DETAILED ACTION
This Office Action is in response to the Application Ser. No. 19/209,176 filed on May 15, 2025. Claims 1-20 are pending and are examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Priority
Acknowledgment is made of applicant’s claim for domestic priority as a continuing application under 35 U.S.C. 120 based on Non-Provisional Application Ser. No. 18/148,529 filed on December 30, 2022.
Information Disclosure Statement
Applicant’s submission of the Information Disclosure Statement dated August 12, 2025, is acknowledged by the Examiner and the cited references have been considered in the examination of the claims now pending (see attached PTO-1449).
Drawings
Drawings were received on May 15, 2025. The drawings are accepted.
Claim Objections
The claims are objected to because of the following informalities:
regarding Claim 1, the phrase “the first resource in operating” recited in line 14 should be “the first resource is operating”;
regarding Claim 12, the phrase “the first resource in operating” recited in lines 12-13 should be “the first resource is operating”;
regarding Claim 17, the phrase “the first resource in operating” recited in line 16should be “the first resource is operating”; and
regarding Claim 19, the extraneous “1” at the beginning of line 1 of the claim should be deleted.
Appropriate correction is required.
Claim Rejections - 35 USC § 112(a)
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
Claim 18-20 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claim 18 recites the limitations “prior to receiving, by the anomaly detection system, the first resource health data: monitoring, by a health analyzer of the device, the first resource health data; and performing, by the health analyzer, a temporal anomaly analysis to detect anomalous points in time where the first resource is suspected of being unstable” in lines 2-6. As shown in Figure 1 and described in paragraph [0020] of the specification, system 100 for detecting anomalous behavior comprises both health analyzer 112 and anomaly detection system 11o. While paragraphs [0028]-[0029] and [0033] of the specification suggest that the health analyzer 112 and anomaly detection system 110 may reach different conclusions of anomalous behavior using the same set of health time-series data, e.g., health analyzer identifies a data event as anomalous and marks the corresponding resource as unstable while anomaly detection system determines that the corresponding resource is operating in a normal behavior state, the specification does not disclose how the health analyzer and anomaly detection system interoperate or interact with each other beyond suggesting they may operate using the same health time-series data as input. Therefore, there is insufficient written description support for monitoring, by the health analyzer, the first resource health data of the device and performing, by the health analyzer, a temporal anomaly analysis to detect anomalous points in time where the first resource is suspected of being unstable “prior to receiving, by the anomaly detection system, the first resource health data” as claimed.
Dependent Claims 19 and 20 are rejected for the reasons presented above with respect to rejected Claim 18 in view of their dependence thereon.
Additionally, Claim 20 recites the limitation “after performing, by the health analyzer, the root cause analysis, validating the root cause analysis by executing the anomaly detection system” in lines 2-3. While paragraph [0028] of the specification discloses that the health analyzer may perform a root cause analysis to determine the root cause of a resource event, i.e., an anomalous or outlier pattern in the health data indicating the resource is unstable, identified by the health analyzer based on a temporal anomaly analysis of the health data, and paragraph [0033] of the specification separately discloses that the evaluation performed by the anomaly detection system may contradict the determination of the health analyzer that the resource is unstable, there is insufficient written description support for “validating the root cause analysis by executing the anomaly detection system” as claimed.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-5, 7-9, 11-14 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Kumar et al. Pub. No. US 2021/0304067 A1, hereby “Kumar”, in view of Seto, Pub. No. US 2015/0205691 A1.
Regarding Claim 1, Kumar discloses “A system (Kumar figs. 1A and 5 and paragraphs 39 and 90: computing system 500 implementing anomaly detection engine 110), comprising:
a processor (Kumar fig. 5 and paragraphs 90-92: processor 510); and
memory comprising computer executable instructions (Kumar fig. 5 and paragraphs 90-92: memory 520) that, when executed, perform operations comprising:
receiving first resource health data from a first resource having a resource type (Kumar figs. 1A-1B, 3A and 4 and paragraphs 37, 40-45, 61, and 85-86: anomaly detection engine 110 receives sequence 314 of performance metrics from a managed object in information technology system 140, i.e., a first set of resource health data from a first resource, wherein the managed object may be an application server, i.e., a first resource type);
generating first embeddings of the first resource health data by providing the first resource health data to a resource behavior model trained on the resource type (Kumar figs. 1A, 3A and 4 and paragraphs 46, 54 and 87: anomaly detection system 110 generates an encoded representation 316 from the sequence 314 of performance metrics using machine-learning model 115)”.
However, while Kumar discloses generating an encoded representation from the sequence of performance metrics using the trained machine learning model (Kumar paragraphs 46, 54 and 87), Kumar does not explicitly disclose “calculating a similarity measurement between the first embeddings and second embeddings of second resource health data received from a set of second resources having the resource type by comparing the first embeddings to the second embeddings;
in response to determining the similarity measurement does not satisfy a similarity threshold value, determining the first resource in operating in an anomalous behavior state; and
reporting the anomalous behavior state.”
In the same field of endeavor, Seto discloses “calculating a similarity measurement between the first embeddings and second embeddings of second resource health data received from a set of second resources having the resource type by comparing the first embeddings to the second embeddings (Seto figs. 2, 10 and 12 and paragraphs 28, 55-56, 105, 116, 122, 192, 195 and 207: cluster analysis 1014 calculates the distance, i.e., a similarity measurement, between transformed data 1012, i.e., first embeddings generated from current performance metrics, and transformations of historical performance metrics, i.e., second embeddings);
in response to determining the similarity measurement does not satisfy a similarity threshold value, determining the first resource in operating in an anomalous behavior state (Seto figs. 2, 10 and 12 and paragraphs 53, 105, 116, 122, 192, 195 and 207-210: cluster analysis 1014 identifies anomalous behavior when the calculated distance is outside predefined limits, i.e., does not satisfy a similarity threshold); and
reporting the anomalous behavior state (Seto figs. 2, 10 and 12 and paragraphs 7, 53, 122, 192 and 210: an alert indicating the anomalous behavior is generated).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the system of Kumar to identify anomalous operation of a managed object by comparing an encoded representation of current performance metrics with encoded representations of historical performance metrics as taught by Seto because doing so constitutes a simple substitution of one known element (a model comparing a transformation of current performance data against transformations of historical performance data) for another (a model comparing reconstructed performance metrics against original performance metrics) to obtain predictable and desirable results (identifying anomalous operation of the managed object). See KSR International Co. v. Teleflex Inc., 82 USPQ2d 1385 (U.S. 2007).
Regarding Claim 2, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Kumar discloses “wherein the first resource health data is represented as a vector time series of metrics collected at regular intervals (Kumar figs. 1A-1B, 3A and 4 and paragraphs 37, 40-45, 61, and 85-86: sequence 314 of performance metrics includes at least one performance metric collected from the information technology system at successive time intervals).”
Regarding Claim 3, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Kumar discloses “wherein generating the first embeddings comprises generating weighted vectors representing relationships between metrics included in the first resource health data (Kumar fig. 3B and paragraphs 56, 61-65, 68, 70 and 74: generating encoded representation 316 from the sequences of performance metrics comprises generating vectors from the sequences of performance metrics and applying weights based on interdependencies between the performance metrics).”
Regarding Claim 4, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Seto discloses “wherein: the first resource health data has a first dimension size (Seto paragraphs 7, 28, 44, 76-77, 82 and 190: the time series data at each time interval contains a vector comprising many parameters, i.e., a first dimension size); and
generating first embeddings comprises reducing the first dimension size to a second dimension size that is smaller than the first dimension size (Seto paragraphs 7, 28, 43-45, 53, 105, 114 and 194: a dimensionality reduction transformation is applied to reduce the time series data to a set of principal components – while not explicitly stated, reducing the time series to a second dimension size that is smaller than the first dimension size is inferred).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the system of Kumar to identify anomalous operation of a managed object by comparing an encoded representation of current performance metrics with encoded representations of historical performance metrics as taught by Seto for the reasons set forth in the rejection of Claim 1.
Regarding Claim 5, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Seto discloses “wherein the resource behavior model:
includes an encoder for generating the first embeddings (Seto fig. 2, 10 and 12 and paragraphs 7, 43-45, 53, 105, 114, 122, 192 and 206: dimensionality reduction analysis 1008 comprises a transformation function, i.e., an encoder, that is applied to the current performance metrics to generate transformed data 1012); and
does not include a decoder for decoding the first embeddings (Seto fig. 2, 10 and 12 and paragraphs 7, 43-45, 53, 105, 114, 122, 192 and 206: while not explicitly stated, it is inferred that dimensionality reduction analysis 1008 does not comprise a decoder for decoding the transformed data as there is no disclosure describing reconstruction of the transformed data).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the system of Kumar to identify anomalous operation of a managed object by comparing an encoded representation of current performance metrics with encoded representations of historical performance metrics as taught by Seto for the reasons set forth in the rejection of Claim 1.
Regarding Claim 7, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Seto discloses “wherein the second embeddings correspond to embeddings reflective of expected behavior of the resource type (Seto paragraphs 7, 53-56, 105, 116, 122 and 207: the transformations of historical performance metrics represent normal operation, i.e., expected behavior).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the system of Kumar to identify anomalous operation of a managed object by comparing an encoded representation of current performance metrics with encoded representations of historical performance metrics as taught by Seto for the reasons set forth in the rejection of Claim 1.
Regarding Claim 8, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Seto discloses “wherein calculating the similarity measurement comprises:
utilizing a similarity engine of the system to measure similarity between the first embeddings and the second embeddings (Seto figs. 2, 10 and 12 and paragraphs 28, 55-56, 105, 116, 122, 192, 195 and 207: cluster analysis 1014, i.e., a similarity engine, calculates the distance, i.e., a similarity measurement, between transformed data 1012 and the transformations of historical performance metrics).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the system of Kumar to identify anomalous operation of a managed object by comparing an encoded representation of current performance metrics with encoded representations of historical performance metrics as taught by Seto for the reasons set forth in the rejection of Claim 1.
Regarding Claim 9, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Seto discloses “wherein the similarity measurement is a Euclidean distance or cosine similarity (Seto paragraphs 4, 28, 55 and 207: cosine similarity may be used to calculate the distance).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the system of Kumar to identify anomalous operation of a managed object by comparing an encoded representation of current performance metrics with encoded representations of historical performance metrics as taught by Seto for the reasons set forth in the rejection of Claim 1.
Regarding Claim 11, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Kumar discloses “wherein the resource type is an analytics resource or a storage resource (Kumar figs. 1A-1B and paragraphs 39-41: managed objects of information technology system 140 may include databases, i.e., analytics and/or storage resources).”
18. Insofar as it recites similar claim elements, Claim 12 is rejected for substantially the same reasons presented above with respect to Claim 1.
Additionally, Kumar discloses “A method... (Seto fig. 12 and paragraphs 7 and 203: a method for identifying performance anomalies)”.
Regarding Claim 13, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Kumar discloses “wherein the first resource behavior model is trained by a machine learning training engine of the anomaly detection system (Kumar figs. 1A and 4 and paragraphs 46-47, 55 and 83: machine learning model 115 is trained using the sequences of non-anomalous performance metrics).”
Regarding Claim 14, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
Additionally, Seto discloses “wherein the first resource behavior model is trained on historical health time-series data of resources of the first resource type (Seto paragraphs 5, 26-29, 53-54, 84, 106 and 114: the observations used to train transformation 1010 may comprise observed time series from multiple runs of the same application on the same execution platform).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the method of Kumar to identify anomalous operation of a managed object by comparing an encoded representation of current performance metrics with encoded representations of historical performance metrics as taught by Seto for the reasons set forth in the rejection of Claim 1.
Insofar as it recites similar claim elements, Claim 17 is rejected for substantially the same reasons presented above with respect to Claim 1.
Additionally, Kumar discloses “A device (Kumar figs. 1A and 5 and paragraphs 39 and 90: computing system 500 implementing anomaly detection engine 110), comprising:
a processor (Kumar fig. 5 and paragraphs 90-92: processor 510); and
memory comprising computer executable instructions that, when executed perform operations... (Kumar fig. 5 and paragraphs 90-92: memory 520)”.
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over the combination of Kumar and Seto in view of Stergioudis, Pub. No. US 2022/0201008 A1.
Regarding Claim 6, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
However, while Seto discloses storing the time series of historical performance metrics in a database (Seto paragraphs 25, 29 and 102-105: time series database 220) and discloses calculating the distance between the transformation of the current performance metrics and transformations of historical performance metrics to identify anomalous behavior (Seto paragraphs 28, 55-56, 105, 116, 122, 192, 195 and 207), the combination of Kumar and Seto does not explicitly disclose “wherein the second embeddings are collected from an embeddings library external to the system.”
In a related field of endeavor, Stergioudis discloses “wherein the second embeddings are collected from an embeddings library external to the system (Stergioudis fig. 8 and paragraphs 6 and 156-157: "In some cases, the historical representations 824A-C can be pre-computed and stored in a data repository or a database.").
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the system of Kumar, as modified by Seto, to obtain the transformations of the historic performance metrics from a database storing pre-computed transformations as taught by Stergioudis. One of ordinary skill in the art would have been motivated to combine obtaining the transformations of the historic performance metrics from a database storing pre-computed transformations to decrease processing time for determining anomalous behavior (Stergioudis paragraph 156).
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over the combination of Kumar and Seto in view of Bajaj, Pat. No. US 12,468,617 B1.
Regarding Claim 10, the combination of Kumar and Seto discloses all of the limitations of Claim 1.
However, while Kumar discloses that the managed objects may include databases, hosts, application servers, network devices (e.g., hypervisors, switches and routers), and/or the like (Kumar paragraph 40), the combination of Kumar and Seto does not explicitly disclose “wherein the resource type is a machine learning (ML) resource.”
In the same field of endeavor, Bajaj discloses “wherein the resource type is a machine learning (ML) resource (Bajaj fig. 2B and column 8, lines 4-30: the monitored resource is a machine learning model).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the system of Kumar, as modified by Seto, to monitor a machine learning model, i.e., a machine learning resource, for abnormal behavior as taught by Bajaj because doing so constitutes a simple substitution of one known element (a machine learning resource) for another (an analytics and/or storage resource) to obtain predictable and desirable results (identifying anomalous behavior of a machine learning resource). See KSR International Co. v. Teleflex Inc., 82 USPQ2d 1385 (U.S. 2007).
Claims 15 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Kumar and Seto in view of Diamanti et al., the paper titled “An AI-Empowered Framework for Cross-Layer Softwarized Infrastructure State Assessment”, hereby “Diamanti”.
Regarding Claim 15, the combination of Kumar and Seto discloses all of the limitations of Claim 12.
However, while Kumar discloses generating an encoded representation of the performance metrics, i.e., a first set of embeddings, using the machine-learning model (Kumar paragraphs 38, 46, 54 and 87), and further suggests that different performance metrics may be collected for different managed object types (Kumar paragraphs 40 and 45), the combination of Kumar and Seto does not explicitly disclose “wherein the anomaly detection system further comprises a second resource behavior model trained on historical health time-series data of resources of a second resource type.
In the same field of endeavor, Diamanti discloses “wherein the anomaly detection system further comprises a second resource behavior model trained on historical health time-series data of resources of a second resource type (Diamanti Fig. 2 and § “B. Deep LSTM-Based Autoencoders for Anomaly Detection” and “III. SYRROCA (SYSTEM RADIOGRAPHY AND ROOT CAUSE ANALYSIS) FRAMEWORK”: “SYRROCA uses dedicated deep autoencoders for each group of resources (CPU-related, memory-related, network-related, and file-disk-related)”.
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the method of Kumar, as modified by Seto, to utilize a set of transformation functions wherein each transformation function is trained for detecting anomalies in the behavior of a particular resource type as taught by Diamanti. One of ordinary skill in the art would have been motivated to combine utilizing a set of transformation functions wherein each transformation function is trained for detecting anomalies in the behavior of a particular resource type to allow characterization of anomalies in a fine-grained manner (Diamanti “III. SYRROCA (SYSTEM RADIOGRAPHY AND ROOT CAUSE ANALYSIS) FRAMEWORK”).
Regarding Claim 16, the combination of Kumar, Seto and Diamanti discloses all of the limitations of Claim 15.
However, while Kumar discloses generating an encoded representation of the performance metrics, i.e., a first set of embeddings, using the machine-learning model (Kumar paragraphs 38, 46, 54 and 87), and Seto discloses calculating the distance between the transformation of the current performance metrics and transformations of historical performance metrics to identify anomalous behavior (Seto paragraphs 28, 55-56, 105, 116, 122, 192, 195 and 207), the combination of Kumar and Seto does not explicitly disclose “receiving, by the anomaly detection system, third resource health data from a third resource having the second resource type;
generating, by the anomaly detection system, third embeddings of the third resource health data by providing the third resource health data to the second resource behavior model;
calculating, by the anomaly detection system, a second similarity measurement between the third embeddings and fourth embeddings of fourth resource health data received from a set of fourth resources having the second resource type by comparing the third embeddings to the fourth embeddings; and
determining whether the second similarity measurement satisfies the similarity threshold value.”
In the same field of endeavor, Diamanti discloses an anomaly detection framework that utilizes a set of autoencoders wherein each autoencoder is trained for detecting anomalies in the operation of resources of a particular type (Diamanti Fig. 2 and § “B. Deep LSTM-Based Autoencoders for Anomaly Detection” and “III. SYRROCA (SYSTEM RADIOGRAPHY AND ROOT CAUSE ANALYSIS) FRAMEWORK”: “SYRROCA uses dedicated deep autoencoders for each group of resources (CPU-related, memory-related, network-related, and file-disk-related)” and “In SYRROCA, an anomaly is characterized as a meaningful deviation from nominal conditions on a set of metrics. The framework is based on LSTM AEs wich allow to detecting anomalies when their reconstruction error exceeds a given fixed threshold.”).
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the method of Kumar, as modified by Seto, to utilize a set of transformation functions wherein each transformation function is trained for detecting anomalies in the behavior of a particular resource type as taught by Diamanti for the reasons set forth in the rejection of Claim 16.
Claim 18 is rejected under 35 U.S.C. 103 as being unpatentable over the combination of Kumar and Seto in view of Sedjelmaci, Pub. No. US 2021/0185061 A1.
Regarding Claim 18, the combination of Kumar and Seto discloses all of the limitations of Claim 17.
Additionally, Seto discloses “monitoring, by a health analyzer of the device, the first resource health data (Seto figs. 2 and 5 and paragraphs 25-26, 32-35, 87, 90, 103-104, 110 and 147-148: predictive analysis engine 228 receives performance metrics of a current time series segment from tracer 248); and
performing, by the health analyzer, a temporal anomaly analysis to detect anomalous points in time where the first resource is suspected of being unstable (Seto figs. 2 and 5 and paragraphs 25-26, 32-35, 87, 90, 103-104, 110 and 154-157: predictive analysis engine 228 compares the current time series segment with historic time series segments to find matching historic time series segments, i.e., performs a temporal anomaly analysis, to predicts events such as device failure or service degradation, i.e., suspected instability, by identifying events that occurred after the matching historic time series segments).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the device of Kumar to predict events that are likely to occur by comparing a current time series segment with historic time series segments as taught by Seto. One of ordinary skill in the art would have been motivated to combine predicting events that are likely to occur by comparing a current time series segment with historic time series segments to enable the administrator to take corrective action proactively (Seto paragraphs 3 and 24).
However, while Seto discloses a predictive analysis engine that predicts events such as device failure or service degradation that are likely to occur by comparing a current time series segment against historic time series segments (Seto figs. 2 and 5 and paragraphs 25-26, 32-35, 87, 90, 103-104, 110 and 154-157), and further discloses the coexistence of the predictive analysis engine with the dimensionality reduction analyzer (Seto fig. 2 and paragraphs 101-105, 110 and 114-116), the combination of Kumar and Seto does not explicitly disclose predicting, by the predictive analysis engine, events such as device failure or service degradation that are likely to occur “prior to receiving, by the anomaly detection system, the first resource health data”.
In the same field of endeavor, Sedjelmaci discloses “prior to receiving, by the anomaly detection system, the first resource... data (Sedjelmaci fig. 1 and paragraphs 88, 104 and 113: second obtainment module 2B, i.e., an anomaly detection system, receives the features FEAT representative of the data traffic transiting user equipment 1 and the decisions from first obtainment module 2A, i.e., a health analyzer, after first obtainment module 2A has performed an analysis and determined the data traffic is abnormal):
monitoring, by a health analyzer of the device, the first resource... data (Sedjelmaci fig. 1 and paragraphs 86-87, 91 and 100-101: first obtainment module 2A, i.e., an analyzer system of a computing device, receives features FEAT representative of data traffic transiting user equipment 1, i.e., data for a first resource having a first resource type); and
performing, by the health analyzer, a temporal anomaly analysis to detect anomalous points in time... (Sedjelmaci fig. 1 and paragraphs 87 and 102-103: submodules 2A1 and 2A2 of first obtainment module 2A render decisions indicating the data traffic transiting the user equipment 1 is abnormal based on the features FEAT).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the device of Kumar, as modified by Seto, to use the anomalous operation determination of the anomaly detection system to verify the reliability of an anomalous operation determination rendered by another analysis system as taught by Sedjelmaci. One of ordinary skill in the art would have been motivated to combine using the anomalous operation determination of the anomaly detection system to verify the reliability of an anomalous operation determination rendered by another analysis system to update a confidence level assigned to the determinations rendered by the other analysis system (Sedjelmaci paragraphs 39-42 and 123-128).
Claims 19 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Kumar, Seto and Sedjelmaci in view of Gupta et al., Pub. No. US 2024/0007342 A1, hereby “Gupta”.
Regarding Claim 19, the combination of Kumar, Seto and Sedjelmaci discloses all of the limitations of Claim 18.
Additionally, Seto discloses “based on the temporal anomaly analysis, generating, by the health analyzer, an incident report that provides information about a diagnosed resource event for the first resource (Seto figs. 2 and 5 and paragraphs 35, 89-90, 110 and 157: predictive analysis engine 228 generates an alert indicating the predicted event when the probability of the event occurring is high and provides the alert to an administrator)”.
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the device of Kumar to predict events that are likely to occur by comparing a current time series segment with historic time series segments as taught by Seto for the reasons set forth in the rejection of Claim 18.
However, while Seto discloses generating, by the predictive analysis engine, an alert indicating the predicted event when the probability of the event occurring is high (Seto paragraphs 35, 89-90, 110 and 157), the combination of Kumar, Seto and Sedjelmaci does not explicitly disclose “performing, by the health analyzer, a root cause analysis for the resource event.”
In the same field of endeavor, Gupta discloses “performing, by the health analyzer, a root cause analysis for the resource event (Gupta figs. 2 and 5 and paragraphs 6, 103-105 and 230: anomaly detector 236 invokes a root cause analysis to identify the likely root cause of an anomalous condition detected by the anomaly detector).
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the device of Kumar, as modified by Seto and Sedjelmaci, to perform root cause analysis to identify a likely root cause when anomalous behavior is detected as taught by Gupta. One of ordinary skill in the art would have been motivated to combine performing root cause analysis to identify a likely root cause when anomalous behavior is detected to enable more efficient operation of the managed objects (Gupta paragraph 5).
Regarding Claim 20, the combination of Kumar, Seto, Sedjelmaci and Gupta discloses all of the limitations of Claim 19.
Additionally, Sedjelmaci discloses “after performing, by the health analyzer, the... analysis, validating the... analysis by executing the anomaly detection system (Sedjelmaci fig. 1 and paragraphs 88, 113-114 and 121-122: submodule 2B1 of second obtainment module 2B renders decision d3 indicating whether or not the data traffic transiting the user equipment is abnormal based on the features FEAT, wherein decision d3 is used to verify the reliability of decisions d1 and d2 received from first obtainment module 2A).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the device of Kumar, as modified by Seto, to use the anomalous operation determination of the anomaly detection system to verify the reliability of an anomalous operation determination rendered by another analysis system as taught by Sedjelmaci for the reasons set forth in the rejection of Claim 18.
However, while Sedjelmaci discloses using the decision of the second obtainment module to verify the reliability of an anomalous operation determination rendered by the first obtainment module (Sedjelmaci paragraphs 88, 113-114 and 121-122), the combination of Kumar, Seto and Sedjelmaci does not explicitly disclose “after performing, by the health analyzer, the root cause analysis, validating the root cause analysis by executing the anomaly detection system (emphasis added).”
In the same field of endeavor, Gupta discloses performing root cause analysis to identify a likely root cause when anomalous behavior is detected (Gupta figs. 2 and 5 and paragraphs 6, 103-105 and 230: anomaly detector 236 invokes a root cause analysis to identify the likely root cause of an anomalous condition detected by the anomaly detector).”
It would have been obvious to one of ordinary skill in the art at the time of the effective filing to modify the device of Kumar, as modified by Seto and Sedjelmaci, to verify the reliability of a root cause analysis identifying the likely cause of an anomalous condition as taught by Gupta because doing so constitutes a simple substitution of one known element (a root cause analysis of an anomalous condition) for another (a signature analysis identifying abnormal behavior) to obtain predictable and desirable results (verifying the reliability of a root cause analysis). See KSR International Co. v. Teleflex Inc., 82 USPQ2d 1385 (U.S. 2007).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
Gupta et al., Pub. No. US 2016/0261465 A1, discloses systems and methods of behavioral analysis wherein behavior anomalies are detected by comparing a behavior vector representing the operational behavior of a device with a model representing normal behavior of the device; and
Viclizki et al., Pub. No. US 2023/0297453 A1, discloses a system and method for predicting a probability of an error or anomaly in processing units using a plurality of machine learning models trained based on telemetry data for a plurality of devices that share a common device type.
A shortened statutory period for reply to this action is set to expire THREE MONTHS from the mailing date of this action. An extension of time may be obtained under 37 CFR 1.136(a). However, in no event, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WILLIAM C MCBETH whose telephone number is (571)270-0495. The examiner can normally be reached on Monday - Friday, 8:00AM - 4:30PM ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Vivek Srivastava can be reached on 571-272-7304. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/WILLIAM C MCBETH/Examiner, Art Unit 2449
