DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . This action is in response to the communication filed on 08/21/2026. Claims 9-16 are pending in this application.
Response to Arguments
Applicant’s election of claims 9-12, 13-16 (Claim Group II) in the reply filed on 08/21/2026 is acknowledged. Applicant has not stated if claims 9-12, 13-16 (Claim Group II) are elected with or without traverse. Based on Applicant’s remarks, the election has been treated as an election without traverse.
Claim Objections
Claims 9, 12-13 and 17 is objected to because of the following informalities:
Claims 9 and 13 recite the limitation “normal activity” in line 8 and line 10 respectively. It is unclear to the examiner if the limitation refers to “normal activity” recited in line 6 of claim 9 and line 7 of claim 13. For examination purpose, the limitation “normal activity” recited in line 8 of claim 9 and line 10 of claim 13 will read as “the normal activity.”
In Claim 12, line 6, appropriate indentation should be applied.
Claim 17 is marked as “(Original)” in line 1. Based on Applicant’s remarks, claim 17 should be marked as “(Withdrawn)” in line 1.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 9-16 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claims 9 and 13 recite the limitation “the information describing activity” in line 5 and line 7 respectively. It is unclear to the examiner if the limitation refers “information describing current activity” recited in line 4 of claim 9 and line 6 of claim 13. For examination purpose, “the information describing activity” recited in line 5 of claim 9 and line 7 of claim 13 will read as ““the information describing current activity.”
The dependent claims of the above rejected claims are rejected due to their dependencies.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 9-16 is/are rejected under 35 U.S.C. 102 (a)(1) as being anticipated by US 20220400129 A1 (hereinafter Kapoor).
For Claim 9, Kapoor teaches a method (Kapoor, FIG. 12; para. [0682] “… FIG. 12 sets forth a flow chart illustrating an example method of detecting deviation from normal behavior of a user device …”) comprising:
generating, using information describing activity associated with a user device, a trained model for detecting normal activity for the user device (Kapoor, FIG. 12; Examiner notes that Kapoor was published with different Applicant, therefore no Double Patenting rejection is issued; para. [0683] “… The example method depicted in FIG. 12 includes generating 1202, using information describing historical activity associated with a user device, a trained model for detecting normal activity for the user device …”);
gathering information describing current activity associated with the user device (Kapoor, FIG. 12; para. [0685] “… The example method depicted in FIG. 12 also includes gathering 1204 information describing current activity associated with the user device …”);
determining, by using the information describing activity associated with a user device as input to the trained model, whether the user device has deviated from normal activity (Kapoor, FIG. 12; para. [0686] “… The example method depicted in FIG. 12 also includes determining 1206, by using the information describing current activity associated with the user device as input to the trained model, whether the user device has deviated from normal activity …”);
initiating a remediation workflow in response to a determination that the user device has deviated from normal activity (Kapoor, FIG. 14; para. [0698] “… The example method depicted in FIG. 14 also includes initiating 1406 a remediation workflow after determining that the user device has deviated from normal activity …”).
For Claim 10, Kapoor teaches the method of claim 9 further comprising periodically retraining the trained model (Kapoor, FIG. 14; para. [0696] “… The example method depicted in FIG. 14 also includes periodically 1402 retraining the trained model …”).
For Claim 11, Kapoor teaches the method of claim 9, wherein generating, using information describing activity associated with a user device, a trained model for detecting normal activity for the user device (Kapoor, FIG. 12; para. [0683] “… Generating 1202 a trained model for detecting normal activity for the user device using information describing historical activity associated with a user device may therefore be carried out, for example, by applying one or more machine learning algorithms to a training dataset that includes the information describing the historical activity associated with the user device …”) further comprises performing one or more of:
generating the trained model using information describing physical geolocations corresponding to user device utilization (Kapoor, FIG. 12, FIG. 13; para. [0683] “… The information describing the historical activity associated with the user device can include, for example, information describing the locations at which the user device was utilized at some point in the past ….”; para. [0688] “… In the example method depicted in FIG. 13, generating 1202 a trained model for detecting normal activity for the user device can include generating 1302 the trained model using information describing physical locations at which the user device was utilized …”);
generating the trained model using information describing usage of one or more applications accessed by the user device (Kapoor, FIG. 12, FIG. 13; para. [0683] “… information describing the applications on the user device that were executed at some point in the past …”; para. [0689] “… In the example method depicted in FIG. 13, generating 1202 a trained model for detecting normal activity for the user device can include generating 1304 the trained model using information describing usage of one or more applications executed on the user device …”);
generating the trained model using information describing times at which activity on the user device occurred (Kapoor, FIG. 12, FIG. 13; para. [0683] “… information describing the dates and times the applications on the user device that were executed, and so on …”; para. [0690] “… In the example method depicted in FIG. 13, generating 1202 a trained model for detecting normal activity for the user device can include generating 1306 the trained model using information describing times at which activity previously occurred …”).
For Claim 12, Kapoor teaches the method of claim 9, wherein gathering information describing current activity associated with the user device further comprises performing one or more of:
gathering information describing a physical geolocation at which the user device is currently being used (Kapoor, FIG. 13; para. [0692] “… In the example method depicted in FIG. 13, gathering 1204 information describing current activity associated with the user device can include gathering 1308 information describing a physical location at which the user device is currently being used …”);
gathering information describing usage of applications accessed by the user device (Kapoor, FIG. 13; para. [0693] “… In the example method depicted in FIG. 13, gathering 1204 information describing current activity associated with the user device can include gathering 1310 information describing usage of applications that are being accessed by the user device …”);
gathering information describing times at which current activity occurred on the user device (Kapoor, FIG. 13; para. [0694] “… In the example method depicted in FIG. 13, gathering 1204 information describing current activity associated with the user device can include gathering 1312 information describing times at which current activity occurred on the device …”).
For Claim 13, the claim is substantially similar to claim 9 and therefore is rejected for the same reasoning set forth above. Additionally, Kapoor teaches a non-transitory computer-readable medium having stored thereon instructions that, when executed by one or more hardware processors, are configurable to cause the hardware processors to (Kapoor, para. [0090] “… A non-transitory computer-readable medium as referred to herein may include any non-transitory storage medium that participates in providing data (e.g., instructions) that may be read and/or executed by a computing device (e.g., by a processor of a computing device) …”).
For Claim 14, the claim is substantially similar to claim 10 and therefore is rejected for the same reasoning set forth above.
For Claim 15, the claim is substantially similar to claim 11 and therefore is rejected for the same reasoning set forth above.
For Claim 16 the claim is substantially similar to claim 12 and therefore is rejected for the same reasoning set forth above.
Citation of Pertinent Prior Art
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure is listed below, thank you:
i. US 11,424,976 B1 (Adamo) teaches detecting anomalies that indicate potential system infrastructure problems. The method includes: obtaining a first set of telemetry data that relates to a system infrastructure events, logs, and metrics that occur during a predetermined time interval; retrieving, from a memory, historical data that relates to system infrastructure telemetry; comparing the obtained first set of telemetry data with the retrieved historical data; detecting an anomaly based on a result of the comparing; and determining a potential system infrastructure problem based on the detected anomaly. The method may include using a machine learning algorithm to analyze the obtained first set of telemetry data; identify a pattern in the data; assign scores to the events included in the data; and use the pattern and/or the scores to detect the anomaly using an artificial intelligence (AI) model that is trained using the retrieved historical data (Abstract).
ii. US 8,561,142 B1 (Sobel) teaches that a plurality of computing devices used to access backend computing resources of an enterprise by a specific user are identified, and geo-locations of the devices at specific times are tracked. A trusted authentication is received from a specific one of the devices. Responsive to the trusted authentication, the specific device is classified as the primary node of a trusted cluster, and the current geo-location of the user is defined as the geo-location of the specific device, as of the time of the trusted authentication. Devices are assigned to a logical trusted device clusterorto a logical non-trusted device cluster, based on distances between the device geo-locations and the current geo-location of the user, and based on differences between establishment times of the device geo-locations and the establishment time of the user's geo-location (Abstract).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ZONGHUA DU whose telephone number is (408)918-7596. The examiner can normally be reached Monday - Friday 8 AM - 5 PM PST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, John Follansbee can be reached on (571) 272-3964. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Z.D./Examiner, Art Unit 2444
/SCOTT B CHRISTENSEN/Primary Examiner, Art Unit 2444
Prosecution Insights