Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed 12/19/2025 has been entered.
Response to Arguments
Applicant’s arguments filed 12/19/2025 have been fully considered.
Applicant argues Gupta’s time data is not an example of “audit log data”. However, Gupta teaches monitoring log data for auditing purposes in at least ¶ 4, 109, 118, 124, 160.
Applicant argues that the prior art to Gupta fails to teach: “a plurality of user nodes representing respective entities which make changes to the computing infrastructure” of claim 1.
However, when a node is added to a computing infrastructure, the infrastructure is changed. Likewise, when the number of nodes in an infrastructure is scaled, the infrastructure is changed. When nodes are removed from a computing infrastructure, the infrastructure is changed. Applicant’s arguments are not persuasive in light of Gupta disclosure detailing the adding, removing, and scaling features (see Gupta, ¶ 58, 125, 132, 139, 146, 153, 160).
Moreover, applicant’s claim is drawn to identifying timestamps within log data, not to the initiation of any changes in the computing infrastructure. Applicant’s exemplary claim 1 is devoid of any positively recited changing or initiating step which would lend patentable weight to such features. Applicant’s claim is drawn to an identification step only and the language describing the actions related to the nodes appears to be merely non-functionally descriptive and/or intended use type language.
Applicant argues that Gupta fails to teach because although Gupta discloses the scaling, adding, and removing of infrastructure nodes, the scaling/adding/removing is a “contextual/operational description” and does not teach assigning time values to edges representing a time of change in the computing infrastructure. However, Gupta is drawn to creating graphs with graph edges and representing the network infrastructure and determining changes in the graph between times, including determining differences in the graphs at different times such as the times related to adding, scaling, or removing nodes (see Gupta, abstract, ¶ 6-7, 58, 125, 132, 139, 146, 153, 160).
Regarding claim 2, applicant argues the prior art fails to teach or suggest: “action nodes” representing actions which caused changes to the computing infrastructure. However, Gupta’s nodes represent actions which caused changes to the computing infrastructure (see discussion above regarding adding/scaling/removing; ¶ 6-12, nodes in graph represent connections and other relationships causing changes; and ¶ 252-256, 177-181).
Regarding claim 3, applicant argues the prior art fails to teach or suggest: “wherein each action node is connected to a user node of the plurality of user nodes representing a user who initiated the action represented by the action node, wherein each action node is further connected to a computing resource node of the plurality of computing resource nodes representing a computing resource that was created or modified via the action”. However, Gupta discloses a system where user nodes (see ¶ 50-55) connect to network applications. The subscriber devices initiate access to various network and cloud-based nodes (Gupta, ¶ 55-59). Gupta discloses monitoring services to determine performance and functionally metrics associated with the connections of the network nodes (Gupta, ¶ 61) and creates time series graphs representing all the application and corresponding infrastructure components (Gupta, ¶ 68). Therefore, the prior art discloses the connection between the “action nodes” and the “user nodes”. Accordingly, applicant’s arguments cannot be held persuasive in this regard.
Regarding claim 6, applicant argues the prior art fails to teach or suggest: “wherein identifying the root cause of the alert further comprises: detecting at least one anomaly based on the retrieved first temporal variation, wherein the at least one anomaly is at least one anomalous change among the plurality of changes”. However, Gupta is directed to identifying root causes of anomalies (Gupta, abstract) where the anomalies are based on time changes (see ¶ 124-160, graph analysis identifying changes in graph between times; note changes (addition/deletion of nodes) of ¶ 124-153). Accordingly, applicant’s arguments cannot be held persuasive in this regard.
With regards to claim 7, applicant argues the prior art fails to teach or suggest: “wherein each anomalous change is determined based on one of the entities which made the anomalous change”. However, Gupta discloses in at least ¶ 88-95, anomalous changes determined based on nodes and connections between nodes, and anomalies in compute node operation (¶ Gupta, 65, 80, anomalous nodes/applications; ¶ 93, 95, anomalous services; “end-to-end” anomaly; ¶ 105, identification of node that caused the anomaly).
With regards to claim 8, applicant argues the prior art fails to teach or suggest: “aggregating a plurality of nodes having at least one common root cause among the plurality of nodes” However, Gupta disclose the aggregation in at least ¶ 7-8 describing aggregating at least first and second nodes associated with root causes of the anomaly (see also Gupta ¶ 105 and 218).
With respect to claim 9, applicant argues the prior art fails to teach or suggest: “wherein aggregating the plurality of nodes having the at least one common root cause further comprises: generating an aggregated node based on the plurality of nodes having the at least one common root cause, wherein updating the graph further comprises replacing the plurality of nodes having the at least one common root cause with the aggregated node”. However Gupta discloses the aggregation of a plurality of probe modules on of a given node and anomaly detection respective to the aggregated node (¶ 92-93, aggregation of all probe nodes in compute node).
Applicant’s further arguments are moot in view of the new grounds of rejection presented herein.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
Claims 1-20 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Exemplary claim 1 recites: “creating a plurality of temporal variations of the graph by assigning a time value to each edge of the plurality of edges based only on the identified plurality of timestamps”. Applicant’s specification is devoid a description of creating temporal variations of a graph including a plurality of nodes and a plurality of edges, wherein the plurality of nodes includes a plurality of computing resource nodes representing respective computing resources among a plurality of computing resources and a plurality of user nodes representing respective entities that initiate changes to the computing infrastructure with respect to the plurality of computing resources based “only on the identified plurality of timestamps”. Rather applicant’s specification describes the creation process as one that is based on the computing resource nodes, user nodes, etc. The remaining independent claims are addressed by similar rationale.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim 1-19 are rejected under 35 U.S.C. 103 as being unpatentable over US 20240007342 to Gupta in view of US 20230099424 to Hawkinson.
Regarding claim 1, Gupta teaches a method for alert mitigation, comprising:
identifying a plurality of timestamps in audit log data with respect to a plurality of nodes in a graph including the plurality of nodes and a plurality of edges, wherein the plurality of nodes includes a plurality of computing resource nodes representing respective computing resources among the a plurality of computing resources and a plurality of user nodes representing respective entities that initiate changes to the computing infrastructure with respect to the plurality of computing resources (abstract, ¶ 6-7, time series based network graphs);
creating a plurality of temporal variations of the graph by assigning a time value to each edge of the plurality of edges based only on the identified plurality of timestamps, wherein the time value assigned to each edge represents a time of a change in the computing infrastructure among a plurality of changes to the computing infrastructure, wherein each change of the plurality of changes is defined at least with respect to one of the plurality of computing resources (¶ 252-256, temporal variations of graphs; ¶ 61-68; changes defined in terms of connections to computing elements; see ¶ 58, 125, 132, 139, 146, 153, 160);
retrieving a first temporal variation of the plurality of temporal variations of the graph based on at least one time, wherein the first temporal variation includes at least a subset of the plurality of nodes and the plurality of edges determined based on the time value assigned to each edge of the plurality of edges (¶ 252-256, temporal variations of graph);
identifying a root cause of an alert based on the retrieved first temporal variation (abstract, ¶ 4-8, 106, 177-181, 251-256, identification of root cause); and
Gupta fails to teach but Hawkinson teaches:
performing at least one mitigation action based on the identified root cause (abstract, ¶ 51, mitigation based on root cause analysis).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Hawkinson. The motivation to do so is that the teachings of Hawkinson would have been advantageous in terms of mitigating anomalies (Hawkinson, abstract, ¶ 51).
Regarding claim 2, 12,
Gupta teaches:
wherein the plurality of nodes further includes a plurality of action nodes, wherein each action node represents a respective action which caused one of the plurality of changes (¶ 6-12, nodes in graph represent connections and other relationships causing changes; ¶ 252-256, 177-181).
Regarding claim 3, 13,
Gupta teaches:
wherein each action node is connected to a user node of the plurality of user nodes representing a user who initiated the action represented by the action node, wherein each action node is further connected to a computing resource node of the plurality of computing resource nodes representing a computing resource that was created or modified via the action (¶ 48-52, 67-68).
Regarding claim 4, 14,
Gupta teaches:
wherein each change of the plurality of changes is any of: a creation of one of the plurality of computing resources, and a modification of one of the plurality of computing resources (¶ 118, change including modification or creation of resources).
Regarding claim 5, 15,
Gupta teaches:
wherein at least a portion of the plurality of changes includes at least one connection between computing resources among the plurality of computing resources (¶ 10, 61, changes include connections between resources).
Regarding claim 6, 16,
Gupta teaches:
wherein identifying the root cause of the alert further comprises: detecting at least one anomaly based on the retrieved first temporal variation, wherein the at least one anomaly is at least one anomalous change among the plurality of changes (¶ 6-7, 89, anomalous conditions related to time series data).
Regarding claim 7, 17,
Gupta teaches:
wherein each anomalous change is determined based on one of the entities which made the anomalous change (¶ 88-95, anomalous change determined based on nodes and connections between nodes).
Regarding claim 8, 18,
Gupta teaches:
aggregating a plurality of nodes having at least one common root cause among the plurality of nodes (¶ 7-8, 105, edges of graph indicating nodes associated with root cause of anomalies); and
updating the graph based on the aggregated plurality of nodes having the at least one common root cause, wherein the first temporal variation is retrieved from the updated graph (¶ 7-8, 105, 218, updated based on ranking and weighting of edges of graph).
Regarding claim 9, 19,
Gupta teaches:
wherein aggregating the plurality of nodes having the at least one common root cause further comprises: generating an aggregated node based on the plurality of nodes having the at least one common root cause, wherein updating the graph further comprises replacing the plurality of nodes having the at least one common root cause with the aggregated node (¶ 92, aggregation of all probe nodes in compute node).
Claim 10-11 addressed by similar rationale as claim 1.
Claim 20 is rejected under 35 U.S.C. 103 as being unpatentable over Gupta and Hawkinson in view of US 20230164044 to Deb.
Regarding claim 20,
Gupta fails to teach but Deb teaches:
wherein at least one action node among the plurality of action nodes represents a commit command, the at least one action node is connected to at least one computing resource node by a first edge among the plurality of edges, wherein the assigned time value to the first edge represents a time at which the commit command was executed (¶ 49-55).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the teachings of Deb. The motivation to do so is that the teachings of Deb would have been advantageous in terms of facilitating recalculation of data flows and configuration change updates (Deb, ¶ 49, 55).
CONCLUSION
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RYAN J JAKOVAC whose telephone number is (571)270-5003. The examiner can normally be reached on 8-4 PM EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar A. Louie can be reached on 572-270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RYAN J JAKOVAC/Primary Examiner, Art Unit 2445