Case 3:17-cv-05659-WHA Document 435-12 Filed 04/12/19 Page 1 of 3
`Case 3:17-cv-05659-WHA Document 435-12 Filed 04/12/19 Page 1 of 3
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`EXHIBIT 9
`EXHIBIT 9
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-05659-WHA Document 435-12 Filed 04/12/19 Page 2 of 3
`
` Volume 4
` Pages 615 - 831
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`BEFORE THE HONORABLE WILLIAM H. ALSUP, JUDGE
`
`)
`FINJAN, INC.,
` )
` Plaintiff,
`)
` )
` VS. ) No. C 17-5659 WHA
` )
`JUNIPER NETWORKS, INC.,
`)
` )
` Defendant.
`)
` ) San Francisco, California
` Thursday, December 13, 2018
`
`
`TRANSCRIPT OF PROCEEDINGS
`
`
`APPEARANCES:
`
`For Plaintiff: KRAMER, LEVIN, NAFTALIS & FRANKEL LLP
` 990 Marsh Road
` Menlo Park, California 94025
` BY: PAUL J. ANDRE, ESQ.
` LISA KOBIALKA, ESQ.
` JAMES HANNAH, ESQ.
` KRISTOPHER B. KASTENS, ESQ.
`
` KRAMER LEVIN NAFTALIS AND FRANKEL LLP
` 1177 Avenue of the Americas
` New York, New York 10036
` BY: CRISTINA LYNN MARTINEZ, ESQ.
`
`
`(Appearances continued on next page)
`
`
`
`
`Reported By: Katherine Powell Sullivan, CSR No. 5812, RMR, CRR
` Jo Ann Bryce, CSR No. 3321, RMR, CRR
` Official Reporters
`
`I N D E X
`
`
`Thursday, December 13, 2018 - Volume 4
`
` PAGE VOL.
`Plaintiff Rests
`643
`4
`
`PLAINTIFF'S WITNESSES PAGE VOL.
`
`ICASIANO, ALEX
`By Videotaped Deposition
`
`GUPTA, SHELLY
`By Videotaped Deposition
`
`DEFENDANT'S WITNESSES PAGE VOL.
`
`BUSHONG, MICHAEL
`(SWORN)
`Direct Examination by Ms. Carson
`Cross-Examination by Mr. Hannah
`Redirect Examination by Ms. Carson
`
`RUBIN, AVIEL
`(SWORN)
`Direct Examination by Mr. Heinrich
`Cross-Examination by Mr. Andre
`Redirect Examination by Mr. Heinrich
`
`UGONE, KEITH RAYMOND
`(SWORN)
`Direct Examination by Ms. Curran
`Cross-Examination by Ms. Kobialka
`
`642
`
`643
`
`644
`645
`698
`709
`
`710
`711
`771
`796
`
`797
`798
`820
`
`4
`
`4
`
`4
`4
`4
`4
`
`4
`4
`4
`4
`
`4
`4
`4
`
`APPEARANCES (CONTINUED):
`
`For Defendant: IRELL & MANELLA LLP
` 1800 Avenue of the Stars, Suite 900
` Los Angeles, California 90067-4276
` BY: JONATHAN S. KAGAN, ESQ.
` ALAN J. HEINRICH, ESQ.
` JOSHUA GLUCOFT, ESQ.
` CASEY CURRAN, ESQ.
`
` IRELL & MANELLA LLP
` 840 Newport Center Drive, Suite 400
` Newport Beach, California 92660
` BY: REBECCA CARSON, ESQ.
` KEVIN X. WANG, ESQ.
`
`I N D E X
`
` E X H I B I T S
`
`
`TRIAL EXHIBITS IDEN EVID VOL.
`
`
`58
`
`685
`
`4
`
`182
`
`1059
`
`1070
`
`1170
`
`1241, Title Page & Table of Contents
`
`1241, Page 39
`
`1248
`
`1264
`
`1347
`
`1552
`
`2197
`
`686
`
`727
`
`720
`
`690
`
`730
`
`763
`
`760
`
`751
`
`682
`
`726
`
`724
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`4
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`

`

`Case 3:17-cv-05659-WHA Document 435-12 Filed 04/12/19 Page 3 of 3
`
`RUBIN - DIRECT / HEINRICH
` 764
`has to do with having rules for how you put things together.
`This is different from a database schema, which defines how you
`put data into a database. A JSON schema defines how you put
`text into a JSON object.
`Q. So it gets a little confusing. Does use of the word
`"schema" mean a database schema?
`A.
`It does not. And this is actually where I want to get
`back to my original theme of labels.
`I felt that Dr. Cole was using the label "schema"
`incorrectly; and just because something is in a JSON schema,
`doesn't mean that if you put that object into a database, it
`would be a database schema. If you put that object into a
`schema-less database, you can have a JSON in a schema-less
`database, but I don't think it's appropriate to try to confuse
`that the JSON schema somehow makes that a database schema.
`Q. Now, does the JSON format used in Sky ATP organize
`everything in what Dr. Cole refers to as the ResultsDB
`database?
`A. No.
`Q. Can you explain?
`A. So, first of all, there is no such thing as a ResultsDB
`database. He's drawing a box around three different storage
`solutions and calling that the ResultsDB database. That's the
`first part of my answer.
`Secondly, the JSONs, which are the results of the
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
` 763
`
`RUBIN - DIRECT / HEINRICH
`direct examination.
`MR. HEINRICH: Thank you, Your Honor.
`Just one additional housekeeping matter. The
`Exhibit 1241, SQL for Dummies, we'd move into evidence one
`additional page at 1241-39.
`THE COURT: Any problem with that?
`MR. ANDRE: No, Your Honor. No objection.
`THE COURT: All right. That's in, 1231 [sic].
`MR. HEINRICH: So that's 1241 at page 39 of the
`
`exhibit.
`
`THE COURT: Oh, 39. Okay.
`(Trial Exhibit 1241, Page 39 received in evidence)
`MR. HEINRICH: All right. So we were about to pull up
`Exhibit 1248, so let's just bring that up on the screen. And
`if we can pull up on page 3 of 1248.
`Q. What does -- the Internet Engineering Task Force, how do
`they describe the JSON format?
`A. So the IETF defines JSON, and in this first sentence in
`the introduction it says that (reading):
`"JSON is a text format for the serialization of
`structured data."
`So that basically says that it's a way to take data and
`keep it in an organized way on the computer.
`Q. Now, can a JSON conform to a schema?
`A. Yes. You can have a JSON schema. The word "schema" just
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`RUBIN - DIRECT / HEINRICH
`
` 766
`
`A. Okay.
`Q. Can you kind of walk us through?
`A. Sure. So what happens is there are two types of
`information stored in two different tables in DynamoDB. So
`when the analysis engines run, they produce results and those
`results can contain a lot of information. If the total results
`that get put into a JSON does not exceed 400 kilobytes, then
`that gets put in a JSON into DynamoDB.
`If it's bigger than 400 kilobytes, then those results,
`which could be, you know, 3 megabytes, 4 megabytes, much bigger
`than 400 kilobytes, it gets put into S3, which is just an
`object store, and then a link to that data in S3 is put into
`DynamoDB.
`Q. Now, we saw some testimony from Dr. Cole that, well, there
`must be a database with a schema because once stored, the
`security profiles with the list of suspicious operations have
`to be quickly accessed. Is that right?
`A. That's not right.
`Q. And why not?
`A. The reason is that when those results of the analysis are
`stored, all those detail results, they're not used again by the
`system. What the system uses is the verdict. The verdict is
`very small and easy to look up.
`Q. Now, when Sky ATP accesses a stored verdict, is it also
`accessing that security profile?
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`RUBIN - DIRECT / HEINRICH
` 765
`analysis, are stored in DynamoDB or S3, which are schema-less.
`And so that's very different from the way Dr. Cole described
`it.
`Q. The MySQL database used in Sky ATP, does that use the JSON
`format?
`A.
`It does not. Nothing that's stored in the MySQL database
`is of a JSON format.
`Q. And if you can please pull up Exhibit 99. This is already
`in evidence. This is the source code.
`And let's take a look at page 207. You can just take a
`look at it on the screen.
`A. Okay.
`Q. Can you explain what this code is telling us here?
`A. Okay. So what we're looking at here is the code for a
`table of objects and different -- different keys, like the
`primary key, unique key, indexed. So this is the SQL
`information in the MySQL database.
`Q. And does this use the JSON format?
`A.
`It does not.
`Q. All right. Dr. Cole also referred to what's called main
`schema. What does that relate to?
`A. Okay. So the main schema is also a JSON schema and it
`defines how certain data is stored in a JSON.
`Q. So let's drill down a little bit deeper and let's talk in
`more detail about how information is stored in DynamoDB.
`
` 1
` 2
` 3
` 4
` 5
` 6
` 7
` 8
`
`
`91
`
`0
`11
`12
`13
`14
`15
`16
`17
`18
`19
`20
`21
`22
`23
`24
`25
`
`