DETAILED ACTION
Claims 16-35 are pending in this action.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statements (IDS) submitted on 5/28/2025, 12/2/2025 and 2/23/2026 are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statements have been considered by the examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 16-18, 21, 23, 27 and 29-34 are rejected under 35 U.S.C. 103 as being unpatentable over Sakamoto et al. (US PGPUB No. 2017/0208080) [hereinafter “Sakamoto”] in view of Tsou et al. (US PGPUB No. 2018/0189667) [hereinafter “Tsou”].
As per claim 16, Sakamoto teaches a method of detecting anomalous events indicative of malicious activity, the method comprising: receiving a log of an event (Abstract, events from a log of events), the event having a plurality of attributes and the log comprising a known value for each of the plurality of attributes of the event (Abstract and [0037], pattern data created from content data associated with the event or events – this interpreted to be “attributes” of an event see also [0026] various metadata attached to event for anomaly analysis); generating a masked log by masking a known value of one of the plurality of attributes in the received log ([0052], transforming the event(s) which are made up of content data by applying a mask to them – the mask is used to align the events so that potential anomaly patterns might be detected) see also ([0036] and [0038], masking an associated event that is a part of a larger specific event wherein the associated event can be interpreted to be an attribute); based on the masked log and a trained machine learning model, generating possible values of the masked known value ([0031], trained machine model stores past logs that represent known values – these past logs are previously converted into “known” anomaly patterns to be used for anomaly detection see [0037]), wherein the trained machine learning model is based on a plurality of other masked logs of events ([0038], the process of generating these anomaly patterns based on past logs includes a masking step which aligns the events into a potential anomaly pattern); and determining that the event is an anomalous event by comparing for the known value of the masked known value to a threshold ([0087]-[0088], calculating a similarity degree between known event patterns and current pattern to determine whether it is normal, suspicious or anomalous – as stated before, these patterns include a masking step).
Sakamoto does not explicitly teach a distribution of probabilities for possible values of the masked known value; and determining that the event is an anomalous event by comparing a probability, from the distribution of probabilities, for the known value of the masked known value to a threshold. Tsou teaches a distribution of probabilities for possible values of the masked known value ([0096], distribution of probability for the outcome of sample data); and determining that the event is an anomalous event by comparing a probability, from the distribution of probabilities, for the known value of the masked known value to a threshold ([0096], comparing probability to a probability threshold for classification as anomaly).
At the time of filing, it would have been obvious to one of ordinary skill the art to combine Sakamoto with the teachings of Tsou, a distribution of probabilities for possible values of the masked known value determining that the event is an anomalous event by comparing a probability, from the distribution of probabilities, for the known value of the masked known value to a threshold, to use effective and well known statistical models to detect anomalies in event data.
As per claim 17, the combination of Sakamoto and Tsou teaches the method of claim 16, further comprising, in response to determining that the event is an anomalous event, at least one of: generating an alert; or automatically performing a remedial action (Tsou; [0063], triggering an alert or other action based on anomaly detection).
As per claim 18, the combination of Sakamoto and Tsou teaches the method of claim 16, further comprising training the trained machine learning model, wherein training of the trained machine learning model comprises: generating the plurality of other masked logs of events from a plurality of logs of other events by masking a value in each log, the values masked in at least a subset of the plurality of other masked logs corresponding to said one of the plurality of attributes (Sakamoto; [0052], transforming the event(s) which are made up of content data by applying a mask to them – the mask is used to align the events so that potential anomaly patterns might be detected); generating, for each of the other masked logs, a distribution of probabilities for possible values of the masked value by inputting the plurality of other masked logs of events into a machine learning model (Tsou; [0096], generating an anomaly detection model by training with past training/sample data from past anomaly and normal events – these values could be masked by combining with the teachings of Sakamoto); and updating the machine learning model based on the distributions of probabilities and corresponding known values of the masked values from the plurality of logs of other events (Tsou; [0096], new normal or anomaly discovered can be kept and used to train the model).
As per claim 21, the combination of Sakamoto and Tsou teaches the method of claim 16, wherein the value masked in the received log and the values masked in each log of the plurality of other masked logs all correspond to a same attribute of the event (Sakamoto; [0036], masking rule is applied to a specific event, ex. e-mail, PC operation or website action with an specific event, with smaller associated events that make up the specific events which can be interpreted to be an attribute see [0038]).
As per claim 23, the combination of Sakamoto and Tsou teaches the method of claim 16, wherein the machine learning model additionally outputs data identifying one or more attributes corresponding to one or more values in the masked log that contributed to the determination of the probability for the known value of the masked known value, in the distribution of probabilities, of the known value of the masked known value (Sakamoto; [0025], outputting anomaly detection requests including collation event data with past logs of event and associated events – wherein event data is masked see [0038]).
As per claim 27, the combination of Sakamoto and Tsou teaches the method of claim 26, further comprising identifying, based on the weights, one or more values in the masked log that contributed to the determination (Tsou; Abstract, determining a weighting value for data to make a data classification including an anomaly pattern see [0055] and [0090]) with (Sakamoto; [0038], wherein the data is masked before classification) motivated to bring data into alignment if necessary, so that patterns become more readily detected.
As per claim 29, the substance of the claimed invention is identical or substantially similar to that of claim 16. Accordingly, the claim is rejected under the same rationale.
As per claim 30, the substance of the claimed invention is identical or substantially similar to that of claim 17. Accordingly, the claim is rejected under the same rationale.
As per claim 31, the substance of the claimed invention is identical or substantially similar to that of claim 18. Accordingly, the claim is rejected under the same rationale.
As per claim 32, the substance of the claimed invention is identical or substantially similar to that of claim 16. Accordingly, the claim is rejected under the same rationale.
As per claim 33, the substance of the claimed invention is identical or substantially similar to that of claim 17. Accordingly, the claim is rejected under the same rationale.
As per claim 34, the substance of the claimed invention is identical or substantially similar to that of claim 18. Accordingly, the claim is rejected under the same rationale.
Claim 19 is rejected under 35 U.S.C. 103 as being unpatentable over Sakamoto and Tsou in further view of Deng et al. (WO-2021139235-A1) [hereinafter “Deng”].
As per claim 19, the combination of Sakamoto and Tsou teaches the method of claim 18, as well as, masked values for event data (Sakamoto; [0038], wherein the data is masked before classification)
The combination of Sakamoto and Tsou does not explicitly teach using, for each of the plurality of logs of other events, a probability of the known value of a value of event data from the distribution of probabilities as a cross-entropy loss. Deng teaches using, for each of the plurality of logs of other events, a probability of the known value of a value of event data from the distribution of probabilities as a cross-entropy loss (Page 12, para. 5, calculating the cross-entropy loss for the probability distribution for level values of marked and unmarked logs stored in training model see Page 2, para. 7).
At the time of filing, it would have been obvious to one of ordinary skill the art to combine Sakamoto and Tsou with the teachings of Deng, using, for each of the plurality of logs of other events, a probability of the known value of a value of event data from the distribution of probabilities as a cross-entropy loss, to use effective and well known statistical models to detect anomalies in event data.
Claim 20 is rejected under 35 U.S.C. 103 as being unpatentable over Sakamoto and Tsou in further view of Zhang et al. (WO-2023136812-A1) [hereinafter “Zhang”].
As per claim 20, the combination of Sakamoto and Tsou teaches the method of claim 18.
The combination of Sakamoto and Tsou does not explicitly teach randomly selecting a value in the log; and generating a masked log by masking the selected value. Zhang teaches randomly selecting a value in the log ([0062], randomly selecting and masking a set of features from collected data by randomly choosing a mask for the features, , i.e. which features are masked will be random) with ([0044], collecting time-series data from network sensors, i.e. events); and generating a masked log by masking the selected value ([0062], features are masked using a randomly selected mask, i.e. which features are masked will be random).
At the time of filing, it would have been obvious to one of ordinary skill the art to combine Sakamoto and Tsou with the teachings of Zhang, randomly selecting a value in the log; and generating a masked log by masking the selected value, to provide entropy into the anomaly detection process that can prevent circumvention.
Claim 22 is rejected under 35 U.S.C. 103 as being unpatentable over Sakamoto and Tsou in further view of Akhtar (US PGPUB No. 2023/0344842).
As per claim 22, the combination of Sakamoto and Tsou teaches the method of claim 16, and masked values, see rejection of claim 16.
The combination of Sakamoto and Tsou does not explicitly teach wherein the attribute corresponding to the value is the internet service provider (ISP) of the event. Akhtar teaches wherein the attribute corresponding to the value is the internet service provider (ISP) of the event ([0019], tracking features of packet events for anomalies wherein the tracking is done in two stages and includes tracking the origin user and ISP of a packet see [0020]).
At the time of filing, it would have been obvious to one of ordinary skill the art to combine Sakamoto and Tsou with the teachings of Akhtar, wherein the attribute corresponding to the value is the internet service provider (ISP) of the event, to track all relevant information of an event that may be used to help predict an anomaly.
Claim 24 is rejected under 35 U.S.C. 103 as being unpatentable over Sakamoto and Tsou in further view of Shehri et al. (US PGPUB No. 2021/0041347) [hereinafter “Shehir”].
As per claim 24, the combination of Sakamoto and Tsou teaches the method of claim 23.
The combination of Sakamoto and Tsou does not explicitly teach wherein the method further comprises: disregarding any anomalous events determined based on contributions from values corresponding to one or more predefined attributes. Shehri teaches wherein the method further comprises: disregarding any anomalous events determined based on contributions from values corresponding to one or more predefined attributes ([0075], specific factors or conditions of an event that are known to lead to false positives).
At the time of filing, it would have been obvious to one of ordinary skill the art to combine Sakamoto and Tsou with the teachings of Shehri, wherein the method further comprises: disregarding any anomalous events determined based on contributions from values corresponding to one or more predefined attributes, to reduce the inaccuracies associated with false positives that originate from known attributes of an event.
Claim 25 is rejected under 35 U.S.C. 103 as being unpatentable over Sakamoto and Tsou in further view of Gunasekara et al. (US PGPUB No. 2023/0108863) [hereinafter “Gunasekara”].
As per claim 25, the combination of Sakamoto and Tsou teaches method of claim 16.
The combination of Sakamoto and Tsou does not explicitly teach wherein the machine learning model comprises two linear layers with a hyperbolic tangent activation function between them and an embeddings layer as a first hidden layer of the model. Gunasekara teaches wherein the machine learning model comprises two linear layers ([0035], multiple hidden layers can comprise the neural network model wherein each comprises a function which can include rectilinear functions) with a hyperbolic tangent activation function between them ([0035], interposing a hidden layer including a hyperbolic tangent activation function) and an embeddings layer as a first hidden layer of the model ([0035], including a word-embedding layer in one of the hidden layers).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Sakamoto and Tsou with the teachings of Gunasekara, wherein the machine learning model comprises two linear layers with a hyperbolic tangent activation function between them and an embeddings layer as a first hidden layer of the model, to use advanced neural network functionality to identify anomalies from attributes of event data.
Claim 26 is rejected under 35 U.S.C. 103 as being unpatentable over Sakamoto, Tsou and Gunasekara in further view of Geng et al. (US PGPUB No. 2021/0248375) [hereinafter “Geng”].
As per claim 26, the combination of Sakamoto, Tsou and Gunasekara teaches the method of claim 25.
The combination of Sakamoto, Tsou and Gunasekara does not explicitly teach wherein the embeddings layer outputs a plurality of attribute vectors and the model is further arranged to use a query vector to compute weights for the attribute vectors and apply the weights in a weighted sum of the attribute vectors that flows as input into a first of the linear layers. Geng teaches wherein the embeddings layer outputs a plurality of attribute vectors and the model is further arranged to use a query vector to compute weights for the attribute vectors ([0041], determining and using weights of feature vectors based on a query) and apply the weights in a weighted sum of the attribute vectors that flows as input into a first of the linear layers ([0041], calculating a weighted sum to be used as input to one or more layers in a neural network).
At the time of filing, it would have been obvious to one of ordinary skill in the art to combine Sakamoto, Tsou and Gunasekara with the teachings Geng, wherein the embeddings layer outputs a plurality of attribute vectors and the model is further arranged to use a query vector to compute weights for the attribute vectors and apply the weights in a weighted sum of the attribute vectors that flows as input into a first of the linear layers, to use advanced neural network functionality to identify anomalies from attributes of event data.
Claims 28 and 35 are rejected under 35 U.S.C. 103 as being unpatentable over Sakamoto and Tsou in further view of Upadhyay et al. (US PGPUB No. 2023/0063601) [hereinafter “Upadhyay”].
As per claim 28, the combination of Sakamoto and Tsou teaches the method according to claim 16.
The combination of Sakamoto and Tsou does not explicitly teach periodically updating the threshold based on a number of detected anomalous events in a preceding time period. Upadhyay teaches periodically updating the threshold based on a number of detected anomalous events in a preceding time period ([0065], using detected anomaly events from other vehicles, repair shops, etc. to update anomaly thresholds).
At the time of filing, it would have been obvious to one of ordinary skill the art to combine Sakamoto and Tsou with the teachings of Upadhyay, wherein the method further comprises: disregarding any anomalous events determined based on contributions from values corresponding to one or more predefined attributes, to reduce the inaccuracies associated with false positives that originate from known attributes of an event.
As per claim 35, the substance of the claimed invention is identical or substantially similar to that of claim 28. Accordingly, the claim is rejected under the same rationale.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Pendar et al. (US PGPUB No. 2019/0087737), Donner et al. (US PGPUB No. 2019/0114390), Herman Safar et al. (US PGPUB No. 2020/0042703), Sarpatwar et al. (US PGPUB No. 2021/0092137), Tsou et al. (WO-2018004580-A1), Deng et al. ("Anomaly Detection Algorithm for Multivariate Complex Data Based on Deep Neural Network," 2025 4th International Conference on Artificial Intelligence, Internet and Digital Economy (ICAID), Guangzhou, China, 2025, pp. 229-232, doi: 10.1109/ICAID65275.2025.11034428), Kiziloren et al. ("Anomaly Detection with Self-Organizing Maps and Effects of Principal Component Analysis on Feature Vectors," 2009 Fifth International Conference on Natural Computation, Tianjian, China, 2009, pp. 509-513, doi: 10.1109/ICNC.2009.652), Li et al. ("Energy-Efficient Anomaly Detection With Primary and Secondary Attributes in Edge-Cloud Collaboration Networks," in IEEE Internet of Things Journal, vol. 8, no. 15, pp. 12176-12188, 1 Aug.1, 2021, doi: 10.1109/JIOT.2021.3062420) and Casas et al. ("Detecting and diagnosing anomalies in cellular networks using Random Neural Networks," 2016 International Wireless Communications and Mobile Computing Conference (IWCMC), Paphos, Cyprus, 2016, pp. 351-356, doi: 10.1109/IWCMC.2016.7577083) all disclose various aspects of the claimed invention including anomaly detection using distribution probabilities and weighted neural network models.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PETER C SHAW whose telephone number is (571)270-7179. The examiner can normally be reached Max Flex.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PETER C SHAW/Primary Examiner, Art Unit 2493 May 25, 2026
Prosecution Insights