Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 1 of 78
`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 1 of 78
`
`(cid:55)(cid:53)(cid:44)(cid:36)(cid:47)(cid:3)(cid:40)(cid:59)(cid:17)(cid:3)1760
`TRIAL EX. 1760
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 2 of 78
`
`
`
`UNITED STATES PATENT AND TRADEMARK OFFICE
`
`__________________
`
`BEFORE THE PATENT TRIAL AND APPEAL BOARD
`
`___________________
`
`PALO ALTO NETWORKS, INC,
`
`Petitioner,
`
`v.
`
`FINJAN, INC.,
`
`Patent Owner.
`
`____________________
`
`Case IPR2016-00159
`Patent 8,677,494
`
`__________________________________________________________
`
`
`
`
`
`PATENT OWNER’S RESPONSE
`
`
`Trial Ex. 1760-1
`
`UNITED STATES DISTRICT COURT
`NORTHERN DISTRICT OF CALIFORNIA
`
` Trial Exhibit
`Case No. 3:17-cv-05659-WHA
`
`Date Entered___________________
`
`By____________________________
` DEPUTY CLERK
`
`1760
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 3 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`TABLE OF CONTENTS
`
`Page
`
`I.
`
`
`II.
`
`
`Introduction ...................................................................................................... 1
`
`Facts ................................................................................................................. 1
`
`A.
`
`
`B.
`
`
`C.
`
`
`The ‘494 Patent ..................................................................................... 1
`
`Overview of Swimmer .......................................................................... 4
`
`Overview of Martin ............................................................................... 6
`
`
`
` Overview of Evidence Before the Board .............................................. 6 D.
`
`1.
`
`
`Dr. Aviel Rubin ........................................................................... 7
`
`
`
` Mr. John Hawes .......................................................................... 7 2.
`
`
`
` Claim Construction .......................................................................................... 8 III.
`
`A.
`
`
`B.
`
`
`C.
`
`
`“downloadable security profile data” (all claims) ................................. 8
`
`“database” (all claims)......................................................................... 11
`
`“Downloadable” (all claims) ............................................................... 11
`
`
`
` Other Terms ......................................................................................... 11 D.
`
` Petitioner Has Failed To Show That The References Were Publicly IV.
`
`
`Available ........................................................................................................ 11
`
`A.
`
`
`Swimmer Was Not Publicly Available ............................................... 12
`
`
`
` Martin Was Not Publicly Available .................................................... 14 B.
`
`V.
`
`
`Swimmer Does Not Render Claims 1, 2, 6, 10, 11, and 15 Obvious
`Under 35 U.S.C. § 103(a) .............................................................................. 15
`
`A.
`
`
`Swimmer Teaches Away from the Invention Claimed in the
`‘494 Patent ........................................................................................... 16
`
`- i -
`
`Trial Ex. 1760-2
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 4 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`B.
`
`
`Petitioner Has Not Demonstrated That Swimmer Discloses “[a
`Downloadable scanner coupled with said receiver, for] deriving
`DSP data, including a list of suspicious computer operations
`that may be attempted by the Downloadable” (claims 1 and 10) ....... 17
`
`1.
`
`
`2.
`
`
`3.
`
`
`4.
`
`
`5.
`
`
`Swimmer Does Not Disclose “a list of suspicious
`computer operations that may be attempted by the
`Downloadable” because Swimmer never deems any
`operations as suspicious ............................................................19
`
`Petitioner’s Argument That Swimmer Discloses A List of
`Suspicious Computer Operations Fails Because No
`Computer Operations Are a priori Suspicious .........................23
`
`Swimmer’s Audit Trail Does not Include a List of
`Suspicious Computer Operations Simply Because it can
`be Used to Detect Viruses .........................................................24
`
`The Claims Require Deriving a List of Suspicious
`Computer Operations ................................................................25
`
`Swimmer’s Activity Data Contained Within an Audit
`Record Cannot Correspond to DSP Data Because an
`Audit Record does not Include a List of Suspicious
`Computer Operations ................................................................27
`
`C.
`
`
`Petitioner Has Not Demonstrated that Swimmer Discloses
`“storing the DSP data in a database” (claims 1 and 10) ...................... 28
`
`1.
`
`
`2.
`
`
`3.
`
`
`Swimmer’s Audit Trail Is Not A Database Because
`Swimmer’s Audit Trail Is Undisputedly a Log File .................29
`
`Swimmer Teaches that the Audit Trail Is Not A Database ......34
`
`Swimmer’s Audit Trail does Not have a Schema and
`Does Not Describe a Flat-File Database ...................................35
`
`a.
`
`“Canonical Format” is a Generic File Format, Not
`a “Database Schema” ......................................................37
`
`4.
`
`
`Converting Data Does Not Store the Data in a Database .........38
`
`- ii -
`
`Trial Ex. 1760-3
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 5 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`5.
`
`
`6.
`
`
`The Claims of the ‘494 Patent Impose a Timing
`Requirement not Met by Swimmer’s VIDES System ..............40
`
`There is No Motivation to Substitute Swimmer’s Log
`File With a Database .................................................................41
`
`D.
`
`
`E.
`
`
`Swimmer does not Teach or Suggest “a database manager
`coupled with said Downloadable scanner, for storing the DSP
`data in a database” (claim 10) ............................................................. 43
`
`Swimmer does not Teach or Suggest storing “a date & time
`when the Downloadable Security profile data was derived”
`(claims 2 and 11) ................................................................................. 46
`
` Swimmer and Martin Do Not Render Claims 4-5 and 13-14 Obvious VI.
`
`
`Under 35 U.S.C. § 103(a) .............................................................................. 47
`
`A.
`
`
`B.
`
`
`C.
`
`
`Swimmer is Not Prior Art and Teaches Away from the
`Invention Claimed in the ‘494 Patent .................................................. 47
`
`Swimmer and Martin Do Not Disclose Wherein the
`Downloadable includes Program Script or Active Control ................ 47
`
`Petitioner Provides Insufficient Motivation To Combine
`Swimmer And Martin .......................................................................... 48
`
`
`
` Secondary Considerations of Non-Obviousness ........................................... 54 VII.
`
`A.
`
`
`B.
`
`
`C.
`
`
`D.
`
`
`Long-Felt But Unresolved Need and Recognition of a Problem ........ 61
`
`Skepticism and Unexpected Results ................................................... 61
`
`The Failure of Others .......................................................................... 62
`
`Teaching Away By Others .................................................................. 62
`
`
`
` CONCLUSION .............................................................................................. 63 VIII.
`
`
`
`- iii -
`
`Trial Ex. 1760-4
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 6 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`TABLE OF AUTHORITIES
`
` Page(s)
`
`Cases
`ActiveVideo Networks, Inc., v. Verizon Comm’ns, Inc.,
`694 F.3d 1312 (Fed. Cir. 2012) .......................................................................... 54
`
`Apple Inc. v. Int’l Trade Comm’n,
`725 F.3d 1356 (Fed. Cir. 2013) .......................................................................... 65
`
`Blue Calypso, LLC v. Groupon, Inc.,
`815 F.3d 1331 (Fed. Cir. 2016) .......................................................................... 12
`
`Cisco Sys., Inc. v. Constellation Techs. L.L.C.,
`IPR2014-01085, Paper 11 (P.T.A.B. Jan. 9, 2015) ............................................ 12
`
`In re CSB-Sys. Int’l, Inc.,
`No. 2015-1832, Slip Op. at 8 (Fed. Cir. Aug. 9, 2016) ..................................... 30
`
`In re: Cyclobenzaprine Hydrochloride Extended-Release Capsule
`Patent Litig.,
`676 F.3d 1063 (Fed. Cir. 2012) .......................................................................... 64
`
`Demaco Corp. v. F. Von Langsdorff Licensing Ltd.,
`851 F.2d 1387 (Fed. Cir. 1988) .......................................................................... 57
`
`Finjan v. Websense, Inc.,
`14-CV-01353-BLF (N.D. Cal.) .......................................................................... 59
`
`In re Gal,
`980 F.2d 717 (Fed. Cir. 1992) ...................................................................... 44, 48
`
`Graftech Int’l Holdgs, Inc., v. Laird Techs., Inc.,
`No. 2015-1796, 2016 WL 3357427 (Fed. Cir. June 17, 2016) ........................... 56
`
`In re Gurley,
`27 F.3d 551 (Fed. Cir. 1994) .............................................................................. 55
`
`In re Hall,
`781 F.2d 897 (Fed. Cir. 1986) ............................................................................ 12
`
`- i -
`
`Trial Ex. 1760-5
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 7 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`Institut Pasteur & Universite Pierre Et Marie Curie v. Focarino,
`738 F.3d 1337 (Fed. Cir. 2013) .......................................................................... 56
`
`Interactive Gift Express, Inc. v. Compuserve, Inc.,
`256 F.3d 1323 (Fed. Cir. 2001) ............................................................................ 8
`
`In re Klopfenstein,
`380 F.3d 1345 (Fed. Cir. 2004) .......................................................................... 13
`
`KSR Int’l Co. v. Teleflex Inc.,
`550 U.S. 398 (2007) ............................................................................................ 44
`
`Kyocera Wireless Corp. v. Int’l Trade Comm’n,
`545 F.3d 1340 (Fed. Cir. 2008) .................................................................... 12, 15
`
`L-3 Commc’n Holdings, Inc. v. Power Survey, LLC,
`IPR2014-00832, Paper No. 9 (P.T.A.B. Nov. 14, 2014) .................................... 12
`
`Leo Pharm. Prods., Ltd. v. Rea,
`726 F.3d 1346 (Fed. Cir. 2013) .......................................................................... 51
`
`In re Magnum Oil Tools Int’l, Ltd.,
`No. 2015-1300, 2016 WL 3974202 (Fed. Cir. July 25, 2016) ............... 15, 44, 52
`
`Microsoft Corp. v. Proxyconn, Inc.,
`789 F.3d 1292 (Fed. Cir. 2015) .......................................................................... 40
`
`Minnesota Mining & Mfg. Co. v. Johnson & Johnson Orthopaedics, Inc.,
`976 F.2d 1559 (Fed. Cir. 1992) .......................................................................... 62
`
`OpenTV, Inc. v. Cisco Tech., Inc.,
`IPR2013-00328, Paper No. 13 (PTAB Nov. 29, 2013) ...................................... 47
`
`Orthopedic Equip. Co. v. All Orthopedic Appliances, Inc.,
`707 F.2d 1376 (Fed. Cir. 1983) .......................................................................... 64
`
`Osram Sylvania Inc. v. Am. Induction Technologies Inc.,
`701 F.3d 698 (Fed. Cir. 2012) ............................................................................ 65
`
`Rambus Inc. v. Rea,
`731 F.3d 1248 (Fed. Cir. 2013) .......................................................................... 65
`
`- ii -
`
`Trial Ex. 1760-6
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 8 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`In re Ratti,
`270 F.2d 810 (C.C.P.A. 1959) ............................................................................ 53
`
`SAS Institute, Inc. v. Complementsoft, LLC,
`No. 2015-01346, 2016 WL 3213103 (Fed. Cir. June 10, 2016)......................... 35
`
`Sophos, Inc. v. Finjan, Inc.,
`IPR2015-00907, Decision Denying Institution,
`Paper No. 8 (P.T.A.B. Sept. 24, 2015) ............................................................... 10
`
`SRI Int’l, Inc. v. Internet Sec. Sys. Inc.,
`511 F.3d 1186 (Fed. Cir. 2008) .......................................................................... 13
`
`In re Suitco Surface, Inc.,
`603 F.3d 1255 (Fed. Cir. 2010) ...................................................................... 9, 10
`
`Statutes
`
`35 U.S.C. § 103(a) ......................................................................................... 3, 15, 49
`
`35 U.S.C. § 311(b) ................................................................................................... 12
`
`Other Authorities
`
`Federal Rules of Evidence 801 ................................................................................ 14
`
`Federal Rules of Evidence 802 ................................................................................ 14
`
`Federal Rules of Evidence 803 ................................................................................ 14
`
`
`
`- iii -
`
`Trial Ex. 1760-7
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 9 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`PATENT OWNER’S EXHIBIT LIST
`
`
`
`Description
`
`Exhibit-2001 Claim Construction Order, Finjan, Inc., v. Sophos, Inc., Case No.
`14-cv-01197-WHO, Dkt. No. 73.
`
`Exhibit-2002 U.S. Patent No. 8,079,086.
`
`Exhibit-2003 U.S. Patent No. 7,613,926.
`
`Exhibit-2004 U.S. Patent No. 6,804,780.
`
`Exhibit-2005 U.S. Patent No. 6,480,962.
`
`Exhibit-2006 U.S. Patent No. 6,167,520.
`
`Exhibit-2007 Decision on Appeal, Ex Parte Finjan, Inc., Appeal 2015-006304,
`Reexamination Control No. 90/013,017.
`
`Exhibit-2008 Notice of Intent to Issue Ex Parte Reexamination Certificate.
`
`Exhibit-2009 Reexamination Certificate for U.S. Patent 7,058,822.
`
`Exhibit-2010 Finjan, Inc. v. Palo Alto Networks, Inc., Case No. 14-cv-04908-
`PJH, excerpts from Plaintiff Finjan, Inc.’s Objections and
`Responses to Defendant Palo Alto Networks, Inc.’s First Set of
`Interrogatories (Nos. 1-13), dated February 25, 2015
`
`Exhibit-2011 Declaration of Nenad Medvidovic, Ph.D. on the Validity of Claims
`1, 2, 3, 4, 5, 6, 10, 11, 12, 13, 14, and 15 of U.S. Patent No.
`8,677,494 in Support Patent Owner’s Response with Dr.
`Medvidovic Curriculum Vitae
`
`Exhibit-2012 Declaration of S.H. Michael Kim in Support of Patent Owner’s
`Response
`
`Exhibit-2013 Declaration of Jeffrey H. Price in Support of Patent Owner’s
`Response
`
`Exhibit-2014 Deposition Transcript of John Hawes in Palo Alto Networks, Inc.
`v. Finjan, Inc., Case No. IPR2016-00159, taken on July 14, 2016
`
`- i -
`
`Trial Ex. 1760-8
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 10 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`
`
`Description
`
`Exhibit-2015 Deposition Transcript of Aviel Rubin, Ph.D. in Palo Alto
`Networks, Inc. v. Finjan, Inc., Case No. IPR2015-01979, taken on
`May 20, 2016
`
`Exhibit-2016 Deposition Transcript of Jack W. Davidson. in Symantec Corp. v.
`Finjan, Inc., Case No. IPR2015-01892, taken on May 27, 2016
`
`Exhibit-2017 Microsoft Press Computer Dictionary, Third Edition - Excerpts,
`Pages 74, 199, 288, 421, 451
`
`Exhibit-2018
`
`IBM Dictionary of Computing (Excerpts, page 149, 653)
`
`Exhibit-2019 Dictionary of Computer Words - An A to Z Guide to Today’s
`Computers (1995) - Page 62
`
`Exhibit-2020 Definition of Logfile from Wikipedia, available at
`http://en.wikipedia.org/wiki/Logfile
`
`Exhibit-2021 Microsoft MS-DOS Programmer’s Reference - The Official
`Technical Reference to MS-DOS (1993), Page 10
`
`Exhibit-2022 Log File, available at http://techterms.com/definition/logfile.
`
`Exhibit-2023 Abdelaziz Mounji, “User Guide for Implementing NADF
`Adaptors,” Institut d’ Informatique (Jan. 1995)(“MOU95”)
`
`Exhibit-2024 Finjan, Inc. v. Sophos, Inc., 14-cv-1197-WHO (N.D. Cal.), Dkt.
`No. 58-12, Declaration of Nenad Medvidovic in Support of
`Plaintiff Finjan, Inc.’s Opening Claim Construction Brief, dated
`December 1, 2014
`
`Exhibit-2025 Finjan, Inc. v. Websense, Inc., Case No. 14-cv-01353 (N.D. Cal.),
`Plaintiff Finjan, Inc.’s Disclosure of Asserted Claims and
`Infringement Contentions, dated April 22, 2014
`
`Exhibit-2026 Websense, Inc. brochure - Triton APX (2015), available at
`https://www.websense.com/assets/brochures/brochure-triton-apx-
`en.pdf.
`
`- ii -
`
`Trial Ex. 1760-9
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 11 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`
`
`Description
`
`Exhibit-2027 Claim charts created by Dr. Nenad Medvidovic regarding the
`products of Finjan’s licensees and the ‘494 Patent
`
`Exhibit-2028 F-Secure Whitepaper - F-Secure DeepGuard, available at
`https://www.f-
`secure.com/documents/996508/1030745/deepguard_whitepaper.pd
`f.
`
`Exhibit-2029 Proofpoint, Inc.’s 10-K, dated December 31, 2014
`
`Exhibit-2030 Reuters news article - Avast worth ‘upwards of $2 billion’; no IPO
`before 2017, available at http://www.reuters.com/article/us-avast-
`ceo-idUSKCN0SN2MJ20151029
`
`Exhibit-2031 F-Secure 2015 revenue and financials, available at https://www.f-
`secure.com/en/web/investors_global/financials.
`
`Exhibit-2032 Websense, Inc. Revenue and Financial Data, available at
`http://www.hoovers.com/company-information/cs/revenue-
`financial.websense_inc.89ee9262879a5b65.html.
`
`Exhibit-2033 Proofpoint, Inc. Press Release - Proofpoint Announces Fourth
`Quarter and Full Year 2015 Financial Results (Jan. 28, 2016),
`available at
`http://investors.proofpoint.com/releasedetail.cfm?releaseid=95229
`5
`
`Exhibit-2034 Finjan Holdings, Inc. 8-K, dated April 7, 2015
`
`Exhibit-2035 Finjan Holdings, Inc. 8-K, dated December 30, 2015
`
`Exhibit-2036 Finjan Holdings, Inc. 8-K, dated May 14, 2015
`
`Exhibit-2037 Finjan Holdings, Inc. 8-K, dated May 20, 2016
`
`Exhibit-2038 Finjan Holdings, Inc. 8-K, dated November 15, 2015
`
`Exhibit-2039 Finjan Holdings, Inc. 8-K, dated September 24, 2014
`
`- iii -
`
`Trial Ex. 1760-10
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 12 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`
`
`Description
`
`Exhibit-2040 Gartner - Magic Quadrant for Secure Web Gateways, May 28,
`2013
`
`Exhibit-2041 Gartner - Magic Quadrant for Secure Email Gateways, July 2,
`2013
`
`Exhibit-2042 Ray Duncan, Advanced MS-DOS Programming, page 274
`
`Exhibit-2043 Proofpoint Inc. 10-K, dated February 25, 2016
`
`Exhibit-2044 Webster’s New World Dictionary of Computer Terms, Sixth Ed.,
`page 78
`
`- iv -
`
`Trial Ex. 1760-11
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 13 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`I.
`
`
`INTRODUCTION
`
`Petitioner has failed to meet its burden of proof that the challenged claims
`
`are unpatentable, because (1) Petitioner has not established that Swimmer and/or
`
`Martin was publicly available prior to the critical date; (2) Swimmer and Martin,
`
`fail to disclose several of the challenged claim elements, and there is no legal or
`
`technical basis for filling these gaping holes as Petitioner requests, and (3)
`
`Petitioner’s declarants failed to provide adequate factual basis for their opinions—
`
`relying instead on conclusory statements to support their position. For these
`
`reasons, and those stated below, Petitioner’s obviousness challenge to claims 1-6
`
`and 10-15 of U.S. Patent 8,677,494 (Ex. 1001) (“the ‘494 Patent”) should be
`
`denied and all claims found patentable.
`
`II.
`
`
`FACTS
`
`
`
` The ‘494 Patent A.
`
`The ‘494 Patent1 describes an Internet-based technology that protects
`
`personal computers from the risk of “suspicious or other ‘malicious’ operations
`
`
`1 The ‘494 Patent claims priority to U.S. Patent Nos. 8,079,086 (“the ‘086 Patent”),
`
`7,613,926 (“the ‘926 Patent”), 7,058,822 (“the ‘822 Patent”), 6,804,780 (Ex.
`
`2028)(“the ‘780 Patent”), 6,092,194 (Ex. 2013) (“the ‘194 Patent”), 6,480,962
`
`
`
`- 1 -
`
`Trial Ex. 1760-12
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 14 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`that might otherwise be effectuated by remotely operable code.” ‘494 Patent at
`
`2:51–56. This protects against potentially malicious content by receiving incoming
`
`content (i.e. a Downloadable) from the Internet and establishing that the code will
`
`not cause any harm before it is allowed to run. The Downloadable is reviewed and
`
`Downloadable security profile data, 2 which includes a list of suspicious computer
`
`operations that the Downloadable may attempt, is derived. ‘194 Patent at 5:45–48.
`
`Importantly, the DSP is stored in a database. ‘494 Patent at 21:24–25; ‘194
`
`Patent at 4:14–18; 9:52–55. Accordingly, DSP data can be retrieved when a
`
`known Downloadable is detected, thereby allowing security decisions to be made
`
`without generating security profiles for all incoming Downloadables. The storage
`
`of the DSP in a database is one of the key features that distinguished the ‘494
`
`Patent over the prior art.
`
`Petitioner submitted a Petition to institute IPR on November 6, 2015,
`
`challenging claims 1-18 of the ‘494 Patent. Paper No. 2 (“Petition”). Petitioner
`
`
`(“the ‘962 Patent”), and 6,167,520 (“the ‘520 Patent”). The ‘494 Patent
`
`incorporates the disclosures of these patents by reference.
`
`2 This paper refers to the terms “security profile data for a Downloadable” and
`
`“Downloadable security profile data” as “DSP data.”
`
`- 2 -
`
`Trial Ex. 1760-13
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 15 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`challenged the claims based on Swimmer3, Touboul4, Ji5, and Martin6. Id. On
`
`May 13, 2016, the Board instituted IPR under 35 U.S.C. § 103(a) based on
`
`Swimmer for claims 1, 2, 6, 10, 11, and 15 and Swimmer and Martin for claims 3-
`
`5 and 12-14. Paper No. 8 (“Institution Decision”) at 34. Claims 1 and 10 are
`
`independent claims. ‘494 Patent, claims 1 and 10; Institution Decision at 3.
`
`Claims 2-6 are dependent on claim 1, and claims 11-15 are dependent on claim 10.
`
`‘494 Patent, claims 2-6, 11-15; Institution Decision at 4. Claim 10 is illustrative
`
`and is reproduced below:
`
`10. A system for managing Downloadables, comprising:
`
`
`
`a receiver for receiving an incoming Downloadable;
`
`a Downloadable scanner coupled with said receiver, for deriving
`
`security profile data for the Downloadable, including a list of suspicious
`computer operations that may be attempted by the Downloadable; and
`
`
`3 Morton Swimmer, et al., Dynamic Detection and Classification of Computer
`
`Viruses Using General Behaviour Patterns, Virus Bulletin Conference, Virus
`
`Bulletin Ltd. (Ex. 1006, “Swimmer”).
`
`4 Int’l Publication No. WO 1998/0023683 (Ex. 1026, “Touboul”).
`
`5 U.S. Patent No. 5,983,348 (Ex. 1010, Ji).
`
`6 David Martin, et al., Blocking Java Applets at the Firewall (Ex. 1047, “Martin”).
`
`- 3 -
`
`Trial Ex. 1760-14
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 16 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`a database manager coupled with said Downloadable scanner, for
`
`storing the Downloadable security profile data in a database.
`
`‘494 Patent at 22:7-16.
`
`
`
` Overview of Swimmer B.
`
`Swimmer discloses the “Virus Intrusion Detection Expert System”
`
`(“VIDES”), a DOS-based theoretical expert system for virus researchers.
`
`Swimmer at 2, ¶ 3. Swimmer discloses VIDES being built from a number of
`
`available programs, including using the “Advanced Security audit trail Analysis on
`
`uniX” tool (“ASAX”) for analyzing audit trails in the generic NADF format. Id. at
`
`11, ¶ 2; id. at 12, ¶¶ 2-4. Swimmer discloses VIDES is for virus researchers and is
`
`not of practical use to end users. Swimmer at 2, ¶ 3. Swimmer does not teach how
`
`to use VIDES, or the underlying ASAX audit analysis tool, in a network based
`
`solution that is able to identify a list of suspicious computer operations and teaches
`
`against the use of a database. Id. at 3, ¶¶ 1–3 (teaching away from the use of
`
`scanners and databases because they allegedly cannot detect polymophic viruses).
`
`Swimmer teaches that to overcome the proliferation of polymorphic viruses
`
`that are able to circumvent database-based solutions, VIDES uses the ASAX tool
`
`to analyze a stream of data through a 8086 processor emulator. Id. at 1, ¶ 1
`
`(“ASAX is used to analyse the stream of data which the emulator produces”); id. at
`
`8, ¶ 9 (“The solution which was finally chosen was the software emulation of the
`
`- 4 -
`
`Trial Ex. 1760-15
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 17 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`8086 processor.”). Swimmer states that the emulator in VIDES is disclosed to
`
`accept the “entire instruction set of a processor as input, and interprets the binary
`
`code as the original processor would.” Id. at 8, ¶ 9. Swimmer then teaches that the
`
`emulator emulates the instruction set to create “audit data” or “audit trails” “by
`
`placing hooks for processing all opcodes corresponding with the events.” See id. at
`
`9, ¶ 6. Swimmer teaches that the emulator uses hooks to record “audit records”
`
`formed into an “audit trail”:
`
`<CS•3911 T;i,• =0 Fn=30 a.rg ( ) ret. ( AX=S}>
`<C5•391l °tYl,e•O Fn=29 arg <) ret ( BX=l28 ES:3 911 l >
`<CSa 3911 Type=O Fn=64 arg ( .>.L=61 CL=3 strl=T . COM) r et I AL= O CF=OJ >
`<CS• 39ll Type:O Fn=Sl a:rg ( .>.L=O strl =COMMAND. COl1) ret I AL=O CX, 32 CF:0 ) >
`<CS:3911 Type=O Fn=Sl aro ( AL=l strl=-COMM.WO . COM) reti AL=O CX:32 CF=-0 >>
`<CS=-3911 Type =O Fn=45 arg( .~L=2 CL=-32 strl=COMMAND, COM) r&t< AL=O AX=S CF=(cid:144)>>
`<CS:39 11 Type=O Fn:73 ar9 ( BX:5) r•t< CX:10241 DX••206 CF:0) >
`<CS:39!1 'l'-yp-e:O Fn=-27 arg(I ret. ( cx,;121 DX•8032)>
`<CS-=3911 Type=O F'n=47 arg ( BX =S CX=3 DX:828 DS:3911) ret ( AX:3 CF:OJ>
`<CS:3911 Type•O Fn-:50 arg { AL=2 BX=S CX=O DX=O) r@t( AL= O AX:50031 DX= CF=0 ) >
`<CS=3911 'l'ype= O F'n =-48 arg( SX=-5 CX: 648 DX, 313 DS:3911) r et( AX:648 CF=Ot>
`<CS•39ll Type•O Pn:50 arg ( AL=O BX=S CX=O DX=O) ret ( AL=O A.X:0 DX=O CF=0J>
`<CS:3911 Type•O Pn•48 arg< BX=5 CX=-3 DX=83l DS=39ll ) ret ( .IIX=3 CP=O)>
`<CSa3911 Type=O Fn:74 arg( SX=5 CX:10271 DX=6206f ::ec ( CF:01>
`<CS:3911 'l'YP•=O Fn•46 Arg( BX•S) ret { CFaO) >
`<CS:3911 TypeaO Fn•Sl arg( AL•l •<rhCOflliAND .C011l ret t AL=O CY.=32 CF=O ) ,
`
`Figure 3: Excerp1from an audit trail for the Vien11a vints
`
`
`
`Swimmer at 9, Figure 3.
`
`Next, Swimmer describes how VIDES uses ASAX as an experts system for
`
`analysis of this audit trail. Swimmer at 10, ¶2. Rules for VIDES are written using
`
`the “RUle-baSed Sequence Evaluation Language” (“RUSSEL”), a language
`
`tailored for searching arbitrary patterns of records in sequential files. Swimmer at
`
`12, ¶5.
`
`- 5 -
`
`Trial Ex. 1760-16
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 18 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`VIDES is a system that first emulates a file to create a log file with a record
`
`of operations performed by that file, and then analyzes the audit trial with the
`
`ASAX expert system using rules written in RUSSEL.
`
`
`
` Overview of Martin C.
`
`Martin discloses techniques to block external applets from reaching an
`
`internal network, while potentially allowing trusted applets through using a
`
`firewall. Martin 5, Abstract. For example, Martin describes strategies for blocking
`
`applets at the firewall, and therefore preventing them from entering the network by
`
`rewriting <applet> tags, detecting files that begin with “CA FE BA BE,” and
`
`rejecting all HTTP, FTP, and gopher traffic for files with the extension “.class.”
`
`Martin at 11-12. Martin does not provide any description of how JavaScript or
`
`ActiveX would be blocked or the particular threat they provide. Martin at 12, Col.
`
`1, ¶3. Applying Martin to Swimmer would not cure Swimmer’s deficiency
`
`because Martin’s strategy does not address “active control” or “program script.”
`
`Martin makes this especially clear by stating: “[n]aturally, this strategy cannot
`
`block Javascript or ActiveX code.” Martin at 12, Col. 2, ¶3.
`
`
`
` Overview of Evidence Before the Board D.
`
`As noted above, the Board instituted trial based on Swimmer and Martin.
`
`Accordingly, the only evidence that Petitioner submitted that is relevant in this IPR
`
`is:
`
`- 6 -
`
`Trial Ex. 1760-17
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 19 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`• Swimmer
`
`• Martin
`
`• Dr. Aviel D. Rubin’s Declaration (“Rubin Decl.”) and Curriculum
`
`Vitae (Ex. 1002; Ex. 1037)
`
`• Mr. John Hawes Declaration (Ex. 1088)
`
`Dr. Aviel Rubin
`
`1.
`
`Petitioner submitted the declaration of Dr. Aviel Rubin with its Petition to
`
`establish the grounds of obviousness. However, a thorough review of Dr. Rubin’s
`
`declaration demonstrates that he does not provide opinions that support Petitioner’s
`
`position beyond parroting the language of Petition. Specifically, he had no basis
`
`for his opinion, claim interpretation, or why the prior art teaches the ‘494 Patent.
`
`Dr. Rubin does not have any credible opinions with factual support, and as such,
`
`there was no reason to take his deposition, which would only serve to allow him to
`
`supplement his unsupported testimony.
`
` Mr. John Hawes 2.
`
`Petitioner introduced Mr. John Hawes’ declaration to establish the date that
`
`Swimmer was allegedly publicly available. Ex. 1088. On July 14, 2016, Patent
`
`Owner deposed Mr. Hawes. Mr. Hawes testified that he did not begin working at
`
`Virus Bulletin until 2005, and did not attend any Virus Bulletin Conference before
`
`2005. Ex. 2014 (“Hawes Tr.”) at 6:8-12; 20:12-24. As such, Mr. Hawes did not
`
`- 7 -
`
`Trial Ex. 1760-18
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 20 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`have any personal knowledge that Swimmer was publicly available in the United
`
`States.
`
`In his declaration, Mr. Hawes states that Swimmer was published to
`
`conference attendees in Boston. However, during discovery, it was discovered that
`
`Mr. Hawes made this statement based on hearsay, and not personal knowledge.
`
`Hawes Tr. at 23:10-24:24; 26:10-12. Mr. Hawes testimony was based on
`
`unauthenticated documents without evidence that the documents were maintained
`
`in the ordinary course of business. Accordingly, Mr. Hawes’ testimony is
`
`unsubstantiated because it does not rely upon admissible evidence, only
`
`speculation. Thus, the record demonstrates that the Petitioner lacks sufficient
`
`evidence that proves Swimmer was publicly available.
`
`
`
` CLAIM CONSTRUCTION III.
`
`A.
`
`
`“downloadable security profile data” (all claims)
`
`The plain and ordinary meaning should apply to this term. As the Board
`
`stated in its Institution Decision, “there is no need to separately construe
`
`‘downloadable security profile data.’” Institution Decision at 7; see, e.g.,
`
`Interactive Gift Express, Inc. v. Compuserve, Inc., 256 F.3d 1323, 1331 (Fed. Cir.
`
`2001) (“If the claim language is clear on its face, then our consideration of the rest
`
`of the intrinsic evidence is restricted to determining if a deviation from the clear
`
`language of the claims is specified.”). The proper construction for
`
`- 8 -
`
`Trial Ex. 1760-19
`
`

`

`Case 3:17-cv-05659-WHA Document 440-7 Filed 04/18/19 Page 21 of 78
`Patent Owner’s Response
`IPR2016-00159 (U.S. Patent No. 8,677,494)
`
`“Downloadable” is “an executable application program which is downloaded from
`
`a source computer and run on the destination computer.” The remaining part of the
`
`term “security profile data” should follow the plain language given to it in claims 1
`
`and 10.
`
`The term “Downloadable security profile data” appears in all of the
`
`challenged claims with its scope clearly set forth in the claims. For example, in the
`
`challenged independent claims 1 and 10, the claims show that (1) Downloadable
`
`security profiles are derived for the Downloadable; (2) Downloadable se