DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claims 3, 5, 7-10, 17, and 19 are objected to because of the following informalities:
Claims 3 and 9: Spell out the acronym “AI.”
Claims 5, 7, 8, and 10: Spell out the acronym “VM.”
Claim 17: Change to “…mapping of correlated anomalies with system components, and causing of the plurality of diagnostics…”
Claim 19: Change to “…generating, using the summary system, the prompt
Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-14 and 16-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter.
With regards to Claims 1 and 16, the claimed systems have been read in view of Applicant’s specification (see ¶ 0068). The claimed systems appear to include elements which could be interpreted as including only software. For example, in Claim 1, the claimed automated incident investigation system and the claimed results consolidation system both execute computer executable instructions, indicating that these systems are merely software per se. Claim 16 recites similar language associated with its claimed systems.
Software is not one of the four categories of invention; therefore, these claims are not statutory. Software is not a series of steps or acts and thus is not a process. Software is not a physical article or object and as such is not a machine or manufacture. Software is not a combination of substances and therefore not a composition of matter.
Claims 2-14 and 17-20 depend upon Claims 1 and 16, respectively. Claims 2-14 and 17-20 add nothing further to indicate anything other than mere software per se.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to (an) abstract idea(s) without significantly more.
Claims 1 and 15 recite:
wherein the investigation orchestration system executes computer executable instructions that cause the investigation orchestration system to perform first operations comprising:
receiving, using the incident data collection system, a plurality of incident data collected from a detection and monitoring platform;
identifying, using the anomaly detection system, one or more anomalies associated with one or more incident data among the plurality of incident data;
identifying, using the correlation system, which of the one or more anomalies are correlated with respect to a time at which an incident that is flagged for investigation occurred; and
causing, using the troubleshooting system, a plurality of diagnostics systems to identify a potential root cause for the incident, based on the identification of which of the one or more anomalies are correlated with respect to the time at which the incident occurred; and
wherein the results consolidation system executes computer executable instructions that cause the results consolidation system to perform second operations comprising:
generating, using the summary system, a first prompt based on the one or more anomalies correlated with the time at which the incident occurred, corresponding incident data among the one or more incident data, and the identified potential root cause for the incident;
sending, using the summary system, the first prompt as input into a large language model ("LLM") -based system to output a summary of results that consolidates information regarding the incident, one or more possible explanations for occurrence of the incident, supporting information for the one or more possible explanations based on the identified potential root cause for the incident, and potential steps to resolve the incident; and
presenting the summary of results.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
For Claim 1: No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
For Claim 15: Yes – a process.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘identifying’ limitations in # 2 and 3 above, as claimed and under broadest reasonable interpretation (BRI), are mental processes that cover performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses a person making an observation and/or an evaluation associated with data.
The ‘causing…to identify’ limitation in # 4 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses the person making an observation and/or an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘receiving’ limitation in # 1 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “receiving” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
The ‘generating’ limitation in # 5 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “generating” in the context of this claim encompasses mere data manipulation, e.g., forming a data string. See MPEP 2106.05(g).
The ‘sending…to output’ limitation in # 6 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “outputting” in the context of this claim encompasses mere data manipulation, e.g., outputting a data string. See MPEP 2106.05(g).
The ‘presenting’ limitation in # 7 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “presenting” in the context of this claim encompasses mere data manipulation, e.g., outputting data. See MPEP 2106.05(g).
Additionally, the claim recites the following additional elements:
an automated incident investigation system (Claims 1 and 15),
an investigation orchestration system (Claim 1),
an incident data collection system (Claims 1 and 15),
a diagnostics triggering system (Claim 1),
an anomaly detection system (Claims 1 and 15),
a correlation system (Claims 1 and 15),
a troubleshooting system (Claims 1 and 15),
a results consolidation system (Claim 1),
a platform consolidation system (Claim 1), and
a summary system (Claims 1 and 15).
These additional elements are recited at a high level of generality (i.e. as generic computer components) such that they amount to no more than components comprising mere instructions to apply an exception. Accordingly, these additional elements do not integrate the abstract idea(s) into a practical application because they do not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional elements amount to no more than components comprising mere instructions to apply an exception. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
Additionally, with regards to # 1 and 5-7 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) (using a telephone for image transmission); OIP Techs., Inc., v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network); buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) (computer receives and sends information over a network); and
iv. Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim 2 recites:
wherein the plurality of incident data includes at least one of alert data, change data, metrics data, log data, or system health data during execution of a workload,
wherein the anomaly detection system includes a corresponding at least one of an alert anomaly detection subsystem, a change anomaly detection subsystem, a metrics anomaly detection subsystem, a log anomaly detection subsystem, or a system health anomaly detection subsystem,
wherein identifying the one or more anomalies associated with the one or more incident data comprises identifying at least one of one or more alert anomalies associated with the alert data, one or more change anomalies associated with the change data, one or more metrics anomalies associated with the metrics data, one or more log anomalies associated with the log data, or one or more system health anomalies associated with the system health data, using the corresponding at least one of the alert anomaly detection subsystem, the change anomaly detection subsystem, the metrics anomaly detection subsystem, the log anomaly detection subsystem, or the system health anomaly detection subsystem.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘identifying’ limitation in # 10 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses the person making an observation and/or an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 8 above, the claimed plurality of incident data is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 9 above, the claimed anomaly detection system is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 3 recites:
wherein the workload includes one of a compute workload, a virtual machine ("VM") workload, a container orchestration environment workload, a software application workload, an AI workload, a machine learning ("ML") workload, a system operation workload, a memory access and operation workload, a database access and operation workload, a data transfer workload, or a service bus workload.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 2 are the same as the abstract idea(s) of dependent Claim 3.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 11 above, the claimed workload is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 4 recites:
wherein the alert data corresponds to data that is collected by the detection and monitoring platform when a parameter value being monitored exceeds one of a set threshold value, a set threshold percentage, a set multiple of standard deviations for the parameter value, or a deviation from an observed pattern,
wherein the parameter value corresponds to one of an amount of compute resources used, a percentage of compute resource used, an amount of memory resources used, a percentage of memory resource used, an amount of storage resources used, a percentage of storage resource used, a number of failures, a percentage of failures, a number of successful operations, or a percentage of successful operations.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 2 are the same as the abstract idea(s) of dependent Claim 4.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 12 above, the claimed alert data is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 13 above, the claimed parameter value is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 5 recites:
wherein the change data corresponds to data that is collected by the detection and monitoring platform when an incident occurs within a threshold period following one of a configuration change, a certificate change, a permissions change, a pathname change, an identifier ("ID") change, a location change, a patch installation, a hardware update, a firmware update, or a software update for a corresponding one of a compute resource, a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 2 are the same as the abstract idea(s) of dependent Claim 5.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 14 above, the claimed change data is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 6 recites:
wherein the metrics data corresponds to data that is collected by the detection and monitoring platform when time-series metrics values being monitored exceed one of a set threshold value, a set threshold percentage, a set multiple of standard deviations for the time-series metrics values, a sudden spike in observed metrics values, a sudden drop in observed metrics values, or a deviation from an observed pattern in the time-series metrics values,
wherein the time-series metrics values correspond to metrics related to one of an amount of compute resources used, a percentage of compute resource used, an amount of memory resources used, a percentage of memory resource used, an amount of storage resources used, a percentage of storage resource used, a number of failures, a percentage of failures, a number of successful operations, or a percentage of successful operations.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 2 are the same as the abstract idea(s) of dependent Claim 6.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 15 above, the claimed metrics data is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 16 above, the claimed time-series metrics values are further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 7 recites:
wherein the log data corresponds to data that is collected by the detection and monitoring platform when a new pattern in a log for one of a compute resource, a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component is observed, and
a sentiment analysis on the new pattern indicates a potential issue with the new pattern.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘analysis’ limitation in # 18 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “analyzing” in the context of this claim encompasses the person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 17 above, the claimed log data is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 8 recites:
wherein the system health data corresponds to data that is collected by the detection and monitoring platform when a health signal value being monitored for one of a compute resource, a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component either falls below a threshold health level or deviates from a determined normal range of operating parameter values.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 2 are the same as the abstract idea(s) of dependent Claim 8.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 19 above, the claimed system health data is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 9 recites:
wherein the detection and monitoring platform includes at least one of alert monitoring systems, service level indicator or service level objective monitoring systems, system health monitoring systems, an AI-based interactive assistant system, a resource monitoring system, an applications monitoring system, or an input system for manual triggering of incident investigation.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 1 are the same as the abstract idea(s) of dependent Claim 9.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 20 above, the claimed detection and monitoring platform is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 10 recites:
wherein the diagnostics triggering system further includes a mapping system, wherein the first operations further comprise:
mapping, using the mapping system, each of the one or more anomalies that is correlated with respect to the time at which the incident occurred with at least one system component,
wherein the at least one system component includes at least one of a compute resource, a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component;
wherein causing the plurality of diagnostics systems to identify the potential root cause for the incident is further based on the mapping of the one or more anomalies.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘mapping’ limitation in # 21 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “mapping” in the context of this claim encompasses the person making an evaluation associated with data.
The ‘causing…to identify’ limitation in # 23 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses the person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 22 above, the claimed at least one system component is further described in the context of a mere field of use. See MPEP 2106.05(h).
Additionally, the claim recites the following additional element:
a mapping system.
This additional element is recited at a high level of generality (i.e. as a generic computer component) such that it amounts to no more than a component comprising mere instructions to apply an exception. Accordingly, this additional element does not integrate the abstract idea(s) into a practical application because it does not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional element amounts to no more than a component comprising mere instructions to apply an exception. Mere instructions to apply an exception using one or more generic computer components cannot provide an inventive concept.
Claim 11 recites:
wherein the first operations further comprise: repeating the following operations for a set number of iterations, until no additional anomalies are identified as being correlated with respect to the time the incident occurred, or until potential root causes that are identified converge:
identifying, using the anomaly detection system, one or more additional anomalies based on the potential root causes initially identified by the plurality of diagnostics systems or based on potential root causes identified in a preceding iteration;
identifying, using the correlation system, which of the one or more additional anomalies are correlated with respect to the time at which the incident occurred; and
causing, using the troubleshooting system, the plurality of diagnostics systems to identify additional potential root causes for the incident, based at least on the one or more additional anomalies that are identified to correlate with the time at which the incident occurred.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘identifying’ limitations in # 24 and 25 above, as claimed and under BRI, are mental processes that cover performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses a person making an observation and/or an evaluation associated with data.
The ‘causing…to identify’ limitation in # 26 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses the person making an observation and/or an evaluation associated with data.
Claim 12 recites:
wherein the platform consolidation system further comprises an anomaly enrichment system,
wherein the anomaly enrichment system compiles enrichment data associated with at least one of a period during which the incident occurred, a transaction pattern that is correlated with the period during which the incident occurred, a trace pattern that is correlated with the period during which the incident occurred, an exception that triggered in the period during which the incident occurred, a geographic region or region covered by a data center from which incident occurred, or a difference pattern corresponding to a difference between a pattern occurring before the incident occurred and a pattern occurring after the incident occurred,
wherein the first prompt is further based on the enrichment data compiled by the anomaly enrichment system.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 1 are the same as the abstract idea(s) of dependent Claim 12.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘compiles’ limitation in # 27 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “compiling” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
In # 28 above, the claimed first prompt is further described in the context of a mere field of use. See MPEP 2106.05(h).
Additionally, the claim recites the following additional element:
an anomaly enrichment system.
This additional element is recited at a high level of generality (i.e. as a generic computer component) such that it amounts to no more than a component comprising mere instructions to apply an exception. Accordingly, this additional element does not integrate the abstract idea(s) into a practical application because it does not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional element amounts to no more than a component comprising mere instructions to apply an exception. Mere instructions to apply an exception using one or more generic computer components cannot provide an inventive concept.
Additionally, with regards to # 27 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
iv. Storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015); OIP Techs., 788 F.3d at 1363, 115 USPQ2d at 1092-93.
Claim 13 recites:
wherein the platform consolidation system further comprises a group ranking system,
wherein the potential root cause for the incident includes multiple potential root causes,
wherein the group ranking system performs analysis on the multiple potential root causes and
assigns rankings to the multiple potential root causes,
wherein the first prompt is further based on the rankings of the multiple potential root causes.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘performs analysis’ limitation in # 30 above, as claimed and under BRI, is a mental processes that cover performance of the limitation in the mind. For example, “analyzing” in the context of this claim encompasses a person making an evaluation associated with data.
The ‘assigns’ limitation in # 31 above, as claimed and under BRI, is a mental processes that cover performance of the limitation in the mind. For example, “assigning” in the context of this claim encompasses a person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
In # 29 above, the claimed potential root cause is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 32 above, the claimed first prompt is further described in the context of a mere field of use. See MPEP 2106.05(h).
Claim 14 recites:
generating a second prompt based on the potential steps to resolve the incident,
sending the second prompt as input into the LLM-based system to output first instructions for an automated anomaly resolution system to implement a resolution process, and
sending the first instructions to the automated anomaly resolution system;
generating a third prompt based on the potential steps to resolve the incident,
sending the third prompt as input into the LLM-based system to output second instructions for one or more systems affected by the incident to implement a resolution process, and
sending the second instructions to the one or more systems; or
generating a fourth prompt based on the potential steps to resolve the incident,
sending the fourth prompt as input into the LLM-based system to output a service request for a service team to diagnose and resolve the incident, and
sending the service request to service request intake system for the service team.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 1 are the same as the abstract idea(s) of dependent Claim 14.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘generating’ limitations in # 33, 36, and 39 above, as claimed and under BRI, are additional elements that are insignificant extra-solution activity. For example, “generating” in the context of this claim encompasses mere data manipulation, e.g., forming a data string. See MPEP 2106.05(g).
The ‘sending…to output’ limitations in # 34, 37, and 40 above, as claimed and under BRI, are additional elements that are insignificant extra-solution activity. For example, “outputting” in the context of this claim encompasses mere data manipulation, e.g., outputting data. See MPEP 2106.05(g).
The ‘sending’ limitations in # 35, 38, and 41 above, as claimed and under BRI, are additional elements that are insignificant extra-solution activity. For example, “sending” in the context of this claim encompasses mere data manipulation (sending/transmitting data). See MPEP 2106.05(g).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
With regards to # 33-41 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) (using a telephone for image transmission); OIP Techs., Inc., v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network); buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) (computer receives and sends information over a network); and
iv. Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim 16 recites:
wherein the investigation orchestration system executes computer executable instructions that cause the investigation orchestration system to perform first operations comprising:
receiving, using the incident data collection system, a plurality of incident data including at least one of alert data, change data, metrics data, log data, or system health data collected from a detection and monitoring platform;
identifying, using the anomaly detection system, one or more anomalies associated with the at least one of the alert data, change data, metrics data, log data, or system health data;
identifying, using the correlation system, which of the one or more anomalies are correlated with respect to a time at which an incident that is flagged for investigation occurred; and
mapping, using the mapping system, each of the one or more anomalies that is correlated with respect to the time at which the incident occurred with at least one system component; and
causing, using the troubleshooting system, a plurality of diagnostics systems to identify a potential root cause for the incident, based on the identification of which of the one or more anomalies are correlated with respect to the time at which the incident occurred;
wherein the one or more anomalies correlated with the time at which the incident occurred, corresponding incident data among the at least one of the alert data, change data, metrics data, log data, or system health data, the at least one system component mapped with the one or more anomalies correlated with the time at which the incident occurred, and the identified potential root cause for the incident are used to generate a prompt for a large language model ("LLM") -based system
to output a summary of results that consolidates information regarding the incident, one or more possible explanations for occurrence of the incident, supporting information for the one or more possible explanations based on the identified potential root cause for the incident, and potential steps to resolve the incident.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘identifying’ limitations in # 43 and 44 above, as claimed and under BRI, are mental processes that cover performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses a person making an observation and/or an evaluation associated with data.
The ‘mapping’ limitation in # 45 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “mapping” in the context of this claim encompasses the person making an evaluation associated with data.
The ‘causing…to identify’ limitation in # 46 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “identifying” in the context of this claim encompasses the person making an observation and/or an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘receiving’ limitation in # 42 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “receiving” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
The ‘…to generate’ limitation in # 47 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “generating” in the context of this claim encompasses mere data manipulation, e.g., forming a data string. See MPEP 2106.05(g).
The ‘…to output’ limitation in # 48 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “outputting” in the context of this claim encompasses mere data manipulation, e.g., outputting data. See MPEP 2106.05(g).
Additionally, the claim recites the following additional elements:
an investigation orchestration system,
an incident data collection system,
a diagnostics triggering system,
an anomaly detection system,
a correlation system,
a mapping system, and
a troubleshooting system.
These additional elements are recited at a high level of generality (i.e. as generic computer components) such that they amount to no more than components comprising mere instructions to apply an exception. Accordingly, these additional elements do not integrate the abstract idea(s) into a practical application because they do not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional elements amount to no more than components comprising mere instructions to apply an exception. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
Additionally, with regards to # 42, 47, and 48 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
i. Receiving or transmitting data over a network, e.g., using the Internet to gather data, Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) (using a telephone for image transmission); OIP Techs., Inc., v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network); buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) (computer receives and sends information over a network); and
iv. Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim 17 recites:
iterating identification of anomalies correlated with respect to the time at which the incident occurred, mapping of correlated anomalies with system components, and causing the plurality of diagnostics systems to identify potential root causes for the incident for a set number of iterations, until no additional anomalies are identified as being correlated with respect to the time the incident occurred, or until potential root causes that are identified converge.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘iterating’ limitation in # 49 above, as claimed and under BRI, is a mental process that covers performance of the limitation in the mind. For example, “iterating” in the context of this claim encompasses the person making repetitive observations and/or evaluations associated with data.
Claim 18 merely further describes the claimed at least one system component of Claim 16 in the context of a mere field of use. See MPEP 2106.05(h).
Claim 19 recites:
a results consolidation system, comprising:
a platform consolidation system including a summary system;
wherein the results consolidation system executes computer executable instructions that cause the results consolidation system to perform second operations comprising:
generating, using the summary system, the prompt the prompt for the LLM-based system; and
presenting the summary of results.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s). The abstract idea(s) of Claim 16 are the same as the abstract idea(s) of dependent Claim 19.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘generating’ limitation in # 50 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “generating” in the context of this claim encompasses mere data manipulation, e.g., forming a data string. See MPEP 2106.05(g).
The ‘presenting’ limitation in # 51 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “presenting” in the context of this claim encompasses mere data manipulation, e.g., outputting data. See MPEP 2106.05(g).
Additionally, the claim recites the following additional elements:
a results consolidation system,
a platform consolidation system, and
a summary system.
These additional elements are recited at a high level of generality (i.e. as generic computer components) such that they amount to no more than components comprising mere instructions to apply an exception. Accordingly, these additional elements do not integrate the abstract idea(s) into a practical application because they do not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional elements amount to no more than components comprising mere instructions to apply an exception. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
Additionally, with regards to # 50 and 51 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
iv. Presenting offers and gathering statistics, OIP Techs., 788 F.3d at 1362-63, 115 USPQ2d at 1092-93.
Claim 20 recites:
wherein the platform consolidation system further comprises an anomaly enrichment system and a group ranking system,
wherein the anomaly enrichment system compiles enrichment data associated with at least one of a period during which the incident occurred, a transaction pattern that is correlated with the period during which the incident occurred, a trace pattern that is correlated with the period during which the incident occurred, an exception that triggered in the period during which the incident occurred, a geographic region or region covered by a data center from which incident occurred, or a difference pattern corresponding to a difference between a pattern occurring before the incident occurred and a pattern occurring after the incident occurred;
wherein the potential root cause for the incident includes multiple potential root causes,
wherein the group ranking system performs analysis on the multiple potential root causes and
assigns rankings to the multiple potential root causes;
wherein the prompt is further based on the enrichment data compiled by the anomaly enrichment system and based on the rankings of the multiple potential root causes.
Step 1: Is the claim to a process, machine, manufacture, or composition of matter?
No. See above.
Per the flowchart in MPEP 2106(III), the Examiner will proceed with the subject matter eligibility analysis as if this claim was amended to fall within a statutory category.
Step 2A, Prong I: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes: (an) abstract idea(s).
The ‘performs analysis’ limitation in # 54 above, as claimed and under BRI, is a mental processes that cover performance of the limitation in the mind. For example, “analyzing” in the context of this claim encompasses a person making an evaluation associated with data.
The ‘assigns’ limitation in # 55 above, as claimed and under BRI, is a mental processes that cover performance of the limitation in the mind. For example, “assigning” in the context of this claim encompasses a person making an evaluation associated with data.
Step 2A, Prong II: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No.
The ‘compiles’ limitation in # 52 above, as claimed and under BRI, is an additional element that is insignificant extra-solution activity. For example, “compiling” in the context of this claim encompasses mere data gathering. See MPEP 2106.05(g).
In # 53 above, the claimed potential root cause is further described in the context of a mere field of use. See MPEP 2106.05(h).
In # 56 above, the claimed prompt is further described in the context of a mere field of use. See MPEP 2106.05(h).
Additionally, the claim recites the following additional elements:
an anomaly enrichment system, and
a group ranking system.
These additional elements are recited at a high level of generality (i.e. as generic computer components) such that they amount to no more than components comprising mere instructions to apply an exception. Accordingly, these additional elements do not integrate the abstract idea(s) into a practical application because they do not impose any meaningful limits on practicing the abstract idea(s).
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No.
As discussed above with respect to integration of the abstract idea(s) into a practical application, the aforementioned additional elements amount to no more than components comprising mere instructions to apply an exception. Mere instructions to apply an exception using generic computer components cannot provide an inventive concept.
Additionally, with regards to # 52 above, per MPEP 2106.05(d)(Il), the courts have recognized the following computer functions as well-understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity:
iv. Storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015); OIP Techs., 788 F.3d at 1363, 115 USPQ2d at 1092-93.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-3, 9, 10, 12, 14-16, 18, and 19 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Page et al. (U.S. Patent Application Publication No. US 2025/0291670 A1), hereinafter “Page.”
With regards to Claim 1, Page teaches:
an automated incident investigation system (¶ 0125. As interpreted by the Examiner, all claimed ‘systems’ are considered to be software as part of an application program.), comprising:
an investigation orchestration system (¶ 0125.), comprising:
an incident data collection system (¶ 0125.);
a diagnostics triggering system including an anomaly detection system and a correlation system (¶ 0125.); and
a troubleshooting system (¶ 0125.); and
a results consolidation system (¶ 0125.), comprising:
a platform consolidation system including a summary system (¶ 0125.);
wherein the investigation orchestration system executes computer executable instructions that cause the investigation orchestration system to perform first operations comprising:
receiving, using the incident data collection system, a plurality of incident data collected from a detection and monitoring platform (Fig. 2 and ¶ 0050; regarding, e.g., event records.);
identifying, using the anomaly detection system, one or more anomalies associated with one or more incident data among the plurality of incident data (Fig. 2; ¶ 0053; regarding, e.g., a component failure; and ¶ 0056.);
identifying, using the correlation system, which of the one or more anomalies are correlated with respect to a time at which an incident that is flagged for investigation occurred (Fig. 2 and ¶ 0056.); and
causing, using the troubleshooting system, a plurality of diagnostics systems to identify a potential root cause for the incident, based on the identification of which of the one or more anomalies are correlated with respect to the time at which the incident occurred (Fig. 2; ¶ 0057; Fig. 1; ¶ 0035; and ¶ 0039.); and
wherein the results consolidation system executes computer executable instructions that cause the results consolidation system to perform second operations comprising:
generating, using the summary system, a first prompt based on the one or more anomalies correlated with the time at which the incident occurred, corresponding incident data among the one or more incident data, and the identified potential root cause for the incident (¶ 0011; Fig. 6; ¶ 0106; and ¶ 0109-0113.);
sending, using the summary system, the first prompt as input into a large language model ("LLM") -based system (Fig. 6 and ¶ 0109-0113.) to output a summary of results that consolidates information regarding the incident (Fig. 6 and ¶ 0112-0113.), one or more possible explanations for occurrence of the incident (Fig. 6 and ¶ 0112-0113.), supporting information for the one or more possible explanations based on the identified potential root cause for the incident (Fig. 6 and ¶ 0112-0113.), and potential steps to resolve the incident (Fig. 6 and ¶ 0112-0113; regarding, e.g., “action ‘x’ is performed.”); and
presenting the summary of results (Fig. 6 and ¶ 0112-0113; regarding, e.g., a textual explanation of a remediation action.).
With regards to Claim 2, Page teaches the system of Claim 1 as referenced above. Page further teaches:
wherein the plurality of incident data includes at least one of alert data (Fig. 1; ¶ 0027-0028; Fig. 2; and ¶ 0053.), change data (Fig. 1 and ¶ 0027-0028.), metrics data (Fig. 1 and ¶ 0031-0032; regarding, e.g., data values.), log data (Fig. 1 and ¶ 0031-0032.), or system health data (Fig. 2 and ¶ 0053.) during execution of a workload (Fig. 1 and ¶ 0027-0028.), wherein the anomaly detection system includes a corresponding at least one of an alert anomaly detection subsystem (¶ 0125.), a change anomaly detection subsystem (¶ 0125.), a metrics anomaly detection subsystem (¶ 0125.), a log anomaly detection subsystem (¶ 0125.), or a system health anomaly detection subsystem (¶ 0125.),
wherein identifying the one or more anomalies associated with the one or more incident data comprises identifying at least one of one or more alert anomalies associated with the alert data (Fig. 2; ¶ 0053; and ¶ 0056.), one or more change anomalies associated with the change data (Fig. 2; ¶ 0053; and ¶ 0056.), one or more metrics anomalies associated with the metrics data (Fig. 2; ¶ 0053; and ¶ 0056.), one or more log anomalies associated with the log data (Fig. 2; ¶ 0053; and ¶ 0056.), or one or more system health anomalies associated with the system health data (Fig. 2; ¶ 0053; and ¶ 0056.), using the corresponding at least one of the alert anomaly detection subsystem (¶ 0125.), the change anomaly detection subsystem (¶ 0125.), the metrics anomaly detection subsystem (¶ 0125.), the log anomaly detection subsystem (¶ 0125.), or the system health anomaly detection subsystem (¶ 0125.).
With regards to Claim 3, Page teaches the system of Claim 2 as referenced above. Page further teaches:
wherein the workload includes one of a compute workload (Fig. 1 and ¶ 0027-0028.), a virtual machine ("VM") workload, a container orchestration environment workload, a software application workload, an AI workload, a machine learning ("ML") workload, a system operation workload, a memory access and operation workload, a database access and operation workload, a data transfer workload, or a service bus workload.
With regards to Claim 9, Page teaches the system of Claim 1 as referenced above. Page further teaches:
wherein the detection and monitoring platform includes at least one of alert monitoring systems, service level indicator or service level objective monitoring systems, system health monitoring systems, an AI-based interactive assistant system, a resource monitoring system (Fig. 1 and ¶ 0027-0028.), an applications monitoring system, or an input system for manual triggering of incident investigation.
With regards to Claim 10, Page teaches the system of Claim 1 as referenced above. Page further teaches:
wherein the diagnostics triggering system further includes a mapping system (¶ 0125.), wherein the first operations further comprise:
mapping, using the mapping system, each of the one or more anomalies that is correlated with respect to the time at which the incident occurred with at least one system component (Fig. 2 and ¶ 0056.), wherein the at least one system component includes at least one of a compute resource (Fig. 2 and ¶ 0056.), a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component;
wherein causing the plurality of diagnostics systems to identify the potential root cause for the incident is further based on the mapping of the one or more anomalies (Fig. 2; ¶ 0056; Fig. 1; ¶ 0035; and ¶ 0039.).
With regards to Claim 12, Page teaches the system of Claim 1 as referenced above. Page further teaches:
wherein the platform consolidation system further comprises an anomaly enrichment system (¶ 0125.), wherein the anomaly enrichment system compiles enrichment data (Fig. 2 and ¶ 0056; regarding, e.g., data values and/or metadata associated with correlated events.) associated with at least one of a period during which the incident occurred (Fig. 2 and ¶ 0056.), a transaction pattern that is correlated with the period during which the incident occurred, a trace pattern that is correlated with the period during which the incident occurred, an exception that triggered in the period during which the incident occurred, a geographic region or region covered by a data center from which incident occurred, or a difference pattern corresponding to a difference between a pattern occurring before the incident occurred and a pattern occurring after the incident occurred, wherein the first prompt is further based on the enrichment data compiled by the anomaly enrichment system (Fig. 6; ¶ 0096-0098; and ¶ 0108-0109.).
With regards to Claim 14, Page teaches the system of Claim 1 as referenced above. Page further teaches:
wherein the second operations further comprise one of:
generating a second prompt based on the potential steps to resolve the incident (¶ 0011; Fig. 6; and ¶ 0112-0113.), sending the second prompt as input into the LLM-based system to output first instructions for an automated anomaly resolution system to implement a resolution process (¶ 0011; Fig. 6; and ¶ 0112-0113.), and
sending the first instructions to the automated anomaly resolution system (Fig. 6; ¶ 0112-0113; and ¶ 0125.);
generating a third prompt based on the potential steps to resolve the incident, sending the third prompt as input into the LLM-based system to output second instructions for one or more systems affected by the incident to implement a resolution process, and
sending the second instructions to the one or more systems; or
generating a fourth prompt based on the potential steps to resolve the incident, sending the fourth prompt as input into the LLM-based system to output a service request for a service team to diagnose and resolve the incident, and
sending the service request to service request intake system for the service team.
With regards to Claim 15, the system of Claim 1 performs the same steps as the method of Claim 15, and Claim 15 is therefore rejected using the same art and rationale set forth above in the rejection of Claim 1 by the teachings of Page.
With regards to Claim 16, Page teaches:
a system, comprising:
an investigation orchestration system (¶ 0125. As interpreted by the Examiner, all claimed ‘systems’ are considered to be software as part of an application program.), comprising:
an incident data collection system (¶ 0125.);
a diagnostics triggering system (¶ 0125.), comprising:
an anomaly detection system (¶ 0125.);
a correlation system (¶ 0125.); and
a mapping system (¶ 0125.); and
a troubleshooting system (¶ 0125.);
wherein the investigation orchestration system executes computer executable instructions that cause the investigation orchestration system to perform first operations comprising:
receiving, using the incident data collection system, a plurality of incident data (Fig. 2 and ¶ 0050; regarding, e.g., event records.) including at least one of alert data (Fig. 1; ¶ 0027-0028; Fig. 2; and ¶ 0053.), change data (Fig. 1 and ¶ 0027-0028.), metrics data (Fig. 1 and ¶ 0031-0032; regarding, e.g., data values.), log data (Fig. 1 and ¶ 0031-0032.), or system health data (Fig. 2 and ¶ 0053.) collected from a detection and monitoring platform (¶ 0125. As interpreted by the Examiner, the claimed ‘detection and monitoring platform’ is considered to be software as part of an application program.);
identifying, using the anomaly detection system, one or more anomalies associated with the at least one of the alert data, change data, metrics data, log data, or system health data (Fig. 2; ¶ 0053; regarding, e.g., a component failure; and ¶ 0056.);
identifying, using the correlation system, which of the one or more anomalies are correlated with respect to a time at which an incident that is flagged for investigation occurred (Fig. 2 and ¶ 0056.); and
mapping, using the mapping system, each of the one or more anomalies that is correlated with respect to the time at which the incident occurred with at least one system component (Fig. 2 and ¶ 0056.); and
causing, using the troubleshooting system, a plurality of diagnostics systems to identify a potential root cause for the incident, based on the identification of which of the one or more anomalies are correlated with respect to the time at which the incident occurred (Fig. 2; ¶ 0057; Fig. 1; ¶ 0035; and ¶ 0039.);
wherein the one or more anomalies correlated with the time at which the incident occurred, corresponding incident data among the at least one of the alert data, change data, metrics data, log data, or system health data, the at least one system component mapped with the one or more anomalies correlated with the time at which the incident occurred, and the identified potential root cause for the incident are used to generate a prompt for a large language model ("LLM") -based system (¶ 0011; Fig. 6; ¶ 0106; and ¶ 0109-0113.) to output a summary of results that consolidates information regarding the incident (Fig. 6 and ¶ 0112-0113.), one or more possible explanations for occurrence of the incident (Fig. 6 and ¶ 0112-0113.), supporting information for the one or more possible explanations based on the identified potential root cause for the incident (Fig. 6 and ¶ 0112-0113.), and potential steps to resolve the incident (Fig. 6 and ¶ 0112-0113; regarding, e.g., “action ‘x’ is performed.”).
With regards to Claim 18, Page teaches the system of Claim 16 as referenced above. Page further teaches:
wherein the at least one system component includes at least one of a compute resource (Fig. 2 and ¶ 0056.), a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component.
With regards to Claim 19, Page teaches the system of Claim 16 as referenced above. Page further teaches:
a results consolidation system (¶ 0125.), comprising:
a platform consolidation system (¶ 0125.) including a summary system (¶ 0125.);
wherein the results consolidation system executes computer executable instructions that cause the results consolidation system to perform second operations comprising:
generating, using the summary system, the prompt the prompt for the LLM-based system (¶ 0011; Fig. 6; ¶ 0106; and ¶ 0109-0113.); and
presenting the summary of results (Fig. 6 and ¶ 0112-0113; regarding, e.g., a textual explanation of a remediation action.).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Page, and further in view of Chavez, Jr. et al. (U.S. Patent No. US 7,266,734 B2), hereinafter “Chavez.”
With regards to Claim 4, Page teaches the system of Claim 2 as referenced above. Page does not explicitly teach:
wherein the alert data corresponds to data that is collected by the detection and monitoring platform when a parameter value being monitored exceeds one of a set threshold value, a set threshold percentage, a set multiple of standard deviations for the parameter value, or a deviation from an observed pattern, wherein the parameter value corresponds to one of an amount of compute resources used, a percentage of compute resource used, an amount of memory resources used, a percentage of memory resource used, an amount of storage resources used, a percentage of storage resource used, a number of failures, a percentage of failures, a number of successful operations, or a percentage of successful operations in accordance with the system of Claim 2.
However, Chavez teaches:
wherein the alert data corresponds to data that is collected by the detection and monitoring platform when a parameter value being monitored exceeds one of a set threshold value (col. 1, lines 9-16.), a set threshold percentage, a set multiple of standard deviations for the parameter value, or a deviation from an observed pattern, wherein the parameter value corresponds to one of an amount of compute resources used, a percentage of compute resource used, an amount of memory resources used, a percentage of memory resource used, an amount of storage resources used (col. 1, lines 9-16.), a percentage of storage resource used, a number of failures, a percentage of failures, a number of successful operations, or a percentage of successful operations.
Therefore, it would have been obvious before the effective filing date of the claimed invention to one of ordinary skill in the art to which said subject matter pertains to combine Page with exceeding a system condition threshold, the condition being, e.g., a buffer overflow as taught by Chavez because combining prior art elements (processing a type of event record – Page: Fig. 2 and Page: ¶ 0053; and exceeding the system condition threshold) according to known methods can be performed to yield predictable results (providing known means for detecting and processing a type of event for incident analysis – Page: Fig. 2; Page: ¶ 0053; and Page: ¶ 0056).
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over Page, and further in view of Samuni et al. (U.S. Patent No. US 9,690,645 B2), hereinafter “Samuni.”
With regards to Claim 5, Page teaches the system of Claim 2 as referenced above. Page does not explicitly teach:
wherein the change data corresponds to data that is collected by the detection and monitoring platform when an incident occurs within a threshold period following one of a configuration change, a certificate change, a permissions change, a pathname change, an identifier ("ID") change, a location change, a patch installation, a hardware update, a firmware update, or a software update for a corresponding one of a compute resource, a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component in accordance with the system of Claim 2.
However, Samuni teaches:
wherein the change data corresponds to data that is collected by the detection and monitoring platform when an incident occurs within a threshold period (Fig. 1 and col. 3, lines 10-35.) following one of a configuration change, a certificate change, a permissions change, a pathname change, an identifier ("ID") change, a location change, a patch installation, a hardware update, a firmware update, or a software update (Fig. 1 and col. 3, lines 10-35.) for a corresponding one of a compute resource, a memory resource, a storage resource, a network resource (Fig. 1 and col. 3, lines 10-35.), a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component.
Therefore, it would have been obvious before the effective filing date of the claimed invention to one of ordinary skill in the art to which said subject matter pertains to combine Page with tracking a change event within a predetermined time threshold as taught by Samuni because combining prior art elements (processing a type of event record – Page: Fig. 2 and Page: ¶ 0053; and tracking the change event) according to known methods can be performed to yield predictable results (providing known means for detecting and processing a type of event for incident analysis – Page: Fig. 2; Page: ¶ 0053; and Page: ¶ 0056).
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Page, and further in view of Iyer et al. (U.S. Patent No. US 9,323,599 B1), hereinafter “Iyer.”
With regards to Claim 6, Page teaches the system of Claim 2 as referenced above. Page does not explicitly teach:
wherein the metrics data corresponds to data that is collected by the detection and monitoring platform when time-series metrics values being monitored exceed one of a set threshold value, a set threshold percentage, a set multiple of standard deviations for the time-series metrics values, a sudden spike in observed metrics values, a sudden drop in observed metrics values, or a deviation from an observed pattern in the time-series metrics values, wherein the time-series metrics values correspond to metrics related to one of an amount of compute resources used, a percentage of compute resource used, an amount of memory resources used, a percentage of memory resource used, an amount of storage resources used, a percentage of storage resource used, a number of failures, a percentage of failures, a number of successful operations, or a percentage of successful operations in accordance with the system of Claim 2.
However, Iyer teaches:
wherein the metrics data corresponds to data that is collected by the detection and monitoring platform when time-series metrics values being monitored (Fig. 3; col. 7, lines 65-67; col. 8, lines 1-4; Fig. 8; col. 8, lines 66 and 67; and col. 9, lines 1-10.) exceed one of a set threshold value (Fig. 8; col. 8, lines 66 and 67; and col. 9, lines 1-10.), a set threshold percentage, a set multiple of standard deviations for the time-series metrics values, a sudden spike in observed metrics values, a sudden drop in observed metrics values, or a deviation from an observed pattern in the time-series metrics values, wherein the time-series metrics values correspond to metrics related to one of an amount of compute resources used (Fig. 9 and col. 9, lines 22-30.), a percentage of compute resource used, an amount of memory resources used, a percentage of memory resource used, an amount of storage resources used, a percentage of storage resource used, a number of failures, a percentage of failures, a number of successful operations, or a percentage of successful operations.
Therefore, it would have been obvious before the effective filing date of the claimed invention to one of ordinary skill in the art to which said subject matter pertains to combine Page with comparing time-series metric patterns to determine an anomaly as taught by Iyer because combining prior art elements (processing a type of event record – Page: Fig. 2 and Page: ¶ 0053; and the comparing of the time-series metric patterns) according to known methods can be performed to yield predictable results (providing known means for detecting and processing a type of event for incident analysis – Page: Fig. 2; Page: ¶ 0053; and Page: ¶ 0056).
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Page, and further in view of Ramegowda et al. (U.S. Patent No. US 11,210,158 B2), hereinafter “Ramegowda.”
With regards to Claim 7, Page teaches the system of Claim 2 as referenced above. Page does not explicitly teach:
wherein the log data corresponds to data that is collected by the detection and monitoring platform when a new pattern in a log for one of a compute resource, a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component is observed, and a sentiment analysis on the new pattern indicates a potential issue with the new pattern in accordance with the system of Claim 2.
However, Ramegowda teaches:
wherein the log data corresponds to data that is collected by the detection and monitoring platform when a new pattern in a log (Fig. 3 and col. 6, lines 29-54.) for one of a compute resource, a memory resource, a storage resource, a network resource (col. 4, lines 1-11.), a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component is observed, and a sentiment analysis on the new pattern indicates a potential issue with the new pattern (Fig. 3 and col. 6, lines 29-54.).
Therefore, it would have been obvious before the effective filing date of the claimed invention to one of ordinary skill in the art to which said subject matter pertains to combine Page with performing a sentiment analysis on log text to determine an anomaly as taught by Ramegowda because combining prior art elements (processing a type of event record – Page: Fig. 2 and Page: ¶ 0053; and the performing of the sentiment analysis) according to known methods can be performed to yield predictable results (providing known means for detecting and processing a type of event for incident analysis – Page: Fig. 2; Page: ¶ 0053; and Page: ¶ 0056).
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Page, and further in view of Xia et al. (U.S. Patent No. US 8,887,006 B2), hereinafter “Xia.”
With regards to Claim 8, Page teaches the system of Claim 2 as referenced above. Page does not explicitly teach:
wherein the system health data corresponds to data that is collected by the detection and monitoring platform when a health signal value being monitored for one of a compute resource, a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component either falls below a threshold health level or deviates from a determined normal range of operating parameter values in accordance with the system of Claim 2.
However, Xia teaches:
wherein the system health data corresponds to data that is collected by the detection and monitoring platform when a health signal value being monitored for one of a compute resource (Fig. 3 and col. 7, lines 3-27.), a memory resource, a storage resource, a network resource, a VM, an orchestrator, a hypervisor, a platform firmware, a device, a software application, a platform, or infrastructure component either falls below a threshold health level (Fig. 3 and col. 7, lines 3-27.) or deviates from a determined normal range of operating parameter values.
Therefore, it would have been obvious before the effective filing date of the claimed invention to one of ordinary skill in the art to which said subject matter pertains to combine Page with determining a health indicator of a component being below a health threshold level as taught by Xia because combining prior art elements (processing a type of event record – Page: Fig. 2 and Page: ¶ 0053; and the determining of the health indicator) according to known methods can be performed to yield predictable results (providing known means for detecting and processing a type of event for incident analysis – Page: Fig. 2; Page: ¶ 0053; and Page: ¶ 0056).
Claims 13 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Page, and further in view of Dolby et al. (U.S. Patent Application Publication No. US 2023/0059857 A1), hereinafter “Dolby.”
With regards to Claim 13, Page teaches the system of Claim 1 as referenced above. Page does not explicitly teach:
wherein the platform consolidation system further comprises a group ranking system, wherein the potential root cause for the incident includes multiple potential root causes, wherein the group ranking system performs analysis on the multiple potential root causes and assigns rankings to the multiple potential root causes, wherein the first prompt is further based on the rankings of the multiple potential root causes in accordance with the system of Claim 1.
However, Dolby teaches:
wherein the platform consolidation system further comprises a group ranking system (Fig. 1 and ¶ 0039; regarding, e.g., component 122.), wherein the potential root cause for the incident includes multiple potential root causes (Fig. 1 and ¶ 0039.), wherein the group ranking system performs analysis on the multiple potential root causes and assigns rankings to the multiple potential root causes (Fig. 1 and ¶ 0039.), wherein the first prompt is further based on the rankings of the multiple potential root causes (Fig. 1 and ¶ 0039.).
Therefore, it would have been obvious before the effective filing date of the claimed invention to one of ordinary skill in the art to which said subject matter pertains to combine Page with generating a prompt associated with a ranked list of root causes as taught by Dolby because the ranked list provides a user with a larger variety of choices of root causes to select from for determining a solution (Dolby: Fig. 1 and Dolby: ¶ 0039).
With regards to Claim 20, Page teaches the system of Claim 19 as referenced above. Page further teaches:
wherein the platform consolidation system further comprises an anomaly enrichment system (¶ 0125.) and a group ranking system (¶ 0125.),
wherein the anomaly enrichment system compiles enrichment data (Fig. 2 and ¶ 0056; regarding, e.g., data values and/or metadata associated with correlated events.) associated with at least one of a period during which the incident occurred (Fig. 2 and ¶ 0056.), a transaction pattern that is correlated with the period during which the incident occurred, a trace pattern that is correlated with the period during which the incident occurred, an exception that triggered in the period during which the incident occurred, a geographic region or region covered by a data center from which incident occurred, or a difference pattern corresponding to a difference between a pattern occurring before the incident occurred and a pattern occurring after the incident occurred;
wherein the prompt is further based on the enrichment data compiled by the anomaly enrichment system (Fig. 6; ¶ 0096-0098; and ¶ 0108-0109.).
Page does not explicitly teach:
wherein the potential root cause for the incident includes multiple potential root causes (Fig. 1 and ¶ 0039.),
wherein the group ranking system performs analysis on the multiple potential root causes and assigns rankings to the multiple potential root causes;
wherein the prompt is further based on the rankings of the multiple potential root causes in accordance with the system of Claim 19.
However, Dolby teaches:
wherein the potential root cause for the incident includes multiple potential root causes,
wherein the group ranking system performs analysis on the multiple potential root causes and assigns rankings to the multiple potential root causes (Fig. 1 and ¶ 0039.);
wherein the prompt is further based on the rankings of the multiple potential root causes (Fig. 1 and ¶ 0039.).
Therefore, it would have been obvious before the effective filing date of the claimed invention to one of ordinary skill in the art to which said subject matter pertains to combine Page with generating a prompt associated with a ranked list of root causes as taught by Dolby because the ranked list provides a user with a larger variety of choices of root causes to select from for determining a solution (Dolby: Fig. 1 and Dolby: ¶ 0039).
Allowable Subject Matter
Claims 11 and 17 would be allowable if rewritten to overcome the rejection(s) under 35 U.S.C. 101, set forth in this Office action and to include all of the limitations of the base claim and any intervening claims.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
Ahmed et al. (“Recommending Root-Cause and Mitigation Steps for Cloud Incidents using Large Language Models” – Non-Patent Literature); teaching a large-scale study to evaluate the effectiveness of models for helping engineers root cause and mitigate production incidents. A rigorous study is performed at Microsoft, on more than 40,000 incidents and the comparing of several large language models in zero-shot, fine-tuned and multi-task setting using semantic and lexical metrics is conducted. Lastly, a human evaluation with actual incident owners shows the efficacy and future potential of using artificial intelligence for resolving cloud incidents.
Chen et al. (“Empowering Practical Root Cause Analysis by Large Language Models for Cloud Incidents” – Non-Patent Literature); teaching RCACopilot which matches incoming incidents to corresponding handlers based on alert types, aggregates critical runtime diagnostic information, predicts the incident’s root cause category, and provides an explanation.
Kholodkhov et al. (U.S. Patent Application Publication No. US 2025/0147754 A1); teaching a data processing system obtaining build logs that include information associated with a software build problem; analyzing the logs to generate a knowledge graph identifying the relationship between various entities in the logs; extracting a signature of a candidate root cause of the build problem from the knowledge graph representing a subset of nodes and edges of the knowledge graph; providing the signature of the candidate root cause to a graphical language model to obtain a prediction of a category of root cause failure selected from among a plurality of root cause failures; constructing a prompt for a language model to generate a root cause failure analysis that describes the root cause of the build problem, the prompt including the category of root cause; receiving the root cause failure analysis from the language model; and performing one or more actions in response to receiving the root cause failure analysis.
Koziolek et al. (U.S. Patent Application Publication No. US 2025/0362665 A1); teaching a method for supporting troubleshooting software and hardware issues in a distributed control system (DCS) associated with an automation equipment in industrial plant including monitoring data; detecting an anomaly in the monitored data based on predetermined anomaly detection rules; based on a result of the detecting, performing, for a detected anomaly, a similarity search on historic anomaly data associated with the DCS and/or the automation equipment; based on a result of the performed similarity search, querying a large language model (LLM) for diagnosis and/or recommendation for troubleshooting the detected anomaly; based on the querying, obtaining an output from the LLM, wherein the output is indicative of a diagnosis and/or recommendation for troubleshooting the detected anomaly; and providing the output to a user.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOSEPH KUDIRKA whose telephone number is (571)270-7126. The examiner can normally be reached M-F 7:30am - 5pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ashish Thomas can be reached at (571) 272-0631. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JOSEPH R KUDIRKA/Primary Patent Examiner, Art Unit 2114