DETAILED ACTION
Response to Amendment
The amendment filed on 03/16/26 has been entered. Claims 1-2, 4-9, 11-12 are pending in the application.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-2, 4-9, 11-12 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. Independent claim 1 recites a system for querying large provenance graph repositories comprising: a server; a processor; and a memory storing instructions, which when executed by the processor, cause the processor to apply a graph simplification including a system directory-based abstraction, wherein the graph simplification includes an abstraction which is configured to merge object nodes including at least one of files, network sockets, and registry entries into a single subject node, apply an embedding function, and apply a subgraph prediction function, and provide a prediction as to whether a first ego-graph is a subgraph of a second ego-graph of an original provenance graph, wherein the embedding function is a learned function that utilizes an inductive graph neural network with an order embedding technique and a max-margin loss, and wherein the embedding function is: n_Gp -> Rd, that maps each ego-graph Gp(GpcG) to a d-dimensional representation z E Rd, where, GP: a k-hop ego-graph centered around node p, g: a original provenance graph, Rd: a d-dimensional real vector space, and z: a d-dimensional embedding vector corresponding to the ego-graph Gp.
The limitations of apply a graph simplification including a system directory-based abstraction, wherein the graph simplification includes an abstraction which is configured to merge object nodes including at least one of files, network sockets, and registry entries into a single subject node, apply an embedding function, and apply a subgraph prediction function, and provide a prediction as to whether a first ego-graph is a subgraph of a second ego-graph of an original provenance graph, wherein the embedding function is a learned function that utilizes an inductive graph neural network with an order embedding technique and a max-margin loss, and wherein the embedding function is: n_Gp -> Rd, that maps each ego-graph Gp(GpcG) to a d-dimensional representation z E Rd, where, GP: a k-hop ego-graph centered around node p, g: a original provenance graph, Rd: a d-dimensional real vector space, and z: a d-dimensional embedding vector corresponding to the ego-graph Gp, as drafted, are processes that, under their broadest reasonable interpretation, cover mental processes and mathematical formulas/relationships but from the recitation of implementing them on generic computer components. These additional steps are considered an abstract idea (mental process and mathematical concepts) and do not integrate the judicial exception into a practical application. The “apply a graph simplification” limitation encompasses the user judging an abstraction by judging a merging of object nodes comprising entries. Further, the “apply an embedding function and subgraph prediction function” steps as well as the wherein clauses for the embedding function are directed to mathematical formulas/relationships while the limitation “and provide” encompasses a judgement. If a claim limitation, under its broadest reasonable interpretation, covers judgments and mathematical relationships and/or formulas, then it falls within the “Mental Process” and “Mathematical Concepts” groupings of abstract ideas, respectively. Accordingly, claim 1 recites an abstract idea (Step 2A, Prong 1).
This judicial exception is not integrated into a practical application. In particular, the claim recites the additional elements of – a system for querying large provenance graph repositories comprising: a server; a processor; and a memory storing instructions, which when executed by the processor, cause the processor to apply an embedding function, and apply a subgraph prediction function, wherein the embedding function is a learned function ... with an order embedding technique and a max-margin loss, and wherein the embedding function is: n_Gp -> Rd, that maps each ego-graph Gp(GpcG) to a d-dimensional representation z E Rd, where, GP: a k-hop ego-graph centered around node p, g: a original provenance graph, Rd: a d-dimensional real vector space, and z: a d-dimensional embedding vector corresponding to the ego-graph Gp. The system, processor, server, and memory are recited at a high-level of generality (i.e., as generic computer devices performing generic computer functions) and do not meaningfully limit the claim. The claim does not include any further additional elements. Further, these limitations are recited as being performed using generic computing components at a high level of generality. That is, the limitation pertaining to “utilizes an inductive graph neural network”, computing components are used as a tool to perform the generic computer function of being a learned function. See MPEP 2106.05(f). In the limitation pertaining to “the embedding function”, the computer is used to perform an abstract idea, as discussed above in Step 2A, Prong One, such that it amounts to no more than mere instructions to apply the exception using a generic computer. See MPEP 2106.05(f). The judicial exception of “the embedding function” is performed utilizing “an inductive graph neural network”. The inductive graph neural network is used to generally apply the abstract idea without placing any limits on how the learned function utilizes the inductive graph neural network. The recitation of “utilizing “an inductive graph neural network” in the limitations also merely indicates a field of use or technological environment in which the judicial exception is performed. Although the additional element “utilizing “an inductive graph neural network” limits the identified judicial exception of applying the embedding function, this type of limitation merely confines the use of the abstract idea to a particular technological environment (neural networks) and thus fails to add an inventive concept to the claims. See MPEP 2106.05(h). Accordingly, these additional elements, individually and in combination, do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea (Step 2A, Prong 2).
The claims do not include any additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements represent further mental process steps. In the limitation pertaining to “the embedding function”, the computer is used to perform an abstract idea, as discussed above in Step 2A, Prong One, such that it amounts to no more than mere instructions to apply the exception using a generic computer. See MPEP 2106.05(f). The additional elements pertaining to the embedding function being a learned function that utilizes an inductive graph neural network was both found to be insignificant extra-solution activity in Step 2A, Prong Two. The additional elements merely recite generic computing devices performing generic computing functions which are not further limiting, and thus, do not cause the claim to amount to significantly more than the judicial exception. (Step 2B). Accordingly, claims 1 is not patent eligible.
Claims 2, 4 depend on claim 1 and include all the limitations of these claims. Therefore, these claims are directed to the same abstract idea and the analysis must proceed to (Step 2A, Prong 2).
Claim 2 recites additional limitations pertaining to the server receiving kernel logs. These additional limitations do not integrate the abstract idea into a practical application and merely represent insignificant extra-solution activities to the judicial exception and are mere data gathering steps. Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements represent well-understood, routine, conventional activity previously known to the industry. That is, these limitations represent well-understood, routine, conventional activity in the fields of data processing and/or data storage and retrieval and are merely directed to the well-understood, routine, conventional activity of storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015) and receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information). Therefore, these additional elements do not cause the claim to amount to significantly more than the judicial exception.
Claim 4 recites additional limitations pertaining to the subgraph prediction function. This judicial exception is not integrated into a practical application. The additional elements represent further mathematical relationships/formulas. If a claim limitation, under its broadest reasonable interpretation, covers mathematical relationships/formulas but for the recitation of generic computer components, then it falls within the “Mathematical Concepts” grouping of abstract ideas. This additional step is considered an abstract idea and does not integrate the judicial exception into a practical application.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements represent further mathematical concepts. Therefore, these additional limitations are not sufficient to amount to significantly more than the judicial exception. Claim 4 is not patent eligible.
Response to Arguments
The following is in response to the amendment filed on 03/16/26.
Applicant’s arguments have been carefully and respectfully considered but are not persuasive.
Regarding 35 USC 101, on pgs. 7-8, applicant argues that the claims recite significantly more than the judicial exception and that the claims present an improvement to the functioning of the computer.
In response to the preceding argument, examiner respectfully submits that the citations from the applicant’s specification include subject matter that is not reflected in the claims. Further, “it is important to keep in mind that an improvement in the abstract idea itself (e.g. a recited fundamental economic concept) is not an improvement in technology. For example, in Trading Technologies Int’l v. IBG, 921 F.3d 1084, 1093-94, 2019 USPQ2d 138290 (Fed. Cir. 2019), the court determined that the claimed user interface simply provided a trader with more information to facilitate market trades, which improved the business process of market trading but did not improve computers or technology” (MPEP 2106.05(a)).
Regarding 35 USC 101, on pg. 8, applicant argues that claim 1 recites sufficient structure such that the claim is not directed to a mental process or mathematical relationships, and that, the claim recites the “apply a graph simplification” limitations.
In response to the preceding argument, examiner respectfully submits that the amended limitation in claim 1 recites applying a graph simplification without including limitations defining the graph itself or it’s data structure/storage. Therefore, this limitation encompasses the user judging an abstraction by judging a merging of object nodes comprising entries.
Pertinent Prior Art
The following prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
Kapoor discloses PROV-GEM: automated provenance analysis framework using graph embeddings;
Yang discloses PROGRAPHER}: An anomaly detection system based on provenance graph embedding;
Han discloses Unicorn: Runtime provenance-based detector for advanced persistent threats.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WILLIAM P BARTLETT whose telephone number is (469)295-9085. The examiner can normally be reached on M-Th 11:30-8:30, F 11-3.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sherief Badawi can be reached on 571-272-9782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/WILLIAM P BARTLETT/Primary Examiner, Art Unit 2169
Prosecution Insights