DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-19 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
As per claims 1 and 14, those claims recite the phase “ a self-healing..”. Par 0078 discloses self-healing actions may be taken as is necessary and/or desired. [0014] In one embodiment, the self-healing action comprises disabling outside network connections. There is not enough disclosure of the mechanism of the disabling step or method [0015] In one embodiment, the self-healing action comprises deploying additional hardware. There is not enough disclosure of the steps of the deploying mechanism, [0016] In one embodiment, the self-healing action comprises disabling a workflow. There is not enough disclosure of the steps of the action mechanism. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art.
All the dependents’ claims are rejected based on the same rational set forth in the dependent claims respectfully.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
As per claims 1 and 14, those claims recite the phase “ a self-healing..”. Par 0078 discloses self-healing actions may be taken as is necessary and/or desired. [0014] In one embodiment, the self-healing action comprises disabling outside network connections. There is not enough disclosure of the mechanism of the disabling step or method [0015] In one embodiment, the self-healing action comprises deploying additional hardware. There is not enough disclosure of the steps of the deploying mechanism, [0016] In one embodiment, the self-healing action comprises disabling a workflow. There is not enough disclosure of the steps of the action mechanism. So, the it is not clear of the boundary of those claims’ limitations.
All the dependents’ claims are rejected based on the same rational set forth in the dependent claims respectfully.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-19 are rejected under 35 U.S.C. 103 as being unpatentable over Gupta et al US 2025/0219894 and Brown et al US 2021/0141900.
As per claim 1, Gupta discloses a method, comprising:
receiving, by an anomaly detection computer program ( 0011 by a computing system), a plurality of log messages from a data source ( 0011 obtaining, by a computing system, a plurality of candidate logs for a plurality of layers of a computing infrastructure);
creating, by the anomaly detection computer program, an offline anomaly detection model by ( 0051 FIG. 1, log analytics engine 146, model service 152 may include a template mining model trained offline at an external computing system or computing device. and 0072 the machine learning model may be trained offline at an external system):
performing statistical modelling on the log messages from each network device ( 0006 an analytics system maps cross-layer candidate logs to log templates and determines critical logs from among the candidate logs based on properties of the log templates. ); creating a log template for each log message based on static and variables parts of the log message (0006 The analytics system learns to generate log templates with a template mining model trained, using historical cross-layer logs, to identify cross-layer log schemas or patterns of cross-layer logs);
creating a template dictionary of log templates for each network device; ( 0006 The analytics system generates log templates for candidate logs, based on learned patterns of cross-layer logs, to significantly reduce resources (e.g., memory, processing, etc.) used for determining critical logs and [0007] The analytics system generates log templates with the template mining model. Log templates may be generated by providing the template mining model historical log data and/or candidate logs and Par 0009 0009] The analytics system, in some examples, considers various types of telemetry data such as cross-layer logs, cross-layer metrics, and/or network traces. The analytics system determines a structured log message for historical telemetry data (e.g., cross-layer metrics and network traces) that may be provided as training logs the template mining model uses to learn schemas or patterns for the various types of telemetry data. The analytics system collects various telemetry data that may be considered anomalous when compared to baseline behavior. The analytics system includes structured log messages for the collected telemetry data as candidate logs that are mapped to instances of log templates generated with the trained template mining model. In this way, the analytics system outputs critical logs that includes various telemetry data (e.g., key performance indicators, network traces, etc.) to pinpoint the root cause of a network application performance issue with greater accuracy);
creating a log template distribution (0042 Compute nodes 110 may host services for multiple different network applications each distributed with one or more services, i.e. log template distribution. In some examples, services of a network application are distributed across compute nodes managed by any combination of service providers, enterprises, or other entities. Such compute nodes may be located in multiple different data centers, on-prem, or in private, public, or hybrid clouds. And 0051 FIG. 1, a network application may include service 122A through service 122N or any combination of services 122. Log analytics engine 146 of analytics system 140 may obtain cross-layer logs associated with services 122 to output critical logs using a machine learning model, such as model service 154, i.e. a log template distribution. ); and
creating template variables ( 0007 The analytics system generates an instance of a log template by mapping a candidate log to the log template. The instance of the log template may include the patterns or standard items of the log template that matches the candidate log, variable data from the candidate log mapped to the log template, as well as a timestamp of the mapped candidate log and the source (e.g., layer of the computing infrastructure) the candidate log originated from. And 0008 0008] The analytics system selects mapped log templates according to a ranking , i.e. variables, of the mapped log templates based on properties of each of the mapped log templates );
receiving, by the anomaly detection computer program, streaming data comprising log files from a plurality of network devices ( 0092 log analytics engine 446 may track the mapped log template for future use and potential classification as the first or second category in subsequent analysis. In some examples, a candidate log with a scheme or pattern that is unrecognized by the template mining model may itself be the log template assigned to this category);
aggregating, by the anomaly detection computer program, the streaming data for each network device for a period of time (0101 where a log template is assigned to multiple log template categories, analytics engine 446 may take the aggregate of the template category weight determined for each category by multiplying each weight value determined for each template category. And 0006 Candidate logs may include cross-layer logs collected within a time period surrounding the occurrence of a performance issue of a network application. And 0056 considering time recency in view of various log template categories and critical template score and 0060 log collector tools 144 may add metadata (e.g., tags) to each log that identifies the time and source of the log data included in the log. And 0062] Log analytics engine 146 may obtain candidate logs from log database 142. In some instances, log analytics engine 146 may obtain candidate logs as each systems log generated over a certain period of time (e.g., a thirty minute period of time leading up to a performance issue of service 122A). In some instances, log analytics engine 146 may obtain candidate logs as a reduced set of system logs generated over the period of time using a knowledge graph specifying particular nodes from each layer of computing infrastructure 100 associated with performance issues of a network application. );
identifying, by the anomaly detection computer program, an anomaly in the aggregated streaming data using the offline anomaly detection model ([0129] Model service 154 may select one or more candidate logs corresponding to the mapped log templates as critical logs based on the ranking of the mapped log templates (608). In some instances, model service 154 may first select mapped log templates based on the ranking, then select corresponding candidate logs by mapping the candidate logs with a most recent timestamp back to mapped log templates. In some examples, model service 154 may extract candidate logs as critical logs based on instances of log templates that are selected based on a ranking heuristic. Model service 154 may output at least one of an indication of the critical logs to determine a potential root cause associated with a performance issue of a network application or an indication of the potential root cause associated with the performance issue of the network application (610). );
classifying, by the anomaly detection computer program, the anomaly as a rate anomaly, a time anomaly, or a variable anomaly ( [0129] Model service 154 may select one or more candidate logs corresponding to the mapped log templates as critical logs based on the ranking of the mapped log templates (608). In some instances, model service 154 may first select mapped log templates based on the ranking, then select corresponding candidate logs by mapping the candidate logs with a most recent timestamp back to mapped log templates. In some examples, model service 154 may extract candidate logs as critical logs based on instances of log templates that are selected based on a ranking heuristic. Model service 154 may output at least one of an indication of the critical logs to determine a potential root cause associated with a performance issue of a network application or an indication of the potential root cause associated with the performance issue of the network application (610).); and
Gupta does not explicitly disclose collection the steam data, executing, by the anomaly detection computer program, a self-healing action based on the classification (emphasis added).
However, Brown discloses the streaming data, executing, by the anomaly detection computer program, a self-healing action based on the classification (0138 the information streamed from agents within the nodes is used to classify the types of the nodes or, in other words, to partition the nodes into node groups, each of which represents a different node type [0113] Automated methods and systems described herein are implemented in a management system that collects and monitors multiple streams of metric data to detect anomalous behavior in applications running in a distributed computing system. The management system also collects log messages generated operating systems and the applications. When a problem is detected in the numerous streams of metric data, methods and systems generate an alert and identify log messages that may be used to determine the source the of the problem and determine appropriate remedial measures, i.e. a self-healing action, to correct the problem. And abstract, automatically, i.e. self-healing action, executed to correct the problem. And 0037 three autoregressive models. I.e. self-healing action).
Gupta and Brown are both considered to be analogous to the claimed invention because they are in the same field of anamoly detection system. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Gupta to incorporate the teachings of Brown and provide anamoly detection system. Doing so would provide secure streaming network, thereby increasing the device defendibility in the open network.
As per claim 2. Gupta and Brown disclose the method of claim 1,Gupta discloses wherein each log message comprises a date time of the log, a network device name or identifier, an error code, and an error description(0006 The analytics system generates log templates for candidate logs, based on learned patterns of cross-layer logs, to significantly reduce resources (e.g., memory, processing, etc.) used for determining critical logs. Candidate logs may include cross-layer logs collected within a time period surrounding the occurrence of a performance issue of a network application. Candidate logs may include a set of cross-layer logs from nodes of each layer in a computing infrastructure identified as associated with a performance issue of a network application. In some examples, the analytics system identifies candidate logs based on a knowledge graph specifying dependencies of nodes of each layer in the computing infrastructure).
As per claim 3. Gupta and Brown disclose the method of claim 1, Gupta discloses further comprising: preprocessing, by the anomaly detection computer program, the log messages ([0127] Analytics system 140 may, for each candidate log of the plurality of candidate logs, map the candidate log to a log template of a plurality of log templates, wherein each log template to which a candidate log is mapped is a mapped logged template (604) and [0128] Analytics system 140, or more specifically model service 154, may rank the mapped log templates based on properties of each of the mapped log templates (606). Model service 154 may rank the mapped log templates based on properties of mapped log templates, such as keywords included in the log template, a number of instances of the log template ); and encoding, by the anomaly detection computer program, the preprocessed log messages( Brown discloses 0080 defined interfaces through which electronically-encoded data is exchanged, process execution launched 0094 The OVF package can be encoded and stored as a single file or as a set of files. ).
As per claim 4. Gupta and Brown disclose the method of claim 3, Gupta discloses wherein the preprocessing comprises transforming the log messages([0127] Analytics system 140 may, for each candidate log of the plurality of candidate logs, map the candidate log to a log template of a plurality of log templates, wherein each log template to which a candidate log is mapped is a mapped logged template (604). ).
As per claim 5. Gupta and Brown disclose The method of claim 1, Gupta discloses wherein the statistical modelling comprises a rate and a distribution of each log message([0009] The analytics system, in some examples, considers various types of telemetry data such as cross-layer logs, cross-layer metrics, and/or network traces. The analytics system determines a structured log message for historical telemetry data (e.g., cross-layer metrics and network traces) that may be provided as training logs the template mining model uses to learn schemas or patterns for the various types of telemetry data. The analytics system collects various telemetry data that may be considered anomalous when compared to baseline behavior. The analytics system includes structured log messages for the collected telemetry data as candidate logs that are mapped to instances of log templates generated with the trained template mining model. I).
As per claim 6. Gupta and Brown disclose The method of claim 1, Gupta discloses wherein the log template distribution is based on statistical rates and probabilities of the log templates for a period of time([0082] Analytics system 240 may determine a knowledge graph with an application layer including service nodes 302, a compute layer including compute nodes 304, and a network layer including TOR switches 306 and chassis switches 308. In some instances, service nodes 302 may correspond to multiple, distributed services or network applications. In some examples, each service node of service nodes 302 may include multiple instances that are hosted on distributed compute nodes 304 in the compute layer of the knowledge graph. Each of compute nodes 304 may include bare metal servers, computing devices, virtual machines, or the like. Compute nodes 304 may be connected to a TOR switch of TOR switches 306 in the network layer. TOR switches 306 may be coupled to one or more chassis switches of chassis switches 308 in the network layer. ).
As per claim 7. Gupta and Brown disclose The method of claim 1, Gupta discloses wherein the template variables comprise special identifiers for dynamic parts of the log messages ( [0117] Model trainer 452 trains a template mining model used to determine log templates for a set of critical logs. For example, model trainer 452 may implement Drain3 for template generation algorithms. Model trainer 452 may use Drain3 algorithms for template generation and to customize the template generation to optimize for various use cases. Model trainer 452 may use the Drain3 python library that provides utility support for training and storing template-mining models. By model trainer 452 employing a dynamically updating template clustering system of Drain3 template mining models, a template mining model of log analytics engine 446 may dynamically learn templates by masking away variable tokens inside of common strings. Even after being trained, template mining models can be retrained and will update their log templates to reflect new logs being ingested. The template mining model may be trained on normally performing application and infrastructure log data and templatize the logs into clusters).
As per claim 8. Gupta and Brown disclose the method of claim 1, Gupta discloses further comprising: calculating, by the anomaly detection computer program, a uniqueness of each variable position for each template variable in each log template( 0098 log analytics engine 446 may determine critical logs 470 based on a critical template score. Log analytics engine 446 may calculate a critical template score for each mapped log template. Log analytics engine 446 may calculate critical template scores based on multiple factors such as a time of occurrence with respect to when performance anomalies of a network application has occurred, a rarity of observed log templated in an analysis or inference window, a log template category assigned to the mapped log template, and whether the mapped log template includes insignificant keywords that often indicate logs that are not very critical. Log analytics engine 446 may assign each factor values corresponding to a weight each factor should influence a calculated critical template score. In some examples, log analytics engine 446 may multiply the weight values of each factor to generate a raw critical template score value between zero and negative infinity. Log analytics engine 446 may normalize (e.g., with a SoftMax function) the raw critical template score to generate a critical template score with a value between zero and one. Log analytics engine 446 may select a number of log templates based on critical template scores for log templates closest to one).
As per claim 9. Gupta and Brown disclose the method of claim 1, the combination discloses wherein the rate anomaly is identified based on a rate of logs files in the aggregated streaming data for one of the log templates( Gupta discloses 0101 where a log template is assigned to multiple log template categories, analytics engine 446 may take the aggregate of the template category weight determined for each category by multiplying each weight value determined for each template category and Brown 0260 The period determined for the shorter sampling rate has higher priority in forecasting than a period obtained for a longer sampling rate. And [0104] FIG. 10 shows virtual-cloud-connector nodes (“VCC nodes”) and a VCC server, components of a distributed system that provides multi-cloud aggregation and that includes a cloud-connector server ).
As per claim 10. Gupta and Brown disclose the method of claim 1, Brown discloses wherein the time anomaly is identified based on an average time between log files in the aggregated streaming data (0046 a periodogram computed for a time window of seasonal metric data. 0059 determining a principal frequency in time windows applied to a seasonal stream of metric data. And [0104] FIG. 10 shows virtual-cloud-connector nodes (“VCC nodes”) and a VCC server, components of a distributed system that provides multi-cloud aggregation and that includes a cloud-connector server and cloud-connector nodes that cooperate to provide services that are distributed across multiple clouds).
As per claim 11. Gupta and Brown disclose the method of claim 1, Brown discloses wherein the self-healing action comprises disabling outside network connections (0348] Once the root cause of anomalous behavior has been identified, remedial measures may be automatically or manually executed to correct the anomalous behavior. Remedial measures include, but are not limited to, increasing the amount of usable capacity of a resource to application nodes; assigning additional resources to the application nodes that use resources exhibiting anomalous behavior; migrating the node that use the anomalous behaving resource to a different server computer with the same resource having a larger usable capacity than the anomalous behaving resource; and creating one or more additional virtual objects from a template of the virtual object used to run the node, the additional virtual objects to share the workload of the virtual object used to run the node. ).
As per claim 12. Gupta and Brown disclose Brown discloses the method of claim 1, wherein the self-healing action comprises deploying additional hardware(0153 metric values of normally behaving related streams of metric data are distributed according to a normal distribution ).
As per claim 13. Gupta and Brown disclose The method of claim 1, Brown discloses wherein the self-healing action comprises disabling a workflow(0146 control flows to block 2605 in which the one or more streams of metric data are forwarded to metric processor 2109. The metrics may also be copied to the metrics database 2118 in FIG. 21).
As per claim 14. Gupta discloses a non-transitory computer readable storage medium, including instructions stored thereon, which when read and executed by one or more computer processors(0065 computing system 202 may include one or more processor(s) ), cause the one or more computer processors to perform steps comprising:
receiving, by an anomaly detection computer program ( 0011 by a computing system), a plurality of log messages from a data source ( 0011 obtaining, by a computing system, a plurality of candidate logs for a plurality of layers of a computing infrastructure);
creating, by the anomaly detection computer program, an offline anomaly detection model by ( 0051 FIG. 1, log analytics engine 146, model service 152 may include a template mining model trained offline at an external computing system or computing device. and 0072 the machine learning model may be trained offline at an external system):
performing statistical modelling on the log messages from each network device ( 0006 an analytics system maps cross-layer candidate logs to log templates and determines critical logs from among the candidate logs based on properties of the log templates. ); creating a log template for each log message based on static and variables parts of the log message (0006 The analytics system learns to generate log templates with a template mining model trained, using historical cross-layer logs, to identify cross-layer log schemas or patterns of cross-layer logs);
creating a template dictionary of log templates for each network device; ( 0006 The analytics system generates log templates for candidate logs, based on learned patterns of cross-layer logs, to significantly reduce resources (e.g., memory, processing, etc.) used for determining critical logs and [0007] The analytics system generates log templates with the template mining model. Log templates may be generated by providing the template mining model historical log data and/or candidate logs and Par 0009 0009] The analytics system, in some examples, considers various types of telemetry data such as cross-layer logs, cross-layer metrics, and/or network traces. The analytics system determines a structured log message for historical telemetry data (e.g., cross-layer metrics and network traces) that may be provided as training logs the template mining model uses to learn schemas or patterns for the various types of telemetry data. The analytics system collects various telemetry data that may be considered anomalous when compared to baseline behavior. The analytics system includes structured log messages for the collected telemetry data as candidate logs that are mapped to instances of log templates generated with the trained template mining model. In this way, the analytics system outputs critical logs that includes various telemetry data (e.g., key performance indicators, network traces, etc.) to pinpoint the root cause of a network application performance issue with greater accuracy);
creating a log template distribution (0042 Compute nodes 110 may host services for multiple different network applications each distributed with one or more services, i.e. log template distribution. In some examples, services of a network application are distributed across compute nodes managed by any combination of service providers, enterprises, or other entities. Such compute nodes may be located in multiple different data centers, on-prem, or in private, public, or hybrid clouds. And 0051 FIG. 1, a network application may include service 122A through service 122N or any combination of services 122. Log analytics engine 146 of analytics system 140 may obtain cross-layer logs associated with services 122 to output critical logs using a machine learning model, such as model service 154, i.e. a log template distribution. ); and
creating template variables ( 0007 The analytics system generates an instance of a log template by mapping a candidate log to the log template. The instance of the log template may include the patterns or standard items of the log template that matches the candidate log, variable data from the candidate log mapped to the log template, as well as a timestamp of the mapped candidate log and the source (e.g., layer of the computing infrastructure) the candidate log originated from. And 0008 0008] The analytics system selects mapped log templates according to a ranking , i.e. variables, of the mapped log templates based on properties of each of the mapped log templates );
receiving, by the anomaly detection computer program, streaming data comprising log files from a plurality of network devices ( 0092 log analytics engine 446 may track the mapped log template for future use and potential classification as the first or second category in subsequent analysis. In some examples, a candidate log with a scheme or pattern that is unrecognized by the template mining model may itself be the log template assigned to this category);
aggregating, by the anomaly detection computer program, the streaming data for each network device for a period of time (0101 where a log template is assigned to multiple log template categories, analytics engine 446 may take the aggregate of the template category weight determined for each category by multiplying each weight value determined for each template category. And 0006 Candidate logs may include cross-layer logs collected within a time period surrounding the occurrence of a performance issue of a network application. And 0056 considering time recency in view of various log template categories and critical template score and 0060 log collector tools 144 may add metadata (e.g., tags) to each log that identifies the time and source of the log data included in the log. And 0062] Log analytics engine 146 may obtain candidate logs from log database 142. In some instances, log analytics engine 146 may obtain candidate logs as each systems log generated over a certain period of time (e.g., a thirty minute period of time leading up to a performance issue of service 122A). In some instances, log analytics engine 146 may obtain candidate logs as a reduced set of system logs generated over the period of time using a knowledge graph specifying particular nodes from each layer of computing infrastructure 100 associated with performance issues of a network application. );
identifying, by the anomaly detection computer program, an anomaly in the aggregated streaming data using the offline anomaly detection model ([0129] Model service 154 may select one or more candidate logs corresponding to the mapped log templates as critical logs based on the ranking of the mapped log templates (608). In some instances, model service 154 may first select mapped log templates based on the ranking, then select corresponding candidate logs by mapping the candidate logs with a most recent timestamp back to mapped log templates. In some examples, model service 154 may extract candidate logs as critical logs based on instances of log templates that are selected based on a ranking heuristic. Model service 154 may output at least one of an indication of the critical logs to determine a potential root cause associated with a performance issue of a network application or an indication of the potential root cause associated with the performance issue of the network application (610). );
classifying, by the anomaly detection computer program, the anomaly as a rate anomaly, a time anomaly, or a variable anomaly ( [0129] Model service 154 may select one or more candidate logs corresponding to the mapped log templates as critical logs based on the ranking of the mapped log templates (608). In some instances, model service 154 may first select mapped log templates based on the ranking, then select corresponding candidate logs by mapping the candidate logs with a most recent timestamp back to mapped log templates. In some examples, model service 154 may extract candidate logs as critical logs based on instances of log templates that are selected based on a ranking heuristic. Model service 154 may output at least one of an indication of the critical logs to determine a potential root cause associated with a performance issue of a network application or an indication of the potential root cause associated with the performance issue of the network application (610).); and
Gupta does not explicitly disclose collection the steam data, executing, by the anomaly detection computer program, a self-healing action based on the classification (emphasis added).
However, Brown discloses the streaming data, executing, by the anomaly detection computer program, a self-healing action based on the classification (0138 the information streamed from agents within the nodes is used to classify the types of the nodes or, in other words, to partition the nodes into node groups, each of which represents a different node type [0113] Automated methods and systems described herein are implemented in a management system that collects and monitors multiple streams of metric data to detect anomalous behavior in applications running in a distributed computing system. The management system also collects log messages generated operating systems and the applications. When a problem is detected in the numerous streams of metric data, methods and systems generate an alert and identify log messages that may be used to determine the source the of the problem and determine appropriate remedial measures, i.e. a self-healing action, to correct the problem. And abstract, automatically, i.e. self-healing action, executed to correct the problem. And 0037 three autoregressive models. I.e. self-healing action).
Gupta and Brown are both considered to be analogous to the claimed invention because they are in the same field of anamoly detection system. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Gupta to incorporate the teachings of Brown and provide anamoly detection system. Doing so would provide secure streaming network, thereby increasing the device defendibility in the open network.
As per claim 15. Gupta and Brown disclose the non-transitory computer readable storage medium of claim 14, Gupta discloses wherein each log message comprises a date time of the log, a network device name or identifier, an error code, and an error description (0006 The analytics system generates log templates for candidate logs, based on learned patterns of cross-layer logs, to significantly reduce resources (e.g., memory, processing, etc.) used for determining critical logs. Candidate logs may include cross-layer logs collected within a time period surrounding the occurrence of a performance issue of a network application. Candidate logs may include a set of cross-layer logs from nodes of each layer in a computing infrastructure identified as associated with a performance issue of a network application. In some examples, the analytics system identifies candidate logs based on a knowledge graph specifying dependencies of nodes of each layer in the computing infrastructure).
As per claim 16. Gupta and Brown disclose the non-transitory computer readable storage medium of claim 14, Gupta discloses further including instructions stored thereon, which when read and executed by the one or more computer processors, cause the one or more computer processors to perform steps comprising: transforming the log messages( 0127] Analytics system 140 may, for each candidate log of the plurality of candidate logs, map the candidate log to a log template of a plurality of log templates, wherein each log template to which a candidate log is mapped is a mapped logged template (604) and [0128] Analytics system 140, or more specifically model service 154, may rank the mapped log templates based on properties of each of the mapped log templates (606). Model service 154 may rank the mapped log templates based on properties of mapped log templates, such as keywords included in the log template, a number of instances of the log template); and encoding the transformed log messages (Brown discloses 0080 defined interfaces through which electronically-encoded data is exchanged, process execution launched 0094 The OVF package can be encoded and stored as a single file or as a set of files ).
As per claim 17. Gupta and Brown disclose the non-transitory computer readable storage medium of claim 14, Gupta discloses further including instructions stored thereon, which when read and executed by the one or more computer processors, cause the one or more computer processors to perform steps comprising: calculating a uniqueness of each variable position for each template variable in each log template ( 0098 log analytics engine 446 may determine critical logs 470 based on a critical template score. Log analytics engine 446 may calculate a critical template score for each mapped log template. Log analytics engine 446 may calculate critical template scores based on multiple factors such as a time of occurrence with respect to when performance anomalies of a network application has occurred, a rarity of observed log templated in an analysis or inference window, a log template category assigned to the mapped log template, and whether the mapped log template includes insignificant keywords that often indicate logs that are not very critical. Log analytics engine 446 may assign each factor values corresponding to a weight each factor should influence a calculated critical template score. In some examples, log analytics engine 446 may multiply the weight values of each factor to generate a raw critical template score value between zero and negative infinity. Log analytics engine 446 may normalize (e.g., with a SoftMax function) the raw critical template score to generate a critical template score with a value between zero and one. Log analytics engine 446 may select a number of log templates based on critical template scores for log templates closest to one).
As per claim 18. Gupta and Brown disclose the non-transitory computer readable storage medium of claim 14, Gupta discloses wherein the rate anomaly is identified based on a rate of logs files in the aggregated streaming data for one of the log templates and the time anomaly is identified based on an average time between log files in the aggregated streaming data([0086] FIG. 3B is a block diagram illustrating an example knowledge graph of network layer nodes associated with a performance issue of a network application, in accordance with one or more techniques of this disclosure. Analytics system 240 may prune or limit the knowledge graph used to obtain candidate logs to reduce the number of candidate logs stored in log database 242 and processed by log analytics engine 246. Analytics system 240 may apply anomaly detection engine 258 to determine performance issues (e.g., latency) associated with service nodes 302A, 302B, and 302C. Analytics system 240 may apply dependency map generator service 256 to prune a knowledge graph (e.g., the knowledge graph of FIG. 3A) from the perspective of anomalous application layer nodes (e.g., generate a subgraph to include nodes associated with service nodes experiencing the performance issues). In the example of FIG. 3B, analytics system 240 may prune the knowledge graph of FIG. 3A to include service nodes 302A, 302B, 302C, compute nodes 304A, 304B, 304C, TOR switches 306A, 306B, and chassis switches 308A, 308B. Analytics system 240 may collect, filter, format, and tag logs based on the nodes included in the pruned knowledge graph of FIG. 3B. Analytics system 240 may store ingested cross-layer logs for the reduced number of nodes as candidate logs. In this way, log analytics engine 246 may analyze a fewer number of candidate logs, compared to the number of candidate logs ingested according to the knowledge graph of FIG. 3A, without impacting the accuracy of resulting critical logs. ).
As per claim 19. Gupta and Brown disclose the non-transitory computer readable storage medium of claim 14, Brown discloses wherein the self-healing action comprises disabling outside network connections, deploying additional hardware, and/or disabling a workflow (0138 the information streamed from agents within the nodes is used to classify the types of the nodes or, in other words, to partition the nodes into node groups, each of which represents a different node type [0113] Automated methods and systems described herein are implemented in a management system that collects and monitors multiple streams of metric data to detect anomalous behavior in applications running in a distributed computing system. The management system also collects log messages generated operating systems and the applications. When a problem is detected in the numerous streams of metric data, methods and systems generate an alert and identify log messages that may be used to determine the source the of the problem and determine appropriate remedial measures, i.e. a self-healing action, to correct the problem. And abstract, automatically, i.e. self-healing action, executed to correct the problem. And 0037 three autoregressive models. I.e. self-healing action).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ABU S SHOLEMAN whose telephone number is (571)270-7314. The examiner can normally be reached EST: 9am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, JORGE ORTIZ CRIADO can be reached at 571-272-7624. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ABU S SHOLEMAN/Primary Examiner, Art Unit 2496
Prosecution Insights