DETAILED ACTION
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This Office Action is in response to the communication filed on 06/03/2026.
Claims 1, 10, 13, 14, and 19 have been amended.
Claims 2-3 and 15-18 have been canceled.
Claims 1, 4-14 and 19 are pending for consideration.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Applicant’s claim for the benefit of a prior-filed application under 35 U.S.C. 119(e) or under 35 U.S.C. 120, 121, 365(c), or 386(c) is acknowledged. Applicant has not complied with one or more conditions for receiving the benefit of an earlier filing date under 35 U.S.C. 119(e) as follows:
The later-filed application must be an application for a patent for an invention which is also disclosed in the prior application (the parent or original nonprovisional application or provisional application). The disclosure of the invention in the parent application and in the later-filed application must be sufficient to comply with the requirements of 35 U.S.C. 112(a) or the first paragraph of pre-AIA 35 U.S.C. 112, except for the best mode requirement. See Transco Products, Inc. v. Performance Contracting, Inc., 38 F.3d 551, 32 USPQ2d 1077 (Fed. Cir. 1994).
The disclosure of the prior-filed application, Application No. 63/547,165, fails to provide adequate support or enablement in the manner provided by 35 U.S.C. 112(a) or pre-AIA 35 U.S.C. 112, first paragraph for one or more claims of this application. The provisional application does not adequately disclose/support the subject matter of claim 19 which includes the following limitations:
A computer-implemented method for synthetically testing a website, comprising: clustering, by a computer processor, sessions in a database to form a group of clusters, such that each subset of sessions belonging to a cluster is similar to other sessions in the same cluster; for each cluster in the group of clusters, creating, by the computer processor, synthetic test data for the subset of session data in a cluster; for each cluster in the group of clusters, generating, by the computer processor, a textual description for the synthetic test data in a cluster; selecting, by a user interface, one or more clusters from the group of clusters based on the corresponding textual descriptions for each of the clusters in the group of clusters and combining, by the computer processor, synthetic test data for each of the one or more selected clusters. Accordingly, claim 19 is not entitled to the benefit of the prior application.
Response to Arguments
Applicant’s arguments with respect to claims 1, 4-14 and 19 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 4 and 5 are rejected under 35 U.S.C. 103 as being unpatentable over Zhang et al. ("Robust Log-Based Anomaly Detection on Unstable Log Data")(hereinafter Zhang) in view of Bulut et al. (U.S. 2024/0427879)(hereinafter Bulut).
Regarding claim 1, Zhang teaches A computer-implemented method for semantically analyzing session data captured in a distributed computing system, comprising: receiving, by a computer processor, session data from a session occurring in the distributed computing system (Zhang: see Page 809 Section 2.1, "The log event is comprised of fixed text strings and is a template of a log message. A log event is acquired from a log message through log parsing"); generating, by the computer processor, a textual description for the session data, where the vector embedding represents the semantics of the session data (Zhang: see Page 811 Section 3.2.1, "To capture the semantics of log events, LogRobust treats a log event E as a sentence in natural language, denoted as S = [t1,t2,...tN ], where ti,i ∈ [1,N] represents the i-th token and N is the length of the log-event sentence”); and generating, by the computer processor, a vector embedding from the textual description (Zhang: see Page 811 Section 3.2.2, "After pre-processing, LogRobust transforms each log-event sentence S into a semantic vector V").
However, Zhang does not teach the textual description is generated by prompting the large language model to summarize events in the session data; a text embedding model that differs from the large language model; and storing, by the computer processor, the vector embedding, along with a reference to the session data, in a database.
Nevertheless, Bulut-which is in the same field of endeavor- teaches the textual description is generated by prompting the large language model to summarize events in the session data (Bulut: see Page 3 paragraph 0032, "The security embedding generation engine 194 uses a security embedding generation LLM to generate the embedding 195 for the search query. The security embedding generation LLM has been trained to combine the language of security data, such as the language found in security logs and alerts, with natural language text"); a text embedding model that differs from the large language model (Bulut: see Page 8 paragraph 0079, "The encoder transformer 300 includes input embeddings 306 of an input sequence and positional embeddings 308 that represent an order of the tokens in the input sequence. A tokenizer is used to transform the input sequence (e.g., from natural language text or from a security log) into a sequence of tokens which are encoded into the input embeddings 306"; Page 10 paragraph 0098, "In some embodiments, given a user query (e.g., for identifying a cyber incident or threat), a data security system generates vector representations (or embeddings) for the user's query and associated logs lines within security data"); and storing, by the computer processor, the vector embedding, along with a reference to the session data, in a database (Bulut: see Page 4 paragraph 0042, "The security specific dataset 102 includes data related to security logs, alerts, events, incidents, threat intelligence information and other security related data. The security specific dataset 102 is stored in a datastore or a data storage layer").
Zhang and Bulut are analogous art because they are from the same field of endeavor. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to utilize Zhang’s method for transforming log data/events with Bulut’s method for transforming log data into natural language and vector embeddings. The suggestion/motivation for doing so would be to improve similarity-based searching, semantic analysis, and classification of events.
Regarding claim 4, Zhang teaches collecting backend data from host computers in the distributed computing system (Zhang: see Page 809 Section 2.1, Logs, which contain abundant information (e.g., events, parameters, execution details, etc.) about the running status of a software intensive system, play a crucial role in the maintenance of online service systems") and generating the textual description using the session data and the backend data (Zhang: see Page 811 Section 3.2.1, "To capture the semantics of log events, LogRobust treats a log event E as a sentence in natural language, denoted as S = [t1,t2,...tN ], where ti,i ∈ [1,N] represents the i-th token and N is the length of the log-event sentence").
Regarding claim 5, Zhang teaches collecting session data and backend data from computer hosts in the distributed computing system during the performance of the session (Zhang: see Page 809 Section 2.1,Each log message consists of a constant part (log event) and a variable part (log parameter). The log parameter records some system attributes (e.g., URL, file name or IP address, etc.). The log event is comprised of fixed text strings and is a template of a log message. A log event is acquired from a log message through log parsing. A log sequence consists of a sequence of log events which records an execution flow of a specific task. Log events from the same log sequence share the same task ID, which can be used to link the events chronologically. Figure 1b shows an example of log sequence with the task ID blk 7503483334202473044"); and generating the textual description considering session data and backend data (Zhang: see Page 811 Section 3.2.1, "To capture the semantics of log events, LogRobust treats a log event E as a sentence in natural language, denoted as S = [t1,t2,...tN ], where ti,i ∈ [1,N] represents the i-th token and N is the length of the log-event sentence").
Claims 6-14 are rejected under 35 U.S.C. 103 as being unpatentable over Zhang and Bulut, as applied to claims 1, 4 and 5 above, and in further view of Schlerf et al. (U.S. 2024/0078269)(hereinafter Schlerf).
Regarding claim 6, Zhang and Bulut teach the invention detailed above.
However, Zhang and Bulut do not teach querying the database for session data.
Nevertheless, Schlerf-which is in the same field of endeavor- teaches querying the database for session data (Schlerf: see Page 8 paragraph 0058, “In response to receiving an indication that the user has selected the user input element, the web page curator 246 may receive data from the web page monitor 244 (e.g., web pages viewed by the user during a session) and/or the database 245 (e.g., user characteristics from a user profile or session context), provide the received data to the vector generator 243 to generate feature vectors, and provide a subset or all of the generated vectors to a machine-learned model of the models 242 to determine a predicted next web page to which the user intends to navigate”).
Zhang, Bulut and Schlerf are analogous art because they are from the same field of endeavor. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to incorporate Schlerf’s targeted query of a database of vector embeddings with Zhang and Bulut’s method for collecting and processing log event data. The suggestion/motivation for doing so would be to query stored log event data corresponding to the collected log event data and utilize the similar data to analyze related events/logs.
Regarding claim 7, Zhang, Bulut and Schlerf teach receiving, by a user interface, session data or a textual description for a target session (Schlerf: see Page 8 paragraph 0062 lines 1-3, "In the process 300, the web page prediction model 320 receives input data 310, which includes session context 311, web page vectors 312, and a user profile 313"); generating a target vector embedding from the session data or the textual description (Schlerf: see Page 8 paragraph 0062 lines 3-6, "Although not depicted, some or all of the input data 310 may be input to the vector generator 243, which may then output a feature vector that is input to the web page prediction model 320"); and querying the database using the target vector embedding (Schlerf: see Page 9 paragraph 0067 lines 4-7, "The web page curator 246 may query the database 245 for a web page that the user is likely to visit while performing the identified action, and the database 245 may return the web page 330"). Motivation to combine Zhang, Bulut, and Schlerf in the instant claim, is the same as that in claim 6.
Regarding claim 8, Zhang, Bulut, and Schlerf teach computing a similarity measure between the target vector embedding and the vector embeddings in the database (Schlerf: see Page 14 claim 12, "calculating a plurality of similarity metrics between a web address of the latest viewed web page of the web pages viewed with web addresses of a set of the web pages viewed before the latest viewed web page"); comparing the similarity measure to a threshold; and reporting vector embeddings having a similarity measure greater than the threshold (Schlerf: see Page 14 claim 12, "and identifying a subset of the generated vectors corresponding to a subset of the web page addresses having at least a threshold similarity metric with the web page address of the latest viewed web page, wherein the subset of the generated vectors is used to determine the combined vector"). Motivation to combine Zhang, Bulut, and Schlerf in the instant claim, is the same as that in claim 6.
Regarding claim 9, Zhang, Bulut, and Schlerf teach the similarity measure is further defined as a cosine similarity (Schlerf: see Page 3 paragraph 0028 lines 23-26, "For example, the model training engine 241 may automatically label a feature vector based on a similarity (e.g., cosine similarity) with a previously labeled feature vector"). Motivation to combine Zhang, Bulut, and Schlerf in the instant claim, is the same as that in claim 6.
Regarding claims 10 and 11, Zhang, Bulut, and Schlerf teach receiving, by a computer processor, new session data from a session occurring in the distributed computing system (Zhang: see Page 809 Section 2.1, "The log event is comprised of fixed text strings and is a template of a log message. A log event is acquired from a log message through log parsing");
generating, by the computer processor, a textual description for the new session data (Zhang: see Page 811 Section 3.2.1, "To capture the semantics of log events, LogRobust treats a log event E as a sentence in natural language, denoted as S = [t1,t2,...tN ], where ti,i ∈ [1,N] represents the i-th token and N is the length of the log-event sentence") using a large language model, where the textual description is generated by prompting the large language model to summarize events in the session data (Bulut: see Page 3 paragraph 0032, "The security embedding generation engine 194 uses a security embedding generation LLM to generate the embedding 195 for the search query. The security embedding generation LLM has been trained to combine the language of security data, such as the language found in security logs and alerts, with natural language text");
generating, by the computer processor, a new vector embedding from the textual description (Zhang: see Page 811 Section 3.2.2, "After pre-processing, LogRobust transforms each log-event sentence S into a semantic vector V") using a text embedding model that differs from the large language model (Bulut: see Page 8 paragraph 0079, "The encoder transformer 300 includes input embeddings 306 of an input sequence and positional embeddings 308 that represent an order of the tokens in the input sequence. A tokenizer is used to transform the input sequence (e.g., from natural language text or from a security log) into a sequence of tokens which are encoded into the input embeddings 306"; Page 10 paragraph 0098, "In some embodiments, given a user query (e.g., for identifying a cyber incident or threat), a data security system generates vector representations (or embeddings) for the user's query and associated logs lines within security data"), where the new vector embedding represents the new session data;
receiving, by a computer processor, reference session data (Schlerf: see Page 3 paragraph 0028 lines 2-9, "In some embodiments, the model training engine 241 generates a training data set using at least one of web pages viewed by users and corresponding user characteristics"), where the reference session data is indicative of a fraudulent session (Zhang, Bulut, and Schlerf do not explicitly state that the session data is indicative of a fraudulent session. However, Zhang’s system specifically detects/determines anomalous log data. Furthermore, the characterization of the session data in the present application does not appear to alter the steps as claimed. Therefore, it would have been obvious to a POSITA to characterize the session data as fraudulent/anomalous based on Zhang’s teaching) ;
generating, by the computer processor, a reference vector embedding from the reference session data (Schlerf: see Page 3 paragraph 0028 lines 2-9, "In some embodiments, the model training engine 241 generates a training data set using at least one of web pages viewed by users and corresponding user characteristics. The model training engine 241 may use feature vectors (e.g., generated by the vector generator 243) that are quantitative representations of one or more of users' previously viewed web pages (e.g., pageview histories), characteristics, or session contexts"), where the reference vector embedding represents the fraudulent session;
comparing, by the computer processor, the new vector embedding to the reference vector embedding (Schlerf: see Pages 6-7 paragraph 0050, “The vector generator 243 may select or filter a subset of feature vectors for use in generating the combined vector by using vector characteristics (e.g., similarity between vectors). In one example, the vector generator 243 may select the subset of feature vectors having at least a threshold similarity metric with one another. The vector generator 243 can calculate similarity metrics between a web page address of the latest viewed web page of an order of web pages viewed and web page addresses of pages viewed before the latest viewed web page”); and
reporting, by the computer processor, the new session data as being fraudulent in response to the new vector embedding being similar to the reference vector embedding (Schlerf: see Page 8 paragraph 0057, “In another example, the web page curator 246 can display usage statistics of the central database system 240 used to determine the recommendation: “Four other users within the past week were also looking at similar web pages. Are you trying to find a copy of your pay stub? Pay stubs can be found at the following page”). Motivation to combine Zhang, Bulut, and Schlerf in the instant claims, is the same as that in claim 6.
Regarding claim 12, Zhang, Bulut, and Schlerf teach comparing the new vector embedding to the reference vector embedding includes computing a similarity measure between the new vector embedding and the reference vector embedding (Schlerf: see Page 3 paragraph 0028 lines 23-27, "For example, the model training engine 241 may automatically label a feature vector based on a similarity (e.g., cosine similarity) with a previously labeled feature vector. The model training engine 241 may retrieve labels from pageview histories stored in the database 220 or 245") and reporting the new session data as being fraudulent in response to the similarity measure exceeding a threshold (Dong: see Col 11 lines 48-53, " If the recipient accounts 130 behaves like an attacker, (i.e. the output value of equation 506 is close to 1 or above a certain threshold), then this request 134 will be classified as fraudulent (fraudulent prediction 508), and guided through an additional authentication flow again, or in embodiments outright denied"). Motivation to combine Zhang, Bulut, and Schlerf in the instant claim, is the same as that in claim 6.
Regarding claim 13, Zhang, Bulut, and Schlerf teach querying a database using the reference vector embedding, where the database stores a plurality of vector embeddings and each of the plurality of vector embedding represent a session in the distributed computer system (Schlerf: see Page 9 paragraph 0067 lines 4-7; Page 5 paragraph 0038 lines 13-15, "A training data set may include feature vectors representing the web pages viewed by users"; Page 7 paragraph 0053 lines 1-10, "The database 245 stores data for the central database system 240 to perform predictive web page navigation. Examples of data stored in the database 245 may include training data sets used by the model training engine 241.. session context data, outputs of the one or more models 242 (e.g., predicted next web pages)..."). Motivation to combine Zhang, Bulut, and Schlerf in the instant claim, is the same as that in claim 6.
Regarding claim 14, Zhang, Bulut, and Schlerf teach querying a database using the reference vector embedding, where the database stores a plurality of vector embeddings and each of the plurality of vector embedding represent a session in the distributed computer system (Schlerf: see Page 9 paragraph 0067 lines 4-7; Page 5 paragraph 0038 lines 13-15, "A training data set may include feature vectors representing the web pages viewed by users"; Page 7 paragraph 0053 lines 1-10, "The database 245 stores data for the central database system 240 to perform predictive web page navigation. Examples of data stored in the database 245 may include training data sets used by the model training engine 241.. session context data, outputs of the one or more models 242 (e.g., predicted next web pages)..."). Motivation to combine Zhang, Bulut, and Schlerf in the instant claim, is the same as that in claim 6.
Regarding claim 14, Zhang, Bulut, and Schlerf teach querying the database further comprises: computing a similarity measure between the reference vector embedding and each of the plurality of the vector embeddings in the database; comparing the similarity measures to a threshold (Schlerf: see Page 3 paragraph 0028 lines 23-27, "For example, the model training engine 241 may automatically label a feature vector based on a similarity (e.g., cosine similarity) with a previously labeled feature vector. The model training engine 241 may retrieve labels from pageview histories stored in the database 220 or 245"; Schlerf: see Page 14 claim 12, "and identifying a subset of the generated vectors corresponding to a subset of the web page addresses having at least a threshold similarity metric with the web page address of the latest viewed web page, wherein the subset of the generated vectors is used to determine the combined vector"); and tagging select vector embeddings in the database as being fraudulent (Schlerf: see Page 7 paragraph 0053, “The database 245 stores data for the central database system 240 to perform predictive web page navigation. Examples of data stored in the database 245 may include training data sets used by the model training engine 241, web pages viewed by the user (e.g., pageview history), user characteristics (e.g., user profiles), session context data, outputs of the one or more models 242 (e.g., predicted next web pages), identified actions performed by the users, any suitable information for determining a web page to which a user should navigate, or any suitable combination thereof”), where the select vector embeddings have a similarity measure greater than the threshold (Schlerf: see Pages 6-7 paragraph 0050, “In one example, the vector generator 243 may select the subset of feature vectors having at least a threshold similarity metric with one another. The vector generator 243 can calculate similarity metrics between a web page address of the latest viewed web page of an order of web pages viewed and web page addresses of pages viewed before the latest viewed web page. The vector generator 243 can then identify a subset of the feature vectors generated using the viewed web pages, where the subset represents web page addresses having at least a threshold similarity metric with the web page address of the latest viewed web page”). Motivation to combine Zhang, Bulut, and Schlerf in the instant claim, is the same as that in claim 6.
Claim 19 is rejected under 35 U.S.C. 103 as being unpatentable over Smith et al. (U.S. 2024/0160900)(hereinafter Smith) in view of Turner et al. (U.S. 2025/0130918)(hereinafter Turner)
Regarding claim 19, Smith teaches clustering, by a computer processor, sessions in a database to form a group of clusters, such that each subset of sessions belonging to a cluster is similar to other sessions in the same cluster (Smith: see Page 7 paragraph 0114, "Based on Similarities Between the Generated Representation for Multiple Datapoints, Form Groups or Clusters of Datapoints (as suggested by 104)") ; for each cluster in the group of clusters, generating, by the computer processor, a textual description for the synthetic test data in a cluster (Smith: see Page 7 paragraphs 0125-0127, "As described, in some embodiments, the process flow generates a summary descriptor(s) for a cluster so that a human can glance at it and better understand its contents. This is useful because a human may use this descriptor or set of attributes to determine a label…One could also pass several of the documents from the cluster to a large language model (LLM) and ask it to summarize the contents into a set of keywords or to generate a possible label"); and selecting, by a user interface, one or more clusters from the group of clusters based on the corresponding textual descriptions for each of the clusters in the group of clusters (Smith: see Page 8 paragraph 0142, "When building an application (such as a trained model) in Snorkel Flow (the name given by the assignee to the product or service which includes the disclosed process of automatically generating labels for training data), a user can select a button (or other user interface element) to create a cluster view using embedding techniques applied to a dataset").
However, Smith does not teach for each cluster in the group of clusters, creating, by the computer processor, synthetic test data for the subset of session data in a cluster and combining, by the computer processor, synthetic test data for each of the one or more selected clusters.
Nevertheless, Turner -which is in the same field of endeavor – teaches for each cluster in the group of clusters, creating, by the computer processor, synthetic test data for the subset of session data in a cluster (Turner: see Page 2 paragraph 0019, " The real and/or original training datasets may further be used as input samples for generation of one or more synthetic training datasets"); and combining, by the computer processor, synthetic test data for each of the one or more selected clusters (Turner: see Pages 2-3 paragraph 0022, "Synthetic dataset may correspond to a dataset generated from the same data profile characterizing an original/real dataset to ensure that the synthetically generated dataset reflects realistic conditions (e.g., in terms of actual user behavior to existing market conditions) represented by the real dataset. Therefore, synthetically generated datasets tend to have very similar statistical and summary characteristics as the original dataset from which they were generated. For example, referring back to example 100, the original/real training dataset 116 may be fed into a synthetic data generating process/module 122 to generate a plurality of synthetic training datasets 124 (representing a large quantity of training data) which realistically represent user behaviors associated with large groups of hypothetical users").
Smith and Turner are analogous art because they are from the same field of endeavor. Before the effective filing date of the claimed invention, it would have been predictable to one of ordinary skill in the art to utilize the clustering mechanism and summary descriptors of Smith with the generation of synthetic testing data to create targeted test datasets of Turner. The suggestion/motivation for doing so would be to enable users to select human-readable descriptors prior to running test cases.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KELAH JANAE MCFARLAND-BARNES whose telephone number is (571)272-5953. The examiner can normally be reached Monday through Friday 8:00am until 4:00pm Central Time.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn D Feild can be reached at 571-272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KELAH JANAE MCFARLAND-BARNES/Examiner, Art Unit 2431
/LYNN D FEILD/Supervisory Patent Examiner, Art Unit 2431
Prosecution Insights