Detailed Action
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendments
This Final Office Action is in response to amendment filed on 04/29/2026. Claims
1 - 20 have been amended. No claims have been canceled. Claims 1-20 remain
pending in the application.
Response to Amendment
The amended filed 04/29/2026 has been entered. See response to
amendments.
Response to Arguments/Amendment
Examiner’s remark applicant’s arguments concerning rejections under 35 U.S.C. § 103.
The applicant’s argument (remark pages 12-13):
“Zhang fails to disclose selecting a respective subset of similar unlabeled event data. Zhang fails to disclose or suggest that the unlabeled data in data pool 105 is similar unlabeled data, i.e., there is no teaching or suggestion that there is any similarity between or among the unlabeled data in data pool 105…Zhang fails to disclose selecting a respective subset of similar unlabeled event data in
each cluster of similar unlabeled event data.”.
Applicant’s arguments have been fully considered and are persuasive. However,
upon further consideration, arguments are moot in view of new grounds of
rejection necessitated by applicant amendments.
The applicant’s argument (remark pages 13-15):
“Osi fails to disclose translating via a LLM ANN each similar unlabeled event datum ... into a description for the similar unlabeled event datum…Osi fails to disclose the claim 1 limitation, as amended herein, of translating via a LLM ANN each similar unlabeled event datum in each respective subset of similar unlabeled event data into a description for the similar unlabeled event datum”
The Examiner respectfully disagree and arguments is not persuasive because Osi does disclose the claim limitation (see Osi par.0064: “Pre-Labeled Item Repository, which is a storage component that holds datasets which have already been categorized, serving as training material for the system to learn from. (3) Textual Reasoning Generator, which utilizes the LLM to analyze pre-labeled items and generate detailed explanations supporting their classifications, enhancing the system's learning capabilities.”, par.0010: “while utilizing and leveraging a Large Language Model (LLM) to generate and to provide textual reasoning/textual explanation that supports or explains each such classification.”, par.0013: “Some embodiments utilize and leverage an Artificial Intelligence (AI) model, and particularly a Large Language Model (LLM), to extract or recognize or deduce or infer one or more indicators or features from labeled data, and enable the system to use these indicators or features to generate a textual explanation of for classification of new, un-labeled or not-yet-labeled data-items/documents/messages.”, par.0017: “the LLM may be prompted to generate textual reasoning for the classification of each of the pre-labeled messages as “urgent”/“non-urgent”; and, to generate textual reasoning for the classification of each of the pre-labeled messages as “contains PII”/“does not contain PII”; and so forth, for a plurality of classes or categories.” Examiner interpret that the LLM does more than just give a reasoning for categorization but also give a description such as “urgent/not urgent”, “contains PII/does not contain PII”.”).
“Osi fails to teach applying a label ... to at least one similar unlabeled event datum ...responsive to and representative of the respective description for the similar unlabeled event datum…given Osi fails to disclose translating via a LLM ANN each similar unlabeled event datum in each respective subset of similar unlabeled event data into a description for the similar unlabeled event datum, Osi necessarily fails to disclose applying a label via a labeling algorithm to at least one similar unlabeled event datum in a respective cluster responsive to and
representative of the respective description for the similar unlabeled event datum in the respective subset.”.
The Examiner respectfully disagree and arguments is not persuasive because Osi does teach the translating via a LLM ANN each similar unlabeled event datum in each respective subset of similar unlabeled event data into a description for the similar unlabeled event datum as explain above. Since Osi does explain the claim limitation discussed above, Osi also disclose the applying a label ... to at least one similar unlabeled event datum ...responsive to and representative of the respective description for the similar unlabeled event datum.
The Applicant’s argument regarding claim 7 and 15 (remark pages 15-16):
“Applicants contend these claims are patentable under 35 U.S.C. § 103 over Wang,
Zhang and Osi and further in view of Signalibiur and Stokes for at least the same reasons that claim 1 as amended herein is patentable under 35 U.S.C. § 103 over Wang, Zhang and Osi as discussed above. Accordingly”.
Applicant’s arguments have been fully considered and are persuasive. However,
upon further consideration, arguments are moot in view of new grounds of
rejection necessitated by applicant amendments.
The applicant’s argument regarding claim 9 and 17:
“Stokes is not being offered to cure, and indeed do not cure, the above noted deficiencies in Wang, Zhang and Osi. Thus, Applicants contend these claims are patentable under 35 U.S.C. § 103 over Wang, Zhang and Osi and further in view of Stokes for at least the same reasons that claim 1 as amended herein is patentable under 35 U.S.C. § 103 over Wang, Zhang and Osi as discussed above.”.
Applicant’s arguments have been fully considered and are persuasive. However,
upon further consideration, arguments are moot in view of new grounds of
rejection necessitated by applicant amendments.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-5, 8, 10-13, 16, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Wang et al. (US-12432230-B2 hereafter Wang), in view of ブレマー et al. JP 2022542920 A hereafter ブレマー), in further view of Osi et al. (US-20250363327-A1 hereafter Osi).
Regarding claim 1 Wang disclose a computer-implemented method for a digital security system (see Wang Col.2 lines 47-48: “a computer system for performing automated threat detection”), the method comprising:
receiving unlabeled event data associated with a computing environment (see Wang Col.2 lines 54-58: “Detection system 102 may receive unlabeled data 130 (e.g., network traffic, sensor data, firewall data, IoT data, or other telemetry data) from client device 140 and third party system 150 in a distributed communication environment.”);
clustering via an unsupervised machine learning model the unlabeled event data into clusters of similar unlabeled event data, wherein similar unlabeled event data in one cluster are more similar to each other than to unlabeled event data in other clusters (see Wang Col.3 lines 63 - Col.4 lines 3: “the unsupervised machine learning model may correspond with clustering (e.g., k-means, hierarchical clustering), dimensionality reduction (e.g., PCA, t-SNE), association rule learning, or other unsupervised machine learning models. When clustering is implemented, the process may identify natural groupings or clusters in the data, based on a data characteristic,”, Col.7 lines 12-15: “unlabeled data 130 may be aggregated and characterized by detection system 102 using data processing module 108 as described herein.”, Col.8 lines 40-44: “the ingesting process may include filtering, aggregation, and transformation. For example, filtering of the unlabeled data may remove specific subsets of data based on predefined criteria, like specific values, ranges, patterns, or characteristics within the unlabeled data”);
Wang do not explicitly teach however ブレマー teaches
selecting a respective subset of similar unlabeled event data in each cluster of similar unlabeled event data (see ブレマー par.32: “selecting a subset of unlabeled data points includes using the classification results to rank the data points of the current set of unlabeled data points and adding metadata parameters describing the data points. wherein the ranking and the further ranking result in a current set of ranked unlabeled data points, wherein the ranking and further ranking and clustering the data points of the current set of unlabeled data points with a first attribute subset of the set of attributes, resulting in a plurality of clusters, wherein , clustering is performed separately on the data points with the same rank in the current set of unlabeled data points, clustering and for each cluster of the plurality of clusters”);
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang teaching “The unsupervised machine learning models may be trained on unlabeled data to assign or generate a label for the unlabeled data. The unlabeled data may be received without labeled outputs or target variables.” The benefits of training the unsupervised machine learning to generate or assign label for the unlabeled data is to properly to classify data with similar characteristics and continues learning process to retrain itself and to label data to it proper category making the label process more robust to find security threat. (see Wang Col.4 lines: 16-27), with ブレマー teaching “Clustering makes it possible to find groups of similar examples within intermediate subsets of unlabeled data points. For example, more than 1 data point per cluster may not significantly improve model training, and using centroids may be advantageous as it may be a reliable representation of clusters. . Additionally, by choosing the points closest to the centroids of multiple clusters, it may be possible to find points that differ significantly. This could help machine learning to train better models. (see ブレマー par.27).
Wang in view of ブレマー appear to be silence however Osi teaches
translating via a large language model artificial neural network each similar unlabeled event datum in each respective subset of similar unlabeled event data into a description for the similar unlabeled event datum (see Osi par.0064: “Pre-Labeled Item Repository, which is a storage component that holds datasets which have already been categorized, serving as training material for the system to learn from. (3) Textual Reasoning Generator, which utilizes the LLM to analyze pre-labeled items and generate detailed explanations supporting their classifications, enhancing the system's learning capabilities.”, par.0010: “while utilizing and leveraging a Large Language Model (LLM) to generate and to provide textual reasoning/textual explanation that supports or explains each such classification.”, par.0013: “Some embodiments utilize and leverage an Artificial Intelligence (AI) model, and particularly a Large Language Model (LLM), to extract or recognize or deduce or infer one or more indicators or features from labeled data, and enable the system to use these indicators or features to generate a textual explanation of for classification of new, un-labeled or not-yet-labeled data-items/documents/messages.”, par.0017: “the LLM may be prompted to generate textual reasoning for the classification of each of the pre-labeled messages as “urgent”/“non-urgent”; and, to generate textual reasoning for the classification of each of the pre-labeled messages as “contains PII”/“does not contain PII”; and so forth, for a plurality of classes or categories.” Examiner interpret that the LLM does more than just give a reasoning for categorization but also give a description such as “urgent/not urgent”, contains PII”/does not contain PII”.); and
applying a label via a labeling algorithm to at least one similar unlabeled event datum in a respective cluster responsive to and representative of the respective description for the similar unlabeled event datum in the respective subset, thereby transforming the at least one similar unlabeled event datum to a similar labeled event datum. (See Osi par.0064: “Unified List Compiler, which aggregates the generated textual reasonings into a comprehensive list that categorizes and identifies key features and indicators for each class. (5) Instruction Prompt Creator, which constructs detailed instruction prompts from the Unified List, which guide the classification of new, unlabeled items. (6) New Item Feeder, that manages the intake of new, unlabeled items into the system, ensuring they are properly queued for processing according to the generated instruction prompts. (7) Classification Engine, which is the core analytical engine that applies the instruction prompts to new items, categorizing them based on the established rules and indicators. (8) LLM-Based Labeling Unit, which uses the LLM outputs to assign labels to new items, integrating the classification results into a coherent data structure such as a dataset of LLM-labeled textual items.”).
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang in view of ブレマー teaching described above with Osi teaching “Data Analysis and Reasoning Generation: Initially, a dataset of pre-labeled items is analyzed by the LLM. For each item, the LLM generates a textual explanation that supports its classification (e.g., why an item is labeled as spam). This step is critical as it establishes a foundational understanding of features relevant to each category. Then, Indicator Collation is performed: Following the generation of textual reasonings, these explanations are aggregated. This aggregation process involves collating the reasonings per category to form a comprehensive list of indicators that are characteristic of each class. For example, indicators for spam might include phrases like “free money” or “limited time offer”. Then, Instruction Prompt Generation is performed: From the collated indicators, an Instruction Prompt is created for each category.”, (see Osi par.0055).
Regarding claim 10, claim 10 is a non-transitory computer-readable medium
claim that recites similar limitations as the computer-implemented method claim 1 and is being rejected based on the same rational as claim 1. A non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising (see Wang Col.17 lines 59-61: “The threat-labeled computer network traffic may be stored in network traffic data store 940 carried by a non-transitory
computer readable medium.”, Col.25 lines 28-42: “According to one embodiment, the techniques herein are performed by the computer system in response to the processor(s) executing one or more sequences of one or more instructions contained in the main memory. Such instructions may be read into the main memory from another storage medium. Execution of the sequences of instructions contained in the main memory causes the processor(s) to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions.”):
Regarding claim 18, claim 18 is a system claim that recites similar limitations as the computer-implemented method claim 1 and is being rejected based on the same rational as claim 1. a memory to store instructions (see Wang Col.24 lines 29-32: “The computer system also includes a main memory, such as a random access memory (RAM), cache and/or other dynamic storage devices, coupled to the bus for storing information and instructions to be executed by the processor.”);
a processor to execute the instructions stored in the memory for (see Wang Col.24 lines 33-39: “The main memory also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by the processor. Such instructions, when stored in storage media accessible to the processor, render the computer system into a special-purpose machine that is customized to perform the operations specified in the instructions.”):
Regarding claim 2 Wang in view of ブレマー, and Osi disclose the computer-implemented method of claim 1 Osi further teach wherein applying the label via the labeling algorithm to the at least one similar unlabeled event datum in the respective cluster responsive to and representative of the respective description for the similar unlabeled event datum in the respective subset (See Osi par.0064: “Unified List Compiler, which aggregates the generated textual reasonings into a comprehensive list that categorizes and identifies key features and indicators for each class. (5) Instruction Prompt Creator, which constructs detailed instruction prompts from the Unified List, which guide the classification of new, unlabeled items. (6) New Item Feeder, that manages the intake of new, unlabeled items into the system, ensuring they are properly queued for processing according to the generated instruction prompts. (7) Classification Engine, which is the core analytical engine that applies the instruction prompts to new items, categorizing them based on the established rules and indicators. (8) LLM-Based Labeling Unit, which uses the LLM outputs to assign labels to new items, integrating the classification results into a coherent data structure such as a dataset of LLM-labeled textual items.”), comprises applying a label via the labeling algorithm to a plurality of similar unlabeled event datum in each respective cluster responsive to and representative of the respective description for the similar unlabeled event datum in the respective subset. (See Osi par.0016: “the plurality of pre-labeled messages may be fed in parallel to two or more LLMs, for parallel processing and for parallel generation of the reasoning text for the classification (label) of each messages…par.0017: “the LLM may be prompted to generate textual reasoning for the classification of each of the pre-labeled messages as “spam”/“non-spam”; and, the LLM may be prompted to generate textual reasoning for the classification of each of the pre-labeled messages as “urgent”/“non-urgent”; and, to generate textual reasoning for the classification of each of the pre-labeled messages as “contains PII”/“does not contain PII(description)”...par.0023: “examples of such automatically-labeled (LLM-labeled) datasets that can be generated by the LLM are: [0024] Inference: [0025] Example 1: Email Security Classification (label). [0026] Email=>Spam, because. . . . [0027] Fraud-Related, because.”).
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang in view of ブレマー, and Osi teaching of claim 1 with Osi teaching “a plurality of LLMs may be used, in series and/or in parallel, to generate the reasonings for the classifications of the pre-labeled messages into the various categories or classes”, (see Osi par.0018).
Regarding claim 11, claim 11 is a non-transitory computer-readable medium
claim that recites similar limitations as the computer-implemented method claim 1 and is being rejected based on the same rational as claim 2.
Regarding claim 19, claim 18 is a system claim that recites similar limitations as the computer-implemented method claim 2 and is being rejected based on the same rational as claim 2.
Regarding claim 3 Wang in view of ブレマー, and Osi disclose the computer-implemented method of claim 2, Wang further teaches comprises applying a first label via the labeling algorithm to one or more of the similar unlabeled event datum in a given cluster, and applying a second label, different than the first label, via the labeling algorithm to another one or more of the similar unlabeled event datum in the given cluster. (See Wang Col.12 lines 41-63: “the unsupervised machine learning model may compare a set of data characteristics of normal data to the new, unlabeled data. At a first time, a first label of a set of labels may be assigned to the unlabeled data using an unsupervised machine learning model. This may correspond with normal data that is identified in a first set of unlabeled data. At a second time, second unlabeled data may be received. The second unlabeled data may be provided to a particular unsupervised machine learning model based on a data characteristic. When the data characteristic exists and is assigned to an existing unsupervised machine learning model, the particular unsupervised machine learning model may be selected to assign the label to the unlabeled data. The label may correspond with the first label of the set of labels that was assigned to the first labeled data. In this example, the same label may be assigned to the second unlabeled data because the unlabeled data may be similar to the first unlabeled data based on the set of data characteristics. This may also correspond with normal data that is identified in a second set of unlabeled data. When the data is not similar to the first unlabeled data or any corresponding data characteristics of the first unlabeled data, a second label may be generated and assigned to the second set of labeled data.”), Wang in view of ブレマー do not explicitly teach however Osi teaches wherein applying the label via the labeling algorithm to the plurality of similar unlabeled event datum in each respective cluster responsive to and representative of the respective description for the similar unlabeled event datum in the respective subset (see Osi par.0064: “Unified List Compiler, which aggregates the generated textual reasonings into a comprehensive list that categorizes and identifies key features and indicators for each class. (5) Instruction Prompt Creator, which constructs detailed instruction prompts from the Unified List, which guide the classification of new, unlabeled items. (6) New Item Feeder, that manages the intake of new, unlabeled items into the system, ensuring they are properly queued for processing according to the generated instruction prompts. (7) Classification Engine, which is the core analytical engine that applies the instruction prompts to new items, categorizing them based on the established rules and indicators. (8) LLM-Based Labeling Unit, which uses the LLM outputs to assign labels to new items, integrating the classification results into a coherent data structure such as a dataset of LLM-labeled textual items.”).
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang in view of ブレマー, and Osi teaching of claim 1 with Wang teaching “the unsupervised machine learning model may determine a new or second label associated with outliers in the data. The outlier may correspond with data that is not similar to previously identified activities in the system, including non-fraudulent or fraudulent activities, and a label corresponding with the outlier may be generated and assigned to the data.”, (see Wang Col.13 lines 36-42).
Regarding claim 4 Wang in view of ブレマー, and Osi disclose the computer-implemented method of claim 1 Wang further teaches further comprising training a machine learning model to analyze and detect cybersecurity threats using the similar labeled event data. (See Wang Col.2 17-32: “through an unsupervised machine learning model, a label for the data (e.g., “1” for outlier data and “0” for normal data). The labels are provided to a supervised machine learning model during a first training process. When new data is received, the supervised machine learning model is executed during an inference process to cluster the new data in accordance with the labels that were determined by the unsupervised machine learning model. In some examples, a label audit process may be implemented to update the cluster/output of the supervised machine learning model. The updated labels from the label audit process may be provided back to the supervised machine learning model during a second training process. In other words, the system may combine the unsupervised machine learning model with a supervised machine learning model to perform automated threat detection.”).
Regarding claim 12, claim 12 is a non-transitory computer-readable medium
claim that recites similar limitations as the computer-implemented method claim 4 and is being rejected based on the same rational as claim 4.
Regarding claim 5 Wang in view of ブレマー, and Osi disclose the computer-implemented method of claim 1 Wang further teaches wherein clustering via the unsupervised machine learning model the similar unlabeled event data into clusters of similar unlabeled event data, wherein similar unlabeled event data in one cluster are more similar to each other than to unlabeled event data in other clusters (see Wang Col.3 lines 63 - Col.4 lines 3: “the unsupervised machine learning model may correspond with clustering (e.g., k-means, hierarchical clustering), dimensionality reduction (e.g., PCA, t-SNE), association rule learning, or other unsupervised machine learning models. When clustering is implemented, the process may identify natural groupings or clusters in the data, based on a data characteristic,”, Col.7 lines 12-15: “unlabeled data 130 may be aggregated and characterized by detection system 102 using data processing module 108 as described herein.”, Col.8 lines 40-44: “the ingesting process may include filtering, aggregation, and transformation. For example, filtering of the unlabeled data may remove specific subsets of data based on predefined criteria, like specific values, ranges, patterns, or characteristics within the unlabeled data”), comprises clustering via the unsupervised machine learning model the similar unlabeled event data into clusters of similar unlabeled event data, wherein similar unlabeled event data in one cluster are more similar to each other in terms of indicating one or both of an action taken and a result achieved in the computing environment than to unlabeled event data in other clusters. (see Wang Col.12 lines 41-60: “the unsupervised machine learning model may compare a set of data characteristics of normal data to the new, unlabeled data. At a first time, a first label of a set of labels may be assigned to the unlabeled data using an unsupervised machine learning model. This may correspond with normal data that is identified in a first set of unlabeled data. At a second time, second unlabeled data may be received. The second unlabeled data may be provided to a particular unsupervised machine learning model based on a data characteristic. When the data characteristic exists and is assigned to an existing unsupervised machine learning model, the particular unsupervised machine learning model may be selected to assign the label to the unlabeled data. The label may correspond with the first label of the set of labels that was assigned to the first labeled data. In this example, the same label may be assigned to the second unlabeled data because the unlabeled data may be similar to the first unlabeled data based on the set of data characteristics. This may also correspond with normal data that is identified in a second set of unlabeled data.”).
Regarding claim 13, claim 13 is a non-transitory computer-readable medium
claim that recites similar limitations as the computer-implemented method claim 5 and is being rejected based on the same rational as claim 5.
Regarding claim 20, claim 20 is a system claim that recites similar limitations as the computer-implemented method claim 5 and is being rejected based on the same rational as claim 5.
Regarding claim 8 Wang in view of ブレマー, and Osi disclose the computer-implemented method of claim 1, Wang further teaches proposing the label via the labeling algorithm (see Wang Col.3 lines 63 – Col.4 line 11: “the unsupervised machine learning model may correspond with clustering (e.g., k-means, hierarchical clustering), dimensionality reduction (e.g., PCA, t-SNE), association rule learning, or other unsupervised machine learning models. When clustering is implemented, the process may identify natural groupings or clusters in the data, based on a data characteristic, and generate a label associated with that characteristic. When dimensionality reduction is implemented, the process may reduce the number of input variables or features under consideration to simplify the complexity of the dataset by transforming it into a lower-dimensional space while preserving important information. When association rule learning is implemented, the process aims to discover relationships, patterns, or associations within the unlabeled data, and generate a label for the corresponding data.”);
receiving user input to approve the proposed label (see Wang Col.14 47-50: “The labels may be revised or added by human or automated input. In some examples, the data are provided to a display or real-time API to receive an interaction from the user to help relabel the clustered data.”); and
applying the approved label. (See Wang Col.16 lines 39-48: “the display may provide an interaction tool during the label audit process. During the label auditing process, the display may allow an interaction with the individual label. When an interaction is received (e.g., “yes, this data is properly labeled” or “yes, this data corresponds with a threat”), the process may use the interaction response to revise labels associated with particular data or data characteristics. In some examples, the interaction response is received from a human user and the updated label is provided to retrain the supervised machine learning model.”).
Wang in view of ブレマー appear to be silence however Osi teaches
wherein applying the label via the labeling algorithm to the at least one similar unlabeled event datum in the respective cluster responsive to and representative of the respective description for the similar unlabeled event datum in the respective subset, thereby transforming the at least one unlabeled event datum to the similar labeled event datum (See Osi par.0064: “Unified List Compiler, which aggregates the generated textual reasonings into a comprehensive list that categorizes and identifies key features and indicators for each class. (5) Instruction Prompt Creator, which constructs detailed instruction prompts from the Unified List, which guide the classification of new, unlabeled items. (6) New Item Feeder, that manages the intake of new, unlabeled items into the system, ensuring they are properly queued for processing according to the generated instruction prompts. (7) Classification Engine, which is the core analytical engine that applies the instruction prompts to new items, categorizing them based on the established rules and indicators. (8) LLM-Based Labeling Unit, which uses the LLM outputs to assign labels to new items, integrating the classification results into a coherent data structure such as a dataset of LLM-labeled textual items. par.0013: “Some embodiments utilize and leverage an Artificial Intelligence (AI) model, and particularly a Large Language Model (LLM), to extract or recognize or deduce or infer one or more indicators or features from labeled data, and enable the system to use these indicators or features to generate a textual explanation of for classification of new, un-labeled or not-yet-labeled data items/documents/messages.”, par.0017: “the LLM may be prompted to generate textual reasoning for the classification of each of the pre-labeled messages as “urgent”/“non-urgent”; and, to generate textual reasoning for the classification of each of the pre-labeled messages as “contains PII”/“does not contain PII”; and so forth, for a plurality of classes or categories.”), comprises:
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang in view of ブレマー, and Osi teaching of claim 1 with Osi teaching “Data Analysis and Reasoning Generation: Initially, a dataset of pre-labeled items is analyzed by the LLM. For each item, the LLM generates a textual explanation that supports its classification (e.g., why an item is labeled as spam). This step is critical as it establishes a foundational understanding of features relevant to each category. Then, Indicator Collation is performed: Following the generation of textual reasonings, these explanations are aggregated. This aggregation process involves collating the reasonings per category to form a comprehensive list of indicators that are characteristic of each class. For example, indicators for spam might include phrases like “free money” or “limited time offer”. Then, Instruction Prompt Generation is performed: From the collated indicators, an Instruction Prompt is created for each category.”, (see Osi par.0055).
Regarding claim 16, claim 16 is a non-transitory computer-readable medium
claim that recites similar limitations as the computer-implemented method claim 8 and is being rejected based on the same rational as claim 8.
Claims 6 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Wang in view of ブレマー and Osi as applied to claim 1, in further view of Joubert et al. (US-20070157312-A1 hereafter Joubert).
Regarding claim 6 Wang in view of ブレマー, and Osi disclose the computer-implemented method of claim 1, ブレマー further discloses wherein selecting the respective subset of similar unlabeled event data for each cluster of similar unlabeled event data(see ブレマー par.32: “selecting a subset of unlabeled data points includes using the classification results to rank the data points of the current set of unlabeled data points and adding metadata parameters describing the data points. wherein the ranking and the further ranking result in a current set of ranked unlabeled data points, wherein the ranking and further ranking and clustering the data points of the current set of unlabeled data points with a first attribute subset of the set of attributes, resulting in a plurality of clusters, wherein , clustering is performed separately on the data points with the same rank in the current set of unlabeled data points, clustering and for each cluster of the plurality of clusters”),
Wang in view of ブレマー, and Osi do not explicitly teach comprises one or both of selecting similar unlabeled event data of interest and filtering out known or related similar unlabeled event data.
In this instance examiner notes the teaching of prior art reference Joubert.
With regards to applicant’s claim limitation element of comprises one or both of selecting similar unlabeled event data of interest and filtering out known or related similar unlabeled event data. (see Joubert par.0044: “ the component searches for other events that contain the same filter ID as the selected event and adds any matching events to a list of related events.”).
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang in view of ブレマー, and Osi teaching of claim 1 with Joubert teaching “the unified diagnostics system correlates events using identifiers contained within the events. For example, a security event related to an expired certificate may contain a certificate identifier that the system can use to look up additional information about the certificate. If the certificate relates to a particular website, the additional information may allow the system to correlate the security event with networking events that identify that website. As another example, a networking event may contain an identifier of the process that made a failed attempt to access a network device. The system can use this process identifier to find other events related to the same process”, (see Joubert par.0025-26).
Regarding claim 14, claim 14 is a non-transitory computer-readable medium
claim that recites similar limitations as the computer-implemented method claim 6 and is being rejected based on the same rational as claim 6.
Claims 7 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Wang in view of ブレマー and Osi as applied to claim 1, in further view of Signalibiur et al. (NPL “Using LimaCharlie and ChatGPT to Perform Malware Anomaly Detection” hereafter Signalibiur), in further view of Stokes et al. (US-12032687-B2 hereafter Stokes).
Regarding claim 7 Wang in view of ブレマー, and Osi disclose the computer-implemented method of claim 1, Osi further teaches wherein translating via the large language model artificial neural network each similar unlabeled event datum in each respective subset of similar unlabeled event data into the description for the similar unlabeled event datum (see Osi par.0064: “Pre-Labeled Item Repository, which is a storage component that holds datasets which have already been categorized, serving as training material for the system to learn from. (3) Textual Reasoning Generator, which utilizes the LLM to analyze pre-labeled items and generate detailed explanations supporting their classifications, enhancing the system's learning capabilities.”, par.0010: “while utilizing and leveraging a Large Language Model (LLM) to generate and to provide textual reasoning/textual explanation that supports or explains each such classification.”, par.0013: “Some embodiments utilize and leverage an Artificial Intelligence (AI) model, and particularly a Large Language Model (LLM), to extract or recognize or deduce or infer one or more indicators or features from labeled data, and enable the system to use these indicators or features to generate a textual explanation of for classification of new, un-labeled or not-yet-labeled data-items/documents/messages.”, par.0017: “the LLM may be prompted to generate textual reasoning for the classification of each of the pre-labeled messages as “urgent”/“non-urgent”; and, to generate textual reasoning for the classification of each of the pre-labeled messages as “contains PII”/“does not contain PII”; and so forth, for a plurality of classes or categories.” Examiner interpret that the LLM does more than just give a reasoning for categorization but also give a description such as “urgent/not urgent”, contains PII”/does not contain PII”.), comprises translating each similar unlabeled event datum into one or more of: a natural language, a coded, a decoded, or a pseudo-coded, description of an action taken or a result achieved in the computing environment (see Osi par.0016: “the LLM is prompted or commanded or instructed to identify/deduce/infer/generate textual reason(s) that support the pre-labeled classification of each of those pre-labeled documents/messages. For example, the LLM may be prompted, “Please perform textual analysis of each message, and generate a detailed textual explanation of the reasoning that supports the pre-labeled classification of each of those messages”. For example, the LLM may be fed the set of pre-labeled spam/non-spam messages, and may be prompted to “Generate a textual explanation in a natural language, that supports the classification of each of these messages as either spam or non-spam”.”);
Wang in view of ブレマー, and Osi appear to be silence however Signalibiur teaches
a description of a usage of an executable file referenced in the similar unlabeled event datum (see Signalibiur page.3 : “
PNG
media_image1.png
580
1065
media_image1.png
Greyscale
”);
a description of the similar unlabeled event datum indicating a benign or a malicious action was taken or result achieved in the computing environment (see Signalibiur page.3 : “
PNG
media_image2.png
397
1061
media_image2.png
Greyscale
”);
a description of techniques and/or tactics used by threat actors where the similar unlabeled event datum indicates a malicious action was taken or result achieved in the computing environment (see Signalibiur page.4 : “
PNG
media_image3.png
403
1069
media_image3.png
Greyscale
”);
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang in view of ブレマー, and Osi teaching of claim 1 with Signalibiur teaching “innovative and new ways to detect adversary tradecraft. With all of the new hype around ChatGPT and its capabilities: figured I'd give it a try and put it to a test to see how well it performed at detecting common and well known modem attacks VS a benign process.”, (see Signalibiur page.1).
Wang in view of ブレマー, Osi, and Signalibiur appear to be silence however Stokes teaches and
a description of a level of confidence in the translation and description of the similar unlabeled event datum. (See Stokes Col.12 lines 34-51: “the confidence level can be a numerical value that first machine learning model 116 can include in each prediction. In another example, samples may be placed within a class based on a class probability calculated by first machine learning model 116. For instance, a labeled sample 510 is placed in benign activity class 504. Accordingly, samples that are similar to labeled sample 510 can be placed nearby in benign activity class 504. In another example, first machine learning model 116 may place an unlabeled sample 508 based on a calculated confidence level or class probability. In this instance, first machine learning model 116 has determined that unlabeled sample 508 likely belongs in benign activity class 504 and has placed unlabeled sample 508. However, first machine learning model 116 may also determine that unlabeled sample 508 could potentially belong in malicious activity class 502A (e.g., benign activity class 504 and malicious activity class 502A have similar class probabilities).”).
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang in view of ブレマー, Osi, and Signalibiur described above with Stokes teaching “first machine learning model 116 may receive a sample from unlabeled data set 118 that can be quickly and confidently identified as an attack. To enable a rapid and effective response to mitigate the attack, first machine learning model 116 can generate a notification 127. To further enhance the security response, notification 127 may also include information regarding the type of attack. For instance, first machine learning model 116 may detect a data exfiltration attempt in progress.”, (see Stokes Col.7 lines48-56.)
Regarding claim 15, claim 15 is a non-transitory computer-readable medium
claim that recites similar limitations as the computer-implemented method claim 7 and is being rejected based on the same rational as claim 7.
Claims 9 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Wang in view of ブレマー and Osi as applied to claim 1, in further view Stokes et al. (US-12032687-B2 hereafter Stokes).
Regarding claim 9 Wang in view of ブレマー, and Osi disclose the computer-implemented method of claim 1, Wang further teaches wherein applying the label comprises applying a label selected from a group of labels (see Wang Col.11 lines 41-67: “the unsupervised machine learning model may compare a set of data characteristics of normal data to the new, unlabeled data. At a first time, a first label of a set of labels may be assigned to the unlabeled data using an unsupervised machine learning model. This may correspond with normal data that is identified in a first set of unlabeled data. At a second time, second unlabeled data may be received. The second unlabeled data may be provided to a particular unsupervised machine learning model based on a data characteristic. When the data characteristic exists and is assigned to an existing unsupervised machine learning model, the particular unsupervised machine learning model may be selected to assign the label to the unlabeled data. The label may correspond with the first label of the set of labels that was assigned to the first labeled data. In this example, the same label may be assigned to the second unlabeled data because the unlabeled data may be similar to the first unlabeled data based on the set of data characteristics. This may also correspond with normal data that is identified in a second set of unlabeled data. When the data is not similar to the first unlabeled data or any corresponding data characteristics of the first unlabeled data, a second label may be generated and assigned to the second set of labeled data. The second label may be stored with the set of labels and correspond to a second set of the second unlabeled data that is not similar to the first unlabeled data based on the set of data characteristics.”), consisting of:
a binary label that indicates the similar unlabeled event datum to which the binary label is being applied indicates one of a benign or a malicious action taken or result achieved in the computing environment (see Wang Col.9 lines 20-28: “The unsupervised machine learning model may be trained on unlabeled data (received from block 220) to assign or generate a label for the unlabeled data. The unlabeled data may be received without labeled outputs or target variables. In an illustrative example, the label may correspond with “1” (e.g., outlier data) (benign or malicious) or “0” (e.g., normal data) based on the characteristics of the data. The label determined during the training process may be stored in a label data store (block 234).”);
Wang in view of ブレマー, and Osi appear to be silence however Stokes teaches
a multiple class label that indicates the similar unlabeled event datum to which the multiple class label is being applied indicates one of a plurality of actions taken or results achieved in the computing environment (see Stokes Col.7 lines 38 – Col.8 line 7: “as labeled data set 104 expands with each iteration first machine learning model 116 can improve accuracy in detecting malicious command line strings as well as detect more attack methods…first machine learning model 116 can generate a notification 127. To further enhance the security response, notification 127 may also include information regarding the type of attack. For instance, first machine learning model 116 may detect a data exfiltration attempt in progress. Accordingly, notification 127 can reflect the identity of the attack type to enable analyst 126 to carry out appropriate measures for various attack types. In another example, notification 127 can include multiple classes of malicious activity that are ranked by likelihood based on analysis and prediction by first machine learning model 116. In this way, notification 127 can be a multiclass output that provides maximal context and coverage for a potential attack. notification 127 may indicate that an attacker has gained secure access a particular user device (e.g., a laptop) and is attempting to move laterally within a network connected to the user device. Such lateral movement can enable the attacker to compromise other connected devices as well as the greater network infrastructure.”); and
a multiple label that indicates the similar unlabeled event datum to which the multiple label is being applied indicates a plurality of actions taken or results achieved in the computing environment. (See Stokes Col.13 lines 47-53: “first machine learning model 116 can calculate an uncertainty score for each sample. As discussed above with respect to unlabeled sample 508, a sample may have similar class probabilities for multiple activity classes 502-504. In various examples, the uncertainty score can represent a difference between a highest ranked class probability and a second-highest ranked class probability for a sample.”, Col.13 lines 61 – Col.14 line 8: “first machine learning model 116 and second machine learning model 117 can further enable first machine learning model 116 to categorize samples within each activity class 502-504 (multiple label) using activity class legend 514. Activity class legend 514 can define several types of activity classes such as benign 514A and malicious 514B. As will be discussed below, activity class legend 514 can also be expanded with new activity classes as first machine learning model 116 continually learns. For instance, second machine learning model 117 may discover a new type of malicious command line string as enabled by anomaly sampling which can be subsequently recorded in activity class legend 514. In addition, activity class legend 514 can also record new types of benign activity, both new classes as well as subclasses of known benign activity.”).
It would have been obvious to one or ordinary skill in the art before the effective
filing date of the claim invention to combine Wang in view of ブレマー, and Osi teaching of claim 1 with Stokes teaching “a labeled sample 510 is placed in benign activity class 504. Accordingly, samples that are similar to labeled sample 510 can be placed nearby in benign activity class 504. In another example, first machine learning model 116 may place an unlabeled sample 508 based on a calculated confidence level or class probability. In this instance, first machine learning model 116 has determined that unlabeled sample 508 likely belongs in benign activity class 504 and has placed unlabeled sample 508. However, first machine learning model 116 may also determine that unlabeled sample 508 could potentially belong in malicious activity class 502A (e.g., benign activity class 504 and malicious activity class 502A have similar class probabilities).”, (see Stokes Col.12 lines 39-51).
Regarding claim 17, claim 17 is a non-transitory computer-readable medium
claim that recites similar limitations as the computer-implemented method claim 9 and is being rejected based on the same rational as claim 9.
Conclusion
The prior art made of record and not relied upon is considered pertinent to
applicant's disclosure:
Sharma et al. (US-9953160-B2) computer-implemented method may include receiving transactional data associated with a plurality of user accounts, analyzing the transactional data of the accounts in view of a clustering model, associating each of the accounts with one of multiple peer groups from the clustering model, detecting anomalous account behavior in a peer group in view of a scatteredness score computed for each account in the peer group where each scatteredness score is computed based on a neighborhood of accounts in the peer group determined for each respective account of the peer group, and creating a report comprising account and scatteredness score information for one or more of the accounts in the peer group associated with detected anomalous account behavior.
Duma et al. (WO-2023196471-A1) A method for identifying and handling related incidents using a machine-learning based model, includes, performing by one or more processors, operations including: clustering a sub-group of incident records from among a plurality of incident records using the machine-learning based model based on a rolling time window and a number of records in the sub-group of incident records; creating a problem record based on the clustered incident records; populating the problem record with information related to the clustered incident records
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DUILIO MUNGUIA whose telephone number is (571)270-5277. The examiner can normally be reached M-F 9:30AM - 5:00Pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni A Shiferaw can be reached at (571) 272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DUILIO MUNGUIA/Examiner, Art Unit 2497
