Case 3:17-cv-05659-WHA Document 390-18 Filed 03/14/19 Page 1 of 4
`
`Exhibit O
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-05659-WHA Document 390-18 Filed 03/14/19 Page 2 of 4
`Transcript of Khurram Islah, Corporate Designee
`Conducted on February 7, 2019
`
`1 (1 to 4)
`
`1
`
`3
`
` A P P E A R A N C E S
`
`
`
`For the Plaintiff Finjan, Inc.:
`
` KRAMER LEVIN NAFTALIS & FRANKEL LLP
`
` BY: MICHAEL H. LEE, ESQ.
`
` 990 Marsh Road
`
` Menlo Park, California 94025
`
`
`
`For the Defendant Juniper Networks, Inc.
`
`0
`
`and the Witness:
`
`1 2 3 4 5 6 7 8 9 1
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
` IRELL & MANELL LLP
`
` BY: REBECCA CARSON, ESQ.
`
` 840 Newport Center Drive
`
` Suite 400
` Newport Beach, California 92660​6324
`
`
`
` VIDEOGRAPHER: Lucien Newell
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
` IN THE UNITED STATES DISTRICT COURT
`
` NORTHERN DISTRICT OF CALIFORNIA
`
` SAN FRANCISCO DIVISION
`
`--------------------------------X
`
`FINJAN, INC., a Delaware :
`
`Corporation, :
`
` Plaintiff, : Case No.:
`
` vs. : 3:17-CV-05659-WHA
`
`JUNIPER NETWORKS, INC., a :
`
`0
`
`Delaware Corporation, :
`
`1 2 3 4 5 6 7 8 9 1
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
` Defendant. :
`
`--------------------------------X
`
`
`
` VIDEOTAPED 30(b)(6) DEPOSITION OF
`
` JUNIPER NETWORKS, INC.
`
` DESIGNEE: KHURRAM ISLAH
`
` Sunnyvale, California
`
` Thursday, February 7, 2019
`
` 9:42 a.m.
`
`
`
`
`
`
`
`Job No.: 228017
`
`Pages 1 - 139
`
`Reporter: Jenny L. Griffin, RMR, CSR, CRR, CCRR, CRC
`
`25
`
`
`
`2
`
`4
`
` C O N T E N T S
`
`EXAMINATION OF KHURRAM ISLAH
`
` PAGE
`
` PROCEEDINGS 6
`
` BY MR. LEE 7
`
` BY MS. CARSON 136
`
`
`
` E X H I B I T S
`
` (Attached to the Transcript)
`
`0
`
`ISLAH DEPOSITION EXHIBIT PAGE
`
`1 2 3 4 5 6 7 8 9 1
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`Exhibit 1 License Agreement - Joe Security 12
` LLC and Juniper Networks, Inc.
` (JNPR-FNJN_29035_00962471-2499)
`
`Exhibit 2 Joe's Sandbox Installation Guide 30
` (JNPR-FNJN_29040_01462115-2143)
`
`Exhibit 3 License Agreement - Joe Security 37
` LLC and Juniper Networks, Inc.
` (JNPR-FNJN_29035_00962500-2515)
`
`Exhibit 4 Email from Raju Manthena 73
` -11/5/15 - Subject:Improving
` Deception
` (JNPR-FNJN_29040_01180535)
`
`Exhibit 5 Joe Sandbox Desktop 13.0.0 83
` (13.11.2015)
` (JNPR-FNJN_29040_01280968-0978)
`
`Exhibit 6 Joe Sandbox Brief - Jankins Zhan 100
` Feb/07/2017
` (JNPR-FNJN_29033_00665289-5300)
`
`Exhibit 7 Document 111
` (JNPR-FNJN_29040_01194632-4645)
`
`Exhibit 8 Sky ATP Analysis Pipeline 113
` (JNPR-FNJN_29017_00552908-2915)
`
` Videotaped Deposition of KHURRAM ISLAH,
`
`held at the offices of:
`
`
`
`
`
` Juniper Networks, Inc.
`
` 1133 Innovation Way
`
` Building A
`
` Sunnyvale, California 94089
`
`
`
`
`
`
`
`
`
`
`
`
`
` Pursuant to Notice, before Jenny L. Griffin,
`
`California Certified Shorthand Reporter #3969,
`
`Registered Merit Reporter, Certified Realtime
`
`Reporter, California Certified Realtime Reporter,
`
`Certified Realtime Captioner.
`
`
`
`
`
`
`
`
`
`
`
`
`
`PLANET DEPOS
`888.433.3767 | WWW.PLANETDEPOS.COM
`
`24
`
`25
`
`1 2 3 4 5 6 7 8 9 1
`
`0
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`

`

`7
`
`Case 3:17-cv-05659-WHA Document 390-18 Filed 03/14/19 Page 3 of 4
`Transcript of Khurram Islah, Corporate Designee
`Conducted on February 7, 2019
`
`2 (5 to 8)
`
`5
`
` KHURRAM ISLAH,
`being first duly sworn and/or affirmed by the
`Certified Shorthand Reporter to tell the truth, the
`whole truth, and nothing but the truth, testified as
`follows:
` EXAMINATION
`BY MR. LEE:
` Q. Please state your name for the record.
` A. Khurram Islah.
` Q. Where do you work?
` A. I work at Juniper Networks.
` Q. What's your position at Juniper Networks?
` A. I am a software developer.
` Q. What are your responsibilities?
` A. I work in improving the efficacy of the
`product, specifically the Sky ATP solution. My
`primary focus is on the dynamic analysis.
` Q. Can you elaborate? What do you mean by
`"improving the efficacy of the product"?
` A. The -- looking into the dynamic analysis
`results and improving the detection rate, the false
`positives, the false negatives, the true positives,
`true negatives. Improving all those areas improves
`the efficacy of the product.
` Q. How do you improve those areas?
`
`1234567891
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` E X H I B I T S C O N T I N U E D
`
` (Attached to the Transcript)
`
`ISLAH DEPOSITION EXHIBIT PAGE
`
`Exhibit 9 Reputation Client & Server 119
` Document
` (JNPR-FNJN_29017_00552634-2651)
`
`Exhibit 10 VE Efficacy, Oct. 30 123
` (JNPR-FNJN_29017_00552814-2828)
`
`Exhibit 11 Joe Sandbox Cookbook Guide, Last 135
` Update: 01.06.2016
`
`Exhibit 12 Cookbook Script 136
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`6
`
` P R O C E E D I N G S
` THE VIDEOGRAPHER: Here begins
`Disk Number 1 in the videotaped deposition of
`Khurram Islah in the matter of Finjan, Inc., versus
`Juniper Networks, Inc., et al. in the United States
`District Court, Northern District of California,
`San Francisco Division, Case Number
`3:17-CV-05659-WHA.
` Today's date is February 7th, 2019. The
`time on the video monitor is 9:42. The videographer
`today is Lucien Newell, representing Planet Depos.
` This video deposition is taking place at
`1133 Innovation Way, Building A, Sunnyvale,
`California 94089.
` Would counsel please voice-identify
`themselves and state whom they represent.
` MR. LEE: Michael Lee from Kramer Levin,
`representing Finjan.
` MS. CARSON: Rebecca Carson of Irell &
`Manella, representing Juniper Networks and the
`witness.
` THE VIDEOGRAPHER: The court reporter today
`is Jenny Griffin, representing Planet Depos.
` Would the reporter please swear in the
`witness.
`
` A. One way of improving -- for example, in
`dynamic analysis -- is to ensure that your detection
`is close to what the actual classification should
`be.
` Q. How do you ensure that the detection is
`close to the actual classification?
` A. So specifically in the domain of dynamic
`analysis, where you are dependent on certain
`features, as a developer and looking into the
`details of the features, have to figure out what
`0
`features are good for the solutions and what could
`11
`create a false positive.
`12
` Having a false positive is not good for a
`13
`product, so we try to look into details and figure
`14
`out how we could improve by adding in features or
`15
`removing existing features based on the data that we
`16
`think is good enough to look into.
`17
` Q. Are you solely responsible for the dynamic
`18
`analysis part of Sky ATP?
`19
` A. This is my main area of focus. I'm
`20
`responsible for improving the efficacy of the
`21
`dynamic analysis. There are other engineers that
`22
`help me in this domain.
`23
` It's a big team, but my primary focus is on
`24
`dynamic analysis.
`25
`PLANET DEPOS
`888.433.3767 | WWW.PLANETDEPOS.COM
`
`8
`
`1234567891
`
`1 2 3 4 5 6 7 8 9 1
`
`0
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`1234567891
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`

`

`Case 3:17-cv-05659-WHA Document 390-18 Filed 03/14/19 Page 4 of 4
`Transcript of Khurram Islah, Corporate Designee
`Conducted on February 7, 2019
`117
`
`BY MR. LEE:
` Q. It refers to -- can we back up?
` Did you say you don't have enough knowledge
`about the adapter flow to answer questions regarding
`it?
` A. I don't have enough knowledge on the
`pipeline process, yes.
` Q. Okay.
` (Exhibit 9 was marked for
` identification and is attached to the
` transcript.)
`BY MR. LEE:
` Q. You've been handed exhibit marked as
`Exhibit Number 9. Exhibit Number 9 is Bates-labeled
`JNPR-FNJN_29017_00552634 to -2651.
` Do you recognize Exhibit Number 9?
` A. I don't think I've seen this document
`before, and I am not an expert on reputation client
`and server.
` Q. Can you go to the Bates ending in 636?
` A. 636? Yes.
` Q. Do you see in the lower right-hand corner
`of the figure there, there's an arrow that says
`"DeceptionAdapters" --
` A. Sure.
`
`1234567891
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` A. Which page is this?
` Q. This is the 909.
` MS. CARSON: Same sentence we've been
`talking about.
` THE WITNESS: Yeah. Like I said, this
`statement doesn't make any sense to me. What makes
`sense is the last page.
`BY MR. LEE:
` Q. So you don't understand what that sentence
`means?
` A. This -- I'm understanding what it's saying.
`I'm saying it's not making sense because this is not
`the way verdict engine works. The verdict engine in
`the end gives a threshold score.
` Q. Do you see where it says "at each stage"?
` A. At each stage. At each stage. I can't --
`yes.
` Q. Are you aware of whether there's different
`results made at each stage by the verdict engine?
` MS. CARSON: Objection. Form.
` THE WITNESS: At every stage, verdict
`engine will give a specific score. I'm aware of
`that.
`BY MR. LEE:
` Q. And based on the score, is there a decision
`
`30 (117 to 120)
`
`119
`
`120
`
`1234567891
`
`118
`
`not to keep scanning?
` MS. CARSON: Objection. Form.
` THE WITNESS: And based on the score . . .
` The decision could be made -- I just need
`to think it through. Just a second.
` At every stage.
`BY MR. LEE:
` Q. Maybe it will help if I refer you to
`another sentence in here.
` A. Sure.
` Q. 910. It says, "If" -- the last bullet is
`talking about:
` "If we have enough evidence that a
` file is either malicious or benign at
` some intermediate stage of the pipeline
` we can 'early exit' and save the cost of
` full analysis."
` Do you see that? Do you see that sentence?
` A. Yes. Yes, I see it. Sorry. I was reading
`it.
` Q. Is that accurate?
` MS. CARSON: Objection. Form. Outside the
`scope.
` THE WITNESS: This -- okay.
`///
`
` Q. -- and it goes into the reputation server?
` A. Sure.
` Q. Do you have any understanding of what that
`represents?
` A. Yes.
` Q. What is that?
` A. It's too radical a concept of connecting
`Deception adapter to a reputation server.
` Q. Do you have an understanding of whether
`that's been implemented?
`0
` A. To my understanding, it hasn't been
`11
`implemented.
`12
` Q. What's your understanding based on?
`13
` A. To -- yes. Be sure to always look into the
`14
`source code, but, to my understanding, as far as I
`15
`know about the source code, we don't see that
`16
`interaction.
`17
` Q. What is it based on? Your --
`18
` A. To my understanding, based on the source
`19
`code that I have seen, I don't see any samples being
`20
`conveyed to reputation server from Deception
`21
`adapter, but we can always check the source code
`22
`again and confirm it. But I think this is just too
`23
`radical a concept.
`24
` Q. When was the last time you looked at the
`25
`PLANET DEPOS
`888.433.3767 | WWW.PLANETDEPOS.COM
`
`1234567891
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`1234567891
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`