Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
2. Applicant’s arguments with respect to claims 5/11/2026 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Specifically the newly added limitation of independent claims 1, 11 and 17 are taught by newly cited Uniyal (US 2025/0021424).
Claim Rejections - 35 USC § 103
3. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
4. Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Bu (US 2025/0225323) in view of Anand (US 2014/0129536) and further in view of Uniyal (US 2025/0021424).
Regarding Claim 1:
Bu discloses computer-implemented method, comprising:
parsing, a processor set, by natural language processing techniques, text of an alert corresponding to an information technology (IT) abnormality incident, resulting in alert data (Bu: ¶[0011], ¶[0014] discloses receiving an alert logs for suspicious behavior corresponding to security incidents, which are IT abnormalities. ¶[0056]-[0057] determines semantic metadata values); and
generating, by the processor set, by a generative machine learning (ML) model, a natural language summary of the incident (Bu: ¶[0011], ¶[0016] and ¶[0030]-[0037] explicitly discloses a large language model/ generative model, which provides a natural language summary),
wherein the natural language summary comprises and
Bu does not explicitly discloses:
wherein the natural language summary comprises a symptom resource pairing corresponding to the alert and is based on the alert data and on a topology of keywords of the alert. However, Anand discloses wherein the natural language summary comprises a symptom resource pairing corresponding to the alert and is based on the alert data and on a topology of keywords of the alert (Anand: ¶[0025], ¶[0029] teaches generated a symptom-resource pairing corresponding to an alert by extracting semantic keyword metadata and affected resource identifiers from the incident text. Anand further teaches determining a topology of keywords of the alert by learning dependency and co-occurrence relationships among keywords extracted from the alert text). Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose adding to the summary of Bu, a symptom resource pairing correspond to the alert and that is based also on a topology of keywords of the alert. The suggestion/motivation for doing so is “Synonyms and annotation patterns are used to improve the accuracy of extraction. For example, MQ is a synonym of MQSeries. After classification, an incident can be represented by a bag of keywords. For instance, incident IN1 in Table 1 is classified by keywords as shown in Table 2. These keywords are referred to as classification keywords” as disclosed by Anand in ¶[0029].
Bu in view of Anand do not explicitly disclose:
determining, by the processor set, by a remedy code, whether a remedy is able to be identified, such as from a remedy database and based on the natural language summary;
based on a first determining that the remedy is able to be identified, modifying the identified remedy; and
based on a second determining that the remedy is unable to be identified, suggesting a new remedy for use in a remedy suggestion or in a remedy direction, wherein the remedy suggestion addresses the symptom of the symptom-resource pairing.
However, Uniyal discloses:
determining, by the processor set, by a remedy code, whether a remedy is able to be identified, such as from a remedy database and based on the natural language summary (Uniyal: ¶50-51 discloses receiving incident information that can include an incident summary, incident description and incident resolution and ¶59 discloses processing that information and finding a resolution, ¶17 discloses a resolution generator);
based on a first determining that the remedy is able to be identified, modifying the identified remedy (Uniyal: ¶23-25 explains that merely retrieving a historical solution without adapting it to the current incident is inadequate because prior machine names, addresses, databases, architecture and environment variables may not apply to the current incident. Uniyal therefore modifies the retrieved remedy by mapping, localizing or transforming it using the attributes of the current incident and affected environment); and
based on a second determining that the remedy is unable to be identified, suggesting a new remedy for use in a remedy suggestion or in a remedy direction (Uniyal: ¶10, ¶17 and ¶24 discloses that an existing solution does not exist, the resolution generator reconstructs the current incident in a safe environment, generates non generic RPA workflows as new potential resolutions, analyzes and tests the generated workflows, and selects a top resolution. The selected resolution may then be deployed or provided as localized instructions identifying steps that may resolve the incident. ¶59 of Uniyal explicitly discloses that the system may determine that an exact solution has been identified and localized or alternatively that the incident has been reconstructed and a fresh solution has been generated),
wherein the remedy suggestion addresses the symptom of the symptom-resource pairing (Uniyal: ¶31 explicitly discloses that the resolution instructions are generated specifically to resolve the current IT incident. In the proposed combination, the current incident is represented by Anand’s pairing of the observed symptom with the affected resource. The remedy generated by Unital for resolving that incident addresses the symptom identified in the symptom resource pairing).
Bu and Anand in view of Uniyal are combinable because they are from the same field of endeavor, i.e., identify and resolve information technology incidents. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose the exact remedy modification of Uniyal into the combined system of Bu an Anand’s natural language incident summary. Uniyal explicitly contemplates receiving an incident summary as incident information. The modification would have permitted the system to determine whether a previously successful remedy was available, modify the identified remedy according to the resource and environment of the current incident and then generating a new remedy when no suitable existing remedy could be identified. The suggestion/motivation for doing so is discloses in ¶9 of Uniyal: “simply searching an existing database, whether by the user or someone at a help desk, is very problematic and ineffective.” In other words, simply finding a solution that is static may be un-useful in scenarios where the incident requires specific modifications.
Regarding Claim 2:
The proposed combination of Bu, Anand and Uniyal discloses the computer-implemented method of claim 1, further comprising: employing, by a processor set, graph connectivity distances between elements of the topology to verify the symptom-resource pairing (Anand: ¶[0033]-[0034] discloses quantitative relationships (confidence/support) within a keyword dependency network and uses them to validate extracted associations, which corresponds to using graph connectivity distances to verify symptom-resource pairings).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose adding to the summary of Bu, connectivity between data through topology, symptom-resource pairing. The suggestion/motivation for doing so is “problems can be caused by incident of dependent components. The approach of the present disclosure that discovers relevant co-occurring and reoccurring incidents may improve resolution efficiency” as disclosed by Anand in ¶[0021].
Regarding Claim 3:
The proposed combination of Bu, Anand and Uniyal discloses the computer-implemented method of claim 1, further comprising: comparing, by the processor set, historical symptom-resource pairing data to the alert data, resulting in a determination, by the processor set, of the symptom-resource pairing, wherein the historical symptom-resource pairing data comprises data describing causation and resolution for a historical incident corresponding to the historical symptom-resource pairing (Anand: [0035], ¶[0054] and ¶[0061] altogether discloses comparing current incidents to historical incidents, including cause and resolution information to determine symptom resource pairings).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose comparing alert data to historical symptom-resource pairing. The suggestion/motivation for doing so is “the methodology of the present disclosure in one embodiment employs a number of techniques to improve the accuracy of problem diagnosis” as disclosed by Anand in ¶[0055].
Regarding Claim 4:
The proposed combination of Bu, Anand and Uniyal discloses the computer-implemented method of claim 1, further comprising: generating, by the processor set, the symptom-resource pairing, comprising: generating, by the processor set, a vocabulary of computer system properties, matching, by the processor set, nouns of natural language sentences, generated based on the alert data, with the vocabulary, identifying, by the processor set, at least one adjective, being the symptom, from the natural language sentences based on the matching, and mapping, by the processor set, the symptom to the resource using dependency parsing of the natural language sentences (Anand: ¶[0025], ¶[0029] and ¶[0033] discloses generating a vocabulary of system properties extracts keywords from incident text, identifies symptom descriptors and associates them with resources via learned keyword dependencies).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose a vocabulary of compute system properties and metadata. The suggestion/motivation for doing so is “Synonyms and annotation patterns are used to improve the accuracy of extraction. For example, MQ is a synonym of MQSeries. After classification, an incident can be represented by a bag of keywords. For instance, incident IN1 in Table 1 is classified by keywords as shown in Table 2. These keywords are referred to as classification keywords” as disclosed by Anand in ¶[0029].
Regarding Claim 5:
The proposed combination of Bu, Anand and Uniyal discloses the computer-implemented method of claim 1, further comprising: generating, by the processor set, an instruction to be employed by the generative ML model for generating the natural language summary, wherein the instruction comprises at least one user entity-specific template or user entity-specific formatting preference (Bu: ¶[0031], ¶[0035] discloses generating instructions (prompts/templates) including formatting constraints that may be user-specified).
Regarding Claim 6:
The proposed combination of Bu, Anand and Uniyal discloses the computer-implemented method of claim 1, further comprising: parsing, by the processor set, the natural language summary (Bu: ¶[0038]-[0041], ¶[0050] generates summaries);
comparing, by the processor set, a result of the parsing of the natural language summary to the alert data, and identifying, by the processor set, an aspect of the natural language summary that does not correlate to the alert data based on a data correlation threshold (Bu: ¶[0038]-[0041], ¶[0050] parses generating summaries, compares them against alert derived metadata and rejects outputs failing defined thresholds).
Regarding Claim 7:
The proposed combination of Bu, Anand and Uniyal discloses the computer-implemented method of claim 1, further comprising: comparing, by the processor set, the symptom-resource pairing of the natural language summary to the alert data (Anand: ¶[0025] discloses filtering invalid keyword associations);
and identifying, by the processor set, a ghost resource or symptom that fails to correlate to the alert data based on an artificial intelligence for IT operations (AIOps) metric (Bu: ¶[0041]-¶[0044] discloses summary elements unsupported by alert data using quantitative metrics; Anand ¶[0025] discloses filtering invalid keyword associations).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose the summary of the alert data in Bu containing symptom resource pairing. The suggestion/motivation for doing so is “in one aspect of the present disclosure improves the search accuracy by considering domain knowledge and incident context during search” as disclosed by Anand in ¶[0029].
Regarding Claim 8:
The proposed combination of Bu, Anand and Uniyal discloses the proposed combination of Bu, Anand and Uniyal discloses the computer-implemented method of claim 1, further comprising: directing, by the processor set, training of the generative ML model based on:
an output of an artificial intelligence-based analysis of the natural language summary compared to input data on which the natural language summary is based, and a behavioral feedback data corresponding to user entity feedback provided by a user entity of the system, wherein the behavioral feedback data comprises a quantitively defined sentiment corresponding to the user entity feedback (Bu: ¶[0018]-[0019], ¶[0037] discloses training and refining the generative model using quantified user feedback, fine tuning using Reinforcement Learning from Human Feedback (RLHF)).
Regarding Claim 9:
The computer-implemented method of claim 1, further comprising: generating, by the processor set, the remedy suggestion for addressing the symptom of the symptom-resource pairing, wherein the generating of the remedy suggestion is based on weighted indicator data, determined from the natural language summary, and which is applicable to the resource of the symptom-resource pairing (Anand: ¶[0033], ¶[0054] determines causes using weighted indicators; Bu: ¶[0035] outputs remediation text).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose weighted indicators for remedy suggestions provided by Bu’s output. The suggestion/motivation for doing so is “relevant incidents may be determined by relevancy score” as disclosed by Anand in ¶[0051].
Regarding Claim 10:
The computer-implemented method of claim 1, further comprising: generating, by the processor set, the remedy suggestion for addressing the symptom of the symptom-resource pairing, wherein the generating of the remedy suggestion is based on a quantity of correlations within the natural language summary to indicator data that are applicable to the resource of the symptom-resource pairing (Anand: ¶[0033] relies on quantity/ frequency of correlated indicators to infer causes, Bu discloses generating a summary report).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose adding to the summary of Bu, a symptom resource pairing correspond to the alert and that is based also on a topology of keywords of the alert. The suggestion/motivation for doing so is “the correlation, prediction rules can be configured to predict potential problems.” as disclosed by Anand in ¶[0054].
Regarding Claim 11:
Claim 11 has been analyzed with regard to claim 1 (see rejection above) and is rejected for the same reasons of obviousness used above.
It is noted that Bu discloses a processor set, computer readable storage media and a program stored thereon for performing the steps of claim 11 at least at ¶[0011].
Regarding Claim 12:
Claim 12 has been analyzed with regard to claim 2 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 13:
Claim 13 has been analyzed with regard to claim 3 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 14:
Claim 14 has been analyzed with regard to claim 4 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 15:
Claim 15 has been analyzed with regard to claim 7 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 16:
Claim 16 has been analyzed with regard to claim 9 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 17:
Claim 17 has been analyzed with regard to claim 1 (see rejection above) and is rejected for the same reasons of obviousness used above.
It is noted that Bu discloses a processor set, computer readable storage media and a program stored thereon for performing the steps of claim 17 at least at ¶[0011].
Regarding Claim 18:
Claim 18 has been analyzed with regard to claim 2 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 19:
Claim 19 has been analyzed with regard to claim 3 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 20:
Claim 20 has been analyzed with regard to claim 4 (see rejection above) and is rejected for the same reasons of obviousness used above.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to IAN SCOTT MCLEAN whose telephone number is (703)756-4599. The examiner can normally be reached "Monday - Friday 8:00-5:00 EST, off Every 2nd Friday".
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hai Phan can be reached at (571) 272-6338. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/IAN SCOTT MCLEAN/Examiner, Art Unit 2654
/HAI PHAN/Supervisory Patent Examiner, Art Unit 2654
Prosecution Insights