Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement(s) (IDS) submitted on August 10, 2026, and November 12, 2025, are being considered by the examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim [ 1, 4, 9, 12, 16, 19] are rejected under 35 U.S.C. 103 as being unpatentable over
Bu (US 2025/0225323 Al, hereinafter Bu) in view of Deutsch (US 12,164,548 B, hereinafter Deutsch) and in further view of Belgi (US 12,641,110 B2, hereinafter Belgi).
Regarding claim 1,
Bu teaches
A method comprising:
retrieving a plurality of security alerts from a database;
[0030 "retrieves alert logs from the alert repository 108"]
[0027 "The alert repository 108 may be implemented using a database, data warehouse, and/or cloud storage."]
transmitting a prompt to a large language model, the prompt including formatting instructions and the plurality of security alerts;
[0030 "For example, the prompt engine 110 may retrieve alert logs that are deemed to be related to a detected system incident and provide the retrieved logs as
part of a summarization prompt that is provided to a generative machine learning model."]
[0030 "As another example, the prompt engine 110 may retrieve alert logs that occur within a period that includes a detected incident time and/or in
relation to a system component ( e.g., an endpoint device) affected by a detected incident, and provide these retrieved logs as part of a summarization prompt that is provided to
the generative machine learning model."]
[0031 "For example, the summarization prompt may specify one or more structural constraints."]
[0031 "For example, a structural constraint may require that a summarization output have a certain structure, such as including a title, an introductory paragraph, one or more paragraphs summarizing key details about alert groups, and a concluding paragraph.]
However, Bu does not teach
receiving a model response from the large language model, the model response including structured data configured to render an interface, the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event; and
transmitting the model response to application, the model response being to cause the application to render the interface.
But Deutsch teaches
receiving a model response from the large language model, the model response including structured data configured to render an interface,
[Column 7, lines 7-9 "The structured data in the response can be recognized by the front end 172 and used to render the structured data in a visual format."]
transmitting the model response to application, the model response being to cause the application to render the interface.
[Column 7, lines 7-9 "The structured data in the response can be recognized by the front end 172 and used to render the structured data in a visual format."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu with Deutsch because the application could automatically present the generated alert summaries in organized, interactive visual formats, helping analysts review and understand the results.
However, Bu in view of Deutsch do not teach
the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event
But Belgi teaches
the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event; and
[Column 19, lines 61-67 "..and the LLM 444 generates an Attack Chain Description 446, including its discrete steps, and further describing each step in the attack chain and which Alerts were already received in the organization for that step ( e.g., Attack Chain step 1, received so far 17 related alerts; Attack Chain step 2, received so far 8 related alerts; Attack Chain step 3, receives so far 5 related alerts)."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu in view of Deutsch with Belgi so that the rendered summaries identify coordinated attack activity and associate relevant alerts with attach-chain steps, helping analysts understand how individual alerts related to a security incident.
Regarding claim 4, rejection of claim 1 is incorporated.
Bu teaches
The method of claim 1, further comprising:
determining whether the model response achieves a formatting structure defined by the
formatting instructions; and
in response to the model response being determined as achieving the formatting structure
defined by the formatting instructions, transmitting the model response to the
[0039 "For example, the output validation layer 114 may reject those summarization outputs that fail to satisfy structural constraints, completeness constraints, conciseness constraints, and/or correctness constraints. After the output validation layer 114 determines N validated summarization
outputs, the ranking layer 116 generates N corresponding scores for those N summarization outputs. The ranking layer 116 may then provide an output to a client system 118 based on a subset of the N summarization outputs as determined based on the N corresponding scores."]
However, Bu does not teach application
But Deutsch teaches application
[Column 7, lines 7-9 "The structured data in the response can be recognized by the front end 172 and used to render the structured data in a visual format." where front end 172 maps to the application receiving and rendering the structured model response]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu with Deutsch so that responses satisfying the prompt's formatting requirements are transmitted for rendering, reducing formatting errors in the displayed output.
Regarding claim 9
Bu teaches
An apparatus comprising:
at least one processor; and a non-transitory computer-readable medium storing executable instructions that cause the at least one processor to execute operations, the operations comprising:
[0012 “Additionally, the techniques described herein may be performed by a system and/or device having non-transitory computer-readable media storing computer-executable
instructions that, when executed by one or more processors, performs the method described above.”]
retrieving a plurality of security alerts from a database;
[0030 "retrieves alert logs from the alert repository 108"]
[0027 "The alert repository 108 may be implemented using a database, data warehouse, and/or cloud storage."]
transmitting a prompt to a large language model, the prompt including formatting instructions and the plurality of security alerts;
[0030 "For example, the prompt engine 110 may retrieve alert logs that are deemed to be related to a detected system incident and provide the retrieved logs as
part of a summarization prompt that is provided to a generative machine learning model."]
[0030 "As another example, the prompt engine 110 may retrieve alert logs that occur within a period that includes a detected incident time and/or in
relation to a system component ( e.g., an endpoint device) affected by a detected incident, and provide these retrieved logs as part of a summarization prompt that is provided to
the generative machine learning model."]
[0031 "For example, the summarization prompt may specify one or more structural constraints."]
[0031 "For example, a structural constraint may require that a summarization output have a certain structure, such as including a title, an introductory paragraph, one or more paragraphs summarizing key details about alert groups, and a concluding paragraph.]
However, Bu does not teach
receiving a model response from the large language model, the model response including structured data configured to render an interface, the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event; and
transmitting the model response to application, the model response being to cause the application to render the interface.
But Deutsch teaches
receiving a model response from the large language model, the model response including structured data configured to render an interface,
[Column 7, lines 7-9 "The structured data in the response can be recognized by the front end 172 and used to render the structured data in a visual format."]
transmitting the model response to application, the model response being to cause the application to render the interface.
[Column 7, lines 7-9 "The structured data in the response can be recognized by the front end 172 and used to render the structured data in a visual format."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu with Deutsch because the application could automatically present the generated alert summaries in organized, interactive visual formats, helping analysts review and understand the results.
However, Bu in view of Deutsch do not teach
the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event
But Belgi teaches
the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event; and
[Column 19, lines 61-67 "..and the LLM 444 generates an Attack Chain Description 446, including its discrete steps, and further describing each step in the attack chain and which Alerts were already received in the organization for that step ( e.g., Attack Chain step 1, received so far 17 related alerts; Attack Chain step 2, received so far 8 related alerts; Attack Chain step 3, receives so far 5 related alerts)."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu with Deutsch with Belgi so that the rendered summaries identify coordinated attack activity and associate relevant alerts with attach-chain steps, helping analysts understand how individual alerts related to a security incident.
Regarding claim 12, rejection of claim 9 is incorporated.
The apparatus of claim 9, wherein the operations further comprise:
determining whether the model response achieves a formatting structure defined by the
formatting instructions; and
in response to the model response being determined as achieving the formatting structure
defined by the formatting instructions, transmitting the model response to the application.
Claim 12 is rejected for the same reasons as claim 4.
Regarding claim 16
Bu teaches
A non-transitory computer-readable medium storing executable instructions that when executed by at least one processor cause the at least one processor to execute operations, the operations further comprising:
[0012 “Additionally, the techniques described herein may be performed by a system and/or device having non-transitory computer-readable media storing computer-executable
instructions that, when executed by one or more processors, performs the method described above.”]
retrieving a plurality of security alerts from a database;
[0030 "retrieves alert logs from the alert repository 108"]
[0027 "The alert repository 108 may be implemented using a database, data warehouse, and/or cloud storage."]
transmitting a prompt to a large language model, the prompt including formatting instructions and the plurality of security alerts;
[0030 "For example, the prompt engine 110 may retrieve alert logs that are deemed to be related to a detected system incident and provide the retrieved logs as
part of a summarization prompt that is provided to a generative machine learning model."]
[0030 "As another example, the prompt engine 110 may retrieve alert logs that occur within a period that includes a detected incident time and/or in
relation to a system component ( e.g., an endpoint device) affected by a detected incident, and provide these retrieved logs as part of a summarization prompt that is provided to
the generative machine learning model."]
[0031 "For example, the summarization prompt may specify one or more structural constraints."]
[0031 "For example, a structural constraint may require that a summarization output have a certain structure, such as including a title, an introductory paragraph, one or more paragraphs summarizing key details about alert groups, and a concluding paragraph.]
receiving a model response from the large language model, the model response including structured data configured to render an interface, the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event; and
transmitting the model response to application, the model response being to cause the application to render the interface.
However, Bu does not teach
receiving a model response from the large language model, the model response including structured data configured to render an interface, the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event; and
transmitting the model response to application, the model response being to cause the application to render the interface.
But Deutsch teaches
receiving a model response from the large language model, the model response including structured data configured to render an interface, the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event; and
[Column 7, lines 7-9 "The structured data in the response can be recognized by the front end 172 and used to render the structured data in a visual format."]
transmitting the model response to application, the model response being to cause the application to render the interface.
[Column 7, lines 7-9 "The structured data in the response can be recognized by the front end 172 and used to render the structured data in a visual format."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu with Deutsch because the application could automatically present the generated alert summaries in organized, interactive visual formats, helping analysts review and understand the results.
However, Bu in view of Deutsch do not teach
the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event
But Belgi teaches
the structured data including information about a security insight event detected by the large language model using the plurality of security alerts, the structured data identifying a portion of the plurality of security alerts as related to the security insight event; and
[Column 19, lines 61-67 "..and the LLM 444 generates an Attack Chain Description 446, including its discrete steps, and further describing each step in the attack chain and which Alerts were already received in the organization for that step ( e.g., Attack Chain step 1, received so far 17 related alerts; Attack Chain step 2, received so far 8 related alerts; Attack Chain step 3, receives so far 5 related alerts)."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu with Deutsch with Belgi so that the rendered summaries identify coordinated attack activity and associate relevant alerts with attach-chain steps, helping analysts understand how individual alerts related to a security incident.
Regarding claim 19, rejection of claim 16 is incorporated.
Bu in view Deutsch teach the non-transitory computer-readable medium of claim 16, wherein the operations further comprise: determining whether the model response achieves a formatting structure defined by the formatting instructions; and in response to the model response being determined as achieving the formatting structure defined by the formatting instructions, transmitting the model response to the application
Claim 16 is rejected for the same reasons as claim 4.
Claim [ 2, 10, 17 ] are rejected under 35 U.S.C. 103 as being unpatentable over
Bu (US 2025/0225323 Al, hereinafter Bu) in view of Deutsch (US 12,164,548 B, hereinafter Deutsch) and in further view of Belgi (US 12,641,110 B2, hereinafter Belgi) and in further view of Gomez (US 12554888 B2, hereinafter Gomez).
Regarding claim 2, rejection of claim 1 is incorporated.
Bu teaches
The method of claim 1, further comprising:
[0026 "Additional security protection systems 102N may perform other types of security monitoring and generate associated monitoring alert logs"]
However, Bu in view of Deutsch in view of Belgi do not teach
generating anonymized
Gomez teaches
generating anonymized
[Column 13, lines 32-35 "An anonymous prompt 530 is modified from the original prompt 510 by replacing sensitive data with corresponding anonymized information ( e.g., hash values). The anonymous prompt 530 can then be submitted to the LLM."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi with Gomez to replace sensitive entity values in security alerts before including the alerts in the LLM prompt, thereby protecting sensitive information while permitting analysis of the alerts.
Regarding claim 10, rejection of claim 9 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Gomez teaches
The apparatus of claim 9, wherein the operations further comprise:
generating anonymized security alerts from the plurality of security alerts by converting a non-anonymized value of an entity mentioned in a security alert to an anonymized value, wherein the anonymized security alerts are included in the prompt.
Claim 10 is rejected for the same reasons as claim 2.
Regarding claim 17, rejection of claim 16 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Gomez teaches
The non-transitory computer-readable medium of claim 16, wherein the operations further comprise: generating anonymized security alerts from the plurality of security alerts by converting a non-anonymized value of an entity mentioned in a security alert to an anonymized value, wherein the anonymized security alerts are included in the prompt.
Claim 17 is rejected for the same reasons as claim 2.
Claim [ 3, 11, 18 ] are rejected under 35 U.S.C. 103 as being unpatentable over
Bu (US 2025/0225323 Al, hereinafter Bu) in view of Deutsch (US 12,164,548 B, hereinafter Deutsch) and in further view of Belgi (US 12,641,110 B2, hereinafter Belgi) and in further view of Rabin (US 2025/0307546 Al, hereinafter Rabin).
Regarding claim 3, rejection of claim 1 is incorporated.
Bu teaches
The method of claim 1, wherein the plurality of security alerts retrieved from the database include a first format, the method further comprising:
the plurality of security alerts
[0027 "The alert repository 108 may be implemented using a database, data warehouse, and/or cloud storage."]
[0027 "The alert repository 108 may receive the monitoring alert logs in real-time from the monitoring components 102 and the received alert logs in a structured
and/or semi-structured format for efficient retrieval and/or analysis."]
[0030 "For example, the prompt engine 110 may retrieve alert logs that are deemed to be related to a detected system incident and provide the retrieved logs as
part of a summarization prompt that is provided to a generative machine learning model."]
Bu in view of Deutsch in view of Belgi does not teach
converting the plurality of security alerts from the first format to a second format,
But Rabin teaches
converting the plurality of security alerts from the first format to a second format,
[0063 "Postprocessing 625 may convert the generated sequence into a format that may be interpreted by a large language model."]
[0068 "The plurality of machine learning models may each be configured to convert the input for the at least one large language model in view of a summarization
related task, a code analysis related task, a log analysis related task, an audit analysis related task, or a configuration related task."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi with Rabin so that prompt presents those logs in a format suited to the Large Language model.
Regarding claim 11, rejection of claim 9 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Rabin teach the apparatus of claim 9, wherein
the plurality of security alerts retrieved from the database include a first format, wherein the operations further comprise: converting the plurality of security alerts from the first format to a second format, the plurality of security alerts with the second format being included in the prompt.
Claim 11 is rejected for the same reasons as claim 3.
Regarding claim 18, rejection of claim 16 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Rabin teach the non-transitory computer-readable medium of claim 16, wherein the plurality of security alerts retrieved from the database include a first format, wherein the operations further comprise: converting the plurality of security alerts from the first format to a second format, the plurality of security alerts with the second format being included in the prompt.
Claim 18 is rejected for the same reasons as claim 3.
Claim [ 5 ] are rejected under 35 U.S.C. 103 as being unpatentable over
Bu (US 2025/0225323 Al, hereinafter Bu) in view of Deutsch (US 12,164,548 B, hereinafter Deutsch) and in further view of Belgi (US 12,641,110 B2, hereinafter Belgi) and in further view of Nelson (US 2020/0371679 Al, hereinafter Nelson).
Regarding claim 5, rejection of claim 1 is incorporated.
Bu in view of Deutsch in view of Belgi teaches
The method of claim 1
Belgi teaches
[Column 19, lines 61-67 "..and the LLM 444 generates an Attack Chain Description 446, including its discrete steps, and further describing each step in the attack chain and which Alerts were already received in the organization for that step ( e.g., Attack Chain step 1, received so far 17 related
alerts; Attack Chain step 2, received so far 8 related alerts; Attack Chain step 3, receives so far 5 related alerts)." where attack chain descriptions with steps linked to received alerts maps to security insight event]
See the rationale provided in the rejection of claim 1, as it is equally applicable here.
However, Bu in view of Deutsch in view of Belgi do not teach
wherein the structured data defines a computer object for the
But Nelson teaches the wherein the structured data defines a computer object for the
[0175 "An action that receives XML or JSON data into a complex data structure may cause the underlying software to automatically generate a parser to carry out the mapping from XML or JSON fields to complex data object elements."]
[0184 "Notably, each object or array of objects in the complex data object can be collapsed or expanded by selecting or otherwise activating an associated side-arrow."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi with Nelson to present security insight information in an organized object that analysts can expand for details and collapse to conserve display space.
Claim [ 6, 13, 20 ] are rejected under 35 U.S.C. 103 as being unpatentable over
Bu (US 2025/0225323 Al, hereinafter Bu) in view of Deutsch (US 12,164,548 B, hereinafter Deutsch) and in further view of Belgi (US 12,641,110 B2, hereinafter Belgi) and in further view of Nelson (US 2020/0371679 Al, hereinafter Nelson) and in further view of Muddu (US 9,609,011 B2, hereinafter Muddu).
Regarding claim 6, rejection of claim 5 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Nelson teach
Belgi teaches entity mentioned in the security insight event
[Column 19, lines 61-67 "..and the LLM 444 generates an Attack Chain Description 446, including its discrete steps, and further describing each step in the attack chain and which Alerts were already received in the organization for that step ( e.g., Attack Chain step 1, received so far 17 related
alerts; Attack Chain step 2, received so far 8 related alerts; Attack Chain step 3, receives so far 5 related alerts)." where attack chain descriptions with steps linked to received alerts maps to security insight event]
See the rationale provided in the rejection of claim 1, as it is equally applicable here.
However, Bu in view of Deutsch in view of Belgi in view of Nelson do not teach the method of claim 5, wherein the computer object includes a selectable element of an
But Muddu teaches the method of claim 5, wherein the computer object includes a selectable element of an
[Column 76, lines 53-55 "For example, if the user clicks on "Mark Pittman," the GUI generates a "User Facts" view 4100 for Mark Pittman, as shown in FIG. 41."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective
filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi in view of Nelson with Muddu so that selecting an entity in the security-insight object opens its entity page, allowing analysts to review entity details and investigate the insight more efficiently.
Regarding claim 13, rejection of claim 9 is incorporated.
Bu in view of Deutsch in view of Belgi teach
Belgi teaches security insight event; entity mentioned in the security insight event
[Column 19, lines 61-67 "..and the LLM 444 generates an Attack Chain Description 446, including its discrete steps, and further describing each step in the attack chain and which Alerts were already received in the organization for that step ( e.g., Attack Chain step 1, received so far 17 related
alerts; Attack Chain step 2, received so far 8 related alerts; Attack Chain step 3, receives so far 5 related alerts)." where attack chain descriptions with steps linked to received alerts maps to security insight event]
See the rationale provided in the rejection of claim 1, as it is equally applicable here.
However, Bu in view of Deutsch in view of Belgi do not teach
wherein the structured data defines a computer object for the
But Nelson teaches wherein the structured data defines a computer object for the
[0175 "An action that receives XML or JSON data into a complex data structure may cause the underlying software to automatically generate a parser to carry out the mapping from XML or JSON fields to complex data object elements."]
[0184 "Notably, each object or array of objects in the complex data object can be collapsed or expanded by selecting or otherwise activating an associated side-arrow."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi with Nelson to present security insight information in an organized object that analysts can expand for details and collapse to conserve display space.
Bu in view of Deutsch in view of Belgi in view of Nelson do not teach wherein the computer object includes a selectable element of
However, Muddu teaches
[Column 76, lines 53-55 "For example, if the user clicks on "Mark Pittman," the GUI generates a "User Facts" view 4100 for Mark Pittman, as shown in FIG. 41."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective
filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi in view of Nelson with Muddu so that selecting an entity in the security-insight object opens its entity page, allowing analysts to review entity details and investigate the insight more efficiently.
Regarding claim 20, rejection of claim 16 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Nelson in view of Muddu teach
The non-transitory computer-readable medium of claim 16, wherein the structured data defines
a computer object for the security insight event, the computer object configured to be expanded or collapsed, wherein the computer object includes a selectable element of an entity mentioned in the security insight event, the selectable element, when selected, configured to render an entity page.
Claim 20 is rejected for the same reasons as claim 13.
Claim [ 7, 14 ] are rejected under 35 U.S.C. 103 as being unpatentable over
Bu (US 2025/0225323 Al, hereinafter Bu) in view of Deutsch (US 12,164,548 B, hereinafter Deutsch) and in further view of Belgi (US 12,641,110 B2, hereinafter Belgi) and in further view of Cheng (US 2024/0303473 Al, hereinafter Cheng) and in further view of Ahmed (US20230222021A1, hereinafter Ahmed).
Regarding claim 7, rejection of claim 1 is incorporated.
Bu in view of Deutsch in view of Belgi teach
transmitting the prompt
Belgi teaches
[Column 15, lines 9-10 "and can pass such information to the LLM( s) in the prompt as context."]
See the rationale provided in the rejection of claim 1, as it is equally applicable here.
However, Bu in view of Deutsch in view of Belgi do not teach
The method of claim 1, further comprising: receiving a selection of an identifier associated with the large language model;
But Cheng teaches receiving a selection of an identifier associated with the large language model;
[0058 "Provider to be used. Should be one of OpenAI|Cohere"]
[0055 "Specifically, the AI gateway 130 may specify a parameter in the request 513 to identify a target LLM"]
It would have been prima facie obvious to one of ordinary skill in the art before the effective
filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi with Cheng allowing the system to direct security analysis prompts to a selected LLM through a common getaway
Bu in view of Deutsch in view of Belgi in view of Cheng do not teach obtaining a connector that corresponds to the identifier associated with the large language model; and transmitting
But Ahmed teaches obtaining a connector that corresponds to the identifier associated with the large language model; and transmitting
[0067 "determines the API connector for the requested external service, fetches details (e.g., API connector or connector definition 925) of the requested external service from the connector library (e.g., connector library 940), and makes the actual API call to the external service (e.g., third-party API 950) using the details specified in the API connector, including the address, parameter(s), configuration, etc. for making the API call to the service-provider system"]
It would have been prima facie obvious to one of ordinary skill in the art before the effective
filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi in view of Cheng with Ahmed so that selected LLM's corresponding connector is obtained and used to transmit the prompt, reducing custom API coding and simplifying integration with different LLM.
Regarding claim 14, rejection of claim 9 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Cheng with Ahmed teach the apparatus of claim
9, wherein the operations further comprise: receiving a selection of an identifier associated with the large language model; obtaining a connector that corresponds to the identifier associated with the large language model; and transmitting the prompt using the connector.
Claim 14 is rejected for the same reasons as claim 7.
Claim [ 8, 15 ] are rejected under 35 U.S.C. 103 as being unpatentable over
Bu (US 2025/0225323 Al, hereinafter Bu) in view of Deutsch (US 12,164,548 B, hereinafter Deutsch) and in further view of Belgi (US 12,641,110 B2, hereinafter Belgi) and in further view of Cheng (US 2024/0303473 Al, hereinafter Cheng) and in further view of Ahmed (US20230222021A1, hereinafter Ahmed) and in further view of Gnanasekaran (US 12518057 B2, hereinafter Gnanasekaran).
Regarding claim 8, rejection of claim 7 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Cheng teach
The method of claim 7, wherein the large language model is a first large language model
transmitting the prompt
Cheng teaches
[0024 "A generative AI gateway that serve as a generic API to different LLMs may be deployed to connect to different generative AI models and/or services." where different LLMs can be designated the first LLM, another can be designated as second.]
[0064 "If provider specific properties ( exposed through parameters in request and response) are not used then the application can remain agnostic to provider and interact with LLM gateway 130 and switch providers by just specifying the right provider in the request."]
[0055 "Specifically, the AI gateway 130 may specify a parameter in the request 513 to identify a target LLM, and perform vendor specific AuthN/AuthZ when invoking appropriate vendor APis for the target LLM."]
[0058 "Provider to be used. Should be one of OpenAI|Cohere"]
[0058 "Generation Request: type: object
properties:
prompt:
description: "Represents the prompt or text to be completed.""]
[0055 "Specifically, the AI gateway 130 may specify a parameter in the request 513 to identify a target LLM"].
See the rationale provided in the rejection of claim 7, as it is equally applicable here.
Bu in view of Deutsch in view of Belgi in view of Cheng do not teach
connector is a first connector
obtaining a second connector that corresponds to the identifier associated with the second large language model;
But Ahmed teaches
connector is a first connector
[0067 "(e.g., API connector or connector definition 925)" where API connector is the first connector]
obtaining a second connector that corresponds to the identifier associated with the second large language model;
[0067 "The connector engine (e.g., connector engine 930) receives the request for calling the external service, determines the API connector for the requested external service, fetches details (e.g., API connector or connector definition 925) of the requested external service from the connector library (e.g., connector library 940)" where determining which API connector depending on details can be referred to a second connecter and the external service is mapped to the respective LLM];
It would have been prima facie obvious to one of ordinary skill in the art before the effective
filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi in view of Cheng with Ahmed to use Ahmed's retrieval and use of a connector corresponding to the requested external service for each selected LLM, enabling transmission of the prompt through appropriate connector while simplifying integration and maintenance as LLM services are added or changed.
Bu in view of Deutsch in view of Belgi in view of Cheng in view of Ahmed
receiving a selection of an identifier associated with a second large language model;
However, Gnanasekaran teaches
receiving a selection of an identifier associated with a second large language model;
[Column 9, lines 67, Column 10, lines 1-4 "In either embodiment, after a first LLM selection panel 318 a is displayed, the user may select the “Add model” icon 314 again to select a second LLM (318 b), as shown in the display 1000 of FIG. 10 . The user may want to send the same prompt to different LLMs to verify the LLM response, for example."]
It would have been prima facie obvious to one of ordinary skill in the art before the effective
filing date of the claimed invention to combine Bu in view of Deutsch in view of Belgi in view of Cheng in view of Ahmed with Gnanasekaran to include Gnanasekaran's selection of a second LLM and transmission of the same prompt to different LLM's, allowing an analyst to compare model responses and verify the generated security insights.
Regarding claim 15, rejection of claim 14 is incorporated.
Bu in view of Deutsch in view of Belgi in view of Cheng in view of Ahmed in view of
Gnanasekaran teach the apparatus of claim 14, wherein the large language model is a first large language model and the connector is a first connector, wherein the operations further comprise: receiving a selection of an identifier associated with a second large language model; obtaining a second connector that corresponds to the identifier associated with the second large language model; and transmitting the prompt using the second connector.
Claim 15 is rejected for the same reasons as claim 8.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHEZA ABDUL AZIZ whose telephone number is (571)272-9610. The examiner can normally be reached Monday-Friday 7:30am-5pm Alternate Fridays off.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Daniel Washburn can be reached at (571) 272-5551. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHEZA ABDUL AZIZ/Examiner, Art Unit 2657
/DANIEL C WASHBURN/Supervisory Patent Examiner, Art Unit 2657
