Prosecution Insights
Last updated: August 18, 2026
Application No. 18/588,860

TWO-STAGE ANOMALOUS DEVICE DETECTION

Final Rejection §102
Filed
Feb 27, 2024
Examiner
ANYAN, BARBARA BURGESS
Art Unit
2457
Tech Center
2400 — Computer Networks
Assignee
Palo Alto Networks Inc.
OA Round
2 (Final)
78%
Grant Probability
Favorable
3-4
OA Rounds
11m
Est. Remaining
54%
With Interview

Examiner Intelligence

Grants 78% — above average
78%
Career Allowance Rate
573 granted / 736 resolved
+19.9% vs TC avg
Minimal -24% lift
Without
With
+-24.0%
Interview Lift
resolved cases with interview
Typical timeline
3y 5m
Avg Prosecution
10 currently pending
Career history
743
Total Applications
across all art units

Statute-Specific Performance

§101
18.0%
-22.0% vs TC avg
§103
30.9%
-9.1% vs TC avg
§102
38.1%
-1.9% vs TC avg
§112
9.7%
-30.3% vs TC avg
Black line = Tech Center average estimate • Based on career data from 736 resolved cases

Office Action

§102
Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Information Disclosure Statement The information disclosure statement (IDS) submitted on 2/27/24 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner. Claim Rejections - 35 USC § 102 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention. Claims 1-3, 8-10, 13-15, 18 are rejected under 35 USC 102(a)(1) as being anticipated by Thakore (hereinafter “Tha”, US Patent 11831644 B1). As per claims 1, 10, 15, Tha discloses A method, non-transitory machine-readable media, and apparatus comprising: Generating a plurality of embeddings representing a plurality of device profiles, wherein each of the plurality of device profiles comprises at least one of data and metadata collected for a corresponding device in a network (column 11, lines 15-27, column 12, lines 60-67, column 53, lines 30-41, 48-55, 62-67, Device-association data is stored in a user registry or data store. The data store receives sensor data from the device such as data type of sensor data and/or other attributes of the sensor data); Clustering the plurality of embeddings into one or more clusters (column 17, lines 25-30, column 49, lines 10-14, 29-31, column 53, lines 33-40); identifying a subset of the plurality of device profiles as anomalous device profiles based on analyzing the one or more clusters (column 3, lines 6-10, 25-30, column 13, lines 60-67, column 14, lines 9-15, 60-67, The anomaly detector determines that an anomaly is present); Prompting a language model to verify anomalousness of the subset of device profiles (column 3, lines 6-10, 25-30, column 13, lines 60-67, column 14, lines 9-15, 60-67); Based on verifying anomalousness of one or more device profiles of the subset of device profiles, indicating that the one or more device profiles are anomalous (column 3, lines 50-53, 60-65, column 4, lines 1-8, column 5, lines 11-16). As per claims 2, 13, Tha discloses The method of claim 1, wherein prompting the language model to verify anomalousness of the subset of device profiles comprises generating a set of prompts corresponding to the subset of device profiles for the language model and submitting each prompt of the set of prompts to the language model (column 5, lines 21-31, column 13, lines 64-67). As per claims 3, 14, Tha discloses The method of claim 2 further comprising obtaining responses to submitting the set of prompts to the language model that indicate whether corresponding ones of the subset of device profiles are anomalous, wherein verifying anomalousness of the one or more device profiles comprises determining that one or more of the responses indicate that the corresponding one or more device profiles are anomalous (column 14, lines 1-20). As per claim 8, Tha discloses The method of claim 1, wherein the language model was previously adapted to predict whether device profiles indicated in prompts are anomalous based on few shot prompting with sets of known anomalous device profiles and known non-anomalous device profiles (column 54, lines 56-67). As per claim 9, Tha discloses The method of claim 1, wherein the language model comprises a pre-trained Transformer-based large language model (LLM) (column 48, lines 27-30). As per claim 18, Tha discloses The apparatus of claim 15, wherein the instructions executable by the processor to cause the apparatus to prompt the language model to verify anomalousness of each device profile of the anomalous device profile candidates comprise instructions executable by the processor to cause the apparatus to generate a set of prompts corresponding to the anomalous device profile candidates for the language model and submit each prompt of the set of prompts to the language model, wherein the language model was previously adapted to predict whether device profiles indicated in prompts are anomalous (column 14, lines 1-20). Allowable Subject Matter Claims 4-7, 11-12, 16-17, 19-20 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims. Response to Arguments Applicant's arguments filed 5/20/26 have been fully considered but they are not persuasive. Examiner notes the following argument(s): Thakore fails to disclose identifying anomalous device profiles based on analyzing clusters of device profile embeddings for outliers as claim 1 recites. Thakore never mentions that the anomaly detector analyzes clusters of embeddings generated from the sensor data used for anomaly detection for outliers as part of the disclosed anomaly detection techniques. There is an absence of disclosing generating device profile embeddings in Thakore. Thakore certainly cannot disclose analyzing clusters of device profile embeddings for outliers to identify anomalous ones of the device profiles. In Response to: Thakore teaches users are associated with a computing device. The computing device corresponds to a device identifier that is associated with user profile data. A user registry stores the user profile data indicating the device identifier. Devices are associated with sensor data displayed on the device. The sensor data is processed to determine an anomaly which is a part of the user profile associated with the device. Thakore further teaches a user being a part of a peer group of users associated with other devices and the sensor data from the group are used to determine an anomaly. Again, the sensor data is apart of profiles (column 3, lines 11-15, 64-67, column 4, lines 1-10, column 7, lines 45-52, column 54, lines 1-5, column 57, lines 15-25). Therefore, Thakore indeed discloses identifying anomalous device profiles based on analyzing clusters of device profile embeddings for outliers as claim 1 recites. Thakore teaches users are associated with a computing device. The computing device corresponds to a device identifier that is associated with user profile data. A user registry stores displayed on the device. The sensor data is processed to determine an anomaly which is a part of the user profile associated with the device. Thakore further teaches a user being a part of a peer group of users associated with other devices and the sensor data from the group are used to determine an anomaly. Again, the sensor data is apart of profiles. The device(s) may generate metadata being associated with the group profile and device identifier (column 3, lines 11-15, 64-67, column 4, lines 1-10, column 7, lines 45-52, column 53, lines 65-67, column 54, lines 1-15, column 57, lines 15-25). Therefore, Thakore indeed discloses the anomaly detector analyzes clusters of embeddings generated from the sensor data used for anomaly detection for outliers as part of the disclosed anomaly detection techniques. Thakore teaches generating metadata from audio data and is associated with the device identifier associated with the group profile identifier which is identified in the metadata (column 53, lines 65-67, column 54, lines 1-15). Therefore, Thakore discloses generating device profile embeddings in Thakore. Thakore teaches users are associated with a computing device. The computing device corresponds to a device identifier that is associated with user profile data. A user registry stores displayed on the device. The sensor data is processed to determine an anomaly which is a part of the user profile associated with the device. The sensor data can include audio data and acceptable as input into the anomaly detector and can determine an anomaly. Thakore further teaches a user being a part of a peer group of users associated with other devices and the sensor data from the group are used to determine an anomaly. Again, the sensor data is apart of profiles. The device(s) may generate metadata being associated with the group profile and device identifier. (column 3, lines 11-15, 64-67, column 4, lines 1-10, 36-45, column 7, lines 45-52, column 53, lines 65-67, column 54, lines 1-15, column 57, lines 15-25). Therefore, Thakore definitely teaches analyzing clusters of device profile embeddings for outliers to identify anomalous ones of the device profiles. Conclusion THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to BARBARA BURGESS ANYAN whose telephone number is (571)272-3996. The examiner can normally be reached IFP M-F 8am-5pm. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ario Etienne can be reached at 571-272-4001. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. February 17, 2026 /BARBARA B Anyan/Primary Examiner, Art Unit 2457
Read full office action

Prosecution Timeline

Feb 27, 2024
Application Filed
Feb 20, 2026
Non-Final Rejection mailed — §102
May 11, 2026
Interview Requested
May 20, 2026
Response Filed
Jul 29, 2026
Final Rejection mailed — §102 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12701120
THIRD-PARTY ACCESS-CONTROL SUPPORT USING ROLE HISTORY ANALYSIS
1y 9m to grant Granted Aug 04, 2026
Patent 12695682
DETERMINING SPATIAL-TEMPORAL INFORMATIVE PATTERNS FOR USERS AND DEVICES IN DATA NETWORKS
1y 11m to grant Granted Jul 28, 2026
Patent 12689685
ADJUSTING ATTRIBUTES FOR AN ON-DEMAND SERVICE SYSTEM BASED ON REAL-TIME INFORMATION
2y 1m to grant Granted Jul 21, 2026
Patent 12675748
DYNAMIC MODEL-BASED ACCESS RIGHT PREDICTIONS
1y 11m to grant Granted Jul 07, 2026
Patent 12675384
SYSTEMS AND METHODS FOR NON-HUMAN ACCOUNT TRACKING
1y 7m to grant Granted Jul 07, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

3-4
Expected OA Rounds
78%
Grant Probability
54%
With Interview (-24.0%)
3y 5m (~11m remaining)
Median Time to Grant
Moderate
PTA Risk
Based on 736 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month