Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is responsive to the Amendment filed on 12/17/2025.
Claims 1-10, 12-24 are pending in the case. Claim(s) 11 has been cancelled.
Response to Arguments
Applicant's arguments and amendments with regards to the objections to the claim(s) 9 have been fully considered and are persuasive. The objections are respectfully withdrawn.
Applicant's arguments and amendments with regards to the 35 U.S.C. § 101 rejection of claim(s) 24 have been fully considered and are persuasive. The 35 U.S.C. § 101 rejection of claim(s) 24 is respectfully withdrawn.
Applicant’s arguments and amendments with regards to the 35 U.S.C. § 112(b) rejection of claim(s) 9, 15, 16, have been fully considered and are persuasive. Therefore, the 35 U.S.C. § 112(b) rejection of claim(s) 9, 15, 16, is respectfully withdrawn.
Applicant's arguments with respect to claim(s) 1-10, 12-24 have been considered but are moot because the new ground of rejection does not rely on portions of previously cited reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-10, 12, 14-17, 19-24, are rejected under 35 U.S.C. 103 as being unpatentable over Coulter (US20250053587A1) in view of Gardner (US 20250061290 A1), Singh (US 20250045411 A1) and Sharma et al “A reliable knowledge processing framework for combustion science using foundation models” published in Energy AI, 16 (2024), Article 100365, available online 18 April 2024 and retrieved from https://doi.org/10.1016/j.egyai.2024.100365.
Regarding claim 1, Coulter teaches a system, comprising: a processor configured to (Coulter [189-191]):
use a set of historical actions and their frequencies to determine a baseline behavior for a user (Coulter [71-73, 84, 128, 136, 158] event information may be based on event data for a user, event data may be for user actions and may be based on previously seen data, events may be clustered using event data and their frequency);
harvest knowledge from ... log data and contextual information, wherein to harvest knowledge includes removing ... log data indicative of the baseline behavior for the user (Coulter [70, 122, 123] based on clustering and scoring anomalous events are determined that do not meet baseline, Also see Coulter [27-29, 51, 54, 90, 91, 101] knowledge may be extracted from log (event) data and context);
condense the knowledge prior to summarization by extracting security critical information from the knowledge, wherein the security critical information comprises one or more significant actions, identified as significant via an action risk scoring model (Coulter [58, 124-130] true outliers may be determined from anomalous data may using further clustering such as contextual clustering, Also see Coulter [4, 71, 88, 89, 98, 101] uncommon information may be filtered from knowledge); and
generate a ... summary ...based on... the condensed knowledge (Coulter [80, 87, 158, Figs 13 and 14A, based on determined true outliers- a dashboard with event summary including outlier summary may be generated);
and a memory coupled to the processor and configured to provide the processor with instructions (Coulter [189-191]).
Coulter does not specifically teach harvest knowledge from cloud log data; generate a human readable summary by summarizing the condensed knowledge, via a custom summarizer module, wherein the custom summarizer module is trained on an augmented dataset to identify and summarize one or more workloads within an interleaved workload
However Sharma teaches generate a human readable summary by summarizing the condensed knowledge (Sharma Sec 3.3.2 (especially 3rd paragraph) and Secs 2 and 3, condensed knowledge may be summarized into a succinct conversational summary (human readable)).
It would have been obvious to one of an ordinary skill in the art before the effective filing date of the claimed invention, to have incorporated the concept taught by Sharma of generate a human readable summary by summarizing the condensed knowledge, into the invention suggested by Coulter; since both inventions are directed towards generating condensed relevant information from data to present to a user, and incorporating the teaching of Sharma into the invention suggested by Coulter would provide the added advantage of providing information in a succinct manner that is understood by a user, and the combination would perform with a reasonable expectation of success (Sharma Sec 3.3.2 (especially 3rd paragraph) and Secs 2 and 3).
Coulter and Sharma do not specifically teach harvest knowledge from cloud log data; via a custom summarizer module, wherein the custom summarizer module is trained on an augmented dataset to identify and summarize one or more workloads within an interleaved workload.
However Singh teaches generate a ...summary by summarizing the condensed knowledge, via a custom summarizer module, wherein the custom summarizer module is trained on an augmented dataset to identify and summarize one or more workloads within an interleaved workload (Singh [23, 25, 29, 37-39, Figs. 8-10, cloud workloads for services are received and summaries (reports) may be created for analysis of Relative Attacker Attractiveness Analyzer (RAA Analyzer) and its underlying information, workloads may be modified to generate annotated dataset with interleaved (combined) workloads and used to train model(s) for prompts and reports).
It would have been obvious to one of an ordinary skill in the art before the effective filing date of the claimed invention, to have incorporated the concept taught by Singh of generate a ...summary by summarizing the condensed knowledge, via a custom summarizer module, wherein the custom summarizer module is trained on an augmented dataset to identify and summarize one or more workloads within an interleaved workload, into the invention suggested by Coulter, Sharma and Gardner, since both inventions are directed towards generating LLM prompts for summarization, and incorporating the teaching of Singh into the invention suggested by Coulter, Sharma and Gardner would provide the added advantage of allowing LLM prompts for summarization to be generated in the field of workloads and providing an improved dataset using augmentation, and the combination would perform with a reasonable expectation of success (Singh [23, 25, 29, 37-39, Figs. 8-10).
Coulter, Sharma and Singh dot not specifically teach harvest knowledge from cloud log data.
However Gardner teaches harvest knowledge from cloud log data and contextual information (Gardner [42, 318, 254, 147, 590] information may be extracted from cloud log data and context factors to provide situationally-appropriate responses, Also see Gardner [27, 28, 50, 51, 153] situationally-appropriate responses may be provided in human-like text summary).
It would have been obvious to one of an ordinary skill in the art before the effective filing date of the claimed invention, to have incorporated the concept taught by Gardner of harvest knowledge from cloud log data and contextual information, into the invention suggested by Coulter, Sharma and Singh; since both inventions are directed towards providing human-readable summaries from log data, and incorporating the teaching of Gardner into the invention suggested by Coulter, Sharma and Singh would provide the added advantage of providing situationally-appropriate responses in the field of cloud log data, and the combination would perform with a reasonable expectation of success (Gardner [42, 318, 254, 147, 590, 27, 28, 50, 51, 153).
Regarding claim 2, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above. Coulter does not specifically teach wherein the cloud log data includes one or more of: identity and access management actions, compute actions, storage actions, network actions, configuration changes to security groups or firewall rules, modification of virtual private clouds, database actions, audit and configuration management, application and application program interface (API) activity, and anomalous or security-related events
However Gardner teaches wherein the cloud log data includes one or more of: identity and access management actions... (Gardner [585, 589, 590] log information may include actions such as changes made to assigned roles).
Regarding claim 3, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above. Coulter does not specifically teach wherein the contextual information includes one or more of: cloud inventory data, Human Resource Management System (HRMS) data, relationship network data, identities data, resource data, permissions data, authentication data, authorization data, and ticket data
However Gardner teaches wherein the contextual information includes one or more of: cloud inventory data, identities data, ...and ticket data (Gardner [747, 208, 576, 254, 147] information may include context which may include inventory, parties involved, ticket information).
Regarding claim 4, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above.
Coulter further teaches receive the ... log data and the contextual information (Coulter [27-29, 51, 54, 90, 91, 101] knowledge may be extracted from received log (event) data and context).
Coulter does not specifically teach receive the cloud log data.
However Gardner teaches receive the cloud log data (Gardner [46, 70, 77, 42, 318, 254, 147, 590] information for cloud log data and context factors may be accessed).
Regarding claim 5, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above.
Claim 1 further teaches wherein the processor is configured to harvest the knowledge from the cloud log data and the contextual information.
Coulter does not specifically teach wherein to harvest the knowledge from the cloud log data and the contextual information, the processor is configured to: extract key dimensions of the cloud log data; enrich the key dimensions using the contextual information; and generate one or more retrieval augmented generation based (RAG-based) prompts using the enriched key dimensions; and use the one or more RAG-based prompts on one or more machine learning (ML) agents to analyze the enriched key dimensions.
However Sharma teaches wherein to harvest the knowledge from the cloud log data and the contextual information (Sharma Sections 2 and 3):
extract key dimensions of the ... data (Sharma Sec 2 1st Para and Sec 2.1, data embeddings (key dimensions) are determined);
enrich the key dimensions using the contextual information (Sharma Sec 2.2, relevant embeddings (enrich) are determined based on data and context (query)); and
generate one or more retrieval augmented generation based (RAG-based) prompts using the enriched key dimensions (Sharma Secs 2.3 and 3.3.3, RAG prompt is generated based on relevant embeddings); and
use the one or more RAG-based prompts on one or more machine learning (ML) agents to analyze the enriched key dimensions (Sharma 3.3.2 and 3.3.3, RAG prompt is input to LLM to analyze embeddings of data).
Regarding claim 6, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 5 above.
Coulter further teaches wherein the one or more ML agents includes ...behavior anomalies models, geo anomalies models... (Coulter [27, 28, 57, 66, 67, 71] prompts are generated for models to detect normal or abnormal events, normal or abnormal events may be for behavior or geographical location).
Regarding claim 7, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 5 above.
Coulter further teaches wherein the key dimensions include ... Internet Protocol (IP) addresses...and timestamps (Coulter [36, 90] key event information may include IP addesses and timestamps, event vector information (key dimensions) may be based on key event information).
Regarding claim 8, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above.
Coulter further teaches wherein to condense the knowledge prior to summarization,...extract relevant attributes for each of the one or more significant actions (Coulter [58, 124-131] true outliers may be determined from anomalous data may using further clustering such as contextual clustering using attributes and metadata).
Coulter does not specifically teach generate the condensed knowledge by collating the one or more significant is actions and the relevant attributes.
However Sharma teaches generate the condensed knowledge by collating the one or more significant ...items... and the relevant attributes (Sharma Secs 2.2, 3.3.2 and 3.3.3, documents related to query and relevant attributes are collected).
Regarding claim 9, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 8 above. Coulter does not specifically teach wherein to extract the relevant attributes, the processor is configured to use a curated database of relevant attributes from cloud actions to identify the relevant attributes.
However Gardner teaches wherein to extract the relevant attributes, the processor is configured to use a curated database of relevant attributes from cloud actions to identify the relevant attributes (Gardner [72, 130, 145-149, 45, 52] data may be in a curated database with attributes for common user actions, relevant attributes may be determined from data attributes).
Regarding claim 10, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above.
Claim 1 further teaches wherein the processor is configured to generate a human readable summary by summarizing the condensed knowledge.
Coulter further teaches security session logs (Coulter [131, 136, 27-29, 51, 54, 90, 91, 101] knowledge may be log (event) data related to security sessions).
Coulter does not specifically teach segment ...; summarize each segment; and combine the summaries of the segments to produce the human readable summary.
However Sharma teaches segment information; summarize each segment; and combine the summaries of the segments to produce the human readable summary (Sharma 2.2, 3.3.2, 3.3.3, information is converted to chunks (segments), chunks relevant (key findings) to query based on RAG prompt and context are determined, key findings are summarized and the summaries are combined into a succinct, conversational answer).
Regarding claim 12, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above. Coulter does not specifically teach wherein training the custom summarizer module includes using fine-tuning on a base large language model (LLM)
However Gardner teaches wherein training the custom summarizer module includes using fine-tuning on a base large language model (LLM) (Gardner [134] training may involve domain-specific fine-tuning of a pre-trained (base) LLM model).
Regarding claim 14, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above. Coulter does not specifically teach wherein to train the custom summarizer module, the processor is further configured to: receive condensed knowledge; generate one or more summaries by using the condensed knowledge on a second summarizer module; provide feedback on the one or more summaries; and train the custom summarizer module based on the feedback.
However Gardner teaches wherein to train the custom summarizer module, the processor is further configured to: receive condensed knowledge; generate one or more summaries by using the condensed knowledge on a second summarizer module; provide feedback on the one or more summaries; and train the custom summarizer module based on the feedback (Gardner [27, 133, 134, 163-166] relevant information may be summarized using a model, user may provide summary feedback, feedback may be used to train summarization model).
Regarding claim 15, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above. Coulter does not specifically teach wherein to generate the augmented dataset the processor is configured to: receive cloud workloads associated with common services; summarize the cloud workloads of the common services using an LLM; modify the
However Singh teaches wherein to generate the augmented dataset the processor is configured to: receive cloud workloads associated with common services; summarize the cloud workloads of the common services using an LLM; modify theSingh [23, 25, 29, 37-39, Figs. 8-10, cloud workloads for services are received and summaries (reports) may be created for analysis of Relative Attacker Attractiveness Analyzer (RAA Analyzer) and its underlying information, workloads may be modified to generate annotated dataset with interleaved (combined) workloads and used to train model(s) for prompts and reports).
Regarding claim 16, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 15 above.
Claim 15 discloses common cloud workloads.
Coulter further teaches wherein modifying the common... workflows... includes ...combining atomic workflows to make a complex workflow (Coulter [146, 147] actions may be combined).
Regarding claim 17, Coulter, Sharma and Gardner teach the invention as claimed in claim 1 above.
Claim 1 further teaches wherein the processor is configured to harvest the knowledge from the cloud log data and the contextual information.
Coulter further teaches wherein to remove ... log data indicative of the baseline behavior for the user, the processor is further configured to: determine abnormal behavior for the user by removing one or more actions from the set of historical actions associated with the user that are within a threshold from the determined baseline behavior (Coulter [70, 122, 123] based on clustering and scoring anomalous events are determined that do not meet baseline (beyond predetermined threshold), Also see Coulter [28, 98] normal behavior is determined, abnormal behavior is based on events that are not within threshold of normal behavior).
Claim 19 is directed towards a method performing instructions similar in scope to the instructions executed by the system of claim 1, and is rejected under the same rationale.
Claim(s) 20, 21, 23, is/are dependent on claim 19 above, is/are directed towards a method performing instructions similar in scope to the instructions executed by the system of claim(s) 5, 6, 12 respectively, and is/are rejected under the same rationale.
Claim(s) 22, is/are dependent on claim 19 above, is/are directed towards a method performing instructions similar in scope to the instructions executed by the system of claim(s) 8 respectively, and is/are rejected under the same rationale.
Sharma further teaches receiving harvested knowledge (Sharma Secs 2.3 and 3.3.2, based on RAG prompt, relevant information is retrieved (harvested knowledge).
Claim 24, is directed towards a computer program product comprising instructions similar in scope to the instructions executed by the system of claim 1, and is rejected under the same rationale. Coulter further teaches a non-transitory computer readable medium comprising computer instructions (Coulter [189-191]).
Claims 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Coulter (US20250053587A1) in view of Gardner (US 20250061290 A1), Singh (US 20250045411 A1) and Sharma, and further in view of Paulraj (US 20250238303 A1).
Regarding claim 13, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 1 above. Coulter does not specifically teach wherein to train the custom summarizer module, the processor is further configured to: generate an LLM prompt based on domain expertise using examples for few-shot learning; apply training data to a training algorithm; and use the LLM prompt and the training algorithm output to train the custom summarizer module.
However Gardner teaches wherein to train the custom summarizer module, the processor is further configured to: generate an LLM prompt based on domain expertise using examples for ...machine...learning; apply training data to a training algorithm; and use the LLM prompt and the training algorithm output to train the custom summarizer module (Gardner [70-75] LLM prompt may be domain specific using training examples to fine-tune model).
Coulter, Sharma, Singh and Gardner does not specifically teach ... few-shot learning...
However Paulraj teaches generate an LLM prompt based on domain expertise using examples for few-shot learning (Paulraj [28, 38, 176, 182, 183, 193] few-shot learning based on domain may be used to generate LLM prompt).
It would have been obvious to one of an ordinary skill in the art before the effective filing date of the claimed invention, to have incorporated the concept taught by Paulraj of generate an LLM prompt based on domain expertise using examples for few-shot learning, into the invention suggested by Coulter, Sharma, Singh and Gardner, since both inventions are directed towards generating an LLM prompt based on domain expertise, and incorporating the teaching of Paulraj into the invention suggested by Coulter, Sharma, Singh and Gardner would provide the added advantage of training the model with a limited amount of training data, and the combination would perform with a reasonable expectation of success (Paulraj [28, 38, 176, 182, 183, 193]).
Claims 18 are rejected under 35 U.S.C. 103 as being unpatentable over Coulter (US20250053587A1) in view of Gardner (US 20250061290 A1), Singh (US 20250045411 A1) and Sharma, and further in view of Yuan (US 20230281186 A1).
Regarding claim 18, Coulter, Sharma, Singh and Gardner teach the invention as claimed in claim 17 above. Coulter does not specifically teach wherein the baseline behavior for a user is represented as a histogram
However Yuan teaches wherein the baseline behavior for a user is represented as a histogram (Yuan [5] user normal behavior may be represented as a histogram).
It would have been obvious to one of an ordinary skill in the art before the effective filing date of the claimed invention, to have incorporated the concept taught by Yuan of wherein the baseline behavior for a user is represented as a histogram, into the invention suggested by Coulter, Sharma, Singh and Gardner, since both inventions are directed towards determining abnormal behavior based on normal behavior, and incorporating the teaching of Yuan into the invention suggested by Coulter, Sharma, Singh and Gardner would provide the added advantage of allowing normal behavior to be represented by a distribution, and the combination would perform with a reasonable expectation of success (Yuan [5]).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SANCHITA ROY whose telephone number is (571)272-5310. The examiner can normally be reached Monday-Friday 12-8.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Usmaan Saeed can be reached at (571) 272-4046. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
SANCHITA . ROY
Primary Examiner
Art Unit 2146
/SANCHITA ROY/Primary Examiner, Art Unit 2146