Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1 and 9 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by US 20230065889 to Biswas.
Regarding claim 1, Biswas teaches a system for anomaly detection in a computer, the system comprising:
a cloud-based metrics storage service configured to store a plurality of computer metrics received from a metrics reading library installed on the computer to monitor computer equipment, the plurality of computer metrics comprising a plurality of streams of data, each stream related to separate computer equipment (abstract¶ 21, 48); and
at least one processor operably coupled to memory, and instructions that, when executed by the at least one processor, cause the at least one processor to implement:
a training engine configured to train a plurality of computer equipment metric models using an Isolation Forest algorithm (abstract, ¶ 21, 42, 48, training models using isolation forest algorithm using data metrics), wherein each of the plurality of computer equipment metric models is trained for a given metric using the stream of data for the given metric of the plurality of computer metrics (abstract, ¶ 21, 48),
wherein each of the plurality of computer equipment metric models is associated with a different computer metric and not associated with any of the other plurality of computer equipment metric models (¶ 42, each model associated with different metric per user),
an inference engine configured to generate a prediction vector including a non-anomaly determination of 0 or an anomaly determination of 1 for each of the plurality of computer equipment metric models using an Isolation Forest algorithm (abstract, ¶ 21, 48, anomaly determination using isolation forest algorithm), and a
determination engine configured to evaluate the prediction vector to determine an anomaly pattern in the computer (abstract, ¶ 21, 48, anomaly determination).
Claim 9 is addressed by similar rationale as claim 1.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all obviousness rejections set forth in this Office action:
(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103(a) are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims under 35 U.S.C. 103(a), the examiner presumes that the subject matter of the various claims was commonly owned at the time any inventions covered therein were made absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and invention dates of each claim that was not commonly owned at the time a later invention was made in order for the examiner to consider the applicability of 35 U.S.C. 103(c) and potential 35 U.S.C. 102(e), (f) or (g) prior art under 35 U.S.C. 103(a).
Claims 2-4, 6, 10-12, 14 are rejected under 35 U.S.C. 103(a) as being unpatentable over Biswas in view of US 20250211600 to Barkai.
Regarding claim 2, 10,
Biswas fails to teach but Barkai teaches:
a training engine settings monitor configured to generate an anomaly filter based on a mean and a standard deviation for a given metric, wherein the training engine is configured to train the model associated with the given metric using the anomaly filter to reduce false positives (¶ 16-19, 55-56).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Barkai. The motivation to do so is that the teachings of Barkai would have been advantageous in terms of facilitating context based anomaly detection (Barkai, ¶ 16-19, 55-56).
Regarding claim 3, 11,
Biswas fails to teach but Barkai teaches:
wherein the anomaly filter defines a confidence interval using the mean, the standard deviation, and a filter sensitivity (¶ 16-19, 55-56, 63-65). Motivation to include Barkai is the same as presented above.
Regarding claim 4, 12,
Biswas fails to teach but Barkai teaches:
wherein the filter sensitivity includes a low value, a medium value and a high value (¶ 16-19, 31, 38, 60-65, low, mean, and upper bounds). Motivation to include Barkai is the same as presented above.
Regarding claim 6, 14,
Biswas fails to teach but Barkai teaches:
wherein the plurality of computer metrics includes processor load, processor temperature, and RAM usage (¶ 16, 26). Motivation to include Barkai is the same as presented above.
Claim 5, 13 rejected under 35 U.S.C. 103(a) as being unpatentable over Biswas in view of US 20230385143 to Mohanty.
Regarding claim 5, 13,
Biswas fails to teach but Mohanty teaches:
an inference engine settings monitor configured to increment a count of consecutive anomalies, and evaluate the count against a minimum anomaly value, wherein when the count is less than the minimum anomaly value, a non-anomaly determination is made for the given metric (¶ 49, 63, 67).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Mohanty. The motivation to do so is that the teachings of Mohanty would have been advantageous in terms of facilitating anomaly prediction (Mohanty, ¶ 49, 63, 67).
Claim 7-8, 15-16 rejected under 35 U.S.C. 103(a) as being unpatentable over Biswas in view of US 12,393,882 to Yamaguchi.
Regarding claim 7, 15,
Biswas fails to teach but Yamaguchi teaches:
wherein the determination engine is further configured to evaluate the prediction vector by presenting a graphical user interface of the prediction vector by a two-dimensional plot of time against each prediction vector value against a confidence interval for each of the prediction vector values (abstract, col. 3:1-45, claim 1).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Yamaguchi. The motivation to do so is that the teachings of Yamaguchi would have been advantageous in terms of facilitating prediction analysis for time series data (Yamaguchi, abstract, col. 3:1-45).
Regarding claim 8, 16,
Biswas teaches:
wherein the confidence interval comprises a band having a lower bound and an upper bound, wherein the prediction vector value is positioned relative to the band such that anomaly predictions are outside the band and non-anomaly predictions are inside the band (abstract, ¶ 37, 52-53, inside and outside of range calculations).
Claim 17 and 20 rejected under 35 U.S.C. 103(a) as being unpatentable over Biswas in view of US 20230007023 to Andrabi.
Regarding claim 17, Biswas teaches a system for anomaly detection in a computer, the system comprising: a processor and operably coupled memory, and instructions that, when executed by the processor, cause the processor to implement:
a plurality of computer equipment metric models, each trained for a certain computer system metric by a training Isolation Forest Algorithm using a stream of data for the certain computer system metric and not using any of the other metrics for the computer system (abstract, ¶ 21, 42, 48, training models using isolation forest algorithm using data metrics),
an inference engine configured to generate a prediction vector of at least one anomaly determination and at least one anomaly determination for computer system data for each of the plurality of computer equipment metric models according to an inference Extended Isolation Forest Algorithm (abstract, ¶ 21, 48, anomaly determination using isolation forest algorithm), and
a determination engine configured to present a graphical user interface of the prediction vector of a two-dimensional plot of time against each prediction vector against a confidence interval for each of the prediction vector values (abstract, ¶ 21, 48, anomaly determination).
Biswas discloses the use of the Isolation Forest Algorithm but fails to disclose using an Extended Isolation Forest Algorithm. However, Andrabi discloses using an Extended Isolation Forest Algorithm (¶ 100).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Andrabi. The motivation to do so is that the Extended Isolation Forest Algorithm is an obvious variant of the Isolation Forest Algorithm and that the teachings of Andrabi would have been advantageous in terms of facilitating the detection of anomalous actions (Andrabi, ¶ 100).
Regarding claim 20,
Biswas fails to teach but Andrabi teaches:
wherein the plurality of computer equipment metric models comprises a set of tree structures generated according to the training Extended Isolation Forest Algorithm, and wherein the inference engine is configured to analyze the set of tree structures using the inference Extended Isolation Forest Algorithm.(¶ 95-98, 125). Motivation to include Andrabi is the same as presented above.
Claim 18 rejected under 35 U.S.C. 103(a) as being unpatentable over Biswas and Andrabi in view of Barkai.
Regarding claim 18,
Biswas fails to teach but Barkai teaches:
a CPU load model trained to detect anomalies of CPU load on the computer system; and a RAM load model trained to detect anomalies of RAM load on the computer system (¶ 16, 26).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Barkai. The motivation to do so is that the teachings of Barkai would have been advantageous in terms of facilitating context based anomaly detection (Barkai, ¶ 16-19, 55-56).
Claim 19 rejected under 35 U.S.C. 103(a) as being unpatentable over Biswas, Andrabi, and Barkai in view of US 20210125076 to Zhang.
Regarding claim 19,
Biswas fails to teach but Andabi teaches:
wherein the Extended Isolation Forest Algorithm implements outlier detection tailoring (¶ 40, 92-96, 100).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Andrabi. The motivation to do so is that the Extended Isolation Forest Algorithm is an obvious variant of the Isolation Forest Algorithm and that the teachings of Andrabi would have been advantageous in terms of facilitating the detection of anomalous actions (Andrabi, ¶ 100).
Biswas fails to teach but Barkai teaches a node-level data standardization (¶ 49, node data normalization).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Barkai. The motivation to do so is that the teachings of Barkai would have been advantageous in terms of facilitating context based anomaly detection (Barkai, ¶ 16-19, 55-56).
Biswas fails to teach but Zhang teaches:
automatic depth limitation, a penalization mechanism (¶ 107, isolation forest, depth limit, penalization).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of . The motivation to do so is that the teachings of would have been advantageous in terms of facilitating outlier detection (Zhang, ¶ 107).
CONCLUSION
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RYAN J JAKOVAC whose telephone number is (571)270-5003. The examiner can normally be reached on 8-4 PM EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar A. Louie can be reached on 572-270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RYAN J JAKOVAC/Primary Examiner, Art Unit 2445