Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
2. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
3. Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Bu (US 2025/0225323) in view of Anand (US 2014/0129536).
Regarding Claim 1:
Anand discloses a computer-implemented method, comprising:
parsing, by natural language processing techniques, text of an alert corresponding to an information technology (IT) abnormality incident, resulting in alert data (Bu: ¶[0011], ¶[0014] discloses receiving an alert logs for suspicious behavior corresponding to security incidents, which are IT abnormalities. ¶[0056]-[0057] determines semantic metadata values);
and generating, by a generative machine learning (ML) model, a natural language summary of the incident (Bu: ¶[0011], ¶[0016] and ¶[0030]-[0037] explicitly discloses a large language model/ generative model, which provides a natural language summary),
wherein the natural language summary comprises (Bu: ¶[0015], ¶[0032] teaches generating a natural language summary based on alert data, the summary is generated by a generative machine learning model using alert logs as input).
Bu does not explicitly discloses:
wherein the natural language summary comprises a symptom resource pairing corresponding to the alert and is based on the alert data and on a topology of keywords of the alert. However, Anand discloses wherein the natural language summary comprises a symptom resource pairing corresponding to the alert and is based on the alert data and on a topology of keywords of the alert (Anand: ¶[0025], ¶[0029] teaches generated a symptom-resource pairing corresponding to an alert by extracting semantic keyword metadata and affected resource identifiers from the incident text. Anand further teaches determining a topology of keywords of the alert by learning dependency and co-occurrence relationships among keywords extracted from the alert text). Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose adding to the summary of Bu, a symptom resource pairing correspond to the alert and that is based also on a topology of keywords of the alert. The suggestion/motivation for doing so is “Synonyms and annotation patterns are used to improve the accuracy of extraction. For example, MQ is a synonym of MQSeries. After classification, an incident can be represented by a bag of keywords. For instance, incident IN1 in Table 1 is classified by keywords as shown in Table 2. These keywords are referred to as classification keywords” as disclosed by Anand in ¶[0029].
Regarding Claim 2:
The computer-implemented method of claim 1, further comprising: employing, by a processor set, graph connectivity distances between elements of the topology to verify the symptom-resource pairing (Anand: ¶[0033]-[0034] discloses quantitative relationships (confidence/support) within a keyword dependency network and uses them to validate extracted associations, which corresponds to using graph connectivity distances to verify symptom-resource pairings).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose adding to the summary of Bu, connectivity between data through topology, symptom-resource pairing. The suggestion/motivation for doing so is “problems can be caused by incident of dependent components. The approach of the present disclosure that discovers relevant co-occurring and reoccurring incidents may improve resolution efficiency” as disclosed by Anand in ¶[0021].
Regarding Claim 3:
The computer-implemented method of claim 1, further comprising: comparing, by the processor set, historical symptom-resource pairing data to the alert data, resulting in a determination, by the processor set, of the symptom-resource pairing, wherein the historical symptom-resource pairing data comprises data describing causation and resolution for a historical incident corresponding to the historical symptom-resource pairing (Anand: [0035], ¶[0054] and ¶[0061] altogether discloses comparing current incidents to historical incidents, including cause and resolution information to determine symptom resource pairings).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose comparing alert data to historical symptom-resource pairing. The suggestion/motivation for doing so is “the methodology of the present disclosure in one embodiment employs a number of techniques to improve the accuracy of problem diagnosis” as disclosed by Anand in ¶[0055].
Regarding Claim 4:
The computer-implemented method of claim 1, further comprising: generating, by the processor set, the symptom-resource pairing, comprising: generating, by the processor set, a vocabulary of computer system properties, matching, by the processor set, nouns of natural language sentences, generated based on the alert data, with the vocabulary, identifying, by the processor set, at least one adjective, being the symptom, from the natural language sentences based on the matching, and mapping, by the processor set, the symptom to the resource using dependency parsing of the natural language sentences (Anand: ¶[0025], ¶[0029] and ¶[0033] discloses generating a vocabulary of system properties extracts keywords from incident text, identifies symptom descriptors and associates them with resources via learned keyword dependencies).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose a vocabulary of compute system properties and metadata. The suggestion/motivation for doing so is “Synonyms and annotation patterns are used to improve the accuracy of extraction. For example, MQ is a synonym of MQSeries. After classification, an incident can be represented by a bag of keywords. For instance, incident IN1 in Table 1 is classified by keywords as shown in Table 2. These keywords are referred to as classification keywords” as disclosed by Anand in ¶[0029].
Regarding Claim 5:
The computer-implemented method of claim 1, further comprising: generating, by the processor set, an instruction to be employed by the generative ML model for generating the natural language summary, wherein the instruction comprises at least one user entity-specific template or user entity-specific formatting preference (Bu: ¶[0031], ¶[0035] discloses generating instructions (prompts/templates) including formatting constraints that may be user-specified).
Regarding Claim 6:
The computer-implemented method of claim 1, further comprising: parsing, by the processor set, the natural language summary (Bu: ¶[0038]-[0041], ¶[0050] generates summaries);
comparing, by the processor set, a result of the parsing of the natural language summary to the alert data, and identifying, by the processor set, an aspect of the natural language summary that does not correlate to the alert data based on a data correlation threshold (Bu: ¶[0038]-[0041], ¶[0050] parses generating summaries, compares them against alert derived metadata and rejects outputs failing defined thresholds).
Regarding Claim 7:
The computer-implemented method of claim 1, further comprising: comparing, by the processor set, the symptom-resource pairing of the natural language summary to the alert data (Anand: ¶[0025] discloses filtering invalid keyword associations);
and identifying, by the processor set, a ghost resource or symptom that fails to correlate to the alert data based on an artificial intelligence for IT operations (AIOps) metric (Bu: ¶[0041]-¶[0044] discloses summary elements unsupported by alert data using quantitative metrics; Anand ¶[0025] discloses filtering invalid keyword associations).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose the summary of the alert data in Bu containing symptom resource pairing. The suggestion/motivation for doing so is “in one aspect of the present disclosure improves the search accuracy by considering domain knowledge and incident context during search” as disclosed by Anand in ¶[0029].
Regarding Claim 8:
The computer-implemented method of claim 1, further comprising: directing, by the processor set, training of the generative ML model based on:
an output of an artificial intelligence-based analysis of the natural language summary compared to input data on which the natural language summary is based, and a behavioral feedback data corresponding to user entity feedback provided by a user entity of the system, wherein the behavioral feedback data comprises a quantitively defined sentiment corresponding to the user entity feedback (Bu: ¶[0018]-[0019], ¶[0037] discloses training and refining the generative model using quantified user feedback, fine tuning using Reinforcement Learning from Human Feedback (RLHF)).
Regarding Claim 9:
The computer-implemented method of claim 1, further comprising: generating, by the processor set, remedy a suggestion for addressing the symptom of the symptom-resource pairing, wherein the generating of the remedy suggestion is based on weighted indicator data, determined from the natural language summary, and which is applicable to the resource of the symptom-resource pairing (Anand: ¶[0033], ¶[0054] determines causes using weighted indicators; Bu: ¶[0035] outputs remediation text).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose weighted indicators for remedy suggestions provided by Bu’s output. The suggestion/motivation for doing so is “relevant incidents may be determined by relevancy score” as disclosed by Anand in ¶[0051].
Regarding Claim 10:
The computer-implemented method of claim 1, further comprising: generating, by the processor set, remedy a suggestion for addressing the symptom of the symptom-resource pairing, wherein the generating of the remedy suggestion is based on a quantity of correlations within the natural language summary to indicator data that are applicable to the resource of the symptom-resource pairing (Anand: ¶[0033] relies on quantity/ frequency of correlated indicators to infer causes, Bu discloses generating a summary report).
Bu and Anand are combinable because they are from the same field of endeavor, i.e., computer security, incident management and summarizing alerts. Bu discloses generative summarization techniques for IT incidents and Anand discloses extracting structured alert data including symptoms, affected resources and keyword dependency relationships. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to disclose adding to the summary of Bu, a symptom resource pairing correspond to the alert and that is based also on a topology of keywords of the alert. The suggestion/motivation for doing so is “the correlation, prediction rules can be configured to predict potential problems.” as disclosed by Anand in ¶[0054].
Regarding Claim 11:
Claim 11 has been analyzed with regard to claim 1 (see rejection above) and is rejected for the same reasons of obviousness used above.
It is noted that Bu discloses a processor set, computer readable storage media and a program stored thereon for performing the steps of claim 11 at least at ¶[0011].
Regarding Claim 12:
Claim 12 has been analyzed with regard to claim 2 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 13:
Claim 13 has been analyzed with regard to claim 3 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 14:
Claim 14 has been analyzed with regard to claim 4 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 15:
Claim 15 has been analyzed with regard to claim 7 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 17:
Claim 17 has been analyzed with regard to claim 1 (see rejection above) and is rejected for the same reasons of obviousness used above.
It is noted that Bu discloses a processor set, computer readable storage media and a program stored thereon for performing the steps of claim 17 at least at ¶[0011].
Regarding Claim 18:
Claim 18 has been analyzed with regard to claim 2 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 19:
Claim 19 has been analyzed with regard to claim 3 (see rejection above) and is rejected for the same reasons of obviousness used above.
Regarding Claim 20:
Claim 20 has been analyzed with regard to claim 4 (see rejection above) and is rejected for the same reasons of obviousness used above.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to IAN SCOTT MCLEAN whose telephone number is (703)756-4599. The examiner can normally be reached "Monday - Friday 8:00-5:00 EST, off Every 2nd Friday".
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hai Phan can be reached at (571) 272-6338. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/IAN SCOTT MCLEAN/Examiner, Art Unit 2654
/HAI PHAN/Supervisory Patent Examiner, Art Unit 2654