Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
Claims status
Claims 1-20 are pending as the applicant filed response on 05/09/2024.
Claim Rejections - 35 USC § 112
2. The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claims 1-20, the term “detecting an anomaly” “anomaly state” “maximum processing rate” “short-term anomaly” “mild anomaly” “normal ratio value”
are vague and a relative term that renders the claim indefinite. The term “code type” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably appraised of the scope of the invention. An artisan doing measuring and testing would not know at what point "code" within the scope of the claim had been accomplished because nothing within the disclosure establishes when a sufficient “type” of code occurs.
Note: In view of the PTO compact prosecution, the Examiner notes that due to the indefiniteness issues described above all consideration of the merits of the claims in view of prior art is as best understood.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Claim 1, Step 1 the claim is a process (or machine) (Yes),
Step 2A Prong One, does the claim recite an abstract idea? current claim related to an anomaly detection device, for detecting an anomaly in a usage state of an application program for a computing resource, the anomaly in the usage state comprises a first anomaly state and a second anomaly state, the anomaly detection device comprising: an anomaly state counter, having a second count value and selectively accumulating the second count value according to the first anomaly state; and a monitoring unit, for performing the following operations:
monitoring whether the first data amount reaches a predefined data amount, wherein the predefined data amount is related to a maximum processing rate of the application program; when the first data amount reaches the predefined data amount, reading the first count value and determining whether the application program is in the first anomaly state according to the first count value; and
when it is determined that the application program is in the first anomaly state, accumulating and reading the second count value, and determining whether the application program is in the second anomaly state according to the second count value appears is an abstract idea of mental process (MPEP 2106.04(a)) or data gathering equivalent to mathematical concept or mathematical manipulation function (MPEP 2106.04 (a) (2) (concept need not be expressed in mathematical symbols, because "[w]ords used in a claim operating on data to solve a problem can serve the same purpose as a formula), (OR Mathematical Concepts and Mental Processes) Step 2A Prong One: Yes.
Step 2A Prong Two, is the claim directed to an abstract idea? In other words, does claim recite additional elements that integrate the Judicial Exception into a practical application? the additional elements of a data amount accumulation unit, for accumulating a first data amount processed by the application program are recited at a high level of generality and merely amount to a particular field of use (see MPEP 2106.05(h)) and/or insignificant post-solution activity (MPEP 2106.05(g)), this does not integrate the Judicial Exception into a practical application,
Step 2A Prong Two: NO.
Step 2B, Does the claim recite additional element that amount to significantly more than the Judicial exception? the additional elements of an operation time counter, having a first count value and accumulating the first count value according to a first counting frequency appears to be field of use (See MPEP 2106.05(h) and MPEP 2106.05(f)) and/or merely amounts to insignificant extra-solution output of the results (see MPEP 2106.05(g)) and therefore fails to integrate the abstract idea into a practical application or amount to significantly more. Step 2B: No. claim 1 not eligible.
Claim 11, Step 1 the claim is a process (or machine) (Yes),
Step 2A Prong One, does the claim recite an abstract idea? current claim related to an anomaly detection method, for detecting an anomaly in a usage state of an application program for a computing resource, the anomaly in the usage state comprises a first anomaly state and a second anomaly state, the anomaly detection method comprising the following steps: performing the following operations by a monitoring unit: monitoring whether the first data amount reaches a predefined data amount, wherein the predefined data amount is related to a maximum processing rate of the application program; when the first data amount reaches the predefined data amount, reading the first count value and determining whether the application program is in the first anomaly state according to the first count value; and when it is determined that the application program is in the first anomaly state, accumulating and reading the second count value, and determining whether the application program is in the second anomaly state according to the second count value appears is an abstract idea of mental process (MPEP 2106.04(a)) or data gathering equivalent to mathematical concept or mathematical manipulation function (MPEP 2106.04 (a) (2) (concept need not be expressed in mathematical symbols, because "[w]ords used in a claim operating on data to solve a problem can serve the same purpose as a formula), (OR Mathematical Concepts and Mental Processes) Step 2A Prong One: Yes.
Step 2A Prong Two, is the claim directed to an abstract idea? In other words, does claim recite additional elements that integrate the Judicial Exception into a practical application? the additional elements of accumulating a first data amount processed by the application program, by a data amount accumulation unit are recited at a high level of generality and merely amount to a particular field of use (see MPEP 2106.05(h)) and/or insignificant post-solution activity (MPEP 2106.05(g)), this does not integrate the Judicial Exception into a practical application,
Step 2A Prong Two: NO.
Step 2B, Does the claim recite additional element that amount to significantly more than the Judicial exception? the additional elements of accumulating a first count value according to a first counting frequency, by an operation time counter; selectively accumulating a second count value according to the first anomaly state, by an anomaly state counter appears to be field of use (See MPEP 2106.05(h) and MPEP 2106.05(f)) and/or merely amounts to insignificant extra-solution output of the results (see MPEP 2106.05(g)) and therefore fails to integrate the abstract idea into a practical application or amount to significantly more. Step 2B: No. claim 11 not eligible.
Claim 2 related to wherein the first anomaly state indicates a short-term anomaly or a mild anomaly of the usage state, and the second anomaly state indicates a long-term anomaly or a severe anomaly of the usage state, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 2 not eligible.
Claim 3 related to : the monitoring unit sets a normal ratio value of the operation time counter; when the first data amount reaches the predefined data amount, the monitoring unit compares the first count value with the normal ratio value; and when the first count value is greater than the normal ratio value, the monitoring unit determines that the application program is in the first anomaly state, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 3 not eligible.
Claim 4 related to wherein when the first count value is less than or equal to the normal ratio value, the application program reaches the maximum processing rate, and the monitoring unit determines that the application program is in a normal state, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 4 not eligible.
Claim 5 related to wherein the predefined data amount is equal to the maximum processing rate divided by the first counting frequency and then multiplied by the normal ratio value, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 5 not eligible.
Claim 6 related to the monitoring unit estimates the maximum processing rate according to a statistical data of the application program, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 6 not eligible.
Claim 7 related to the monitoring unit sets a threshold value of the anomaly state counter; when the first data amount reaches the predefined data amount and the first count value is greater than the normal ratio value, the monitoring unit accumulates the second count value and compares the second count value with the threshold value; and when the second count value is greater than the threshold value, the monitoring unit determines that the application program is in the second anomaly state, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 7 not eligible.
Claim 8 related to a warning device, for issuing a warning when the second count value is greater than the threshold value, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 8 not eligible.
Claim 9 related to wherein the application program operates in a system platform, the system platform has a system state, and when the system state is a busy state, the monitoring unit determines whether the application program is in the first anomaly state or the second anomaly state according to the first data amount, the first count value and the second count value, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 9 not eligible.
Claim 10 related to wherein the system state has an update frequency, and the threshold value is set as greater than a number of times corresponding the update frequency, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 10 not eligible.
Claim 12 related to , wherein the first anomaly state indicates a short-term anomaly or a mild anomaly of the usage state, and the second anomaly state indicates a long-term anomaly or a severe anomaly of the usage state, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 12 not eligible.
Claim 13 related to wherein the step of determining whether the application program is in the first anomaly state according to the first count value comprising: setting a normal ratio value of the operation time counter, by the monitoring unit; when the first data amount reaches the predefined data amount, comparing the first count value with the normal ratio value, by the monitoring unit; and when the first count value is greater than the normal ratio value, determining that the application program is in the first anomaly state, by the monitoring unit, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 13 not eligible.
Claim 14 related to wherein when the first count value is less than or equal to the normal ratio value, the application program reaches the maximum processing rate, and the monitoring unit determines that the application program is in a normal state, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 14 not eligible.
Claim 15 related to wherein the predefined data amount is equal to the maximum processing rate divided by the first counting frequency and then multiplied by the normal ratio value, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 15 not eligible.
Claim 16 related to wherein the monitoring unit estimates the maximum processing rate according to a statistical data of the application program, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 16 not eligible.
Claim 17 related to wherein the step of determining whether the application program is in the second anomaly state according to the second count value comprising: setting a threshold value of the anomaly state counter, by the monitoring unit; when the first data amount reaches the predefined data amount and the first count value is greater than the normal ratio value, accumulating the second count value and comparing the second count value with the threshold value, by the monitoring unit; and when the second count value is greater than the threshold value, determining that the application program is in the second anomaly state, by the monitoring unit, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 17 not eligible.
Claim 18 related to when the second count value is greater than the threshold value, issuing a warning by a warning device, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 18 not eligible.
Claim 19 related to wherein the application program operates in a system platform, the system platform has a system state, and when the system state is a busy state, determining whether the application program is in the first anomaly state or the second anomaly state according to the first data amount, the first count value and the second count value, by the monitoring unit, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 19 not eligible.
Claim 20 related to wherein the system state has an update frequency, and the threshold value is set as greater than a number of times corresponding the update frequency, its recites further data characterization and mathematical concepts that are part of the abstract idea, claim 20 not eligible.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1-20 are rejected under 35 U.S.C. 102 (a) (1) as being anticipated by . Bailey (US Patent Application Publication 2017/0070523 A1, Date Published:
2017-03-09).
Regarding claim 1:
Bailey described an anomaly detection device, for detecting an anomaly in a usage state of an application program for a computing resource, the anomaly in the usage state comprises a first anomaly state and a second anomaly state, the anomaly detection device comprising (abstract, detecting and scoring anomalies):
a data amount accumulation unit, for accumulating a first data amount processed by the application program (0039, anomaly detection fuzzy profile);
an operation time counter, having a first count value and accumulating the first count value according to a first counting frequency (0005, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D));
an anomaly state counter, having a second count value and selectively accumulating the second count value according to the first anomaly state; and
a monitoring unit, for performing the following operations (0005, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D)):
monitoring whether the first data amount reaches a predefined data amount, wherein the predefined data amount is related to a maximum processing rate of the application program (0005, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D), 0043, in real time);
when the first data amount reaches the predefined data amount, reading the first count value and determining whether the application program is in the first anomaly state according to the first count value (0005, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D), 0043, in real time); and
when it is determined that the application program is in the first anomaly state, accumulating and reading the second count value, and determining whether the application program is in the second anomaly state according to the second count value (0005, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D), 0043, in real time).
Regarding claim 11:
Bailey described an anomaly detection method, for detecting an anomaly in a usage state of an application program for a computing resource, the anomaly in the usage state comprises a first anomaly state and a second anomaly state, the anomaly detection method comprising the following steps (abstract, detecting and scoring anomalies):
accumulating a first data amount processed by the application program, by a data amount accumulation unit (0039, anomaly detection fuzzy profile);
accumulating a first count value according to a first counting frequency, by an operation time counter; selectively accumulating a second count value according to the first anomaly state, by an anomaly state counter; and
performing the following operations by a monitoring unit (0005, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D), 0043, in real time):
monitoring whether the first data amount reaches a predefined data amount, wherein the predefined data amount is related to a maximum processing rate of the application program; when the first data amount reaches the predefined data amount, reading the first count value and determining whether the application program is in the first anomaly state according to the first count value (0005, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D), 0043, in real time); and when it is determined that the application program is in the first anomaly state, accumulating and reading the second count value, and determining whether the application program is in the second anomaly state according to the second count value (0005, determining a count of values from the plurality of values that fall within the at least one bucket; (D) comparing the count of values from the plurality of values that fall within the at least one bucket against historical information regarding the attribute; and (E) determining whether the attribute is anomalous based at least in part on a result of the act (D), 0043, in real time).
Regarding claim 2, Bailey further described wherein the first anomaly state indicates a short-term anomaly or a mild anomaly of the usage state, and the second anomaly state indicates a long-term anomaly (0043, in real time, 0047, anomaly associated with an attribute, the security system may simply examine one or more counters) or a severe anomaly of the usage state.
Regarding claim 3, Bailey further described the monitoring unit sets a normal ratio value of the operation time counter; when the first data amount reaches the predefined data amount, the monitoring unit compares the first count value with the normal ratio value; and when the first count value is greater than the normal ratio value, the monitoring unit determines that the application program is in the first anomaly state (0218, ratio).
Regarding claim 4, Bailey further described wherein when the first count value is less than or equal to the normal ratio value, the application program reaches the maximum processing rate, and the monitoring unit determines that the application program is in a normal state (0170, normalized count, 0218, ratio).
Regarding claim 5, Bailey further described wherein the predefined data amount is equal to the maximum processing rate divided by the first counting frequency and then multiplied by the normal ratio value (0218, match++/anomaly).
Regarding claim 6, Bailey further described wherein the monitoring unit estimates the maximum processing rate according to a statistical data of the application program (0218, Max, Min).
Regarding claim 7, Bailey further described the monitoring unit sets a threshold value of the anomaly state counter; when the first data amount reaches the predefined data amount and the first count value is greater than the normal ratio value, the monitoring unit accumulates the second count value and compares the second count value with the threshold value; and when the second count value is greater than the threshold value, the monitoring unit determines that the application program is in the second anomaly state (0043, in real time, 0218, Max, Min, threshold, ratio count).
Regarding claim 8, Bailey further described a warning device, for issuing a warning when the second count value is greater than the threshold value (0232, raise an alert when significant deviation from an expected baseline is observed).
Regarding claim 9, Bailey further described wherein the application program operates in a system platform, the system platform has a system state, and when the system state is a busy state, the monitoring unit determines whether the application program is in the first anomaly state or the second anomaly state according to the first data amount, the first count value and the second count value (0041, anomaly detection, 0043, 0218, value in real time).
Regarding claim 10, Bailey further described wherein the system state has an update frequency, and the threshold value is set as greater than a number of times corresponding the update frequency (0043, 0218, value in real time).
Regarding claim 12, Bailey further described wherein the first anomaly state indicates a short-term anomaly or a mild anomaly of the usage state, and the second anomaly state indicates a long-term anomaly (0043, in real time, 0047, anomaly associated with an attribute, the security system may simply examine one or more counters) or a severe anomaly of the usage state.
Regarding claim 13, Bailey further described wherein the step of determining whether the application program is in the first anomaly state according to the first count value comprising: setting a normal ratio value of the operation time counter, by the monitoring unit; when the first data amount reaches the predefined data amount, comparing the first count value with the normal ratio value, by the monitoring unit; and when the first count value is greater than the normal ratio value, determining that the application program is in the first anomaly state, by the monitoring unit (0043, in real time, 0218, Max, Min, threshold, ratio count).
Regarding claim 14, Bailey further described wherein when the first count value is less than or equal to the normal ratio value, the application program reaches the maximum processing rate, and the monitoring unit determines that the application program is in a normal state (0170, normalized count, 0218, ratio).
Regarding claim 15, Bailey further described wherein the predefined data amount is equal to the maximum processing rate divided by the first counting frequency and then multiplied by the normal ratio value (0218, ratio).
Regarding claim 16, Bailey further described wherein the monitoring unit estimates the maximum processing rate according to a statistical data of the application program (0218, Max).
Regarding claim 17, Bailey further described wherein the step of determining whether the application program is in the second anomaly state according to the second count value comprising: setting a threshold value of the anomaly state counter, by the monitoring unit; when the first data amount reaches the predefined data amount and the first count value is greater than the normal ratio value, accumulating the second count value and comparing the second count value with the threshold value, by the monitoring unit; and when the second count value is greater than the threshold value, determining that the application program is in the second anomaly state, by the monitoring unit (0218, 0233. real time processing data value).
Regarding claim 18, Bailey further described when the second count value is greater than the threshold value, issuing a warning by a warning device (0232, raise an alert when significant deviation from an expected baseline is observed).
Regarding claim 19, Bailey further described wherein the application program operates in a system platform, the system platform has a system state, and when the system state is a busy state, determining whether the application program is in the first anomaly state or the second anomaly state according to the first data amount, the first count value and the second count value, by the monitoring unit (0218 data processing).
Regarding claim 20, Bailey further described wherein the system state has an update frequency, and the threshold value is set as greater than a number of times corresponding the update frequency (0218, 0233, real time processing data value).
.
Contact information
5. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Tung Lau whose telephone number is (571)272-2274, email is Tungs.lau@uspto.gov. The examiner can normally be reached on Tuesday-Friday 7:00 AM-5:00 PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, TURNER SHELBY, can be reached on 571-272-6334. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272- 1000.
/TUNG S LAU/Primary Examiner, Art Unit 2857
Technology Center 2800
August 10, 2026
.
Prosecution Insights