DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claim 1 and analogous claim 11 are objected to because of the following informalities: “applying the large language model to the subsequent logged event to generate as an output a subsequent description” should read as “applying the large language model to the subsequent logged event to generate as an output as subsequent description”.
Appropriate correction is required.
Claim Rejections - 35 USC § 112(b)
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 and analogous claim 11 recites “an activity log comprising records of logged events each representing at least one of a start of a process, a start of a thread, a termination of a process, a termination of a thread, or a start of a system call,” It is unclear if the “each representing” refers to “each logged event” or “each record of logged events.” Examiner’s note: For examination purposes, Examiner interprets the limitation to be “an activity log comprising records of logged events wherein each logged event representing at least one of a start of a process, a start of a thread, a termination of a process, a termination of a thread, or a start of a system call.”
Claims 2-10 and 12-20 are further rejected on virtue of their dependency to the rejected parent claims.
Claim 1 and analogous claim 11 recites “applying the embedding layer to the initial activity log to generate N d-dimensional numerical vectors by: applying the large language model to each of the N logged events to generate as an output N descriptions… combining the N text embeddings and the N learned embeddings to generate the N d-dimensional numerical vectors… applying the encoding layer to the generated N d-dimensional numerical vectors to generate the profile by contextualizing the N logged events relative to one another…” It is unclear which of the two N d-dimensional numerical vector (generated by assumingly different methods) should be the “generated N d-dimensional numerical vectors.”
Claims 2-10 and 12-20 are further rejected on virtue of their dependency to the rejected parent claims.
Claim 1 and analogous claim 11 recites the limitation "the subsequent learned embedding layer." There is insufficient antecedent basis for this limitation in the claims. Examiner’s note: Examiner suggests claim 1 and analogous claim 11 should instead recite “the learned embedding layer.”
Claims 2-10 and 12-20 are further rejected on virtue of their dependency to the rejected parent claims.
Claim 8 recites “wherein the classifier computes the probability based on: the d-dimensional subsequent numerical vector; and a head-wise weighted average performed on: the N d-dimensional profile vectors; and a head-wise softmax of a multi-head attention score of: the d-dimensional subsequent numerical vector; and each of the N d-dimensional profile vectors.” It is unclear if each of the N d-dimensional profile vectors are variables in the softmax calculation or computing the probability, or the weighted average function.
Claim 19 recites the limitation "The method of claim 1." There is insufficient antecedent basis for this limitation in the claim. Examiner’s note: Examiner suggests claim 19 should instead recite “The method of claim 11.”
Claim 20 is further rejected on virtue of its dependency to claim 19.
Examiner’s note: Examiner interprets claims 19 and 20 to be dependents of claim 11.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1-2, 4, 6-7, 9, 11-12, 14, 16-17 and 19 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by US Pub No. US20240289609A1 Birru et al. (“Birru”).
In regards to claim 1 and analogous claim 11,
Birru teaches
A computer device for using a machine learning model to detect anomalies in a monitored computer system, the computer device comprising: memory comprising a non-transitory computer readable medium storing the machine learning model,
(Birru, “[0111] In a third aspect, the present disclosure provides a computer readable storage medium having computer executable instruction that when executed by a computer system, causes the computer system to execute a method for detecting one or more anomalies in an event data.”)
wherein the machine learning model includes:
an embedding layer configured to combine an output of a large language model and an output of a learned embedding layer;
Examiner interprets the large language model and the learned embedding layer in light of the specification, (“[0024] The large language model 26 may be any suitable large language model or natural language processing model for outputting a description of a logged event 38. For example, the large language model 26 may be implemented using pre-trained commercial large language models such as GPT3.5-Turbo, GPT4.0 or LLaMA,”; [0026], “…The learned embedding layer 28 may be implemented using any trainable embedding algorithm, such as PyTorch’s embedding module.”)
(Birru, “[0082] The processing arrangement is further configured to process the event data using an encoder architecture of the processing arrangement, the encoder architecture comprising at least two encoders, a first set of encoders and a second encoder [wherein the machine learning model includes: an embedding layer configured to combine an output of a large language model and an output of a learned embedding layer]. Throughout the present disclosure, the term “encoder architecture” refers to a structure and/or module comprising a set of encoders (or transformers) operatively coupled with each other and configured to enable the system (or processing arrangement) to accurately and efficiently detect the one or more anomalies in the event data.”)
(Birru, “[0089] In one or more embodiments, the first encoder of the encoder architecture is a log event encoder, wherein the log event encoder is configured to implement a Bidirectional Encoder Representations from Transformers (BERT) based language model to obtain the one or more event embeddings (or embedding vectors) for each of the set of extract tokens via the token-level event representation of the plurality of log events.”)
an encoding layer configured to output a profile representing the role of the monitored computer system based on an initial activity log;
(Birru, “[0099] The processing arrangement is further configured to generate an embedding matrix [an encoding layer ie processing arrangement configured to output a profile ie embedding matrix] utilizing the derived correlations between the plurality of log events and process the embedding matrix to detect the one or more anomalies in the event data [representing the role of the monitored computer system; wherein the role of the embedding matrix is to detect the anomalies]. Typically, the output contextual embeddings (ct) are utilized for generating the embedding matrix ‘C’ to be further utilized via the processing arrangement to be used for various downstream tasks such as log sequence classification, cluster analysis, and prediction of the next incoming log events as explained earlier. Similarly, the processing arrangement can detect the one or more anomalous log events (or anomalies) by predicting the most probable embedding of an incoming log event and identifying or detecting an anomaly, if the log event violates the normal behavior such as, via implementation of a Next Event Decoder head along with the encoder-architecture of the processing arrangement. Notably, in supervised settings, the neural network is capable of detecting anomalous behavior for each event in the given log sequence with respect to other events in the sequence.”)
(Birru, “[0096] According to embodiments of the present disclosure, the neural network would need to predict “normal” instances of log event data for the given time period, as would be discussed later in the disclosure in detail. For this purpose, the neural network may need to be trained on refined log event data representing normal operating conditions (NOC) for the process to be analyzed. Thus, herein, the prior log event data [based on an initial activity log; ie prior log event data] may be selected from available multiple sequences of log events, from the refined log event data, representing the normal operating conditions for the process to be analyzed to detect the one or more anomalies therein. Herein, selection of the given sequence of log events, from the received time-series data, may be based on characterizing a normal behavior for the refined event data for at least a defined time period.”)
and a classifier configured to classify an event as anomalous or normal;
(Birru, [0101], “In another embodiment, the processing arrangement is configured to implement a classifier head decoder (i.e., a classification head) to classify the given sequence of log events (i.e., classification at sequence level), and each of the log events in the given sequence of log events (i.e., classification at event level), using supervised learning objectives.”)
processor circuitry configured to: receive an activity log comprising records of logged events each representing at least one of a start of a process, a start of a thread, a termination of a process, a termination of a thread, or a start of a system call,
(Birru, “[0078] Herein, the processing arrangement is configured to receive event data associated with a plurality of log events [processor circuitry configured to: receive an activity log comprising records of logged events] for a given time period. Herein, the event data received by the processing arrangement comprises the plurality of log events associated with the given time period, for example, 1 hour, 2 hour, 6 hours, 12 hours, 24 hours, 1 week, 1 month, 1 year, and the like, and stored in the database for further processing thereof. The term “log event” as used herein refers to semi-structured text(s) associated with any technical process [each representing at least one of], wherein each log event has two components, namely, a fixed component (i.e., an event template) and a variable component (i.e., parameter values such as, IP address, file path, file size, and time-taken)… The term “log parameter” as used herein refers to processing parameters associated with the plurality of log events in the event data. The one or more log parameters may include, but are not limited to, a location or address, an identifier (such as, process ID or trace identifiers), a size, a path, and a time period, associated with the plurality of log events. Notably, the time period refers to the time interval between two consecutive log events in the event data and may include a start time, an end time [a start of a process… a termination of a process], or duration therebetween, and may further be utilized via the processing arrangement during further processing.”)
wherein: each of the logged events includes event data comprising at least one of an identifier of the event, a type of the event, a parent of the event, a path of a binary related to the event, a path of the parent, an identifier of a user associated with the event, parameters of the event, a return value of the event, a priority of the event, a duration of the event, or a start time of the event;
(Birru, [0078], “The term “log parameter” as used herein refers to processing parameters associated with the plurality of log events in the event data. The one or more log parameters may include [wherein: each of the logged events includes event data comprising at least one of parameters of the event], but are not limited to, a location or address, an identifier (such as, process ID or trace identifiers), a size, a path, and a time period, associated with the plurality of log events. Notably, the time period refers to the time interval between two consecutive log events in the event data and may include a start time, an end time, or duration therebetween, and may further be utilized via the processing arrangement during further processing.”)
each of the logged events occurring during an initial activity period are identified as the initial activity log comprising N logged events;
(Birru, “[0110] Similar to token classification, we have an Nc-dimensional output for each log event in the given sequence, wherein ŷi j represents the output probability of class ‘j’ associated with log event ‘i’ of the sequence of log events and hence, ‘y’ belongs to Rn. Typically, for a given log sequence with a window size of ‘n’, the corresponding output dimension will be n×Nc, wherein the window size ‘n’ represents the total number of log events present in the given log sequence [each of the logged events occurring during an initial activity period ie given log sequence are identified as the initial activity log comprising N logged events ie total number of log events present in the given log sequence (denoted by ‘n’)], and ‘Nc’ represents the total number of output classes.”)
each of the logged events occurring after the initial activity period are identified as a subsequent logged event;
(Birru, “[0099] The processing arrangement is further configured to generate an embedding matrix [an encoding layer configured to output a profile ie embedding matrix] utilizing the derived correlations between the plurality of log events and process the embedding matrix to detect the one or more anomalies in the event data [representing the role of the monitored computer system; wherein the role of the embedding matrix is to detect the anomalies]. Typically, the output contextual embeddings (ct) are utilized for generating the embedding matrix ‘C’ to be further utilized via the processing arrangement to be used for various downstream tasks such as log sequence classification, cluster analysis, and prediction of the next incoming log events as explained earlier. Similarly, the processing arrangement can detect the one or more anomalous log events (or anomalies) by predicting the most probable embedding of an incoming log event and identifying or detecting an anomaly, if the log event violates the normal behavior such [each of the logged events occurring after the initial activity period are identified as a subsequent logged event; wherein the normal behavior is the logged events occurring within the initial activity period and the subsequent logged event is the incoming log event to predict] as, via implementation of a Next Event Decoder head along with the encoder-architecture of the processing arrangement. Notably, in supervised settings, the neural network is capable of detecting anomalous behavior for each event in the given log sequence with respect to other events in the sequence.”)
the initial activity period comprises a predefined time duration;
(Birru, “[0078] Herein, the processing arrangement is configured to receive event data associated with a plurality of log events [the initial activity period comprises a predefined time duration] for a given time period.”)
apply the machine learning model to the received initial activity log by:
applying the embedding layer to the initial activity log to generate N d-dimensional numerical vectors by: applying the large language model to each of the N logged events to generate as an output N descriptions,
wherein each of the N output descriptions represents a logged event of the N logged events that the output description was generated from;
(Birru, [0116], “As shown in FIG. 4A, the first encoder 104A is configured to map each cleaned log event message [wherein each of the N output descriptions represents a logged event ie log event message of the N logged events that the output description was generated from] 302A to an n-dimensional semantic latent space representation i.e., the event representation 402 using the first transformation model (a transformer-based language model) [generate N d-dimensional numerical vectors by: applying the large language model to each of the N logged events to generate as an output N descriptions ie n event representations]”)
applying a text embedding subcomponent of the embedding layer to the N descriptions to generate N fixed sized numerical vectors as N text embeddings,
Examiner’s note: Examiner interprets the text embedding sub-component in light of para. [0023] of the specification (“The text embedding sub-component 48 may be any suitable algorithm, such as a pre-trained text embedding module (e.g., Ada from OpenAI)
wherein each of the N fixed sized numerical vectors is a vector representation of a description of the N description that the fixed sized numerical vector was generated from;
(Birru, “[0117] Referring to FIG. 5, illustrated is a simplified overall architecture of the first encoder model 104A, in accordance with an embodiment of the present disclosure. As shown, the first encoder 104A is configured to map each token of the set of tokens based on the positional encodings and time period associated with each of the plurality of log events in the refined event data 502 to generate an event representation 504 for the mapped set of tokens and process the event representation 504 for the set of tokens to generate one or more event embeddings 506 [applying a text embedding subcomponent of the embedding layer to the N descriptions ie event representations to generate N fixed sized numerical vectors ie event embeddings 506 as N text embeddings] for a given sequence of log events of the plurality of log events in the refined event data based on a first transformation model [wherein each of the N fixed sized numerical vectors is a vector representation of a description of the N description that the fixed sized numerical vector was generated from].”)
applying a tokenizer of the embedding layer to the N logged events to generate N vectors of tokens,
wherein each token vector of the N vectors of tokens represents a logged event of the N logged events;
(Birru, [0081], “Thus, after pre-processing the event messages in the collected plurality of log events, the processing arrangement is configured to create the event ontology with the set of unique tokens [applying a tokenizer of the embedding layer to the N logged events to generate N vectors of tokens] occurring in the messages that is updated dynamically during pre-processing of the event data to improve the processing efficiency and efficacy of the system.”)
applying the learned embedding layer to the N vectors of tokens to generate N fixed size numerical vectors as N learned embeddings;
(Birru, “[0086], “In the context of anomaly detection via the system, the one or more embeddings are generated for representation of extracted tokens of each of the plurality of log events in a reduced or compressed format to enable faster processing via the encoder architecture. For example, the description of the refined event data and/or the plurality of log events therein, can be vectorized into a sparse one-dimensional or two-dimensional matrix based on the needs of the implementation. Herein, the encoder may map each of one or more embeddings based on the one or more parameters to generate the contextualized embeddings, which can further act as input for various downstream processing tasks via the system. Additionally, positional embeddings [applying the learned embedding layer to the N vectors of tokens to generate N fixed size numerical vectors as N learned embeddings ie positional embeddings] may be added to the generated series of event embeddings to retain positional information of each extracted set of tokens in the refined event data. For example, via 1-D positional embeddings, or 2-D aware positional embeddings, wherein the resulting sequence of embedding vectors serves as input to the encoder.”)
and combining the N text embeddings and the N learned embeddings to generate the N d-dimensional numerical vectors;
(Birru, “[0098] Notably, the second encoder obtains (or selects) the sequence of log event embeddings computed using the first event encoder as input along with positional embeddings associated therewith. As explained earlier, the first encoder maps each of the plurality of log events at corresponding time instant (or period) ‘t’ to the one or more embedding vectors (et). Further, the second log sequence encoder is configured to obtain a sequence of log event embeddings: ‘E’={e1, e2, . . . , et, et+1, . . . , en}⊏Rn×de as input and maps the sequence of embeddings into the contextual embedding vectors ‘C’={c1, c2, . . . , ct, ct+1, . . . , cn}⊏Rn×dc, wherein, ‘et’ refers event embedding for a single log entry at time ‘t’, ‘ct’ refers to contextual embeddings comprising the derived correlations [combining the N text embeddings ie log event embeddings and the N learned embeddings ie positional embeddings to generate the N d-dimensional numerical vectors ie contextual embeddings] and having an accurate understanding of the given log sequence in an efficient manner due to the multi-headed attention mechanism, ‘de’ and ‘dc’ are the output dimensions of et (i.e., the first encoder) and ct (i.e., the second encoder) for each of the plurality of log events.”)
applying the encoding layer to the generated N d-dimensional numerical vectors to generate the profile by contextualizing the N logged events relative to one another;
(Birru, “[0099] The processing arrangement is further configured to generate an embedding matrix utilizing the derived correlations between the plurality of log events and process the embedding matrix to detect the one or more anomalies in the event data. Typically, the output contextual embeddings (ct) are utilized for generating the embedding matrix ‘C’ [applying the encoding layer to the generated N d-dimensional numerical vectors ie contextual embeddings to generate the profile ie embedding matrix by contextualizing the N logged events relative to one another] to be further utilized via the processing arrangement to be used for various downstream tasks such as log sequence classification, cluster analysis, and prediction of the next incoming log events as explained earlier.”)
applying the machine learning model to a subsequent logged event by:
applying the embedding layer to the subsequent logged event to generate a d-dimensional subsequent numerical vector by: applying the large language model to the subsequent logged event to generate as an output a subsequent description;
applying the text embedding subcomponent of the embedding layer to the subsequent description to generate a subsequent fixed sized numerical vector as a subsequent text embedding;
applying the tokenizer of the embedding layer to the subsequent logged event to generate a subsequent token vector;
applying the subsequent learned embedding layer to the subsequent token vector to generate a subsequent fixed size numerical vector as a subsequent learned embedding;
combining the subsequent text embedding and the subsequent learned embedding to generate a subsequent d-dimensional numerical vector;
Examiner’s note: Examiner interprets limitations J-N to be substantially similar to limitations D-H wherein the respective machine learning components are applied to the subsequent logged event ie incoming event log. (see teachings of C. b. in view of teachings of substantially similar limitations: D ≈ J; E ≈ K; F ≈ L; G ≈ M; H ≈ N)
applying the classifier to compute a probability that the subsequent logged event is anomalous or normal based on the generated profile and the d-dimensional subsequent numerical vector for the subsequent logged event;
outputting a classification of the subsequent logged event based on the computed probability.
(Birru, “[0110] Similar to token classification, we have an Nc-dimensional output for each log event in the given sequence, wherein ŷi j represents the output probability of class ‘j’ associated with log event ‘i’ of the sequence of log events and hence, ‘y’ belongs to Rn [applying the classifier to compute a probability that the subsequent logged event is anomalous or normal based on the generated profile and the d-dimensional subsequent numerical vector for the subsequent logged event]. Typically, for a given log sequence with a window size of ‘n’, the corresponding output dimension will be n×Nc, wherein the window size ‘n’ represents the total number of log events present in the given log sequence, and ‘Nc’ represents the total number of output classes. During anomaly detection using classification, the processing arrangement is further configured to provide classification outputs to each embedding matrix, wherein the classification outputs includes either an anomalous embedding matrix or a normal embedding matrix. Alternatively stated, for such a classification operation via the processing arrangement, only two output classes are available i.e., anomaly and normal behavior [outputting a classification of the subsequent logged event based on the computed probability].”)
In regards to claim 2 and analogous claim 12,
Birru teaches The computer device of claim 1,
Birru teaches wherein the monitored system comprises at least one of a container, a pod, a virtual machine, (VM) or a physical computer.
(Birru, “[0111] In a third aspect, the present disclosure provides a computer readable storage medium having computer executable instruction that when executed by a computer system [a physical computer], causes the computer system to execute a method for detecting one or more anomalies in an event data.”)
In regards to claim 4 and analogous claim 14,
Birru teaches The computer device of claim 1,
Birru teaches wherein the activity log is generated by the monitored system and sent to the processor circuitry.
(Birru, “[0078] Herein, the processing arrangement is configured to receive event data associated with a plurality of log events for a given time period [wherein the activity log is generated by the monitored system and sent to the processor circuitry]. Herein, the event data received by the processing arrangement comprises the plurality of log events associated with the given time period, for example, 1 hour, 2 hour, 6 hours, 12 hours, 24 hours, 1 week, 1 month, 1 year, and the like, and stored in the database for further processing thereof.”)
In regards to claim 6 and analogous claim 16,
Birru teaches The computer device of claim 1,
Birru teaches wherein the N text embeddings and the N learned embeddings are combined to generate the N d-dimensional numerical vectors by concatenating the N text embeddings and the N learned embeddings, such that each of the N learned embeddings is concatenated with a text embedding of the N text embeddings that is associated with a same logged event of the N logged events.
(Birru, [0086], “Additionally, positional embeddings may be added to the generated series of event embeddings to retain positional information of each extracted set of tokens in the refined event data. For example, via 1-D positional embeddings, or 2-D aware positional embeddings, wherein the resulting sequence of embedding vectors serves as input to the encoder [concatenating the N text embeddings ie event embeddings and the N learned embeddings ie positional embeddings, such that each of the N learned embeddings is concatenated with a text embedding of the N text embeddings that is associated with a same logged event of the N logged events; wherein positional embeddings retain positional information of each set of tokens in the event data (thus, associated with the same logged event)].”)
In regards to claim 7 and analogous claim 17,
Birru teaches The computer device of claim 1,
Birru teaches wherein: the encoding layer includes at least two layers; and the applying of the encoding layer to the generated N d-dimensional numerical vectors to generate the profile includes sequentially applying the at least two layers of the encoding layer.
(Birru, “[0082] The processing arrangement is further configured to process the event data using an encoder architecture of the processing arrangement, the encoder architecture comprising at least two encoders [the encoding layer includes at least two layers], a first set of encoders and a second encoder.”)
(Birru, [0007], “process the refined event data using an encoder architecture of the processing arrangement, the encoder architecture comprising at least two encoders [wherein: the encoding layer includes at least two layers], wherein:
a first encoder is configured to:
map each token of the set of tokens based on the positional encodings associated with each token along with a time period associated with each of the plurality of log events in the refined event data to generate an event representation for the mapped set of tokens; and
process the event representation for the set of tokens to generate one or more event embeddings for each of the log events from the plurality of log events in the refined event data based on a first transformation model; and
a second encoder is configured to:
process the one or more event embeddings for a given sequence of log events of the plurality of log events in the refined event data based on a second transformation model to generate one or more contextual embeddings for each log event; and
simultaneously process the one or more contextual embeddings for each log event via at least one statistical technique to derive correlations between the plurality of log events associated with the set of tokens;
generate an embedding matrix utilizing the derived correlations [applying of the encoding layer to the generated N d-dimensional numerical vectors to generate the profile] between the plurality of log events;”)
(Birru, [0084], “Specifically, in some embodiments, the encoder architecture may comprise a first encoder (customized event encoder) followed by a second encoder (a log sequence encoder) in a hierarchical arrangement [sequentially applying the at least two layers of the encoding layer], to extract contextual embeddings of a given log event(s) of the plurality of log events.”)
In regards to claim 9 and analogous claim 19,
Birru teaches The computer device of claim 1,
Birru teaches wherein the processor circuitry is further configured to train the machine learning model by: receiving a training activity log including training logged events, wherein each of the training logged events is classified as anomalous or normal;
(Birru, “[0105] In one or more embodiments, the processing arrangement, or encoders, and/or decoders therein, may be configured to compute the similarity score based on the cosine similarity between the predicted event embedding vector (e̊i) and the actual event [wherein the processor circuitry is further configured to train the machine learning model by: receiving a training activity log including training logged events,] and an embedding vector (ei) for each of the masked log events.”)
(Birru, [0106], “Notably, in the training phase, only normal log sequences [wherein each of the training logged events is classified as anomalous or normal] are used to minimize the loss function”)
Birru teaches and modifying parameters of the embedding layer, the encoding layer, and the classifier to minimize a loss function based on the training logged events.
(Birru, [0107], “Notably, during training of the neural network, the processing arrangement is configured to minimize the cosine-dissimilarity score therebetween...”; wherein training involves updating parameters)
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 3, 5, 8, 13, 15 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Birru in view of Nedelkoski, Sasho, et al. "Self-Attentive Classification-Based Anomaly Detection in Unstructured Logs." arXiv preprint arXiv:2008.09340 (2020) (“Nedelkoski”).
In regards to claim 3 and analogous claim 13,
Birru teaches The computer device of claim 1,
Birru teaches wherein the encoding layer contextualizes the N logged events relative to one another by: applying a multi-head attention layer to the N d-dimensional numerical vectors;
(Birru, [0086], “The first encoder (or the second encoder) may be built by stacking a set of multi-head attention modules [applying a multi-head attention layer to the N d-dimensional numerical vectors] configured for parallel encoding of the refined event data for enabling further processing via the processing arrangement.”)
However, Birru does not explicitly teach applying a first add and normalize layer to combine the N d-dimensional numerical vectors and the output of the multi-head attention layer through addition and normalization; applying a feed forward layer to an output of the first add and normalize layer to reduce before expanding a dimensionality of the N d-dimensional attention vectors; applying a second add and normalize layer to the output of the feed forward layer to incorporate both the output of the first add and normalize layer and an output of the feed forward layer through addition and normalization; and outputting the profile comprising N d-dimensional profile vectors output by the second add and normalize layer.
Nedelkoski teaches
applying a first add and normalize layer to combine the N d-dimensional numerical vectors and the output of the multi-head attention layer through addition and normalization;
applying a feed forward layer to an output of the first add and normalize layer to reduce before expanding a dimensionality of the N d-dimensional attention vectors;
applying a second add and normalize layer to the output of the feed forward layer to incorporate both the output of the first add and normalize layer and an output of the feed forward layer through addition and normalization;
and outputting the profile comprising N d-dimensional profile vectors output by the second add and normalize layer.
(Nedelkoski, Section IV. B. Fig. 2, “Fig. 2 depicts the inner working of the transformer encoder.
PNG
media_image1.png
569
490
media_image1.png
Greyscale
”)
Birru and Nedelkoski are both considered to be analogous to the claimed invention because they are in the same field of anomaly detection using transformers. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Birru to incorporate the teachings of Nedelkoski in order to provide a transformer encoder with multi-head self-attention mechanism as doing so enables the architecture to learn context information from the log messages (Nedelkoski, Section I., “As a neural network architecture, we adopt the Transformer encoder with multi-head self-attention mechanism [19], which learns context information from the log message in the form of log vector representations (embeddings).”)
In regards to claim 5 and analogous claim 15,
Birru teaches The computer device of claim 1,
However, Birru does not explicitly teach wherein: each logged event of the N logged events is a string; the tokenizer uses a map to tokenize the N logged events; the map includes multiple strings; each of the multiple strings is associated with a unique integer; the tokenizer is configured to tokenize each of the logged events using the map by: when a logged event is included in the map, tokenizing the logged event as the unique integer associated with the logged event; and when the logged event is not included in the map, tokenizing the logged event as a default integer.
Nedelkoski teaches wherein: each logged event of the N logged events is a string;
(Nedelkoski, Section I., “Log messages have free-form text structure written by the developers, which record a specific system event de scribing the runtime system status. Specifically, a log message is a composition of constant string template [wherein: each logged event of the N logged events is a string] and variable values originating from logging instruction (e.g., print(”total of %i errors detected”, 5)) within the source code.”)
Nedelkoski teaches the tokenizer uses a map to tokenize the N logged events; the map includes multiple strings; each of the multiple strings is associated with a unique integer; the tokenizer is configured to tokenize each of the logged events using the map by: when a logged event is included in the map, tokenizing the logged event as the unique integer associated with the logged event; and when the logged event is not included in the map, tokenizing the logged event as a default integer.
(Nedelkoski, Section IV. A., “The smallest inseparable singleton object within a log message is a token. Each log message consists of a finite sequence of tokens, ri = (wj : wj ∈ V, j = 1,2,...,si), where V is a set (vocabulary) of all tokens [the tokenizer uses a map to tokenize the N logged events; the map includes multiple strings], j is the positional index of a token within the log message xi [when a logged event is included in the map, tokenizing the logged event as the unique integer associated with the logged event; and when the logged event is not included in the map, tokenizing the logged event as a default integer; wherein since the tokenizer tokenize the N logged events, all of the logged events should be in the map as indicated by the index and Examiner interprets a default integer to be the index wherein the index is default to a predetermined range], and si is the total number of tokens in xi.”)
Birru and Nedelkoski are both considered to be analogous to the claimed invention because they are in the same field of anomaly detection using transformers. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Birru to incorporate the teachings of Nedelkoski in order to provide a tokenizer that provides direct input to the model as doing so provides the advantage of no information loss (Nedelkoski, Section IV. B., “An important advantage of Logsy compared to previous approaches is that it does not depend on log parsers as a pre-processing step. We consider the tokenized log message as direct input to the model. The advantage is that there is no loss of information from the log message, due to the imperfections that exist in the log parsing methods.”).
In regards to claim 8 and analogous claim 18,
Birru teaches The computer device of claim 1,
Birru teaches wherein the classifier computes the probability based on: the d-dimensional subsequent numerical vector;
(Birru, [0089], “The embedding vector obtained from first encoder serves as an input to existing forecasting-based anomaly detection models, log sequence classification and/or clustering models, and the like, that may be utilized via the processing arrangement.”)
(Birru, [0110], “During anomaly detection using classification, the processing arrangement is further configured to provide classification outputs to each embedding matrix, wherein the classification outputs includes either an anomalous embedding matrix or a normal embedding matrix.”)
Birru teaches and a head-wise weighted average performed on: the N d-dimensional profile vectors;
(Birru, “[0109] In one or embodiments, to perform log event classification prediction on the embedding matrix, the processing arrangement is further configured to process the embedding matrix via a classified head decoder based on a classification algorithm to provide classification outputs to each embedding matrix, wherein the classification outputs includes either an anomalous embedding matrix or a normal embedding matrix. For classification tasks, the processing arrangement comprises a stack of fully connected encoder layers followed by activation functions on top of the second encoder model. The classification algorithm may be based on: [a head-wise weighted average performed on: the N d-dimensional profile vectors]
PNG
media_image2.png
74
318
media_image2.png
Greyscale
”)
However, Birru does not explicitly teach and a head-wise softmax of a multi-head attention score of: the d-dimensional subsequent numerical vector; and each of the N d-dimensional profile vectors.
Nedelkoski teaches and a head-wise softmax of a multi-head attention score of: the d-dimensional subsequent numerical vector; and each of the N d-dimensional profile vectors.
(Nedelkoski, Section IV. B., “We summarize all token embedding vectors of a log message as matrix rows xT∈X on which the following formula is applied:
PNG
media_image3.png
47
496
media_image3.png
Greyscale
Thereby, L denotes the number of attention heads, w = d/L and d modL = 0. The parameters Q, K and V are matrices, that correspond to the query, key, and value elements in Fig. 2 [head-wise softmax of a multi-head attention score of: the d-dimensional subsequent numerical vector; and each of the N d-dimensional profile vectors].”)
Birru and Nedelkoski are both considered to be analogous to the claimed invention because they are in the same field of anomaly detection using transformers. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Birru to incorporate the teachings of Nedelkoski in order to provide a transformer encoder with multi-head self-attention mechanism with softmax as doing so enables the architecture to learn context information from the log messages (Nedelkoski, Section I., “As a neural network architecture, we adopt the Transformer encoder with multi-head self-attention mechanism [19], which learns context information from the log message in the form of log vector representations (embeddings).”) wherein softmax provides the benefit of scaling each token embedding (Nedelkoski, Section IV. B., “After that, the softmax function is applied and the result is used to scale each token embedding vector.”)
Claim(s) 10 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Birru in view of X. Wang, J. Song, X. Zhang, J. Tang, W. Gao and Q. Lin, "LogOnline: A Semi-Supervised Log-Based Anomaly Detector Aided with Online Learning Mechanism," 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE), Luxembourg, Luxembourg, 2023, pp. 141-152, doi: 10.1109/ASE56229.2023.00043. (“Wang”)
In regards to claim 10 and analogous 20,
Birru teaches The computer device of claim 9,
However, Birru does not explicitly teach wherein the loss function is: …
Wang teaches wherein the loss function is:
PNG
media_image4.png
76
557
media_image4.png
Greyscale
, where ε∈0,0.001, δ∈0,0.25, γ≥0, x→ is the computed probability and is a vector of length n, and y→ is the classification and is a vector of length n.
Examiner’s note: Indexes i,j=1 is interpreted to be i=1, j=1. Thus, Examiner points out (y_i-y_j) would be zero as y_i and y_j would always be the same number. The same logic applies to (x_i-x_j). Accordingly, Examiner notes the loss function would reduce as shown below wherein Relu is applied to mean squared error wherein δ=0 [δ∈0,0.25], and γ=1 [γ≥0]. Examiner points out that γ can be zero as the claim specifies it is greater than or equal to zero.
PNG
media_image5.png
268
891
media_image5.png
Greyscale
Wang teaches MSE loss with Relu
(Wang, Section III C., “Consequently, a window of log headers can be denoted as a matrix [rT i−h,rT i−h+1,··· ,rT i ], with each row being the representation of the ith log header. This matrix is then flattened to a vector and fed to the auto-encoder, whose parameters are updated by minimizing the reconstruction error measured by MSE Loss. During evaluation, we compute the reconstruction error of each log window by MSE Loss, and log windows with MSE error smaller than a pre-defined threshold are treated as normal. As for the structure of the auto-encoder, we simply adopt a fully-connected neural network as the underlying building block. Both encoder and decoder are made up of four fully connected layers, with the hidden size of each layer being 64, 32, 12, 3 respectively. Each fully connected layer is followed by a ReLU activation unit [29] except for the last layer of the decoder, which uses a tanh activation function to map the output values to the range [-1, 1].”)
Birru and Wang are both considered to be analogous to the claimed invention because they are in the same field of anomaly detection using transformers. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Birru to incorporate the teachings of Wang in order to provide MSE and Relu as doing so allows the architecture to stay robust to unstable log data while performing better than other approaches (Wang, Abstract, “Based on our proposed online learning mechanism, LogOnline can learn the normal sequence patterns continuously as new log sequences emerge, thus staying robust to unstable log data. Unlike previous works, the proposed online learning mechanism requires no labeled log data nor human intervention in the process. We have evaluated LogOnline on two widely used public datasets, and the experimental results demonstrate the effectiveness of LogOnline. In particular, LogOnline achieves a comparable result with the studied supervised approaches, outperforming all semi-supervised counterparts. When the log instability issue is more common, LogOnline exhibits the best performance over all compared approaches, further confirming its practicability.”)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US20190266325A1 Microsoft teaches Automatic malicious session detection
Malicious computer behavior is detected automatically based on a user session. A user session comprising a sequence of process events is identified and a text-based representation is generated, wherein process events correspond to words and a sequence of words corresponds to a sentence. Subsequently, a text-based classifier classifies the session as malicious or non-malicious based on the sequence of events within the session in the text representation.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JASMINE THAI whose telephone number is (703)756-5904. The examiner can normally be reached M-F 8-4.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Michael Huntley can be reached at (303) 297-4307. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.T.T./Examiner, Art Unit 2129
/MICHAEL J HUNTLEY/Supervisory Patent Examiner, Art Unit 2129
Prosecution Insights