DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
In response to communications filed on 23 April 2025, claims 1-20 are presently pending in the application, of which, claims 1, 9 and 17 are presented in independent form. The Examiner acknowledges amended claims 1, 3, 7-9, 11, 15-17, and 19-20. No claims were cancelled or newly added.
Response to Remarks/Arguments
All objections and/or rejections issued in the previous Office Action, mailed 23 January 2026, have been withdrawn, unless otherwise noted in this Office Action.
Applicant’s arguments, see supra, with respect to the rejections of claims 1-20 under 35 U.S.C. 102(a)(1)/(a)(2) have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Li, Xiaoting, et al (U.S. 2025/0190804, filed 21 March 2023, claiming the benefits of provisional application No. 63/338,089, filed 04 May 2022, and known hereinafter as Li).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable by Muddu, Sudhakar, et al (U.S. 2018/0302423 and known hereinafter as Muddu) in view of Li, Xiaoting, et al (U.S. 2025/0190804, filed 21 March 2023, claiming the benefits of provisional application No. 63/338,089, filed 04 May 2022, and known hereinafter as Li)(newly presented).
As per claim 1, Muddu teaches a method comprising:
monitoring, by at least one processor, execution of a first computer model configured (e.g. Muddu, see paragraph [0274], which discloses machine leanring CEP engine that monitors for computer security issues) dynamically generate data slices of aggregated network operation data (e.g. Muddu, see paragraphs [02743-0275], which discloses generating and analyzing machine-learning based CEP based time slices; Muddu, see paragraph [0158], which discloses the output may be analyzed by various applications such as a threat detection application.), entropy values, and information gain values (e.g. Muddu, see paragraph [0623], which discloses machine-generated nature of a character-based identifier (e.g. value) is a high degree of entropy or randomness in the sequencing of characters.);
collecting, by the at least one processor, data associated with operation of the first computer model (e.g. Muddu, see paragraphs [0161-0162], which discloses event data is collected over batch processing for detecting anomalies, thread indicators and threat, where the event data contains a collection of events that have arrived over a batch period.), the data comprising at least one of:
attributes used to generate data slices, entropy values calculated for the data slices, information gain values calculated for the data slices, or traversal paths taken by the first computer model within a hierarchy of data slices (e.g. Muddu, see paragraphs [0278-0279], which discloses machine learning models enable to perform many types of analysis from event data sources in various contextual settings, where the machine leaning model can perform entity-specific behavior analysis, such as entropy/randomness/n-gram analysis based on a time slice of the event data.);
training, by the at least one processor, the second computer model using the collected data (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model.), wherein the second computer model is configured to learn patterns in data slicing and anomaly detection from the first computer model (e.g. Muddu, see paragraphs [0205-0206], which discloses performing pattern matching for all known formats to determine the most likely format of a particular event data, where the format detector can employ a number of heuristics that can use a hierarchical way to perform pattern matching on event data.); and
executing, by the at least one processor, the second computer model, instead of the first computer model, on a new set of aggregated network operation data to predict an anomalous data slice (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model and continuously receive new incoming event feature sets and reacts to new incoming feature set by processing it through at least one machine learning model, based on time slice of the unbounded stream prior to when a subsequent time slice from the unbounded stream become available.).
Muddu does not explicitly disclose wherein the entropy values indicate of a difference in data values across rolling time windows of the data slices within the aggregated network operation data; transmitting, by at least one processor, the collected data associated with the operation of the first computer model from the first computer model to a second computer model; based on the entropy values and the information gain values, and wherein the second computer model is separate from the first computer model.
Li teaches wherein the entropy values indicate of a difference in data values across rolling time windows of the data slices within the aggregated network operation data (e.g. Li, see paragraphs [0071-0072], which discloses a hybrid entropy reduction for the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for that candidate node.);
transmitting, by at least one processor, the collected data associated with the operation of the first computer model from the first computer model to a second computer model (e.g. Li, see paragraphs [0104-0107], which discloses simulating a GNN training and estimating the training results of the labeling and updating the graph entropy for determining a hybrid uncertainty reduction of labeling different candidate nodes, where the current entropy graph may be determined based on the prediction of each node of the plurality of nodes.);
based on the entropy values and the information gain values, and wherein the second computer model is separate from the first computer model (e.g. Li, see paragraphs [0096-0099], which discloses training a graph neural network, where the transaction provider system may train a two-layer graph convolution network model to train on the input graph and perform a classification task, based on a current graph entropy.)
Muddu is directed to network security anomaly and threat detection using rarity scoring. Li is directed to active learning in graph neural networks through hybrid uncertainty reduction. Both are analogous art because they are directed to entropy values and gradual degradation and therefore it would have been obvious to one of ordinary skilled in the art at the time the invention was filed to modify the teachings of Muddu with the teachings of Li to include the claimed features with the motivation to improve detection of gradual rate reduction.
As per claim 9, Muddu teaches a non-transitory machine-readable storage medium having computer-executable instructions stored thereon that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
monitoring, by at least one processor, execution of a first computer model configured (e.g. Muddu, see paragraph [0274], which discloses machine leanring CEP engine that monitors for computer security issues) dynamically generate data slices of aggregated network operation data (e.g. Muddu, see paragraphs [02743-0275], which discloses generating and analyzing machine-learning based CEP based time slices; Muddu, see paragraph [0158], which discloses the output may be analyzed by various applications such as a threat detection application.), entropy values, and information gain values (e.g. Muddu, see paragraph [0623], which discloses machine-generated nature of a character-based identifier (e.g. value) is a high degree of entropy or randomness in the sequencing of characters.);
collecting, by the at least one processor, data associated with operation of the first computer model (e.g. Muddu, see paragraphs [0161-0162], which discloses event data is collected over batch processing for detecting anomalies, thread indicators and threat, where the event data contains a collection of events that have arrived over a batch period.), the data comprising at least one of:
attributes used to generate data slices, entropy values calculated for the data slices, information gain values calculated for the data slices, or traversal paths taken by the first computer model within a hierarchy of data slices (e.g. Muddu, see paragraphs [0278-0279], which discloses machine learning models enable to perform many types of analysis from event data sources in various contextual settings, where the machine leaning model can perform entity-specific behavior analysis, such as entropy/randomness/n-gram analysis based on a time slice of the event data.);
training, by the at least one processor, the second computer model using the collected data (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model.), wherein the second computer model is configured to learn patterns in data slicing and anomaly detection from the first computer model (e.g. Muddu, see paragraphs [0205-0206], which discloses performing pattern matching for all known formats to determine the most likely format of a particular event data, where the format detector can employ a number of heuristics that can use a hierarchical way to perform pattern matching on event data.); and
executing, by the at least one processor, the second computer model, instead of the first computer model, on a new set of aggregated network operation data to predict an anomalous data slice (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model and continuously receive new incoming event feature sets and reacts to new incoming feature set by processing it through at least one machine learning model, based on time slice of the unbounded stream prior to when a subsequent time slice from the unbounded stream become available.).
Muddu does not explicitly disclose wherein the entropy values indicate of a difference in data values across rolling time windows of the data slices within the aggregated network operation data; transmitting, by at least one processor, the collected data associated with the operation of the first computer model from the first computer model to a second computer model; based on the entropy values and the information gain values, and wherein the second computer model is separate from the first computer model.
Li teaches wherein the entropy values indicate of a difference in data values across rolling time windows of the data slices within the aggregated network operation data (e.g. Li, see paragraphs [0071-0072], which discloses a hybrid entropy reduction for the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for that candidate node.);
transmitting, by at least one processor, the collected data associated with the operation of the first computer model from the first computer model to a second computer model (e.g. Li, see paragraphs [0104-0107], which discloses simulating a GNN training and estimating the training results of the labeling and updating the graph entropy for determining a hybrid uncertainty reduction of labeling different candidate nodes, where the current entropy graph may be determined based on the prediction of each node of the plurality of nodes.);
based on the entropy values and the information gain values, and wherein the second computer model is separate from the first computer model (e.g. Li, see paragraphs [0096-0099], which discloses training a graph neural network, where the transaction provider system may train a two-layer graph convolution network model to train on the input graph and perform a classification task, based on a current graph entropy.)
Muddu is directed to network security anomaly and threat detection using rarity scoring. Li is directed to active learning in graph neural networks through hybrid uncertainty reduction. Both are analogous art because they are directed to entropy values and gradual degradation and therefore it would have been obvious to one of ordinary skilled in the art at the time the invention was filed to modify the teachings of Muddu with the teachings of Li to include the claimed features with the motivation to improve detection of gradual rate reduction.
As per claim 17, Muddu teaches a system comprising at least one processor configured to:
monitoring, by at least one processor, execution of a first computer model configured (e.g. Muddu, see paragraph [0274], which discloses machine leanring CEP engine that monitors for computer security issues) dynamically generate data slices of aggregated network operation data (e.g. Muddu, see paragraphs [02743-0275], which discloses generating and analyzing machine-learning based CEP based time slices; Muddu, see paragraph [0158], which discloses the output may be analyzed by various applications such as a threat detection application.), entropy values, and information gain values (e.g. Muddu, see paragraph [0623], which discloses machine-generated nature of a character-based identifier (e.g. value) is a high degree of entropy or randomness in the sequencing of characters.);
collecting, by the at least one processor, data associated with operation of the first computer model (e.g. Muddu, see paragraphs [0161-0162], which discloses event data is collected over batch processing for detecting anomalies, thread indicators and threat, where the event data contains a collection of events that have arrived over a batch period.), the data comprising at least one of:
attributes used to generate data slices, entropy values calculated for the data slices, information gain values calculated for the data slices, or traversal paths taken by the first computer model within a hierarchy of data slices (e.g. Muddu, see paragraphs [0278-0279], which discloses machine learning models enable to perform many types of analysis from event data sources in various contextual settings, where the machine leaning model can perform entity-specific behavior analysis, such as entropy/randomness/n-gram analysis based on a time slice of the event data.);
training, by the at least one processor, the second computer model using the collected data (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model.), wherein the second computer model is configured to learn patterns in data slicing and anomaly detection from the first computer model (e.g. Muddu, see paragraphs [0205-0206], which discloses performing pattern matching for all known formats to determine the most likely format of a particular event data, where the format detector can employ a number of heuristics that can use a hierarchical way to perform pattern matching on event data.); and
executing, by the at least one processor, the second computer model, instead of the first computer model, on a new set of aggregated network operation data to predict an anomalous data slice (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model and continuously receive new incoming event feature sets and reacts to new incoming feature set by processing it through at least one machine learning model, based on time slice of the unbounded stream prior to when a subsequent time slice from the unbounded stream become available.).
Muddu does not explicitly disclose wherein the entropy values indicate of a difference in data values across rolling time windows of the data slices within the aggregated network operation data; transmitting, by at least one processor, the collected data associated with the operation of the first computer model from the first computer model to a second computer model; based on the entropy values and the information gain values, and wherein the second computer model is separate from the first computer model.
Li teaches wherein the entropy values indicate of a difference in data values across rolling time windows of the data slices within the aggregated network operation data (e.g. Li, see paragraphs [0071-0072], which discloses a hybrid entropy reduction for the graph is determined as a difference between the current entropy of the graph and the updated entropy of the graph determined for that candidate node.);
transmitting, by at least one processor, the collected data associated with the operation of the first computer model from the first computer model to a second computer model (e.g. Li, see paragraphs [0104-0107], which discloses simulating a GNN training and estimating the training results of the labeling and updating the graph entropy for determining a hybrid uncertainty reduction of labeling different candidate nodes, where the current entropy graph may be determined based on the prediction of each node of the plurality of nodes.);
based on the entropy values and the information gain values, and wherein the second computer model is separate from the first computer model (e.g. Li, see paragraphs [0096-0099], which discloses training a graph neural network, where the transaction provider system may train a two-layer graph convolution network model to train on the input graph and perform a classification task, based on a current graph entropy.)
Muddu is directed to network security anomaly and threat detection using rarity scoring. Li is directed to active learning in graph neural networks through hybrid uncertainty reduction. Both are analogous art because they are directed to entropy values and gradual degradation and therefore it would have been obvious to one of ordinary skilled in the art at the time the invention was filed to modify the teachings of Muddu with the teachings of Li to include the claimed features with the motivation to improve detection of gradual rate reduction.
As per claims 2, 10, and 18, the modified teachings of Muddu and Li teaches the method of claim 1, the non-transitory machine-readable storage medium of claim 9, and the system of claim 17, respectively, further comprising:
presenting, by the at least one processor on a user interface, a visual representation of the predicted anomalous data slice (e.g. Muddu, see paragraphs [0438-0439], which discloses visualization features are generated to illustrate trends, recent activity, and relationship between different data.).
As per claims 3, 11, and 19, the modified teachings of Muddu and Li teaches the method of claim 2, the non-transitory machine-readable storage medium of claim 10, and the system of claim 18, respectively, wherein the visual representation is a graph indicating a traverse path associated with a set of data slices within the new set of aggregated transaction data and the predicted anomalous data slice (e.g. Muddu, see paragraphs [0438-0439], which discloses visualization features are generated to illustrate trends, recent activity, and relationship between different data.).
As per claims 4 and 12, the modified teachings of Muddu and Li teaches the method of claim 1 and the non-transitory machine-readable storage medium of claim 9, respectively, further comprising:
receiving, by the at least one processor, an indication of a false positive anomaly (e.g. Muddu, see paragraph [0477], which discloses a user to tag a threat with false positive.); and
recalibrating, by the at least one processor, the second computer model to revise at least one variable used by the first computer model in accordance with an attribute of the false positive anomaly (e.g. Muddu, see paragraph [0151], which discloses anomalies and threats detected by real-time processing path may be employed to automatically trigger an action, where false positives can be provided as feedback data in order to update and improve the model.).
As per claims 5, 13, and 20, the modified teachings of Muddu and Li teaches the method of claim 4, the non-transitory machine-readable storage medium of claim 12, and the system of claim 17, respectively, wherein the attribute of the false positive anomaly is an authorization rate (e.g. Muddu, see paragraph [0151], which discloses anomalies and threats detected by real-time processing path may be employed to automatically trigger an action, where false positives can be provided as feedback data in order to update and improve the model.).
As per claims 6 and 14, the modified teachings of Muddu and Li teaches the method of claim 1 and the non-transitory machine-readable storage medium of claim 9, respectively, wherein the second computer model uses a boosted tree algorithm optimized using the information gain values of at least one data slice (e.g. Muddu, see paragraph [0277], which discloses the machine language-based CEP engine can train a decision tree based on the historical events.).
As per claims 7 and 15, the modified teachings of Muddu and Li teaches the method of claim 1 and the non-transitory machine-readable storage medium of claim 9, respectively, further comprising:
periodically executing, by the at least one processor, the second computer model on the new set of aggregated transaction data (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model and continuously receive new incoming event feature sets and reacts to new incoming feature set by processing it through at least one machine learning model, based on time slice of the unbounded stream prior to when a subsequent time slice from the unbounded stream become available.); and
transmitting, by the at least one processor, an alert when the predicted anomalous data slice is identified (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model and continuously receive new incoming event feature sets and reacts to new incoming feature set by processing it through at least one machine learning model, based on time slice of the unbounded stream prior to when a subsequent time slice from the unbounded stream become available.).
As per claims 8 and 16, the modified teachings of Muddu and Li teaches the method of claim 1 and the non-transitory machine-readable storage medium of claim 9, respectively, further comprising:
generating, by the at least one processor, a predicted remedial action corresponded to the predicted anomalous data slice (e.g. Muddu, see paragraphs [0273-0274], which discloses machine learning based engine utilizes distributed training and deliberation of one or more machine learning models, where the machine learning model involves processing data through a model state of the machine learning model.).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure. See attached PTO-892 that includes additional prior art of record describing the general state of the art in which the invention is directed to.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to FARHAN M SYED whose telephone number is (571)272-7191. The examiner can normally be reached M-F 8:30AM-5:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Apu Mofiz can be reached at 571-272-4080. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/FARHAN M SYED/Primary Examiner, Art Unit 2161 July 1, 2026
Prosecution Insights