Detailed Action
Applicant presented claims 1-20 and Remarks on 04/08/2026 for reconsideration.
Examiner's Notes
The Examiner cites particular sections in the references as applied to the claims below for the convenience of the applicant(s). Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant(s) fully consider the references in their entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the Examiner.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 102 that forms the basis for all the rejections under this section made in this Office Action:
A person shall be entitled to a patent unless—
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-2, 4-5, 10-12, 14-15 and 20 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Han et al., “Unsupervised Cross-system Log Anomaly Detection via Domain Adaptation” (Han).
Claim 1. Han teaches:
A processor-implemented method for machine learning, comprising:
receiving a search request including an input data file as a search criterion; (Han, sec. 2.1, each log message to be compared with normal log messages is a search request for which embedding vectors are generated: “we first use word2vec to represent words in each log message as embedding vectors”)
generating, using a first machine learning model, an embedding representation of the input data file; (Han, sec. 2.1, embedding vectors of each log message is generated: “we first use word2vec to represent words in each log message as embedding vectors”)
generating a compressed version of the input data file based on the embedding representation of the input data file; (Han, the final representation of a log message is a compressed representation of the log: sec. 2.1, “we first use word2vec to represent words in each log message as embedding vectors and then adopt the mean operation over the word embeddings in a log message to derive the representation of one message…we now represent a log sequence as X = {x𝑛}𝑁 𝑛=1 where x𝑛 ∈ R𝑑 is the feature vector of 𝑛-th message. Then, an encoder encodes the log messages in a sequence to a sequence representation with an LSTM model…The last hidden vector h𝑁 captures the information of an entire sequence and is considered as the log sequence representation v = h𝑁”)
retrieving one or more data files similar to the input data file based on the compressed version of the input data file and compressed versions of data files in a data repository; and (Han, all normal log sequences are considered as repository close to the center of a hypersphere and they are outputted along with a given log sequence file for showing whether the given log sequence is close to center or away from center, e.g. anomalous as in fig. 1: sec. 2, “Specifically, we leverage the idea of DeepSVDD [12] to map normal sequences close to a center of a hypersphere…Then, we can detect the anomalies…that have large distances to the center. Figure 1 shows the framework of LogTAD”; sec. 2.2, “Inspired by the DeepSVDD that the normal log sequences should be in a hypersphere and close to the center in the embedding space, we first derive the center of all the log sequences… To make the representation of normal log sequences close to the center c, we develop the objective function…”, sec. 2.3, “To detect the anomalies, we need to set a radius 𝛾 as a decision boundary that separates normal and anomalous sequences. The samples with distances to the center greater than 𝛾 will be labeled as anomalous sequences. We adopt a validation set in the source and target systems respectively to find the best radius 𝛾𝑆 and 𝛾𝑇 . In our experiments, we randomly select one-day log sequences from each system as the validation set”)
outputting the one or more data files as a response to the received search request. (Han, normal files are outputted close to the center while anomalous files are outputted with a defined distance from center, sec. 2.2, “Inspired by the DeepSVDD that the normal log sequences should be in a hypersphere and close to the center in the embedding space, we first derive the center of all the log sequences… To make the representation of normal log sequences close to the center c, we develop the objective function…”, sec. 2.3, “To detect the anomalies, we need to set a radius 𝛾 as a decision boundary that separates normal and anomalous sequences. The samples with distances to the center greater than 𝛾 will be labeled as anomalous sequences. We adopt a validation set in the source and target systems respectively to find the best radius 𝛾𝑆 and 𝛾𝑇 . In our experiments, we randomly select one-day log sequences from each system as the validation set”)
Claim 11. Han teaches:
A processing system for machine learning, comprising: at least one memory having executable instructions stored thereon; and one or more processors configured to execute the executable instructions to cause the processing system to:
receive a search request including an input data file as a search criterion; (Han, sec. 2.1, each log message to be compared with normal log messages is a search request for which embedding vectors are generated: “we first use word2vec to represent words in each log message as embedding vectors”)
generate, using a first machine learning model, an embedding representation of the input data file; (Han, sec. 2.1, embedding vectors of each log message is generated: “we first use word2vec to represent words in each log message as embedding vectors”)
generate a compressed version of the input data file based on the embedding representation of the input data file; (Han, the final representation of a log message is a compressed representation of the log: sec. 2.1, “we first use word2vec to represent words in each log message as embedding vectors and then adopt the mean operation over the word embeddings in a log message to derive the representation of one message…we now represent a log sequence as X = {x𝑛}𝑁 𝑛=1 where x𝑛 ∈ R𝑑 is the feature vector of 𝑛-th message. Then, an encoder encodes the log messages in a sequence to a sequence representation with an LSTM model…The last hidden vector h𝑁 captures the information of an entire sequence and is considered as the log sequence representation v = h𝑁”)
retrieve one or more data files similar to the input data file based on the compressed version of the input data file and compressed versions of data files in a data repository; and (Han, all normal log sequences are considered as repository close to the center of a hypersphere and they are outputted along with a given log sequence file for showing whether the given log sequence is close to center or away from center, e.g. anomalous as in fig. 1: sec. 2, “Specifically, we leverage the idea of DeepSVDD [12] to map normal sequences close to a center of a hypersphere…Then, we can detect the anomalies…that have large distances to the center. Figure 1 shows the framework of LogTAD”; sec. 2.2, “Inspired by the DeepSVDD that the normal log sequences should be in a hypersphere and close to the center in the embedding space, we first derive the center of all the log sequences… To make the representation of normal log sequences close to the center c, we develop the objective function…”, sec. 2.3, “To detect the anomalies, we need to set a radius 𝛾 as a decision boundary that separates normal and anomalous sequences. The samples with distances to the center greater than 𝛾 will be labeled as anomalous sequences. We adopt a validation set in the source and target systems respectively to find the best radius 𝛾𝑆 and 𝛾𝑇 . In our experiments, we randomly select one-day log sequences from each system as the validation set”)
output the one or more data files as a response to the received search request. (Han, normal files are outputted close to the center while anomalous files are outputted with a defined distance from center, sec. 2.2, “Inspired by the DeepSVDD that the normal log sequences should be in a hypersphere and close to the center in the embedding space, we first derive the center of all the log sequences… To make the representation of normal log sequences close to the center c, we develop the objective function…”, sec. 2.3, “To detect the anomalies, we need to set a radius 𝛾 as a decision boundary that separates normal and anomalous sequences. The samples with distances to the center greater than 𝛾 will be labeled as anomalous sequences. We adopt a validation set in the source and target systems respectively to find the best radius 𝛾𝑆 and 𝛾𝑇 . In our experiments, we randomly select one-day log sequences from each system as the validation set”)
Claim 2. The method of Claim 1, wherein generating the compressed version of the input data file comprises encoding the embedding representation of the input data file using a second machine learning model. (Han, 2.1, word2vec is used for generating embedding vectors and an LSTM model is used for compressed representation)
Claim 12 is rejected under the same rationale as above.
Claim 4. The method of Claim 1, wherein retrieving the one or more data files similar to the input data file comprises:
identifying, based on a similarity between the compressed version of the input data file and the compressed version of the data files in the data repository, a set of similar compressed versions of data files to the compressed version of the input data file; and retrieving the one or more data files based on the set of similar compressed versions of data files to the compressed version of the input data file. (Han, sec. 2.2, all compressed similar files will be located close to center: “Inspired by the DeepSVDD that the normal log sequences should be in a hypersphere and close to the center in the embedding space, we first derive the center of all the log sequences from both source and target systems as the mean over all log sequences in both datasets, i.e., c = 𝑀𝑒𝑎𝑛(v𝜖𝑖 ), where 𝜖 ∈ {𝑆,𝑇 } indicates the source or target dataset. To make the representation of normal log sequences close to the center c, we develop the objective function”)
Claim 14 is rejected under the same rationale as above.
Claim 5. The method of Claim 4, wherein identifying the set of similar compressed versions of data files to the compressed version of the input data file comprises identifying embedding representations within a threshold distance from the compressed version of the input data file. (Han, distance from a center is defined: sec. 2, “we leverage the idea of DeepSVDD [12] to map normal sequences close to a center of a hypersphere…we can detect the anomalies in both systems that have large distances to the center”; sec. 2.3, “After the training phase, the encoder gains the ability to embed both source and target samples close to the center c so that the abnormal samples from both systems should have large distances to the center… To detect the anomalies, we need to set a radius 𝛾 as a decision boundary that separates normal and anomalous sequences. The samples with distances to the center greater than 𝛾 will be labeled as anomalous sequences”)
Claim 15 is rejected under the same rationale as above.
Claim 10. The method of Claim 1, further comprising generating a description of the input data file based on labels associated with compressed versions of data files in a data repository similar to the compressed version of the input data file. (Han, files close to the center of a hypersphere have similar normal label while files with defined distance from center labeled anomalous: sec. 2, “we leverage the idea of DeepSVDD [12] to map normal sequences close to a center of a hypersphere…Then, we can detect the anomalies…that have large distances to the center. Figure 1 shows the framework of LogTAD”; sec. 2.2, “Inspired by the DeepSVDD that the normal log sequences should be in a hypersphere and close to the center in the embedding space, we first derive the center of all the log sequences… To make the representation of normal log sequences close to the center c, we develop the objective function…”, sec. 2.3, “To detect the anomalies, we need to set a radius 𝛾 as a decision boundary that separates normal and anomalous sequences. The samples with distances to the center greater than 𝛾 will be labeled as anomalous sequences. We adopt a validation set in the source and target systems respectively to find the best radius 𝛾𝑆 and 𝛾𝑇 . In our experiments, we randomly select one-day log sequences from each system as the validation set”)
Claim 20 is rejected under the same rationale as above.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 3, 6-9, 13 and 16-19 are rejected under 35 U.S.C. 103(a) as being unpatentable over Han as applied to claims 1 and 11 above in view of Magnus GYLLENHAMMAR EP 4645164 A1 (GYLLENHAMMAR).
Claim 3. Han discloses:
The method of Claim 1, wherein:
the input data file comprises a log file and generating the embedding representation of the input data file comprises generating, using the first machine learning model, a first embedding…and a second embedding… (Han, sec. 2.1, wherein word2vec is used for generating a first embedding and an a second embedding: “we first use word2vec to represent words in each log message as embedding vectors and then adopt the mean operation over the word embeddings in a log message to derive the representation of one message)
Han did not specifically disclose but GYLLENHAMMAR discloses a log file including a timestamp column and an activity description column. GYLLENHAMMAR, ¶ 43, “the term embedding network (may also be referred to as "encoding network", "embedding neural network", or "embedding artificial neural network") refers to a computational model or set of techniques that are used to enable a computer to generate an embedding for input data (e.g. sensor data, text data, etc.), where an "embedding" may be understood as a mathematical representation of said input data. In more detail, the "embedding network" is used to transform high-dimensional data into a lower-dimensional space (multi-dimensional (vector) space) while preserving meaningful relationships between the input data points”; ¶ 59, “The sensor data may further comprise associated meta data. The meta data may e.g. comprise timestamps, location information, vehicle information, log duration, etc.”)
Evidently log files are processed for identifying certain information of interest with respect to certain attributes of the log files. Han adopted log files from “(1) BlueGene/L supercomputer system (BGL) dataset [11], which is collected from a BlueGene/L supercomputer system at Lawrence Livermore National Labs; (2) Thunderbird (TB) dataset [11], which is collected from a Thunderbird supercomputer system at Sandia National Labs” while log files used by GYLLENHAMMAR are sensor generated data. Both Han and GYLLENHAMMAR use embeddings technique for processing log data. It would have been obvious before the effective filling date of the claimed invention to a person having ordinary skill in the art to combine the applied references for including a timestamp column and an activity description column as disclosed in GYLLENHAMMAR into logfiles processing as disclosed by Han to achieve the same predictable of result identifying log anomaly detection with respect to interested attribute such as timestamp of log files.
Claim 13 is rejected under the same rationale as above.
Claim 6. The method of Claim 1, wherein the compressed version of the input data file comprises a plurality of embeddings, each embedding in the plurality of embeddings corresponding to a discrete block of time over which data in the input data file was captured. (Han, sec. 2.1, wherein the final representation is a compressed representation of the log; : “we first use word2vec to represent words in each log message as embedding vectors and then adopt the mean operation over the word embeddings in a log message to derive the representation of one message…we now represent a log sequence as X = {x𝑛}𝑁 𝑛=1 where x𝑛 ∈ R𝑑 is the feature vector of 𝑛-th message. Then, an encoder encodes the log messages in a sequence to a sequence representation with an LSTM model…The last hidden vector h𝑁 captures the information of an entire sequence and is considered as the log sequence representation v = h𝑁”; GYLLENHAMMAR, wherein ¶¶ 45-46, wherein input data is clustered, e.g., temporally: “The encoding networks may be trained through processes like supervised learning, unsupervised learning, or self-supervised learning to optimize the embeddings for specific downstream tasks, such as classification, clustering, or recommendation… the various embedding networks are trained to generate embeddings in the same embedding space (the same multi-dimensional space or the same multi-dimensional vector space) so that embeddings (generated by different embedding networks) that are contextually, spatially and/or temporally related point towards the same point within the multidimensional space”)
claim 16 is rejected under the same rationale as above.
Claim 7. The method of Claim 1, wherein the data repository is a remote data repository and wherein the retrieving comprises:
transmitting the compressed version of the input data file to the remote data repository; and receiving the one or more data files similar to the input data file from the remote data repository. (GYLLENHAMMAR, wherein a distributed system suggests transmitting to and receiving from a remote data repository as needed: “It is however to be appreciated that the steps of the method may be distributed over two or more processing systems, such as between a vehicle and a server (may also be referred to as remote server, cloud server, central server, back-office server, fleet server, or back-end server)…Additionally, the method 100 may find applicability also in an offline environment, e.g. performed by a server…the method 100 may be used for identifying, and/or retrieving relevant sequence of sensor data from a database of stored sensor data sequences”)
claim 17 is rejected under the same rationale as above.
Claim 8. The method of Claim 1, wherein the input data file comprises a radio frequency log in which an operating frequency band oscillates between a first frequency band and a second frequency band within a defined period of time. (GYLLENHAMMAR, ¶¶ 37, 45-46, wherein log data includes contextually sensor data, e.g., radio frequency data for a defined period time: “Radar sensors use radio waves to determine the distance and relative speed of objects around the vehicle…Ultrasonic sensors use sound waves to measure proximity to objects. Various machine learning algorithms (such as e.g., artificial neural networks) may be employed to process the output from the sensors”, “the various embedding networks are trained to generate embeddings in the same embedding space (the same multi-dimensional space or the same multi-dimensional vector space) so that embeddings (generated by different embedding networks) that are contextually, spatially and/or temporally related point towards the same point within the multidimensional space”)
claim 18 is rejected under the same rationale as above.
Claim 9. The method of Claim 1, wherein the input data file comprises mixed data types. (GYLLENHAMMAR, ¶¶ 66, input data comprises different data types: “The set of sensor data embeddings comprises two or more sensor data embeddings generated based on the sensor data sequence…the sensor data sequence may comprise sensor data of different sensor data types”)
claim 19 is rejected under the same rationale as above.
Response to Amendment and Arguments
Applicant’s arguments with respect to rejected claims have been considered but are not persuasive for at least the following reason.
Applicant argues Han does not teach "receiving a search request including an input data file as a search criterion” because “the log messages of Han are described as records of "states of online systems" which are used to "detect anomalous log sequences based on obtained normal patterns" in the log messages. Id. at sections 1, 2, 2.1, and 2.2. Such entering of log messages cannot be considered as "receiving a search request."… detection of an anomaly is not equivalent to a specific search based on a "search criterion."” (emphasis omitted). Remarks, 7.
In response, “receiving a search request including an input data file as a search criterion” is simply interpreted as an input data to be used for finding similar data, see Spec. ¶ 30 for interpretation: “to search for similar data files to an input data file, the pipeline 300 may begin at block 310, with receiving an input data file (labeled an "input data tile" in FIG. 3) including a set of data serving as search criteria…”. In Han, a received log sequence to be placed in a hypersphere and close to the center in the embedding space as normal or away from the center is served as search criteria for placing the given input among similar records. Furthermore, a record placed within a threshold distance from a given record is considered as an output file similar to the given file.
Applicant argues Han does not teach "retrieving one or more data files similar to the input data file based on the compressed version of the input data file and compressed versions of data files in a data repository” because “the log sequences of the data are not accessed when anomalous log sequences are detected in the hypersphere. Rather, the log sequences are accessed to build the hypersphere, not based on any factors particular to any log sequences or a received log message. That is, Han describes, at most, "retrieving one or more data files" based on their existence in a stored dataset. Thus, Han does not teach "retrieving one or more data files similar to the input data file based on the compressed version of the input data file and compressed versions of data files in a data repository” (emphasis omitted). Remarks, 8.
In response: A given log sequence is either normal or anomalous and it is placed close to the center of a hypersphere where normal log sequences are placed or away from the center where anomalous log sequences are placed. Therefore, an output of log sequence similar to a given log sequence is all log sequences located in the same cluster as the given log sequence.
Applicant argues “Han does not anticipate or suggest "outputting the one or more data files as a response to the received search request” because “Since no search request was received, as presented above, Han cannot teach outputting anything in response to a received search request… Han describes, at best, "outputting ... one or more data files as a response to" a user selection. Thus, Han does not teach "outputting the one or more data files as a response to the received search request” (emphasis omitted). Remarks, 8.
In response: as noted above a received log sequence to be placed in a hypersphere is interpreted as search request and a record placed within a threshold distance from a given record is considered as an output file similar to the given file.
Finding a result based on the input is very well known in the art. The following prior art is provided as further evidence:
Walters et al., Pub. No.: US 2023/0153284 A1:
[0004] In some embodiments, the present disclosure provides an exemplary technically improved computer-based method that may include at least the following steps of storing, by one or more processors of one or more computing devices, a plurality of datasets in a non-transitory computer memory associated with the one or more computing devices. A plurality of index representations may be generated, by the one or more processors, where each one of the plurality of index representations may include a compressed representation of a respective one of the plurality of datasets. The plurality of index representations may be stored, by the one or more processors, in the non-transitory computer memory. A sample dataset may be received by the one or more processors. A sample dataset representation may be generated by the one or more processors that may include a compressed representation of the sample dataset. At least one of the plurality of datasets is most similar to the sample dataset based on the sample dataset representation and the plurality of index representations may be determining by the one or more processors.
[0005] In some embodiments, the present disclosure provides an exemplary technically improved computer-based system that may include at least the following components of a non-transitory computer memory and at least one processor coupled to the non-transitory computer memory. The at least one processor may be configured to receive a sample dataset, to generate a sample dataset representation comprising a compressed representation of the sample dataset, and to determine that at least one of a plurality of datasets is most similar to the sample dataset based on the sample dataset representation and a plurality of index representations. Each one of the plurality of index representations may include a compressed representation of a respective one of the plurality of datasets.
[0071] In some embodiments, the comparator 38 may determine dataset similarity with the sample dataset 150 by computing the distance between locations in latent space using any suitable distance metrics such as a Euclidean distance, Manhattan distance, a Levenshtein distance, a cosine similarity, and/or any suitable weight and space calculation, for example.
[0073] In some embodiments, the GUI 25 may display a message 220 to the user 15 on the display of the computer 20 associated with the user 15. The message may include a listing of the sample dataset 150 with a message that “After a Quick Search, the sample dataset may have been taken from or related to:” and a display of a list 250 of the datasets in the subset based on the computed distance.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Mohsen Almani whose telephone number is (571)270-7722. The examiner can normally be reached on M-F, 9 AM-5 PM, ET.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ann J. Lo can be reached on 571-272-9767. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MOHSEN ALMANI/Primary Examiner, Art Unit 2159
Prosecution Insights