language feedback and the method further comprises: utilizing a natural language model to infer intent from the feedback, See Paragraph [0052], (Users may provide feedback via various widgets displayed on the user interface in which a narrative description 1100 is presented. The selectable widgets allow the user to indicate at least any of the following: indicate that the end user did not understand the significance of the narrative, a widget to indicate that the end user understood the narrative and found it to be useful, and a widget to indicate that the end user understood the narrative but did not find it to be useful. Users may also provide freeform text input via the user interface, i.e. wherein the user feedback is natural language feedback.) See Paragraph [0053], (The ML classifier may utilize the feedback data, including the freeform text input, to train an ML classifier to determine predicted causes for anomalous events as well as classifying the importance of an anomalous event to a user, i.e. the anomaly monitor customization tool is further configured to: utilize a trained natural language processing (NLP) model to infer intent from the user feedback (e.g. the ML classifier uses the user feedback to refine/augment the classifier functionality).)
and define the alert rule based on the intent. See Paragraph [0053], (The ML classifier may utilize the feedback data, including the freeform text input, to train an ML classifier to determine predicted causes for anomalous events as well as classifying the importance of an anomalous event to a user such that only anomalous events that are of sufficient importance to the end user are reported as elements of the actionable narrative. Note [0026] wherein messaging rules are applied to construct a narrative description of an anomaly, i.e. define the alert rule based on the intent (e.g. the ML classifier may refine the narratives being generated according to user feedback including freeform text entered by a user).)
Dong, Wang and ADAMSON are analogous art because they are in the same field of endeavor, anomaly detection and remediation. It would have been obvious to anyone having ordinary skill in the art before the effective filing date to modify the system of Dong-Wang to include the method of training a machine learning model to classify anomalous event data as disclosed by ADAMSON. Paragraph [0025] of ADAMSON discloses that the process of classifying anomalous events allows for specific messaging to be provided to an end user regarding specific interventions and remediation actions that can be pursued in order to mitigate the impact of an anomalous event on the computing environment.
Response to Arguments
Applicant’s arguments, see Response After Final Action, filed 3/20/2026, with respect to the rejection(s) of claim(s) 1 and 8 under 35 USC 103 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of the combination of Dong et al. (US PGPUB No. 2022/0150590; Pub. Date: May 12, 2022) in view of Wang et al. (US PGPUB No. 2022/0303288; Pub. Date: Sep. 22, 2022) under 35 USC 103 as discussed above.
Applicant’s arguments with respect to the rejection of claim 15 under 35 USC 103 have been fully considered and are persuasive. The corresponding rejection has been withdrawn. Claims 15-21 are considered allowable for at least the reasons indicated above.
The examiner notes that the Application may be placed in condition for Allowance if claims 1-14 are cancelled such that claims 15-21 may be allowed. Applicant may then submit a continuation in order to further pursue the subject matter of claims 1-14.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Fernando M Mari whose telephone number is (571)272-2498. The examiner can normally be reached Monday-Friday 7am-4pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ann J. Lo can be reached at (571) 272-9767. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/FMMV/Examiner, Art Unit 2159 /ALBERT M PHILLIPS, III/Primary Examiner, Art Unit 2159
Prosecution Insights