Prosecution Insights
Last updated: October 23, 2026
Application No. 18/608,187

DETECTING ANOMALIES IN LOG MESSAGES USING CODE-DERIVED MESSAGE PATTERNS TO GUIDE STRUCTURED MESSAGE CLASSIFICATION

Non-Final OA §101§103
Filed
Mar 18, 2024
Examiner
MCNAMARA, SEAN KEVIN
Art Unit
2113
Tech Center
2100 — Computer Architecture & Software
Assignee
ORACLE INTERNATIONAL Corporation
OA Round
1 (Non-Final)
72%
Grant Probability
Favorable
1-2
OA Rounds
0m
Est. Remaining
99%
With Interview

Examiner Intelligence

Grants 72% — above average
72%
Career Allowance Rate
21 granted / 29 resolved
+17.4% vs TC avg
Strong +34% interview lift
Without
With
+33.7%
Interview Lift
resolved cases with interview
Typical timeline
2y 5m
Avg Prosecution
7 currently pending
Career history
46
Total Applications
across all art units

Statute-Specific Performance

§101
17.9%
-22.1% vs TC avg
§103
60.0%
+20.0% vs TC avg
§102
17.9%
-22.1% vs TC avg
§112
4.3%
-35.7% vs TC avg
Black line = Tech Center average estimate • Based on career data from 29 resolved cases

Office Action

§101 §103
NON-FINAL ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claim 1, 4, 6, 8-11, 14-16, 19 and 20 rejected under 35 U.S.C. 101 because the claimed invention is directed to mental processes without significantly more. Step 1 Claims 1-10 recite a method, claims 11-15 recite non-transitory computer readable media, claims 16-20 recite systems, all of which are eligible categories of invention. Step 2A prong 1: Claim 1 recites the mental processes of determining, detecting, and matching. Claims 11 and 16 recite all of the same elements as claim 1. Claims 4 and 6 also recite matching. Claims 8-10 recite making determinations. Claims 14-6 recite the same limitations as 8-10, 19 and 20 recite the same as 8 and 9. Step 2A prong 2: Claim 1 recites receiving a set of messages, which is considered mere data gathering. Triggering is also considered extra solution activity, data output. The source code files are just the data to be gathered. Claim 4 recites using a message classifier, which are also instructions to apply the judicial exceptions. Claim 6 recites observing that a pattern is already stored in gathered data. Claim 8 recites the frequency of patterns, which is only making an observation on the gathered data. Claim 9 recites the use of a large language model to make the determination, which are merely instructions to apply the exception. Claim 10 recites having data that is already marked as anomalous, which is extra solution activity. Step 2B: Regarding claim 1, displaying a notification to a user is well understood routing and conventional (MPEP 2106.05(d)). The computer hardware is recited with a high level of generality. Regarding claim 4, the limitation on computational complexity can be interpreted as simply limiting the rate of computations at a high level. Regarding claim 6, keeping recorded information is well understood, routine and conventional. Regarding claim 8, recording of the frequency of events is also just recording information. Regarding claim 9, the application of a large language learning model is at high level of generality, and the use of LLMs is well understood routine and conventional. Regarding claim 10, it is also just recorded information. Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claim(s) 1, 2, 6, 11, 12, 16, and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Datar (US20220405160) in view of Bang (US 20240311221). Regarding claim 1, Datar teaches . A computer-implemented method comprising: determining a plurality of code-derived message text patterns from one or more source code files that generate messages of one or more types, wherein determining the plurality of code-derived message text patterns comprises: detecting message generating instructions in the one or more source code files that generate messages of the one or more types, (“In another example, source code of a software system may be parsed to create a database or list of all potential error and warning log messages, for example from software statements that generate such log messages” ¶7); and determining that the message generating instructions generate messages according to the plurality of code-derived message text patterns, wherein one or more of the plurality of code-derived message text patterns comprise invariant text and placeholders for variable text (“Variable information in the log messages may be ignored, and in some examples may be removed before inclusion in the database and/or removed before the search.” ¶17); receiving a set of one or more messages; determining a particular message of the one or more messages is at least one type of the one or more types; determining one or more code-derived message text patterns of the plurality of code-derived message text patterns available for the at least one type; matching the particular message to a particular code-derived message text pattern of the one or more code-derived message text patterns; determining whether the particular message is anomalous based at least in part on the one or more code-derived message text patterns; (“In another example, source code of a software system may be parsed to create a database or list of all potential error and warning log messages, for example from software statements that generate such log messages. At run time, in the second stage, log messages may be matched against the list of log messages created during parsing, and any non-matching log message may be treated as anomalous” ¶7). Datar does not teach and based at least in part on determining that the particular message is anomalous, triggering a notification that the particular message is anomalous.. Bang teaches and based at least in part on determining that the particular message is anomalous, triggering a notification that the particular message is anomalous (“The anomaly system generates an indication of an interpretation of the log anomaly for display in a user interface based on the particular log template that contributes to the log anomaly.” ¶3). It would have been obvious for one of ordinary skill in the art prior to the filing of the claimed invention to combine the message anomaly detection system of Datar with the triggering of a notification of the anomaly as described by Bang. This allows the system to display both the anomaly as well as relevant information about the anomaly to the user without further processing (Bang ¶44). Regarding claim 2, Bang teaches The computer-implemented method of Claim 1, wherein matching the particular message to the particular code-derived message text pattern of the one or more code-derived message text patterns comprises: using a drain having a fixed maximum depth to determine a particular text pattern for the particular message, and matching the particular text pattern to the particular code-derived message text pattern. (“In an example, the pre-process module 202 processes the log data 114 using a log parser 402 as described by He et al., Drain: An Online Log Parsing Approach with Fixed Depth Tree, 2017 IEEE 24th International Conference on Web Services, IEEE p. 33-40 (2017), to extract raw content of log messages from the unprocessed log messages 116 and convert the extracted raw content into the two-dimensional representations 404.” ¶48 ). Regarding claim 6, Datar teaches determining a particular text pattern for the particular message, and determining that the particular text pattern exists in a set of stored text patterns, wherein the set of stored patterns comprises a stored association between the particular text pattern and the particular code-derived message text pattern (“In some examples, the database of recorded log messages may be compressed and/or may be partitioned based on patterns. In a second stage, some examples, log messages generated by the software system (also referred to herein as a computing system or application) may be searched in a database (e.g. of “normal” log messages collected in the first stage) to determine if there is a match. If there is no match, the log message may be treated as anomalous.” ¶17). Regarding claims 11 and 12, they recite a non transitory computer readable media with instructions that perform the same steps as claims 1 and 2. Claims 16 and 17 recite a system that performs the same steps as claims 1 and 2 Claim(s) 8, 10, 14, and 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Datar and Bang in view of Wuhib (US 20230011129). Regarding claim 8, Datar and Bang teach the computer implemented method of claim 1, they do not teach wherein matching the particular message to the particular code-derived message text pattern of the one or more code-derived message text patterns comprises: determining a particular text pattern for the particular message, and determining that the particular text pattern exists in a set of stored text patterns, wherein the set of stored patterns comprises a stored association between the particular text pattern and the particular code-derived message text pattern. Wuhib teaches wherein matching the particular message to the particular code-derived message text pattern of the one or more code-derived message text patterns comprises: determining a particular text pattern for the particular message, and determining that the particular text pattern exists in a set of stored text patterns, wherein the set of stored patterns comprises a stored association between the particular text pattern and the particular code-derived message text pattern. (“In some embodiments of this aspect, determining the anomaly in the live log record further includes identifying the live log record is an anomaly when one of the live log record elements either does not match any tree node in the tree structure or matches a tree node of the tree structure that has a frequency below a certain threshold, wherein said frequency represents the number of times the node value has been recorded in training records.” ¶26). It would have been obvious for one of ordinary skill in the art prior to the filing of the claimed invention to combine the anomaly detection method of Datar and Bang with the analysis of the event frequencies as described by Wuhib. Less frequent occurrences may be faults that have been previously detected and more easily identified than previously unseen anomalies, therefore keeping the associations with less frequent events can reduce the need for more expensive detection methods (Wuhib ¶50). Regarding claim 10, Wuhib teaches determining that the one or more code-derived message text patterns have been stored in a set of code-derived message text patterns that are marked as anomalous (“The output of a scoring algorithm, such as ScoreLine, may be a score of the log record, which may be considered a measure of how ‘normal’ a log record is. In some embodiments, a threshold on the score of a log record may be identified so as to be able to either mark the log record as anomaly or not. Depending on how the anomaly detector algorithm is used, the threshold can be initialized in different ways.” ¶160). Claims 14 and 19 recite the same steps as claim 8. Claim(s) 9, 15 and 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Datar and Bang in view of Bao (US 20250245120). Datar and Bang teach the computer implemented method of claim 1, they do not teach determining that the particular code-derived message text pattern is reporting an anomaly based at least in part on a label generated by prompting a large language model to label the particular message, the particular code-derived message text pattern, or particular message generating instructions of the message generating instructions. Bao teaches determining that the particular code-derived message text pattern is reporting an anomaly based at least in part on a label generated by prompting a large language model to label the particular message, the particular code-derived message text pattern, or particular message generating instructions of the message generating instructions (“More particularly, implementations of the present disclosure are directed to a software debugging system that leverages large language models (LLMs) in combination with entity matching machine learning (ML) models (referred to herein as entity matching models) to identify root causes of errors and propose solutions for mitigating root causes.” ¶14). It would have been obvious for one of ordinary skill in the art prior to the filing of the claimed invention to combine the anomaly detection method of Datar and Bang with the use of an LLM to identify and report anomalies as described by Bao. An LLM would be able to match errors to historical errors, and also be able to match the errors to previously determined solutions (Bao ¶18). Claims 15 and 20 recite the same steps as claim 9. Claim Objections Claims 3, 5, 7, 13, and 18 objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Shah (US 20210185066) describes detecting anomalous messages, and the tradeoff between maintaining message size and compression to reduce computational complexity (¶121) but still relies on a fixed size. Any inquiry concerning this communication or earlier communications from the examiner should be directed to SEAN KEVIN MCNAMARA whose telephone number is (703)756-1884. The examiner can normally be reached Monday-Friday 7:30-5:00 EST. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bryce Bonzo can be reached at 571-272-3655. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /SEAN KEVIN MCNAMARA/ Examiner, Art Unit 2113 /PHILIP GUYTON/ Primary Examiner, Art Unit 2113
Read full office action

Prosecution Timeline

Mar 18, 2024
Application Filed
Oct 02, 2026
Non-Final Rejection mailed — §101, §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12754792
SYSTEM AND METHOD FOR PRIORITIZING CODE VIOLATIONS USING MACHINE LEARNING AND DATASETS OF VULNERABLE AND VANILLA CODE SNIPPETS
1y 10m to grant Granted Oct 06, 2026
Patent 12743345
SYSTEMS AND METHODS FOR DATA RECOVERY
2y 11m to grant Granted Sep 22, 2026
Patent 12731071
ML UE CAPABILITY AND INABILITY
3y 8m to grant Granted Sep 08, 2026
Patent 12699642
EFFICIENT DIAGNOSIS OF LOGS BASED ON EVENTS
3y 4m to grant Granted Aug 04, 2026
Patent 12657091
BACKUP AND RESTORE FOR A HYBRID TRANSACTIONAL AND ANALYTICAL PROCESSING (HTAP) DATABASE
2y 2m to grant Granted Jun 16, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

Strategy Recommendation AI-generated — please review before filing

Get a prosecution strategy drawn from examiner precedents, rejection analysis, and claim mapping.
Typically takes 5-10 seconds — AI-generated, attorney review required before filing

Prosecution Projections

1-2
Expected OA Rounds
72%
Grant Probability
99%
With Interview (+33.7%)
2y 5m (~0m remaining)
Median Time to Grant
Low
PTA Risk
Based on 29 resolved cases by this examiner. Grant probability derived from career allowance rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month